Cyber Intelligence abusing Internet Explorer to perform Targeted Attacks

A “mandatory” step to achieve a complete and successful targeted attack is the so called: “Cyber Intelligence Phase”. By definition every targeted attack owns at leeast one specific characteristic which makes it perfectly fit for a given target. As you might want agree, one of the most important activities on develping a targeted attack is to exactly know what’s running on the target system. The activity which takes care of “discovering” what’s running on a given system is often called Cyber Intelligence (many of you on the Cyber Intelligence field might know a little bit different definition… but this is not the point). I wont write, in this quick and dirty blog post,  about cyber intelligence, indeed I want to point you out simple techniques to perform a target enumeration by using Internet Explorer. 

One of the most used techniques to perform Cyber Intelligence through Iinternet Explorer (IE) is the “abusing of resources” (res://) calls. This techniques afflicts IE from 6. to 8. It has been widely discussed in many online sites (for example: here, here, here and here). The technique is based on the assumption that IE blocks access to local file system trhough the “file://” call, but let the “res://” call to have access to image resources on file system. To exploit this IE’s behavior the attacker might look at specific executables holding (as resource)  specific images. The res abuse://  has been used as Cyber Intelligent Weapon in serveral attacks including the “waterhole campagin afffecting a Thailand NGO” as posted here. The aforementioned behavior could be exploited as follows:

Another used technique to map software into a target host sees its implementation through the Microsoft XMLDOM ActiveX Info disclosure vulnerability. This vulnerability has been videly discussed as well (here, here, and here). Basically Microsoft.XMLDOM is an ActiveX control that can run in Internet Explorer without requiring any prompting to the user. This object contains methods that can leak information about a computer system to the operator of a website. By looking at error codes provided by the XMLDOM ActiveX control, an attacker can check for the presence of local drive letters, directory names, files, as well as internal network addresses or websites. It is confirmed that this issue affects Internet Explorer versions 6 through 11 running on Microsoft Windows through version 8.1. The following code shows an example of the implementation of such a vulnerability. It looks for the presence of specific files into the target system.

 Following on this way attackers might use more XMLDOM vulnerabilities such as CVE-2014-0322 in which Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the “onpropertychange” attribute of a script element, as exploited in the wild in January and February 2014. MSF exploits are available out there. As WebSense discussed on his Security Blog Post attackers used the described technique to identify the Microsoft EMET presence on the target system. The same technique was found into Angler Exploit Kit and later on Goon and Cool Exploit Kits too.

Cyber Intelligence, is one of the most fascinating field. It does nothing bad per se, it simply offers detailed infos to next “phases”. As always happens such infos could be used by legitim systems as well as by attacker’ systems. As you problably have learned in the past years… whatch out what you browse  !