Please create an account to participate in the Slashdot moderation system


Forgot your password?
Internet Explorer Security IT

IE 0-Day Flaw Used In Chinese Attack 318

bheer writes "A zero-day attack on IE was used to carry out the cyber attack on Google and others that's been getting so much ink recently, reports The Register, quoting McAfee's CTO. While the web (and security) community has pointed out the problems with IE's many security flaws (and its sluggish update cycle) in the past, IE shows no sign of vanishing from the corporate landscape."
This discussion has been archived. No new comments can be posted.

IE 0-Day Flaw Used In Chinese Attack

Comments Filter:
  • by XPeter ( 1429763 ) on Thursday January 14, 2010 @08:33PM (#30773452) Homepage

    This is unheard of!

    • by Monkeedude1212 ( 1560403 ) on Thursday January 14, 2010 @08:47PM (#30773626) Journal

      No no no, you aren't seeing it.

      Google can stay in China, or pull out, or do whatever its nefarious plan is, and now they can BLAME MICROSOFT!

      Don't you know what this means?!?!?!?!?!?

      Clearly this is all an elaborate ruse to market Chrome!

      • by Knara ( 9377 ) on Thursday January 14, 2010 @08:51PM (#30773668)

        Google can stay in China, or pull out,

        It's far too late for Google to pull out of China. It should have known that the pulling-out method is not a reliable form of birth control, and now it needs to take responsibility for it and China's love child, Baidu.

        • by DMiax ( 915735 )
          What is the problem if Google pulls out? What damages have they done? If anything the chinese are going to notice that it is missing and - maybe - grow some little more discomfort with the current governement that can push them to change things...
        • It's far too late for Google to pull out of China.

          So exactly what is google going to do to China now?

      • Re: (Score:2, Interesting)

        by rtb61 ( 674572 )

        M$ profits and restricted access to the source code is the problem. Once you started dumping the closed source code onto essential technology infrastructure and only basically released the code to governments, especially those governments that oppose the concept of a modern democracy, well, guess what those governments would do with the bugs they find. Greed versus patriotism, let me guess which took the back seat in dealing with unstable undemocratic governments and corporate profits. Open source can have

    • Re: (Score:2, Insightful)

      by Anonymous Coward
      Just keep using mainstream Microsoft products and acting surprised when this happens. At least the rest of us can derive some amusement from your insistence that "Microsoft == high-quality" because it has a recognizable brand name.
    • by spinkham ( 56603 ) on Thursday January 14, 2010 @09:18PM (#30773918)

      Honestly, there are major flaws in all browsers all the time, they're really complicated software and are the most exposed part of the computer at the moment, so lots of research is put into finding flaws.

      The two continuing problems are:
      1) The use of old versions. IE 6 sucks. No way around it. IE 7 sucks less, and IE 8 has a mix of good and bad things.
      2) The time between updates. Some known IE bugs go patched for a long time, with about a 1 month minimum exploitation window, and often quite a bit longer. FF and especially Chrome are MUCH better about pushing out patches and getting their users to upgrade.

      • Re: (Score:3, Insightful)

        browsers... are really complicated software

        Uh, no, not really. It is not that difficult to manage the standard Internet protocols, nor is that hard to construct a DOM and render from it. Add a plugin interface for all the other stuff and you've still got a basically simple browser, that you can make as complex as you need or want.

        I think you might be looking at IE as a sample of one, and extrapolating incorrectly from there. IE was designed intentionally to be a core part of the OS, in order to get around a court decision that MS didn't like. By f

        • by spinkham ( 56603 ) on Thursday January 14, 2010 @11:11PM (#30774792)

          Oh really? Tracing JIT JavaScript interpreters are trivial? Parsing PNG, GIF, JPEG, SVG, and even more image formats is trivial? The rules for the same origin policy including inheritance to iframes and the like, cross domain access, content encoding, proxies, plugins, memory management, not to mention multiple tabs with concurrent access to all these things.. All these are all trivial to you? Man, I'd use your browser in a second, because no one else can manage the complexity. The standards are nice as far as they go, but not complete and there's lots of legacy crap out there. HTML 5 does codify better parsing behavior and other thigns that have been missing for the standard, but still doesn't cover everything.

