Hackers and cybercriminals are using flaws in Microsoft’s Internet Explorer to search computers to discover what kinds of security software they are running and how to take control of them, security researchers claim. The exploits are allowing digital reconnaissance to be performed on a massive scale, across whole companies, computers, web servers and users without their knowledge, exposing holes in their security and allowing criminals to intelligently attack vulnerable machines.
“By knowing what security software is installed, the hackers can determine if their attack is going to work,” Jaime Blasco, director of AlienVault Labs security firm that discovered the techniques, told the Guardian. “That way they will only attack a computer they know is vulnerable and avoid alerting security companies to their presence.” The hackers aren’t solely interested in security software. They also probe systems to discover software that might be vulnerable, including PDF readers and other user applications, which can be attacked to take control of a computer.
“They collect information through Internet Explorer on the software running on the machine to determine which software can be attacked in the future,” Blasco explained. “The hackers also share details of web server and computer vulnerabilities with others inside the community.” Cybercriminals surveil a company’s users, checking for specific vulnerabilities through Explorer before setting up a trap for unsuspecting users, gaining access to their computer on the company network and from there gaining access to data and systems within a company. “We’ve seen it from different groups in China, targeting the US defence department and government employees,” said Blasco. “But we’re also seeing this kind of technique used more and more often.”
“In the beginning we only saw these techniques being used by very skilled attackers, but in the past few months we’ve seen regular cybercriminals adopt them too,” he said. “Regular cybercriminals are learning from the highly skilled.”
The reason Internet Explorer can be exploited in this manner is because of its tight integration into the Windows software, which gives it access to other software features. Third-party browsers such as Firefox or Chrome are not integrated into Windows to the same degree, so they are less likely to expose this kind of data. Microsoft is aware of the vulnerabilities, and has patched a few, but Blasco has seen some sit open for more than a year after the company was made aware of the security hole.
“We’re aware of the reported issues, one of which has been addressed in newer versions of Internet Explorer,” a Microsoft spokesperson told the Guardian. “Each version of Internet Explorer is more secure than the last and contains new and improved security features that help protect customers.”
“We are actively investigating the other issues and continue to recommend customers upgrade to the latest modern browser, Internet Explorer 11,” they said. Blasco recommends people ditch Internet Explorer and use a third-party browser like Google’s Chrome.
“Chrome is designed with security in mind,” explained Blasco. “It has a suite of security features in place that means that even if attackers find a hole in one layer they have to bypass other security measures that are in place.” Chrome is not without its own vulnerabilities. In August 2013 a security flaw offered unrestricted access to user passwords, while some of the Chrome extensions available through Google’s Chrome store have been found to contain malware.
Source: The Guardian