HOME     MENU     SEARCH     NEWSLETTER    
CUSTOMER RELATIONSHIP MANAGEMENT NEWS. UPDATED 5 MINUTES AGO.
You are here: Home / Data Security / Drowning in IE Watering Hole Attack
Druva Endpoint Backup:
Enterprises Realize Simple Secure Backup with Druva
www.druva.com
Security Pros Warn of Drowning in IE 'Watering Hole' Attack
Security Pros Warn of Drowning in IE 'Watering Hole' Attack
By Jennifer LeClaire / CRM Daily Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
FEBRUARY
14
2014



Microsoft has confirmed a report of an Internet Explorer zero-day exploit. Redmond also confirmed it is being leveraged in an active campaign attack. Version 10 of IE is reportedly vulnerable to the so-called watering hole attack.

“FireEye Labs has identified a new Internet Explorer (IE) zero-day exploit hosted on a breached Web site based in the U.S.,” FireEye wrote in a blog post on Thursday. “It’s a brand new zero-day that targets IE 10 users visiting the compromised Web site -- a classic drive-by download attack. Upon successful exploitation, this zero-day attack will download a XOR encoded payload from a remote server, decode and execute it.”

How the Watering Hole Works

FireEye first discovered what it has dubbed “Operation Snowman” on Feb. 11. The zero-day exploit targets CVE-2014-0322 and is being served up from the U.S. Veterans of Foreign Wars’ Web site.

“We believe the attack is a strategic Web compromise targeting American military personnel amid a paralyzing snowstorm at the U.S. capitol in the days leading up to the Presidents Day holiday weekend,” the firm reported. “Based on infrastructure overlaps and tradecraft similarities, we believe the actors behind this campaign are associated with two previously identified campaigns.”

Here’s how it works: After compromising the VFW Web site, the attackers added an iframe into the beginning of the Web site’s HTML code that loads the attacker’s page in the background, FireEye explained. The attacker’s HTML/JavaScript page runs a Flash object, which orchestrates the remainder of the exploit.

FireEye said the exploit includes calling back to the IE 10 vulnerability trigger, which is embedded in the JavaScript. Specifically, visitors to the VFW Web site were silently redirected through an iframe to the exploit at www.[REDACTED].com/Data/img/img.html.

No Out-of-Band Patch Required

We caught up with Tyler Reguly, manager of security research for Tripwire, to get his take on the zero day. He told us past versions of IE have earned a bad reputation for IE and news reports of new zero-days like this one don't help.

“The truth is that recently, IE has had fewer issues per year than other browsers,” he said. “It's just a common target due to the number of users it has.”

Reguly said Websense and FireEye have both released details on the zero-day with different noted targets, which makes him wonder if other sites are affected and how wide spread the exploit code is. He suspects we'll start to see more now that it's publicly discussed.

“While I'd normally be the first to call for an out-of-band Microsoft patch, I don't think this attack requires one,” Reguly said. “Users should upgrade to IE 11 and if they're stuck on 10 (i.e., Vista), they should install EMET because the exploit code will terminate if it sees that the Enhanced Mitigation Experience Toolkit (EMET) is installed.”

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
Neustar, Inc. (NYSE: NSR) is a trusted, neutral provider of real-time information and analysis to the Internet, telecommunications, information services, financial services, retail, media and advertising sectors. Neustar applies its advanced, secure technologies in location, identification, and evaluation to help its customers promote and protect their businesses. More information is available at www.neustar.biz.
MORE IN DATA SECURITY
Product Information and Resources for Technology You Can Use To Boost Your Business

NETWORK SECURITY SPOTLIGHT
Using Internet-connected devices without strong passwords is inherently risky, as illustrated by reports that a Russian Web site is showing live footage from thousands of people's webcams.

ENTERPRISE HARDWARE SPOTLIGHT
Doctor Who had K-9, the robot dog that accompanied him on adventures through space. Now, Mountain View has K5, a 5-foot-tall, 300-pound robot security guard patrolling in the Bay Area.

MOBILE TECHNOLOGY SPOTLIGHT
To better its customer service, Comcast is pulling out at least some of the stops. The cable giant has launched an app so you can track the cable guy in real time. It's designed to ease customer frustration.

© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.