Attackers leverage new IE zero-day in 'Clandestine Fox' op

Share this article:
IE, Firefox, Chrome and Safari's protection against phishing was tested.
The zero-day exploit was already being used in targeted attacks, specifically aimed at IE 9 through IE 11.

A security firm warns that over a quarter of web browsers are likely vulnerable to zero-day attacks that take advantage of a recently discovered bug in Internet Explorer (IE).

Over the weekend, Microsoft alerted users that the vulnerability, affecting IE 6 through IE 11, had already been leveraged in “limited, targeted attacks,” against users. FireEye discovered the threat and disclosed information about the bug in a Saturday blog post, dubbing an ongoing campaign using the exploit, “Operation Clandestine Fox.”

FireEye noted that, in order to exploit the bug, an attacker would need to use an Adobe Flash exploitation technique, meaning the popular software would need to be enabled. Targeted attacks were specifically aimed at IE 9 through IE 11, the company said.

Microsoft has yet to release a patch for the issue, but the tech giant advised IE users to employ its Enhanced Mitigation Experience Toolkit (EMET) as a workaround for the issue, since the tool provides additional security layers that make the vulnerability harder to exploit, a Microsoft security advisory said.

The remote code execution vulnerability (CVE-2014-1776) “exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated,” the advisory said. “The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.”

To exploit the vulnerability, an attacker could convince a user to view a specially crafted website rigged to exploit the flaw, Microsoft said.

In its blog post, FireEye further warned that versions of IE vulnerable to the threat accounted for over 26 percent of the browser market last year, according to data available at NetMarket Share.

Page 1 of 2
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

ISSA tackles workforce gap with career lifecycle program

ISSA tackles workforce gap with career lifecycle program ...

On Thursday, the group launched its Cybersecurity Career Lifecycle (CSCL) program.

Amplification DDoS attacks most popular, according to Symantec

Amplification DDoS attacks most popular, according to Symantec

The company noted in a whitepaper released on Tuesday that Domain Name Server amplification attacks have increased 183 percent between January and August.

Court shutters NY co. selling security software with "no value"

A federal court shut down Pairsys at the request of the Federal Trade Commission.