On April 26th, FireEye Research Labs notified the public of a
IE zero-day exploit being used in “Operation Clandestine Fox.”
The initial attack targeted users of IE versions 9, 10, and 11 on
Windows 7 and 8. Despite attackers only targeting those versions of
Microsoft IE and Windows OS, the vulnerability actually impacts all
versions of IE from 6 through 11.
Today, FireEye Labs can reveal a newly uncovered version of the
attack that specifically targets out-of-life Windows XP machines
running IE 8. This means that live attacks exploiting
CVE-2014-1776
are now occurring against users of IE 8 through 11 and Windows XP,
7 and 8.
We have also observed that multiple, new threat actors are now using
the exploit in attacks and have expanded the industries they are
targeting. In addition to previously observed attacks against the
Defense and Financial sectors, organization in the Government- and
Energy-sector are now also facing attack.
In our tests, disabling VXG.dll blocks this attack on all
configurations of IE and Windows OSs. However, we strongly suggest
that Windows XP users upgrade to a later Windows operating system to
take advantage of new mitigation technologies from Microsoft, such as
EMET 5.0 and IE with Enhanced Protected Mode (EPM). Deploying
preventative measures now will help mitigate the impact of these
exploits until Microsoft patches the underlying vulnerability, and
will offer additional protection from future ZeroDay exploits.
The main differences between this new attack targeting Windows XP
compared to the original Windows 7/8.1 versions of this attack are the
mitigation bypasses. The Windows 7/8.1 version develops its write
primitive into read/write access to much of the process space by
corrupting Flash vector objects. This is to bypass ASLR by searching
for ROP gadgets and building a ROP chain dynamically in memory.
Without ASLR, ROP gadgets can be constructed beforehand with static
addresses. Consequently, Flash assistance in the Windows XP version is
much simpler. It builds a ROP chain with static addresses to gadgets
in MSVCRT, tweaks addresses for a plethora of language packs, and
jumps directly to a pivot without developing a write primitive. From
there, the ROP chain calls VirtualAlloc to allocate executable memory,
copies the shellcode to the allocated chunk, and executes the shellcode.
This new tactic of specifically targeting those running Windows XP
means the risk factors of this vulnerability are now even higher. We
have been working with Microsoft and they have released an
of Band patch. FireEye highly recommends users of Microsoft
Internet Explorer apply the patch as soon as possible for security reasons.