Newest IE bug could be next Conficker, says researcher

It's 'custom-made' for hackers, claims expert; expect major attacks

The critical bug that Microsoft confirmed Monday but has yet to patch is a prime candidate for another Conficker-scale attack, a security researcher said.

"It's better than [the vulnerability used by] Conficker," Roger Thompson, chief research officer at AVG Technologies, said yesterday. "It exposes the whole world, and can be exploited through the firewall. That's better than Conficker, which mostly did its damage once it got inside a network."

Conficker, the worm that exploded into prominence last January when it infected millions of machines, exploited an already-patched bug in Windows that Microsoft had thought dire enough to fix outside its usual update schedule.

The worm hijacked a large number of PCs -- estimates ranged as high as 12 million at one point -- and then assembled them into a massive botnet able to spread malware, plant fake antivirus software or distribute huge amounts of spam.

"I have no doubt that the really bad guys are bustling to get this [new vulnerability] into their exploit toolkits," said Thompson. "For the Conficker people, this could be the next thing. They waited until they had a really good exploit, then combined that with some smart strategies. So I wouldn't be surprised if they picked up on this."

The vulnerability Thompson's worried about is in the Microsoft Video Controller ActiveX Library, or the "msvidctl.dll" file, an ActiveX control that can be accessed using Internet Explorer (IE). Although the bug has been used by hackers since at least June 9, it only made it into the public eye this week, when several security companies, including firms in both China and Denmark, reported that thousands of compromised sites were serving up exploits.

On Monday, Microsoft acknowledged the vulnerability in a security advisory, said it would produce a patch and provided an automated tool to disable the ActiveX control by setting nearly three-dozen "kill bits" in the Windows registry.

"This is a good exploit with a big lump of infectable people," said Thompson.

One reason why the bug is an excellent choice for hackers is that it hasn't been patched. When Conficker first appeared, the flaw it exploited had already been patched by Microsoft. It turned out, however, that there were plenty of PCs that had not been updated with the fix.

Thompson wouldn't hazard a guess as to whether Microsoft would be able to craft a fix in time to add it to the patches slated for delivery next Tuesday, July's regularly-scheduled update day. "But I'm fairly confident that they're trying very hard," he said.

Attack code is readily available, Thompson said, meaning that attackers not yet abusing the bug don't have to figure out an exploit of their own. "If the people who infect banner ads use this before there's a patch, then watch out," he warned.

Today, Microsoft admitted that researchers at IBM's ISS X-Force had reported the vulnerability in 2008, but did not name the date. The X-Force researchers had uncovered the flaw in late 2007, and had reserved a CVE (Common Vulnerabilities and Exposures) number in December of that year. One of the researchers, Alex Wheeler, who is now the manager of 3Com's TippingPoint DVLabs, declined to name the date ISS reported the bug to Microsoft, citing a non-disclosure agreement he'd signed with his former employee.

Microsoft didn't directly answer a question about why it had not patched the ActiveX vulnerability when it has known about the bug for at least six months and possibly as many as 18. "When we were alerted in 2008, we immediately started an investigation," a company spokesman said today in an e-mail. "As we wanted to be thorough, this took extra time to fully evaluate."

The "extra time" Microsoft needed may strike some as odd, since the ActiveX control -- the "msvidctl.dll" file -- is the company's own code. And that's unusual, said Thompson. "This is the first issue with a Microsoft .dll for, really, a long while," Thompson said. "Maybe since the ANI bug in April 2007. Usually, it's a Chinese .dll or something from Adobe."

The vulnerability in Windows' animated cursor -- found in the "user32.dll" file -- was patched more than 100 days after Microsoft was alerted by Alexander Sotirov, a vulnerability researcher at Determina. Microsoft issued an "out-of-band" patch for the ANI bug, breaking from its regular monthly schedule.

"It's not the end of the world or anything," said Thompson. "But I won't be surprised to see Version 2.0 of Conficker with this. It seems custom-made for them."

Systems running Windows XP or Windows Server 2003 are vulnerable to current attacks through IE6 and IE7. Windows Vista and Windows 7 are not at risk; nor are users running IE8 or other browsers, such as Mozilla's Firefox and Google's Chrome.

Join the CSO newsletter!

Error: Please check your email address.

Tags MicrosoftconfickerInternet Explorer

More about 3Com Australia3Com AustraliaAdobe SystemsAVG (AU/NZ)AVG Technologies AUetworkGoogleIBM AustraliaIBM AustraliaISS GroupMicrosoftMozillaTippingPointTippingPointX-Force

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Gregg Keizer

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts