Microsoft promises fast fix for IE zero-day as new attacks are discovered
Posted on 19 September 2012.
The problem of the remotely-exploitable IE zero-day memory-corruption vulnerability that is being misused in current attacks has reached a critical enough level for Microsoft to confirm the issuing of a "Fix it" tool ahead of a badly needed patch.

"While we have only seen a few attempts to exploit the issue, impacting an extremely limited number of people, we are taking this proactive step to help ensure Internet Explorer customers are protected and able to safely browse online," wrote Yunsun Wee, Director of Microsoft's Trustworthy Computing, and pointed out that the Fix it is easy to use, does not affect browsing ability the Web, and it will provide full protection against this issue until an update is available.

German's Federal Office for Information Security (BSI) has reacted to the problem by recommending (webpage in German) to users to switch to other browsers until Microsoft releases a security update for the affected IE versions.

In the meantime, researcher Jaime Blasco and his team at AlienVault have discovered three servers that are actively targeting a number of defense and industrial companies in the US, the UK and India with new versions of the SWF file used to exploit the vulnerability.

Thanks to some previous research on the PlugX RAT used by a Chinese hacker gang, they managed to connect the two security issues and discover that the files on that server have been created several days ago - i.e. before the Internet Explorer zero day vulnerability went mainstream.

"We know that the group actively using the PlugX malware also called Flowershow had access to the Internet Explorer zero-day days before it was uncovered. Due to the similarities of the new discovered exploit code and the one discovered some days ago it is very likely that the same group is behind both instances," they say.

They also believe that they might have discovered the identities of some of the people involved in this enterprise: an individual that goes by the online handle of "WGH" that is believed to be the author of the PlugX RAT, and one that goes by "Wicked Rose" and is believed to be one Tan Dailin, a former student at Sichuan University, and current leader of the Network Crack Program Hacker (NCPH) group.






Spotlight

USBdriveby: Compromising computers with a $20 microcontroller

Posted on 19 December 2014.  |  Security researcher Samy Kamkar has devised a fast and easy way to compromise an unlocked computer and open a backdoor on it: a simple and cheap ($20) pre-programmed Teensy microcontroller.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Fri, Dec 19th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //