Elderwood and the Department of Labor Hack

Summary: The Department of Labor and several other websites were compromised to host a zero-day exploit for Internet Explorer 8 (CVE-2013-1347), and researchers noted similarities to earlier attacks attributed to the Elderwood kit. Trail of Bits said it found no evidence for that attribution, citing fundamental differences from the Elderwood kit and identifying JavaScript functions in both exploits that were copied nearly verbatim from publicly available code, including cookie tracking code from the JavaScript Application Cookbook.
What's compelling: The attribution to Elderwood, a toolset developed by or for the Aurora APT group, rested on resemblance rather than evidence, and some of that resemblance traced back to shared public code any attacker could copy. A security leader reading the attribution should weigh how much of a threat assessment rests on reused code versus actual tooling.

Read the original at Trail of Bits Blog ↗

Mentions: CVE-2013-1347
Related: CVE-2013-1347: Microsoft Internet Explorer Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022
Microsoft Update Tuesday: Update for IE8 0-day and More Cyber Risks ·
Continued analysis of the Lights Out Exploit Kit Cyber Risks ·