Reproducing the Aurora IE Exploit With Metasploit

This video features a detailed demonstration of a technique for reproducing the Aurora Internet Explorer exploit using the Metasploit Framework...

Remember Aurora–and Other Botnets

Last night my attention was drawn to a couple of blog entries relating to Google and the attacks they fell victim to earlier this year. These attacks were eventually labeled as “Operation Aurora” by McAfee based upon the presence of the “aurora” keyword embedded within some of the malware. First...

Marc Maiffret at RSA 2010

Dennis Fisher talks with Marc Maiffret of FireEye at RSA Conference 2010 about the lack of sophistication in the Aurora attack and the state of malware attacks on the Web...

MS10-002 Microsoft Internet Explorer "Aurora" Memory Corruption

This module exploits a memory corruption flaw in Internet Explorer. This flaw was found in the wild and was a key component of the "Operation Aurora" attacks that lead to the compromise of a number of high profile companies. The exploit code is a direct port of the public sample published to the...

Internet Explorer "Aurora" Memory Corruption

$Id: ms10002aurora.rb 8780 2010-03-11 05:49:45Z hdm $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

An Inside Look at the Aurora Scareware Tactic

Some of the malware families that were part of the Operation Aurora attacks that targeted dozens of major U.S. companies are being installed through fake antivirus and scareware attacks, researchers say. Researchers at Damballa, which did an in-depth report on the Aurora attacks, found that the...

Operation Aurora Still Out There

The targeted attacks that hit Google, Adobe, and other U.S. organizations are still ongoing and have affected many more companies than the original 20 to 30 or so reported by Google and others. One researcher believes they are close to naming the suspected coder. Read the full article. Dark Readi...

Tyler Shields on the BlackBerry Spyware and the Coming Wave of Smartphone Attacks

Dennis Fisher talks with Tyler Shields of Veracode about his BlackBerry spyware application, txsBBSPY, the coming wave of smartphone attacks and his lack of surprise about the Google Aurora attack. Podcast audio courtesy of sykboy65 Subscribe to the Digital Underground podcast on...

Paul Roberts on Google Aurora, Advanced Attacks and the RSA Conference

Dennis Fisher talks with Paul Roberts of the 451 Group about the implications of the Aurora attack on Google and Adobe, the need for better understanding of advanced threats and what to expect at the RSA Conference. Podcast audio courtesy of sykboy65 Subscribe to the Digital Underground podcast o...

Key Employees' Friends Were Facebook Targets in Aurora Attacks

A significant discovery in the recent Aurora attack that affected Google, Adobe, Yahoo and others is that the attackers had selected employees at the companies with access to proprietary data, then learnt who their friends were. The hackers compromised the social network accounts of those friends...

Trojan: Aurora.Hydraq (CVE-2010-0249)

The Hydraq Trojan also known as Aurora was being used in the recent attack against Google and other large companies. A then unpatched Internet Explorer vulnerability CVE-2010-0249 was used as one of the propagation vectors for this Trojan. The intent of the trojan is to open a back door on a...

Lessons Learned From the Aurora Attacks

It’s been more than two weeks now since the cyber-end of the cyber-world caused by the cyber-attacks on the cyber-networks of Google, Adobe and several other high tech companies, and amid all of the noise and hand-wringing there has been precious little in the way of cool, logical analysis of wha...

Aurora Attack Malware Components May Be Four Years Old

Although the first known attacks using the Aurora malware that compromised Google weren’t discovered until late last year, some parts of the malware codebase has been in existence in China for nearly four years, raising questions about how many other attacks it might have been used in during that...

Tips For Managing The IE Aurora Attack

Here are some steps Microsoft and other security firms recommend you can take now to help defend yourself against the IE Aurora attacks. Read the full article. Dark Reading...

Inside The Aurora (Google Attack) Malware

Security researchers are continuing to delve into the details of the malware that’s been used in the attacks against Google, Adobe and other large companies, and they’re finding a complex package of programs that use custom protocols and sophisticated infection techniques. The attacks, which are...

Microsoft Internet Explorer "Aurora" Memory Corruption

$Id: ieaurora.rb 8140 2010-01-16 01:00:01Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Microsoft Internet Explorer 6 - Aurora Memory Corruption (MS10-002)

Microsoft Internet Explorer 6 - Aurora Memory Corruption MS10-002 Author : Ahmed Obied [email protected] This program acts as a web server that generates an exploit to target a vulnerability CVE-2010-0249 in Internet Explorer. The exploit was tested using Internet Explorer 6 on Windows XP SP2...

Microsoft Internet Explorer 6 - 'Aurora' Memory Corruption (MS10-002)

Author : Ahmed Obied [email protected] This program acts as a web server that generates an exploit to target a vulnerability CVE-2010-0249 in Internet Explorer. The exploit was tested using Internet Explorer 6 on Windows XP SP2. The exploit's payload spawns the calculator. Usage : python...

Memory corruption

Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessin...

Immunity Canvas: AURORA_FLASH

Name| auroraflash ---|--- CVE| CVE-2010-0249 Exploit Pack| CANVAS Description| Aurora vulnerability with ActionScript JIT spraying for IE8 and Windows 7 Notes| CVE Name: CVE-2010-0249 VENDOR: Microsoft VersionsAffected: Repeatability: References: MS10-002 CVE Url: Date public: 01/21/2001 CVSS: 9....