Woes with Internet Explorer’s ActiveX software continue, as hackers have started actively exploiting a popular IE plug-in that many Facebook and MySpace.com members use to upload photos.
Hackers are concentrating on Aurigma’s Image Uploader, an ActiveX control employed by many social networking sites. It's part of a larger multi-attack kit being used by several Chinese attack sites, according to security firm Symantec – one of five malicious toolkit elements.
Attacks begin when users receive spam or an instant message with an embedded link, said Darren Kemp, a Symantec analyst who issued a warning last week. The link takes users to a bogus MySpace log-in page, which tries to steal members' credentials while also silently probing their computers for vulnerabilities in Uploader, Apple’s QuickTime, Windows and Yahoo Music Jukebox.
Although the Windows and QuickTime bugs were patched eight and 13 months ago, respectively, the Uploader and Yahoo vulnerabilities were only made public and fixed within the past few weeks. Kemp noted how quickly hackers were reacting to new vulnerabilities. "It is unlikely that attackers will stop trying to leverage this vulnerability any time soon," he added.
The Aurigma bug was disclosed at the end of January by researcher Elazar Broad. But no sooner had the the social networking sites alerted members than new bugs cropped up the following, however, forcing Aurigma to again patch the ActiveX control. Not until 13 February did it claim "Image Uploader is safe again".
Yahoo plugged a pair of holes in its music player on 6 February, two days after Broad published attack code for both it and Aurigma.
Symantec has been tracking attacks against the Aurigma vulnerabilities most of the month. More than three weeks, ago, for example, another of its analysts reported seeing evidence of a new multi-exploit hacker tool kit - presumably the same one analysed by Kemp - that included an Image Uploader attack.
Exploits against ActiveX controls are nothing unusual; scores of bugs in the Microsoft-made technology were uncovered and exploited in 2007, according to Symantec. It counted 210 ActiveX vulnerabilities in the first half of last year alone, a prime factor in making IE a popular attack target.
In fact, after the Uploader and Yahoo Music Jukebox vulnerabilities were disclosed, the US. Computer Emergency Readiness Team (US-CERT), which is part of the US Department of Homeland Security, recommended that IE users disable ActiveX.
Kemp, however, saw the social networking angle as just as important. "Given the growing popularity of social networking sites like MySpace and Facebook, attacks leveraging vulnerabilities in their client-side components are not surprising," he wrote in the warning.
Symantec urged users to update the Image Uploader ActiveX control to Version 18.104.22.168.