Java exploit used in Red October cyberespionage attacks, researchers say

Seculert researchers identified a Java exploit and corresponding attack pages on Red October command and control servers

The hundreds of government, military and research organizations targeted in a large-scale cyberespionage operation dubbed Red October were not only attacked using malicious Excel and Word documents as previously believed, but also by using Web-based Java exploits, according to researchers from Israeli IT security firm Seculert.

Researchers from antivirus vendors Kaspersky Lab published the results of their investigation into Red October on Monday. According to their report, the victims were targeted via rogue email messages that contained malicious documents designed to exploit known vulnerabilities in Microsoft Excel and Word.

Costin Raiu, director of Kaspersky's global research and analysis team, said Monday that other methods of distributing the cyberespionage malware might have been used, but hadn't been identified yet.

However, while analyzing the command and control servers used in the campaign, security researchers from Seculert discovered a special folder containing a malicious Java applet -- Web-based Java application -- designed to exploit a Java vulnerability patched in October 2011.

The exploit found on the server was compiled in Feb. 2012, which reinforces the belief that these attackers preferred to target older, known vulnerabilities, not zero-day -- previously unknown -- ones, the Seculert researchers said Tuesday in a blog post.

The discovery was made possible because at some point the attackers switched from using PHP as the server-side scripting language on their command and control servers to CGI. Some older PHP-based attack pages were still left on the servers and accessing them in a browser revealed their source code, the Seculert researchers said.

Evidence suggests that the Web-based attack method continued to be used even after switching the infrastructure to CGI, Aviv Raff, Seculert's chief technology officer, said Tuesday. However, it's not clear if exploits for newer vulnerabilities in Java or other browser plug-ins have been used in the past few months, he said.

Further analysis is impossible at this time because the command and control servers have been shut down, most likely by the attackers in an attempt to cover their tracks, Raff said.

The attackers tricked individuals in the targeted organizations into visiting the attack pages by sending them rogue emails with links pointing to them, the Seculert researchers said. It's not clear what those emails said, because no copy has been recovered yet, but they probably had a news-based theme, Raff said.

The attack pages, the Java exploit itself and even the URL for the malware payload contained strings referencing "news," Raff said. In fact, after the attack page loaded the Java exploit, the victims' browsers were being redirected to legitimate news sites, including one based in Turkey, he said.

Interestingly enough, command and control servers used in the Flame cyberespionage campaign also contained a "NewsForYou" string, suggesting that a news theme was used in those attacks. It's not clear at this time if this is just a coincidence or if there's a connection between the two campaigns, Raff said.

Raff believes that Red October is the work of a group of hackers trying to obtain high-value information which they can later sell to interested parties, rather than the result of a nation state's cyberespionage efforts. Researchers from Kaspersky Lab, who first uncovered this cyberespionage operation, favor the same theory.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Topics: intrusion, online safety, security, spyware, Exploits / vulnerabilities, Seculert, kaspersky lab, malware
Comments are now closed.

Latest News Articles

Most Popular Articles

Follow Us

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Resources

Best Deals on GoodGearGuide

Compare & Save

Deals powered by WhistleOut
Use WhistleOut's technology to compare:
Mobile phone plans & deals
Mobile phone models
Mobile phone carriers
Broadband plans & deals
Broadband providers
Deals powered by WhistleOut
WhistleOut

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?