Researchers Remotely Defeat IE Protected Mode

Attackers can bypass the Microsoft browsers sandbox and install persistent malware, according to researchers at Verizon Business.

Slideshow: Microsoft Internet Explorer 9 Beta Revealed

(click image for larger view and for full slideshow)
A previously undisclosed vulnerability allows attackers to bypass Protected Mode on both Internet Explorer 7 and 8. The flaw was discovered by researchers at managed services firm Verizon Business, which is part of Verizon Communications.
The related attack works by escalating the browsers privilege level from low to medium integrity. Once the initial, remote exploit has been used to execute arbitrary code at low integrity on the client, the payload can create a web server listening on any port on the loopback interface, according to the Verizon Business researchers. This web server then serves an attack locally, which the browser typically grants medium integrity, because its being rendered in the Local Intranet Zone. At that point, repeating the attack can introduce persistent malware, because the medium-integrity setting allows for code to persist.
Since Internet Explorer 7 and Windows Vista -- which added User Account Control (UAC) -- Microsoft has offered a Protected Mode for IE, meant to stop these types of attacks. Furthermore, this mode, which is activated by default for all non-local browsing, has been pitched by Microsoft as a last-ditch defense for ensuring that even if malicious code compromises IE, Protected Mode will prevent the code from being able to persist or do much damage.
Except that according to the new report, Protected Mode doesnt appear to be doing that.
According to the Verizon Business researchers, this begs the question of how much protection Protected Mode is really supposed to do. The fact that a single exploit can be used for both the remote exploit and local privilege escalation is central to why this is a significant issue, they said in their related
report
, Escaping from Microsofts Protected Mode Internet Explorer. The report says, features such as Protected Mode can only be effective if they either significantly raise the cost of an attack, or reduce the probability of a successful attack. But this feature doesnt appear to do either very reliably.
Even so, Verizon Business researchers said that Protected Mode is helpful, since currently, most malicious code that runs at low integrity will likely fail to persist across reboots, since it will not be aware that it is running at low integrity. For example, they said, the Metasploit Framework, an open source penetration testing toolkit with the worlds largest database of publicly tested exploits, is mostly not aware of integrity level.
But the Verizon Business researchers called on vendors such as Microsoft to separate their products security features and functionality from marketing hype. Microsoft and other software vendors should clearly document which features do and do not have associated security claims. Clearly stating which features make security claims, and which do not, will allow informed decisions to be made on IT security issues. This will benefit vendors, customers and even security researchers.
For Further Reading
Internet Explorer Vulnerable To Browser History Hijacking
Microsoft Issues Zero-Day IE Warning
UniBrows Adds Security To Internet Explorer 6 Apps

Last News
▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Researchers Remotely Defeat IE Protected Mode