Researchers warn of new Java exploit being used by attackers

The new exploit affects the latest versions of Java 7 and Java 6, FireEye researchers warn

 A new exploit for a previously unknown and unpatched Java vulnerability is being actively used by attackers to infect computers with malware, according to researchers from security firm FireEye.

"We observed successful exploitation against browsers that have Java v1.6 Update 41 and Java v1.7 Update 15 installed," FireEye researchers Darien Kindlund and Yichong Lin said Thursday in a blog post.

In the attacks analyzed by FireEye, the exploit is being used to download and install a remote access tool (RAT) called McRAT. This type of malware is frequently used in targeted attacks, but FireEye did not disclose any information about who is being targeted.

A screen shot of the exploit's traffic published by the company reveals that the malware is being downloaded from a Japanese website as a .jpg file, although the extension is probably fake and used as a diversion.

The new exploit is not very reliable because it tries to overwrite a big chunk of memory in order to disable Java security protections, the FireEye researchers said. Because of this, in some cases the exploit successfully downloads the malware, but fails to execute it and results in a Java Virtual Machine (JVM) crash.

Security researchers from antivirus vendor Kaspersky Lab confirmed Friday that the exploit works against Java 7 Update 15, which is the most recent version of Java, but said that it fails on older versions, like Java 7 Update 10. The attack appears to be a targeted one, said Costin Raiu, director of Kaspersky's global research and analysis team, but he had no additional information to share.

News of this zero-day -- previously unknown -- Java exploit comes days after researchers from Polish vulnerability research firm Security Explorations found and reported two new Java vulnerabilities to Oracle.

The exploit reported by FireEye seems to target a memory corruption vulnerability that's different from what Security Explorations found, Adam Gowdiak, the founder of Security Explorations, said Friday via email.

"We try to avoid [researching] memory corruption vulnerabilities in Java as they are not that powerful as pure Java level bugs," Gowdiak said. Only one of the 55 Java security issues reported by Security Explorations to Oracle in the past year was a memory corruption vulnerability, he said.

Gowdiak believes that the recent security breaches at Twitter, Facebook, Apple and Microsoft that resulted from an attack using a different Java zero-day exploit, might have triggered additional interest in Java bugs from attackers.

"We have notified Oracle and will continue to work with Oracle on this in-the-wild discovery," the FireEye researchers said. "Since this exploit affects the latest Java 6u41 and Java 7u15 versions, we urge users to disable Java in your browser until a patch has been released; alternatively, set your Java security settings to 'High' and do not execute any unknown Java applets outside of your organization."

Oracle did not immediately respond to a request for comment regarding its patching plans for this vulnerability.

This is the third time this year attackers have used zero-day Java exploits. The increased frequency of attacks has forced Oracle to reduce the time between scheduled Java patches from four months to two months and set the security controls for Java applets in browsers to "High" by default.

Following the Java-based attacks on Twitter, Facebook, Apple and Microsoft engineers that were launched from a compromised community forum for iOS developers, Oracle broke out of its patching cycle to release an emergency security update on Feb. 1.

The company followed that up with another patch on Feb. 19. The next security updates for Java are scheduled for April 16, but it's possible that Oracle will be forced to release an emergency patch again in order to fix this actively exploited vulnerability.

Join the PC World newsletter!

Error: Please check your email address.

Tags securitySecurity ExplorationsFireEyekaspersky labOracle

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?