          For a very quick overview that just grazes the surface on how hard this stuff is, see the Browser Security Handbook [] by Michal Zalewski.

          Firefox lists 35 security flaws in Firefox 3.5 alone, and that's only been out since June.

          Yes, ActiveX is/was/will be a bad idea, but at least it requires a click through now, and runs with DEP in IE 8. Plugins have the same problems on native code for Firefox and the other browsers too, now that Firefox has market share starting to see a rise in plugins and security flaws there instead.

          Now, I'm not a Windows or IE fanboy, actually I hate the darn thing and run Firefox most of the time. But I do break web software for a living, and know how complex this stuff is and how nobody has it right. Both IE and Chrome have added some interesting security features lately to help contain flaws when they do occur, but nobody has yet written perfect software and there will continue to be security flaws in all browsers.

    • by CodeBuster ( 516420 ) on Thursday January 14, 2010 @09:21PM (#30773942)

      This is unheard of!

      Until it gets reported or exploited, then everyone knows about it.

    • Re: (Score:2, Funny)

      by Anonymous Coward

      I've been using IE for years and my computer has never been hacked once. On the other hand people keep breaking into my bank account, web mail, and stealing my card information. Man, I just wish someone would protect those things like IE protects my computer.

  • by Arancaytar ( 966377 ) <> on Thursday January 14, 2010 @08:37PM (#30773510) Homepage

    Clearly instead of (or at least as well as) pulling out of China, Google should stop supporting MSIE.

    And declare cyber-war on Microsoft. :P

    • Re: (Score:3, Insightful)

      by cstdenis ( 1118589 )

      Why is Google even using IE? They have their own web browser. They should be eating their own dog food.

      • Re: (Score:3, Insightful)

        by Haymaker ( 1664103 )

        Why is Google even using IE? They have their own web browser. They should be eating their own dog food.

        Google hardly even uses Windows AFAIK. The IE vulnerability victims are likely the people who had their accounts attacked.

    • by Anachragnome ( 1008495 ) on Thursday January 14, 2010 @09:10PM (#30773834)

      That is pure genius.

      There are Sooooo many people that don't know how to find anything on the web without using Google that if Google did stop supporting IE, many of those people would start using Firefox simply to use Google. And that would be a huge foot-in-the-groin for Microsoft, even if it doesn't DIRECTLY benefit Google.

      Methinks it would avoid any anti-trust issues as well.

      Considering the topic of this thread, it might actually help to prevent further Chinese highjinks.

      • Re: (Score:2, Interesting)

        by lien_meat ( 1126847 )
        I see another scenario... Google stops supporting IE, Microsoft is justified in forcing bing as the default search on ANY IE install, all the people who just use IE cause it's installed (quite a few I believe) will use bing, and see how pretty bing is, and be seduced into thinking google is crap. (bing does look good, I prefer google though, for many reasons) So if anything, I believe a move like that would hurt them.
    • Re: (Score:3, Funny)

      by plover ( 150551 ) *

      When Ballmer said he was going to "f*ck!ng kill Google," you all just laughed (and dodged the occasional chair.)

      But who's laughing now, Sergei? Who's laughing now?

  • More than just IE (Score:5, Informative)

    by FalleStar ( 847778 ) on Thursday January 14, 2010 @08:44PM (#30773584) Homepage

    If you bother to RTFA (I must be new here, right?) you'll see that it wasn't JUST an IE zero-day that was used in the attack.

    "While we have identified the Internet Explorer vulnerability as one of the vectors of attack in this incident, many of these targeted attacks often involve a cocktail of zero-day vulnerabilities combined with sophisticated social engineering scenarios." - George Kurtz []

    So IE is partially to blame, but you can't just say that this is MS's fault.

