Researchers have stumbled on an Internet Explorer zero day exploited in the in-the-wild, but their excitement was over almost as soon as it began.
The M86 security labs team found the exploit when it inspected a legitimate web site that was blacklisted by the company’s gateway products.
It found a now patched remote code execution vulnerability (MS11-050, CVE-2011-1255) which was exploited by code running on the page, but Microsoft quickly patched the hole.
Researcher Avri Schneider said it appears the perpetrator of the attacks also reported the exploit to Microsoft.
“Based on data we have reviewed from various sources, we can say with a high level of certainty, that the anonymous researcher who according to Microsoft’s security advisory, reported the vulnerability details to VeriSign iDefense, or at least one of his acquaintances, had used the vulnerability details for malicious purposes, as part of targeted attacks,” he said.
It inspected the shellcode and found that it pointed to a malicious server which the attacker used in March last year to launch another zero-day exploit for the now patched Peer Objects component vulnerability.
Schneider said the team was able to search Google for the location of the infected servers because the shellcode, hidden within the Domain Name Objects (DOM) of the victim’s web page to bypasses security software, made the data indexable by search engines.
“It’s [interesting] that an attacker’s obfuscation technique can be used against him to find his infection servers using a simple Google search.”
