Java-based Web attack installs backdoors on Windows, Linux, Mac computers

Security researchers identify Web-based malware attack that targets Windows, Linux and Mac OS X users alike

A new Web-based social engineering attack that relies on malicious Java applets attempts to install backdoors on Windows, Linux and Mac computers, according to security researchers from antivirus vendors F-Secure and Kaspersky Lab.

The attack was detected on a compromised website in Colombia, F-Secure senior analyst Karmina Aquino, said in a blog post on Monday. When users visit the site, they are prompted to run a Java applet that hasn't been signed by a trusted certificate authority.

If allowed to run, the applet checks which operating system is running on the user's computer -- Windows, Mac OS X or Linux -- and drops a malicious binary file for the corresponding platform.

The files are detected by F-Secure as "Backdoor:OSX/GetShell.A," "Backdoor:Linux/GetShell.A" and "Backdoor:W32/GetShell.A." Their purpose is to connect to a command-and-control server and look for additional malicious code to download and execute.

However, since F-Secure researchers began monitoring the attack, the remote control server hasn't pushed any additional code, Aquino said.

It appears that the attack uses the Social Engineer Toolkit (SET), a publicly available tool designed for penetration testers, Aquino said Tuesday via email. However, the chances of this being a penetration test sanctioned by the website's owner are relatively low.

"I don't think it's a penetration test," Costin Raiu, director of the global research and analysis team at antivirus vendor Kaspersky Lab, said Tuesday via email.

Kaspersky's researchers are monitoring two separate websites that contain this malware, Raiu said. One is the Colombian website also found by F-Secure, while the second belongs to a water park in Barcelona, Spain.

The presence of the malware on a second website in Spain indicates that this attack is not specific to Colombia or a particular entity, Raiu said.

Kaspersky's researchers are in the process of analyzing the backdoor-type malware downloaded by the malicious shell code on Windows and Linux.

"The Win32 backdoor is large, about 600KB; the Linux backdoor is over 1MB in size," Raiu said. "Both appear to contact very complex code which communicates encrypted with other servers."

This is not the first time that security researchers have discovered a multi-platform attack. In 2010, a similar Java-applet-based social engineering attack capable of executing malicious code on Windows, Mac OS X and Linux computers, was used to distribute the Boonana Trojan program.

"Such multiplatform attacks indicate the fact that Linux and Mac OS X are becoming interesting targets for cybercriminals," Raiu said.

Other malware authors might move to this type of attacks in the future because it allow them to target more users and distribute their creations more widely, Aquino said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?