Researchers warn of new Java exploit being used by attackers

The new exploit affects the latest versions of Java 7 and Java 6, FireEye researchers warn

 A new exploit for a previously unknown and unpatched Java vulnerability is being actively used by attackers to infect computers with malware, according to researchers from security firm FireEye.

"We observed successful exploitation against browsers that have Java v1.6 Update 41 and Java v1.7 Update 15 installed," FireEye researchers Darien Kindlund and Yichong Lin said Thursday in a blog post.

In the attacks analyzed by FireEye, the exploit is being used to download and install a remote access tool (RAT) called McRAT. This type of malware is frequently used in targeted attacks, but FireEye did not disclose any information about who is being targeted.

A screen shot of the exploit's traffic published by the company reveals that the malware is being downloaded from a Japanese website as a .jpg file, although the extension is probably fake and used as a diversion.

The new exploit is not very reliable because it tries to overwrite a big chunk of memory in order to disable Java security protections, the FireEye researchers said. Because of this, in some cases the exploit successfully downloads the malware, but fails to execute it and results in a Java Virtual Machine (JVM) crash.

Security researchers from antivirus vendor Kaspersky Lab confirmed Friday that the exploit works against Java 7 Update 15, which is the most recent version of Java, but said that it fails on older versions, like Java 7 Update 10. The attack appears to be a targeted one, said Costin Raiu, director of Kaspersky's global research and analysis team, but he had no additional information to share.

News of this zero-day -- previously unknown -- Java exploit comes days after researchers from Polish vulnerability research firm Security Explorations found and reported two new Java vulnerabilities to Oracle.

The exploit reported by FireEye seems to target a memory corruption vulnerability that's different from what Security Explorations found, Adam Gowdiak, the founder of Security Explorations, said Friday via email.

"We try to avoid [researching] memory corruption vulnerabilities in Java as they are not that powerful as pure Java level bugs," Gowdiak said. Only one of the 55 Java security issues reported by Security Explorations to Oracle in the past year was a memory corruption vulnerability, he said.

Gowdiak believes that the recent security breaches at Twitter, Facebook, Apple and Microsoft that resulted from an attack using a different Java zero-day exploit, might have triggered additional interest in Java bugs from attackers.

"We have notified Oracle and will continue to work with Oracle on this in-the-wild discovery," the FireEye researchers said. "Since this exploit affects the latest Java 6u41 and Java 7u15 versions, we urge users to disable Java in your browser until a patch has been released; alternatively, set your Java security settings to 'High' and do not execute any unknown Java applets outside of your organization."

Oracle did not immediately respond to a request for comment regarding its patching plans for this vulnerability.

This is the third time this year attackers have used zero-day Java exploits. The increased frequency of attacks has forced Oracle to reduce the time between scheduled Java patches from four months to two months and set the security controls for Java applets in browsers to "High" by default.

Following the Java-based attacks on Twitter, Facebook, Apple and Microsoft engineers that were launched from a compromised community forum for iOS developers, Oracle broke out of its patching cycle to release an emergency security update on Feb. 1.

The company followed that up with another patch on Feb. 19. The next security updates for Java are scheduled for April 16, but it's possible that Oracle will be forced to release an emergency patch again in order to fix this actively exploited vulnerability.

Join the PC World newsletter!

Error: Please check your email address.

Tags Security ExplorationssecurityFireEyeOraclekaspersky lab

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?