infosec-news January 2011 archive
Main Archive Page > Month Archives  > infosec-news archives
infosec-news: [ISN] Accidental Leak Reveals Chinese Hackers Have

[ISN] Accidental Leak Reveals Chinese Hackers Have IE Zero Day

From: InfoSec News <alerts_at_nospam>
Date: Tue Jan 04 2011 - 10:56:40 GMT
To: isn@infosecnews.org

http://www.darkreading.com/vulnerability-management/167901026/security/vulnerabilities/228901665/accidental-leak-reveals-chinese-hackers-have-ie-zero-day.html

By Kelly Jackson Higgins
Darkreading
Jan 03, 2011

A renowned Google researcher who this week released a new free fuzzer
that so far has found around 100 vulnerabilities in all browsers says
Chinese hackers appear to have gotten their hands on one of the same
bugs he discovered with the tool.

Google's Michal Zalewski unleashed the so-called cross_fuzz tool on New
Year's Day and announced the fuzzer to date uncovered more than 100
vulnerabilities, many of them exploitable, in all browsers.

In a bizarre twist, Zalewski says an accidental leak of the address of
the fuzzer prior to its release helped reveal some unexpected
intelligence, namely that "third parties in China" apparently also know
about an unpatched and exploitable bug he found in IE with the fuzzer.
It all started when one of cross_fuzz's developers, who was working on
crashes in the open-source WebKit browser engine used in Chrome and
Safari, inadvertently leaked the address of the fuzzer in one of the
crash traces that was uploaded. That made the fuzzer's directory, as
well as the IE test results from the fuzzer indexed by GoogleBot, he
says.

Zalewski says he was able to confirm afterward that there were no
downloads or discoveries of the tool. But on Dec. 30, he says, an IP
address in China queried keywords included in one of the indexed
cross_fuzz files, specifically two DLL functions, BreakAASpecial and
BreakCircularMemoryReferences, associated with and unique to the
zero-day IE flaw he found with the fuzzer.

[...]

___________________________________________________________
Tegatai Managed Colocation: Four Provider Blended
Tier-1 Bandwidth, Fortinet Universal Threat Management,
Natural Disaster Avoidance, Always-On Power Delivery
Network, Cisco Switches, SAS 70 Type II Datacenter.
Find peace of mind, Defend your Critical Infrastructure.
http://www.tegataiphoenix.com/