Attackers leverage new IE zero-day in 'Clandestine Fox' op

Share this article:
IE, Firefox, Chrome and Safari's protection against phishing was tested.
The zero-day exploit was already being used in targeted attacks, specifically aimed at IE 9 through IE 11.

A security firm warns that over a quarter of web browsers are likely vulnerable to zero-day attacks that take advantage of a recently discovered bug in Internet Explorer (IE).

Over the weekend, Microsoft alerted users that the vulnerability, affecting IE 6 through IE 11, had already been leveraged in “limited, targeted attacks,” against users. FireEye discovered the threat and disclosed information about the bug in a Saturday blog post, dubbing an ongoing campaign using the exploit, “Operation Clandestine Fox.”

FireEye noted that, in order to exploit the bug, an attacker would need to use an Adobe Flash exploitation technique, meaning the popular software would need to be enabled. Targeted attacks were specifically aimed at IE 9 through IE 11, the company said.

Microsoft has yet to release a patch for the issue, but the tech giant advised IE users to employ its Enhanced Mitigation Experience Toolkit (EMET) as a workaround for the issue, since the tool provides additional security layers that make the vulnerability harder to exploit, a Microsoft security advisory said.

The remote code execution vulnerability (CVE-2014-1776) “exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated,” the advisory said. “The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.”

To exploit the vulnerability, an attacker could convince a user to view a specially crafted website rigged to exploit the flaw, Microsoft said.

In its blog post, FireEye further warned that versions of IE vulnerable to the threat accounted for over 26 percent of the browser market last year, according to data available at NetMarket Share.

Page 1 of 2
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

WikiLeaks makes FinFisher surveillance software available to public

Copies of controversial surveillance software, called "FinFisher," were made available for public scrutiny by WikiLeaks.

Researcher challenges reports that BlackPOS variant struck Home Depot

Nuix believes the malware found on Home Depot's systems belongs to a different threat family.

Documents reveal NSA plans to map every internet connected device in the ...

Documents provided by Edward Snowden reveal that the NSA is looking to build a near real-time map of every single internet-connected device in the world.