  • It's not stupidity (Score:5, Insightful)

    by liquiddark ( 719647 ) on Thursday January 14, 2010 @08:44PM (#30773586)
    Corporate users largely work on intranets, and intranets are largely supported by guys who don't have the resources a professional development team has. So corporations buy large make-your-own-adventure web-ish packages like Sharepoint, and suddenly they're locked into IE for another cycle, and the whole ugly repeats itself. It's genuinely difficult to not get locked into somebody's product stack, and Microsoft's is, on the whole, no worse than anybody else's.
    • Re: (Score:3, Informative)

      According to TFA, this vulnerability was in IE6. Lock-in or no, you'd think they could have at least upgraded one version level up, if not two.
      • by liquiddark ( 719647 ) on Thursday January 14, 2010 @09:20PM (#30773924)
        You might think that, but try supporting a massive suite of web applications that all have their own browser ticks, all of which were critical for something just shy of a minute, but which are maintained because retiring one would cause one guy (who always, somehow, happens to have the necessary clout) to die of unproductivity. Until you've lived in that situation for years on end it is wise to withhold judgement.
        • by mcrbids ( 148650 ) on Friday January 15, 2010 @04:10AM (#30776272) Journal

          The hard part is to understand just how long it takes to get a bug fixed!

          I'm a developer. I write code, lots and lots of code. I'm responsible for a FARKING HUGE pile of code that I maintain for a vertical app with over 100 good-sized customers at a small software company. Our developers crank out code - reams and reams of code! we crank through the bugfixes like there's no tomorrow, and the speed of development is somewhere between crazy and insane.

          But, when you leave this frenetic pace of development, when you leave the zone of developers, and enter the realm of corporate America, you find a completely different world inhabited not by crackerjack coders, but by "IT". People who don't write code, who don't craft solutions, and for whom a bug is a big deal.

          These people don't create solutions, they implement them. They spend lots of time doing research. Addressing a single bug can take days, maybe weeks of time, and certainly not hours! And given this very high cost of bug management, being conservative is suddenly very valuable!

          So, when we decide to switch, for example, from Firefox to Chrome, the only consideration is the bugs we'll find, and any we find we can take care in anywhere from hours to minutes, because we wrote the code in the first place, and it's not a big deal to fix.

          But if you didn't write the code, if it's all gibberish to you anyway, and it's your job to get stuff to work anyway, you become very, very conservative very quickly. A solution may work with IE 6, and may only need a few CSS declarations and maybe a tweak to the .js file to work properly with Firefox/Chrome/IE8, but if you don't know how to make those slight changes, you don't change a goddamn thing.

          Slashotters and other coders would do well to understand these people, as they are many and often in control of the purse strings of potential clients! They are the logical oppositve of the developer: risk averse, terrified of change, and work to avoid anything "interesting" anywhere possible.

      • by yuna49 ( 905461 ) on Thursday January 14, 2010 @09:23PM (#30773952)

        According to TFA, this vulnerability was in IE6.

        No, only IE 5.01 SP4 and IE 8 are not vulnerable without enabling "data execution prevention." The attackers apparently targeted IE 6, but nearly all other versions can be compromised.

        From TFA:

        "A security feature known as data execution prevention, which prevents data loaded into memory from being executed, will block the particular exploits McAfee has observed. But Kurtz warned the vulnerability exists in all versions of IE except for IE 5.01, service pack 4, and that it would be possible for attackers to work around the protection.

        In an advisory, Microsoft recommended people use DEP, which by default is enabled in IE 8 but must be turned on in prior versions. The statement also advised users on Vista and later versions of Windows to run IE in protected mode. The advisory didn't say when an update would be released that patches the vulnerability."

      • "According to TFA, this vulnerability was in IE6."

        TBH, I haven't read TFA. If TFA says the vulnerability was in IE6 alone, then I think TFA errs. I've read through 3 different related articles before seeing it come up here on slashdot. The vulnerability is also in IE7 and IE8. The fix is really simple - put your IE security settings up to maximum to prevent any DirectX from running, unless you specifically approve of it.

        Of course, having your security settings on max is a real hassle. On my XP virtual

        • by Carnildo ( 712617 ) on Thursday January 14, 2010 @10:06PM (#30774274) Homepage Journal

          Given the opportunity, I'd make everyone ignore a half dozen warnings.

          Fixed that for you. Warning overload is one of the biggest problems facing computer security today. Since so many of the warnings the average user is bombarded with are meaningless, the genuine threats get lost in the noise and are ignored.

          See also: The boy who cried "wolf".

          • by Runaway1956 ( 1322357 ) on Thursday January 14, 2010 @10:25PM (#30774434) Homepage Journal

            That's one point of view. Another is, after 4 to 6 warnings, no one can claim to have been hit by a "drive by" without any warning at all.

            "Look here, stupid. Firefox warned you TWICE that some unknown software could be malware. After which, Windows warned you twice. Look at the logs. You dismissed all four warnings, and purposefully installed this crap onto this machine. I think that we should go up front, and speak to the boss about your willful, and deliberate violation of company rules and policies."

            An incident or six like this would probably motivate some people to READ the warnings, and give them at least a passing thought.

          • by hoggoth ( 414195 )

            > Warning overload is one of the biggest problems facing computer security today. Since so many of the warnings the average user is bombarded with are meaningless, the genuine threats get lost in the noise and are ignored.

            But... we're at code Yellow today! How can you ignore warnings when we are at code Yellow?

          • There's not really a good way around it. The problem is that for real security separation, you are going to have a lot of "Can I have permission to do this?" type requests. That's the only way it works properly. If you implement ways around it, then other programs can make use of that. A good example would be the solution some Linux distros take to sudo/root type stuff. If you are configuring things, you often get asked a lot to escalate and people get mad about it. So instead, when you escalate, they cache

    • Re: (Score:2, Offtopic)

      by awitod ( 453754 )

      SharePoint 2010 does not fully support IE 6.0. It is a down-level browser. SharePoint 2010 does fully support FireFox, Chrome, Safari, and Opera.

      Just thought you'd be happy to know.

      • I would be delighted, if we had any likelihood of upgrading our SP installation anytime soon. Thanks for the talking point, at least.
    • by Zero__Kelvin ( 151819 ) on Thursday January 14, 2010 @10:24PM (#30774428) Homepage

      "It's genuinely difficult to not get locked into somebody's product stack, and Microsoft's is, on the whole, no worse than anybody else's."

      Right ... in the same way that you are no worse than the typical moron that would make such a statement.

  • by Eyah....TIMMY ( 642050 ) * on Thursday January 14, 2010 @08:46PM (#30773606)
    From an earlier /. article: []

    From the article in this post: The previously unknown flaw in the IE browser was probably just one of the vectors used in the attacks .
    I love the "probably"
    • Ok then they post an update it might be IE. So I guess noone knows, or it depends on the contracts you have with Adobe.
    • Re: (Score:2, Insightful)

      by pookemon ( 909195 )
      Yeah - I read that as "We don't actually know how the attack was done - but we'll go with the popular line and blame Microsoft."
  • by SillyValley ( 1721474 ) on Thursday January 14, 2010 @08:55PM (#30773692)
    I recall MSFT allowed the Chinese government to look at Windows source code a few years back. I wonder if the vulnerable IE6/7/8 code was part of the code provided to the Chinese government, but IE5.4 (not vulnerable to the latest attack, apparently) didn't include the problem code? This is something that can be checked. It could be an indication of whether the Chinese used the source code inspection as a road map to identify vulnerabilities for attacks like these.
    • i think it's an indication that just having the code will not protect you. unless your in the business of developing software, having open source is utterly meaningless.
      • Re: (Score:3, Insightful)

        i think it's an indication that just having the code will not protect you. unless your in the business of developing software, having open source is utterly meaningless.

        You are missing the other half of the equation there. The advantage of having the source isn't simply being able to see the code, it is everybody being able to see the code. This is the so called "1000 eyes" effect. Everybody being able to see the code gets bugs found and fixed sooner. Allowing the Chinese to see Windows code may very well h

    • It is worth noting that unless you specifically exclude IE8 from DEP (or disable DEP globally) then it is not vulnerable to this attack. You can also enable DEP (either via opt-in or by switching the default behavior system-wide to opt-out) for the previous IE versions.

      Nonetheless, it's possible that the vulnerability was discovered in the manner you suggest. I'm not sure they saw the IE8 code, but if the same vulnerability is used on all versions it's probably in code that hasn't changed in a while.

    • Not that they got access to the source, that is unsurprising, MS shares their source with governments, universities, and so on. However I doubt the Chinese scoured the IE code to find security flaws.

      You find that for major projects, security flaws are most often not found looking through the source, but rather testing against a running program. Why? Well because there were always a bunch of skilled programmers that looked at the source, and they didn't see anything. As such, it isn't so likely you'll see an

  • Not PDFs? (Score:4, Insightful)

    by gumbo ( 88087 ) on Thursday January 14, 2010 @08:58PM (#30773716) Homepage

    I've heard that PDFs were used, and that's the one that sounds the most logical. Whenever I've seen attacks against my network from the Chinese, it's always been in the form of malicious spear-phished PDFs.

    Whatever they actually used against Google, there's not one easy solution. You can't just say that they should have used Firefox, because then the attackers would have exploited some random Firefox add-on that some people were using. I'm sure Google employees use every browser out there throughout the company. Keeping Acrobat Reader fully patched and keeping your users alert and well-trained would probably stop a lot of it, but not all.

  • by Trailer Trash ( 60756 ) on Thursday January 14, 2010 @09:04PM (#30773768) Homepage

    Seriously - makes no sense.

    • Maybe for the same reason that Slashdot uses a 3Dified version of the IE5 logo as an icon for Internet Explorer?... and this on a website where people bitch endlessly about IE6, let alone something even more ancient...

      They did it for the lulz.

    • People at google are not using IE - People who use google products like gmail use IE. They are the ones that got really owned. Google itself did not get completely owned (if you trust Google's narrative).
    • by D H NG ( 779318 )
      Not all Google employees are engineers. About half of the employees use Goobuntu. The rest use Windows and Macs.
  • No real fix... (Score:5, Interesting)

    by Aoet_325 ( 1396661 ) on Thursday January 14, 2010 @09:12PM (#30773872)

    Sadly, microsoft doesn't seem to have anything you can do to fix this. []
    It's seems all they advise will only reduce your odds of getting hit (by helping protect against the methods they've seen used to exploit it) and reducing the damage done after IE runs the malicious code on your system.

    What they should be suggesting is that people not use IE on the internet (if possible) until this is fixed.

    '0 day' exploits are everywhere. What matters to me is that once discovered they are quickly patched or at the very least, a work around that actually prevents exploitation is provided.

    I'd be interested to know more about the social engineering aspect of this attack. Was this more of the usual attempts (something that really should have been caught by anyone who knows better than to open random attachments and click links from strangers) or was there something much more involved that allowed the attackers to gain sufficient trust that any one of us would have likely fallen for this. Did the attackers spend months building a strong level of trust with the people at these companies or did someone click an on E-card?

    • by dave562 ( 969951 )

      I'd be interested to know more about the social engineering aspect of this attack.

      I would think that aspect of this would be obvious. They obviously received an email from an ancient Tibetian monk who recently came into a large supply of enlightenment pills, but needs help getting them out of the country. The attached PDF document contained all of the information regarding the pills, but the recipients were encouraged to act quickly as enlightenment is a valued treasure of the Chinese culture and supplie

    • It seems to me that in light of MS's inability to provide an adequate fix, the appropriate solution would be, in those situations where IE has to be used, to run Windows in a virtual machine that was well isolated from the real OS. This could be done under Linux or Mac.

  • No sign of vanishing (Score:3, Informative)

    by enharmonix ( 988983 ) <> on Thursday January 14, 2010 @09:21PM (#30773938)

    IE shows no sign of vanishing from the corporate landscape

    I work at a big company that takes an enormous number of precautions to secure and protect the confidential information of millions of people. And we still use IE6 with no sign of changing any time soon.

  • by fluffy99 ( 870997 ) on Thursday January 14, 2010 @10:10PM (#30774326)

    Make no mistake, China is agressively attacking foreign systems and common software. They are stockpiling these zero-day exploits as potential weapons. They use one until it's discovered and patched, then wait until they have another high priority and then unwrap the next one.

    When you see Symantec or Microsoft reporting an "undisclosed source" on new vulnerabilities, it's usually our own government that reported it after investigating a compromise. It's damn scary just how far the Chinese have wormed into the US corporate and military systems. For now they are content to quietly steal data and technology, but we're in deep shit if China decides to turn malicious. They have the power to level the US financial systems, military supply lines, utilities, etc which would quickly ruin the US. The reason they have not? It's not that they're scared of the US retaliating in kind - they clearly have the upper hand on that front. They need us to continue leeching our dollars and tech.

    • Re: (Score:3, Interesting)

      I am fascinated by your ideas and would like to subscribe to your newsletter.

      It's damn scary just how far the Chinese have wormed into the US corporate and military systems

      That would be scary if I didn't think you were just making that up.

