New IE zero day exploit circulating, used to install Poison Ivy

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

The gang behind the recent Java zero day attacks apparently hasn't packed up for the season.

A researcher examining one of the servers used to launch attacks on vulnerable Java installations says he has found a new zero day exploit for Microsoft's Internet Explorer web browser.

The new and previously unknown (or "zero day") exploit can be used to load malicious software on machines running fully patched Windows XP SP3 along with the latest editions of the IE 7 and IE 8 browser and Adobe's Flash software, said Eric Romang, who discovered the vulnerability.

Further analysis by the firm AlienVault suggests that the zero day is being used in attacks that install the Poison Ivy Trojan.

In a blog post, Romang, a Luxemborg-based IT security advisor at ZATAZ.com, said he discovered the exploit when analyzing a batch of files hosted on one of the servers used by the Nitro gang to distribute attacks that exploited the Java vulnerability.

After running one of the sample files on a fully patched Windows XP SP3 system with an up-to-date version of Adobe Flash, Romang was surprised to find that the files loaded malicious software to his fully patched XP system.

Further analysis revealed that .html and Flash files were used to identify proper targets (Windows XP systems running IE 7 and 8) and use a common technique called a "heap spray" to lay the groundwork for a successful iFrame attack against the systems that exploited the vulnerability and used it to install a malicious program, 111.exe.

That malware has been identified as a new variant of the Posion Ivy Trojan horse program, according to the security firm AlienVault Labs.

Writing about the attack on the AlienVault Labs blog, researcher Jaime Blasco said that evidence collected online suggest the gang behind the Java attacks in August and September may be moving on: with domains used in that attack located at new IP addresses and serving up the new and more potent attacks.

Oracle issued an emergency patch for the vulnerability in Java on August 30, though researchers subsequently showed that the patch could be circumvented.

The new IE exploit is being implemented in the Metasploit penetration testing tool and a module that allows Metasploit users to launch IE 7 and IE8 exploit is expected by Monday, Romang wrote.

Follow @paulfroberts

Poison Ivy image from Shutterstock.

Tags: 0day, Adobe, cross-site scripting, flash, hacking, heap spray, ie7, ie8, iframe, Internet Explorer, internet security, Poison Ivy, Trojan, vulnerability, web security, Windows XP, Zero Day

View the original article here

How a malicious help file can install a spyware keylogger

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Do you think that Windows help file is safe? Think again.

Malware authors can create boobytrapped .HLP files, designed to infect your computer.

Take for instance, the strange .HLP file which was sent to SophosLabs by some of our customers at the end of August.

The file, Amministrazione.hlp ("Amministrazione" is Italian for "Administration") was an example of how cybercriminals can use social engineering to trick unsuspecting users into infecting their computers.

If opened, the help file displays an error message:

Help could not read the current Help file.
Make sure there are no errors on the disk, or if the file is on a network drive, that the server is active. (163)

In the background, however, a file called Windows Security Center.exe is being dropped onto the computer, which in turn creates a file called RECYCLER.DLL.

Since SophosLabs first saw this malware attack we have been writing more generic detections which should help pick up new variants of the attack proactively:

The DLL part of the malware attack is the keylogger. It's partof the DarkShell Trojan that has been tied to GhostNet.

The keylogger component is used to log keystrokes made by the user. These are stored in the following file:

\Documents and Settings\username\Local Settings\Application Data\UserData.dat

(where username is a specific username).

The malware attempts to send this data to images.zyns.com (a domain with a long association with malware).

Stay safe everyone - and remember not to click on .HLP files too readily. They could be harbouring a malware attack.

http://twitter.com/SophosLabs

View the original article here