Last month we posted a blog entitled Malware Exploits Microsoft “Feature” Along With Vulnerabilities. What prompted the creation of that entry was the discovery of malware exploiting the way Internet Explorer handles character encoding, an issue that was first reported last year. Since then we’ve been tracking the posting of exploits targeting this vulnerability. To date we’ve identified 256 obfuscated pages hosted on 198 unique domains. This Google Map plots the geographic location of the servers hosting the malicious files.

As you can see, the majority of servers are hosted in China. What is ironic here is that the reason the flaw exists is due to the handling of US-ASCII encoded pages. The code exists for the “benefit” of English-reading viewers, and yet non-English users are the ones most targeted. Attacks can be successful on such targets due to the manual specification of US-ASCII character encoding within the malicious HTML pages. It doesn’t matter if the victims configured their browsers to use a different character encoding; whichever encoding type is specified within the HTML is the one used by Internet Explorer.

We took a sampling of 89 URLs to catalog the payloads of the malicious code. We found that in virtually all cases, patched Internet Explorer vulnerabilities lay beneath the obfuscation layer. It is fairly common for one page to contain multiple exploits. Here’s a breakdown of the exploits obfuscated:

19 of the obfuscated pages were very obviously created with a readily available exploit creation tool. (The page authors didn’t bother removing the comments that make it obvious how the pages were created.)

We also found that in the vast majority of cases, the final payload of these exploits had been removed, and yet the pages that led victims to those absent payloads were still present. Additionally, a third of the pages charted as MS07-017 exploits had the target ANI files removed. All that remains is the HTML pointers to the files (which, all things considered, we assume contained MS07-017). Perhaps a method of content scanning was used that couldn’t recognize, or decode, the obfuscation.

Finally, four of the domains involved in the attacks are associated with Chinese government sites (.gov.cn), and at least two others rely on social engineering in that they are similar to trusted sites.

So where is this all headed?
As we stated last month, this vulnerability has been discussed before. Given the uptick in malicious usage, the concentration of attacks originating from (and targeting) China, and this all coming about on the heels of the worst vulnerability affecting Microsoft Vista to date (which was disclosed after public exploitation was discovered–in China), we can expect Microsoft to release an official statement on this issue sooner or later. The longer this issue goes unaddressed, the more likely it is that a new IE zero-day attack will leverage this method of obfuscation to conceal its presence just a little bit longer.  And the likelihood of such an attack emanating from China is higher than anywhere else right now. Unfortunately it might just take such an event for this issue to become a priority.