Microsoft Warns Of Dangerous Attack Against Internet Explorer Users

An organized cybercriminal group is conducting a new targeted attack campaign against users of Internet Explorer, narrowing in on U.S. organizations with strong ties to the defense and financial industries, according to FireEye security researchers.

The new Internet Explorer zero-day attack, made public Sunday, has prompted Microsoft to issue a security advisory, in which it is warning users that the attacks are targeting every supported version of its browser. The cybercriminals are using a malicious link to get users to visit an attack website with the aim of gaining complete control of the victim's PC, Microsoft said. The Redmond, Wash., software giant did not rule out an emergency, out-of-cycle security update to address the issue.

"An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website," Microsoft said in the advisory. "On completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through our monthly security update release process, or an out-of-cycle security update, depending on customer needs."

[Related: Verizon Data Breach Report: 10 Most Common Security Incidents Of The Past 10 Years ]

With Microsoft's ending of support for Windows XP, users likely will remain vulnerable indefinitely, said J.J. Thompson, managing director and CEO of Rook Security, a security solution provider and risk management consultancy. Organizations could enable stricter policies in Internet Explorer, use the Microsoft Enhanced Mitigation Experience Toolkit for maximum coverage and disable Flash as a last resort, he said.

"Protecting end users from this attack may prove difficult, especially so for those that happen to still be using Windows XP," Thompson said.

FireEye researchers, meanwhile, said the attack will not work without the Adobe Flash plugin installed on the victim's PC. The Internet Explorer zero-day exploit bypasses Microsoft's built-in security mechanisms designed to thwart malicious code from executing in memory, the company said. In its advisory issued Sunday, FireEye researchers said it knows the threat actors but declined to give details about the operators behind what it is calling the Operation Clandestine Fox campaign.

"We believe this is a significant zero-day as the vulnerable versions represent about a quarter of the total browser market," FireEye said. "Disabling the Flash plugin within IE will prevent the exploit from functioning."

The attack also prompted an advisory from the U.S. Computer Emergency Readiness Team, which said an attack without the use of Flash may be possible.

FireEye said it observed an attack website loading a malicious Flash file to exploit the browser vulnerability. It corrupts Flash content to gain access to the browser's allocated system memory and then bypasses Address Space Layout Randomization and Data Execution Prevention, two embedded security mechanisms designed to deter attackers from carrying out such attacks.

The FireEye researchers, Xiaobo Chen, Dan Caselden and Mike Scott, said the cybercriminal organization has been tracked since it was first identified in 2010. The attackers specializes in using custom browser-based zero-day exploits against Internet Explorer, Firefox and Flash in previous campaigns, the researchers said. The attack patterns have been difficult to trace and their command-and-control methods easily bypass intrusion detection systems. Once they gain access, typically within seconds, they establish a foothold on the victim's machine, implement a back door for remote access and then move laterally on the victim's corporate network, according to FireEye.

NEXT: Browser Attack Is Serious, Say Solution Providers

Solution providers said the attack is a serious threat to organizations with employees who rely on Internet Explorer as their core browser. Administrators have done a better job disabling or firewalling unnecessary software on servers, but attackers have moved to the desktop where Flash and Java are top targets, they said.

"We have many customers that have systems that will not work on any other browser so this is going to be an issue for them, and hopefully Microsoft will come out with a fix quickly," Aquino said. "Most of the options to fix or mitigate this will take more time than it would to get a fix in place."

Many organizations have switched to Google Chrome as their standard browser, but some are still tied to Internet Explorer to enable custom applications to properly function, said Rick Doten, chief information security officer at Digital Management, a Bethesda, Md.-based mobility solution provider. Being able to understand and prioritize external threat intelligence is essential in having an appropriate response to new threats, Doten said.

"Someone on top of this would have identified it through information-sharing among peers or from reading the notice, and could apply the block and track quickly, hopefully before one of their users has been compromised," Doten said. "The goal is to respond before it impacts the business -- not the goal of 'don’t get infected.' When you measure it that way, you shouldn’t be scared when a zero-day happens."

Preventing drive-by attacks will require IT to rethink how they deploy software and workstations, said Chris Camejo, director of consulting and professional services at NTT Com Security. IT should be creating workstations and servers with as little software as possible, only adding software based on each use case, he said.

"A core security concept is that any unnecessary software should be removed or disabled whenever possible to reduce the attack surface," Camejo said.

PUBLISHED APRIL 28, 2014