Hackers exploit latest IE zero-day with drive-by attacks

Researchers expect attacks to explode once exploit code goes public

Hackers are exploiting the just-disclosed unpatched bug in Internet Explorer (IE) to launch drive-by attacks from malicious Web sites, security researchers said today.

"This attack appears to be rather targeted at the moment, but as with other unpatched vulnerabilities in the past, this has the potential to explode now that the word is getting out," said Craig Schmugar, a threat researcher at McAfee, in a blog post today.

Attacks are launched from Web sites in a classic drive-by fashion, said Schmugar and others. "Visiting the page is enough to get infected," Schmugar said.

Symantec also confirmed that it has spotted in-the-wild attacks exploiting the critical vulnerability in IE6 and IE7 that Microsoft acknowledged yesterday. "We're still seeing just limited attacks," said Ben Greenbaum, a senior research manager with Symantec's security response team. "The exploit is carried out simply by visiting a Web page hosting the vulnerability," he continued. "When the browser opens the page, the exploit causes the user's computer to download and execute another piece of malware."

Most of the malware downloaded and installed on the victimized PC consists of backdoors that let hackers install and run even more attack code. Among the malware is a .dll that's injected into IE to provide additional remote access to the machine, Schmugar said.

"It started out as limited and targeted, but now, with the drive-by attacks, it's no longer only a targeted attack," said Schmugar in an interview today.

Tuesday, Microsoft warned users of IE6 and IE7 that attackers were using an unpatched vulnerability in their browsers, but as is its practice, did not publish technical details of the bug.

Nor did Microsoft spell out a patching timetable, or promise that it would issue a fix before the next scheduled Patch Tuesday on April 13. Instead, it recommended that users modify access to the "iepeers.dll," disable scripting, and/or enable DEP (data execution prevention).

According to Vupen Security , the bug is a "user-after-free" memory error in how iepeers.dll handles certain data. "User-after-free" refers to an attempt to reuse memory space after it has been freed, said Andrew Storms, director of security operations at nCircle Network Security, in an instant message interview.

Neither Symantec nor McAfee have yet found evidence that the attack code has been widely distributed via hacker forums or posted more prominently on the Internet. When that happens, Schmugar said he expects attacks to quickly increase.

Microsoft may be forced to react with an emergency update if that happens, Greenbaum said. "It's possible Microsoft may consider an out-of-band patch for this issue," he said.

Symantec notified Microsoft of its discovery of the drive-by attacks a few hours before the latter issued its advisory, Greenbaum said. "The timeline, however, makes us think that they already knew about the issue and were planning on posting the advisory very soon anyway," he said.

Both Symantec and McAfee have created and distributed signatures that detect and block the installation of the malware that the drive-by exploit tries to inject into PCs.

Tuesday's advisory was the second in the last 60 days from Microsoft warning of ongoing attacks against an unpatched IE vulnerability. In mid-January, Microsoft said that a flaw in its browser had been used to attack several companies' networks, including Google 's and Adobe's. Microsoft patched that vulnerability, and seven others, later in the month when it shipped an out-of-band update .

Users able to can also upgrade Internet Explorer to IE8 , which does not contain the bug and so is immune from attack.

Join the CSO newsletter!

Error: Please check your email address.

Tags exploits and vulnerabilitiesMicrosoftInternet Explorerzero day exploit

More about Adobe SystemsAndrew Corporation (Australia)etworkGoogleMcAfee AustraliaMicrosoftnCirclenCircle Network SecuritySymantec

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Computerworld Staff

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts