Widely used Web attack toolkit exploits unpatched MSXML flaw
- 02 July, 2012 17:29
- Comments
An exploit for an unpatched vulnerability in the Microsoft XML Core Services (MSXML) has been incorporated into Blackhole, one of the most widely used Web attack toolkits, according to security researchers from antivirus firm Sophos.
The security flaw is identified as CVE-2012-1889 and is what security researchers call a zero-day vulnerability -- an actively exploited vulnerability for which an official patch doesn't yet exist.
CVE-2012-1889 allows remote attackers to execute malicious code on a user's computer if they convince the user to visit a specially crafted Web page in Internet Explorer.
On June 12, Microsoft published a security advisory regarding this security flaw and provided users with several work-arounds for it, including a semi-automated "Fix it" solution.
Since then, exploit code for the vulnerability was added to the open-source Metasploit penetration testing framework, making it available for anyone to copy and potentially misuse.
"Within a week, CVE-2012-1889 exploiting code very similar to that published to Metasploit was seen within the landing page of a Blackhole exploit kit site," said Fraser Howard, a principal virus researcher at Sophos, in a blog post on Friday.
Blackhole is one of the most popular exploit toolkits -- malicious Web applications designed to exploit vulnerabilities in browser plug-ins and other components in order to distribute malware.
Exploit kits are used in the majority of Web-based attacks launched from compromised websites and are one of the primary methods of infected computers with malware.
The integration of a CVE-2012-1889 exploit into Blackhole could suggest that the number of attacks targeting this flaw will increase significantly. "As soon as we see exploit kits targeting new vulnerabilities we can expect to see a lot more users getting infected - especially if the vulnerabilities are zero-days," Howard said.
However, this hasn't happened yet and the use of such an exploit together with Blackhole was limited to one incident detected on June 21. Howard speculated that this might be because the exploit's integration with Blackhole is still unreliable, or because this particular exploit is only available for new, more expensive, versions of the toolkit.
Regardless of the reason, the exploit's lack of adoption among Blackhole attackers might only be temporary. Therefore, users should deploy Microsoft's "Fix it" solution as soon as possible and keep their antivirus programs up-to-date in order to block attacks targeting this vulnerability.
Recommended
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
- Bookmark this page
- Share this article
- Got more on this story? Email CIO
- Follow CIO on twitter
- Vodafone Ireland Implements World-Class Service Excellence with HP BSM
- Defending Against Increasingly Sophisticated Cyber Attacks
- The Inevitable Extinction of PSTs
- The Data Storage Imperative: Backup, Recovery and Archiving in Australia & New Zealand
- Cloud ready business intelligence with Oracle Business Intelligence 11g
-
Australia suspected to have PRISM data: Ludlam
-
Australia Post’s mail business to lose $200 million this year
-
Australia Post’s mail business to lose $200 million this year
-
Microsoft's ambivalence about Office on the Web gives Apple shot with iWork on iCloud
-
3 Lessons Learned From a Failed Customer Feedback Test
-
Detecting APT Activity with Network Traffic Analysis
Today’s successful targeted attacks use a combination of social engineering, malware, and backdoor activities. This research paper will discuss how advanced detection techniques can be used to identify malware command-and control (C&C) communications related to these attacks, illustrating how even the most high-profile and successful attacks of the past few years could have been discovered. -
Pathways Advanced ICT Leadership Development Program Course Outline and Big 6 2013
Developed by the CIO executive Council in conjunction with Rob Livingstone Advisory, Pathways Advanced is a 12-month CIO delivered, small group, mentor based professional leadership development program. Pathways Advanced brings together best practice, thought leadership and business insights for today’s most promising ICT professionals -
Advanced Persistent Threats and Real-Time Threat Management
Businesses face a constantly evolving threat landscape. One of the greatest challenges is presented by advanced persistent threats (APTs), which are sophisticated, multi‐faceted attacks targeting a particular organisation. Mitigating the risk of APTs requires advances beyond traditional layered security to include real‐time threat management. This whitepaper describes the nature of APTs, the risks they pose to businesses, and techniques for blocking, detecting, and containing APTs and other emerging threats. Read now.
Get exclusive access to Invitation only events CIO, reports & analysis. 
