Hackers find another zero-day hole in Internet Explorer

January 06, 2013

An elite hacker group credited last year with having an inexhaustible supply of zero-day vulnerabilities was responsible for digging up and first using the newest unpatched bug in Internet Explorer (IE), a Symantec manager said. The gang, dubbed "Elderwood" after a source code variable regularly used by the hackers, had been profiled last September by Symantec in a research paper that outlined its strategies as well as its hacking tactics. Last week, Symantec linked Elderwood to the newest IE zero-day, which researchers said last week was being used to attack Windows PCs whose owners visited the Council on Foreign Relations' (CSR) website using IE6, IE7, or IE8. CSR is a high-profile foreign policy think-tank. Symantec based its conclusion on several factors, including similarities in attack code used both in past exploits and the most recent. To read this article in full or to leave a comment, please click here

Link: http://www.computerworld.com/s/article/9235276/Elite_hacker_gang_pulls_out_another_IE_zero_day_from_bottomless_pocket