Microsoft promises fast fix for IE zero-day as new attacks are discovered

The problem of the remotely-exploitable IE zero-day memory-corruption vulnerability that is being misused in current attacks has reached a critical enough level for Microsoft to confirm the issuing of a “Fix it” tool ahead of a badly needed patch.

“While we have only seen a few attempts to exploit the issue, impacting an extremely limited number of people, we are taking this proactive step to help ensure Internet Explorer customers are protected and able to safely browse online,” wrote Yunsun Wee, Director of Microsoft’s Trustworthy Computing, and pointed out that the Fix it is easy to use, does not affect browsing ability the Web, and it will provide full protection against this issue until an update is available.

German’s Federal Office for Information Security (BSI) has reacted to the problem by recommending (webpage in German) to users to switch to other browsers until Microsoft releases a security update for the affected IE versions.

In the meantime, researcher Jaime Blasco and his team at AlienVault have discovered three servers that are actively targeting a number of defense and industrial companies in the US, the UK and India with new versions of the SWF file used to exploit the vulnerability.

Thanks to some previous research on the PlugX RAT used by a Chinese hacker gang, they managed to connect the two security issues and discover that the files on that server have been created several days ago – i.e. before the Internet Explorer zero day vulnerability went mainstream.

“We know that the group actively using the PlugX malware also called Flowershow had access to the Internet Explorer zero-day days before it was uncovered. Due to the similarities of the new discovered exploit code and the one discovered some days ago it is very likely that the same group is behind both instances,” they say.

They also believe that they might have discovered the identities of some of the people involved in this enterprise: an individual that goes by the online handle of “WGH” that is believed to be the author of the PlugX RAT, and one that goes by “Wicked Rose” and is believed to be one Tan Dailin, a former student at Sichuan University, and current leader of the Network Crack Program Hacker (NCPH) group.