US Department of Labor Watering Hole Attack

Question

So I read this article about how the US Department of Labor's website was compromised and users were redirect to a site that installed malware:

Now, I have two questions:

How could the JavaScript that redirected the users be injected into the DOL's site in the first place?
What technology was used the exploit the memory vulnerability in Internet Explorer (i.e. JavaScript, JAVA, Flash, etc)?

I'm asking so that I can prevent my own websites from being compromised in the same way.

score 4 · Accepted Answer · 2013-05-02 15:20:03Z

4

How could the JavaScript that redirected the users be injected into the DOL's site in the first place?

From a cursory reading, it appears that the vulnerability is a simple XSS attack.

What technology was used the exploit the memory vulnerability in Internet Explorer (i.e. JavaScript, JAVA, Flash, etc)?

It appears to be a Javascript-only attack. The proper fix for that particular vulnerability is simply have the users use a more modern browser.

answered May 2 '13 at 15:05

user10211

"use a more modern browser" it affects all unpatched versions of IE technet.microsoft.com/en-us/security/bulletin/ms13-021 – John May 2 '13 at 15:23
1

@John That's the wrong bulletin. This is the correct one. technet.microsoft.com/en-us/security/bulletin/ms13-008 – Xander May 2 '13 at 15:28
@John From the article you linked "This has been exploited in the wild since December and was patched earlier this year by Microsoft." .... – user10211 May 2 '13 at 15:30
So it appears that from a web developer's point of view, the lesson from this article is guard against XSS vulnerabilities. I'm surprised you can execute arbitrary code from JS though... – John May 2 '13 at 15:51
2

@John You can be surprised how powerful JS can be especially if there exist vulnerabilities in the browser that allows JS to break out of the sandbox. – user10211 May 2 '13 at 15:55

add a comment |

1 Answer 1