Hackers are still using vulnerabilities in the seven-year-old Internet Explorer 11 browser to go after targets, even as Microsoft plans to sunset the program in less than a year, researchers at Google’s Threat Analysis Group reported Wednesday.
The campaign largely targeted victims in Armenia. In April and June, cybercriminals targeted Armenian users with the exploit, researchers found.
“This exploit was delivered via an Office document rather than via the Internet Explorer browser GUI,” explained Shane Huntley, director of Google’s Threat Analysis Group. “Even if a user was to uninstall Internet Explorer, the exploit would still work.”
Microsoft fixed the exploit in June.
The same surveillance group cashed in again on a vulnerability in Chrome. They sent the exploits via email with links posing as legitimate websites. They were instead attacker-controlled domains that fingerprinted a user’s device and allowed hackers to determine if they would send the exploit. The vulnerability existed in code shared with Apple’s browser engine WebKit, making Safari also vulnerable. Apple fixed the vulnerability and it doesn’t appear any Safari users were affected.
Google didn’t name the surveillance group it says is behind the exploits but says it operates in the same ecosystem as the NSO Group, which has been accused of working with authoritarian regimes committing human rights abuses.
In an unrelated campaign, attackers used LinkedIn Messaging to target government officials from western European countries by sending them malicious links. The hackers exploited a vulnerability in Safari to conduct the campaign.
Google believes the hackers behind the Safari zero-day are the same Russian hackers as those behind a widespread phishing campaign impersonating USAID employees reported by Microsoft in May. and the USAID campaign to be the same group of actors. The campaigns are unrelated.
The four exploits comprise part of the major uptick of in-the-wild zero-day attacks Google researchers have identified this year. Just halfway into 2021 there have been 33 publicly disclosed zero-day exploits, 11 more than the total for all of 2020.
Researchers speculate the shift could be the result of increased detection and disclosure from vendors like Apple and Google. But it could also be in part to the growing commercial availability of zero-days, once the tool of select nation-states with major hacking expertise. The majority of exploits discovered by Google’s Threat Analysis Group in 2021 were developed and sold by commercial providers to government-backed cybercriminal groups, researchers noted.
“Attackers needing more [zero-day] exploits to maintain their capabilities is a good thing — and it reflects increased cost to the attackers from security measures that close known vulnerabilities,” Threat Analysis Group researchers Maddie Stone and Clement Lecigne wrote in a blog post. “However, the increasing demand for these capabilities and the ecosystem that supplies them is more of a challenge.”
Updated 7/14: This story was updated with additional comments from Google.
"explorer" - Google News
July 15, 2021 at 04:05AM
https://ift.tt/3klaZ82
New Internet Explorer, Chrome zero-days highlight a growing market - CyberScoop
"explorer" - Google News
https://ift.tt/2zIjLrm
Bagikan Berita Ini
0 Response to "New Internet Explorer, Chrome zero-days highlight a growing market - CyberScoop"
Post a Comment