Saturday, March 26, 2016

Too Much Freedom is Dangerous: Understanding IE 11 CVE-2015-2419 Exploitation

It’s been a while since a pure JavaScript vulnerability was widely used by exploit kits. The last few years mostly gave us IE Use-After-Free vulnerabilities. When those were dealt with by Microsoft’s IsolatedHeap and MemoryProtection mechanisms, introduced in the middle of 2014, the stage was clear for Flash to take over.
Now, as Flash is marching towards its imminent death, Silverlight has been dying for a long time, and Java applets must be signed and played only after the user is prompted, we can expect some new trend to arrive on the scene.
CVE-2015-2419 (Jscript9 Memory Corruption), the subject of our paper, was patched a few months ago, but is still used across most Exploit Kits. However, no satisfying analysis, regarding either its root cause or how to successfully exploit it, has been published. We think an analysis of this kind is needed: First, to see a pure JS exploit for IE 11, despite the heap corruption mitigations in IE mentioned above. Second, unless Microsoft comes up with similar protections for IE’s JS engine, this might be the kickoff for similar exploits as soon as Flash disappears.
We started with a working exploit taken from Rig EK (MD5: 4497f09502758ae82f122b21b17d3644. It looks exactly the same as in Angler EK). It’s heavily obfuscated and tricky, which makes the job of understanding the vulnerability, and the exploit directly from the exploit code, very complicated.

4 comments:

  1. The rolex replica is used by professionals in watch servicing. They are ideal for use on Rolex watches as the tape size of 12 mm fits the Rolex bracelets. The tape is known to have high levels of endurance and resistance properties. The hublot replica is an adhesive tape that can withstand high temperatures. The tape is coated with tag heuer replica adhesive on one side which is pressure sensitive. This product has the Dupont trademark. It comes in different sizes like replica watches sale. The tape comes in a roll which is 33 metres long. The tape technology is based on the Kapton film. Apart from rolls, Kapton spots are also available. They come in rolex replica uk and each package contains 1000 spots. The Kapton tape used in watch servicing is stable over a wide temperature range from replica watches uk degrees Celsius.

    ReplyDelete
  2. Watches are the one type of replica watches uk that are advertised for men as well as for women. Sure, men wear bracelets and often wedding rings but the main jewelry staple for a man is the watch. How often do you see very successful men in fake rolex sale. The answer is never. Successful men wear luxury, masculine, and often sporty watches. These watches help define and compliment their rolex replica sale. Many people think that rolex replica sale for a man runs into the thousands of dollars. While this is sometimes true, it is certainly possible to get quality, elegant, character defining replica watches sale for less than $1,000. The key is to buy the watches online. There is always a watch store online featuring that watch that you saw in the mall at a much lower price. For instance, you will often find a breitling replica watch online for $1,000 that is featured at the mall for $2,500.

    ReplyDelete
  3. This comment has been removed by the author.

    ReplyDelete
  4. Hi, Great.. Tutorial is just awesome..It is really helpful for a newbie like me.. I am a regular follower of your blog. Really very informative post you shared here. Kindly keep blogging. If anyone wants to become a Front end developer learn from Javascript Training in Chennai . or Javascript Training in Chennai. Nowadays JavaScript has tons of job opportunities on various vertical industry. JavaScript Training in Chennai

    ReplyDelete