Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So I read this article about how the US Department of Labor's website was compromised and users were redirect to a site that installed malware:

http://threatpost.com/watering-hole-attack-claims-us-department-of-labor-website/

Now, I have two questions:

  1. How could the JavaScript that redirected the users be injected into the DOL's site in the first place?

  2. What technology was used the exploit the memory vulnerability in Internet Explorer (i.e. JavaScript, JAVA, Flash, etc)?

I'm asking so that I can prevent my own websites from being compromised in the same way.

share|improve this question

1 Answer 1

up vote 4 down vote accepted

How could the JavaScript that redirected the users be injected into the DOL's site in the first place?

From a cursory reading, it appears that the vulnerability is a simple XSS attack.

What technology was used the exploit the memory vulnerability in Internet Explorer (i.e. JavaScript, JAVA, Flash, etc)?

It appears to be a Javascript-only attack. The proper fix for that particular vulnerability is simply have the users use a more modern browser.

share|improve this answer
    
"use a more modern browser" it affects all unpatched versions of IE technet.microsoft.com/en-us/security/bulletin/ms13-021 –  John May 2 '13 at 15:23
1  
@John That's the wrong bulletin. This is the correct one. technet.microsoft.com/en-us/security/bulletin/ms13-008 –  Xander May 2 '13 at 15:28
    
@John From the article you linked "This has been exploited in the wild since December and was patched earlier this year by Microsoft." .... –  Terry Chia May 2 '13 at 15:30
    
@Xander thanks. –  John May 2 '13 at 15:50
2  
@John You can be surprised how powerful JS can be especially if there exist vulnerabilities in the browser that allows JS to break out of the sandbox. –  Terry Chia May 2 '13 at 15:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.