      The reason they have not? It's not that they're scared of the US retaliating in kind - they clearly have the upper hand on that front. They need us to continue leeching our dollars and tech.

      Orrr... the Chinese don't actually have the godlike capabilities you ascribe to them.

  • by gillbates ( 106458 ) on Thursday January 14, 2010 @10:37PM (#30774530) Homepage Journal

    Because according to Microsoft, system vulnerability is determined by the following formula:

    Vulnerability = (time of patch - time of discovery) * number of exploits.

    Clearly, since the vulnerability was never publicly discovered, no patch was needed, right? Clearly, since the exploit was never published, it was not a security risk, right?

    For years, those outside the FOSS community behaved as if an unknown or undiscovered (or rather, unpublished) exploit was not a security vulnerability for the purposes of calculating risk. Rather, we were led to believe, by MS and others, that only unpatched systems were vulnerable. For years, I watched as countless IT folks repeated the mantra that a fully patched MS system was just as secure as any other.

    It always seemed obvious to me, but apparently not to others, that risk should be calculated using not on the time of discovery and publication, but rather, upon the ship date of the software. (i.e., a vulnerability discovered 3 years after ship date, but patched a month after discovery means your system was vulnerable for 39 months, instead of only one as the MS method calculated vulnerability.

    I think Google is big enough that people will now recognize that system security is not just a matter of patch early, patch often, but also a characteristic of the entity behind the code. Despite what Microsoft marketing would have you believe, the company can't produce a secure OS because they understand neither the problem, nor even the question.

    The reason Linux is more secure than Windows is due not merely to the fact that it is open source, but also because those who work with UNIX understand the problem of system security. It doesn't mean Linux is perfect, only that it fares much better from a total-risk perspective. Microsoft never really grasped that security was a fundamental system design consideration, rather than a problem to be patched on the back-end of SW development. While they have *tried* to address the security issues (and have been somewhat successful, but only due to their brute-force efforts), they still have a product-design mentality which places ship dates above system quality, and usability above overall security. The fact that they still consider anti-virus software and constant patching a normal part of computing indicates they've failed to grasp the lessons learned of the past 3 decades.

    For Microsoft, security is a checkbox feature, not a way of doing business. Maybe, now that Google was compromised by a type of exploit Microsoft, et al, considered of minimal, if not zero, risk, the world will change its opinion of the acceptability of software requiring constant patches and add-on kludges (i.e. anti-virus sw) just to function normally.

  • If the Chinese dare do it quasi-officially, I dare not think about the amount of corporate espionage that uses the same tools.

  • ... web sites continue to not warn their IE users about the security vulnerabilities in the clients those users are running. They could warn those users each time they visit with IE. But they don't. It's time the webmasters of the world start to do something about the problem and put a big full page notice in front of all IE based visitors warning them about the troubles with IE and urging them to switch to a safer browser (and give some links, too).

  • by Ilgaz ( 86384 ) on Thursday January 14, 2010 @11:53PM (#30775086) Homepage

    This is a real mysterious thing for me since I enable DEP in all kinds of configurations, even including Virtual Machines. I use Windows mostly for critical/complex device driven things like phone firmware updates, backups which means dozens of drivers installed.

    I also print via Bonjour under Windows, using a Airport USB shared Epson Laser printer which has a very complex driver.

    There hasn't been a single issue I have seen regarding DEP being enabled for all programs. Even AntiVirus programs doesn't complain.

    So, as we all know, some companies are "more equal" (look to Adobe/Carbon/OS X), which product likely prevents Microsoft from enabling it by default?

    According to Wikipedia, Apple enabled DEP like technology back in OS X 10.4.0 days and nobody even noticed it. I am not seeing any mysterious crashes, performance issues even with software based DEP. So, why on earth DEP is defaulting to off?

  • DEP setting in IE? (Score:3, Interesting)

    by Askmum ( 1038780 ) on Friday January 15, 2010 @03:45AM (#30776170)

    In an advisory, Microsoft recommended people use DEP, which by default is enabled in IE 8 but must be turned on in prior versions.

    To my knowledge, DEP is a setting in Windows, not in IE. Does Microsoft not know it's own product or is this some different setting?

Evolution is a million line computer program falling into place by accident.