VPNの脆弱性に関する不安が広がっています。ZPAの60日間無料トライアルを利用して、VPNからの移行のメリットをお確かめください。

Zscalerのブログ

Zscalerの最新ブログ情報を受信

購読する
セキュリティリサーチ

Spike Of "iepeers.dll" Exploits

image
JULIEN SOBRIER
5月 18, 2010 - 1 分で読了

We have seen a spike in exploits using  the CVE-2010-0806 "iepeers.dll" vulnerability since this past weekend. The vulnerability affects Internet Explorer 6 and 7.

We have seen this exploit in the wild since that day, usually a few times a week. However, this past weekend, we witnessed a spike of several hundreds exploits a day. They all come from the same type of URL (hxxp://1269754898890.9934.eu.tv/mm/index.html) with different numbers for the sub-domains. The content of the malicious pages is exactly the same.

The code is well obfuscated - it is split between several files, uses eval, DOM references, and exceptions (try ... catch). From the information I could gather, the exploit page has been written by Chinese hackers to target Chinese users. Part of the intermediate code generated is written with Chinese characters. Samples of the exploits have been reported in a couple of Chinese forums. It seems that users get redirected to the exploits from other websites, mainly though hacked sites.

Here is what the original source code looks like:
 

 
 
Image
Source code of the "iepeers.dll" exploits used in recent attacks


The page does not require any user interaction. The exploit runs as soon as the user gets redirected to this page.

-- Julien

form submtited
お読みいただきありがとうございました

このブログは役に立ちましたか?

dots pattern

Zscalerの最新ブログ情報を受信

このフォームを送信することで、Zscalerのプライバシー ポリシーに同意したものとみなされます。