Researchers warn of new Java exploit being used by attackers

The new exploit affects the latest versions of Java 7 and Java 6, FireEye researchers warn

 A new exploit for a previously unknown and unpatched Java vulnerability is being actively used by attackers to infect computers with malware, according to researchers from security firm FireEye.

"We observed successful exploitation against browsers that have Java v1.6 Update 41 and Java v1.7 Update 15 installed," FireEye researchers Darien Kindlund and Yichong Lin said Thursday in a blog post.

In the attacks analyzed by FireEye, the exploit is being used to download and install a remote access tool (RAT) called McRAT. This type of malware is frequently used in targeted attacks, but FireEye did not disclose any information about who is being targeted.

A screen shot of the exploit's traffic published by the company reveals that the malware is being downloaded from a Japanese website as a .jpg file, although the extension is probably fake and used as a diversion.

The new exploit is not very reliable because it tries to overwrite a big chunk of memory in order to disable Java security protections, the FireEye researchers said. Because of this, in some cases the exploit successfully downloads the malware, but fails to execute it and results in a Java Virtual Machine (JVM) crash.

Security researchers from antivirus vendor Kaspersky Lab confirmed Friday that the exploit works against Java 7 Update 15, which is the most recent version of Java, but said that it fails on older versions, like Java 7 Update 10. The attack appears to be a targeted one, said Costin Raiu, director of Kaspersky's global research and analysis team, but he had no additional information to share.

News of this zero-day -- previously unknown -- Java exploit comes days after researchers from Polish vulnerability research firm Security Explorations found and reported two new Java vulnerabilities to Oracle.

The exploit reported by FireEye seems to target a memory corruption vulnerability that's different from what Security Explorations found, Adam Gowdiak, the founder of Security Explorations, said Friday via email.

"We try to avoid [researching] memory corruption vulnerabilities in Java as they are not that powerful as pure Java level bugs," Gowdiak said. Only one of the 55 Java security issues reported by Security Explorations to Oracle in the past year was a memory corruption vulnerability, he said.

Gowdiak believes that the recent security breaches at Twitter, Facebook, Apple and Microsoft that resulted from an attack using a different Java zero-day exploit, might have triggered additional interest in Java bugs from attackers.

"We have notified Oracle and will continue to work with Oracle on this in-the-wild discovery," the FireEye researchers said. "Since this exploit affects the latest Java 6u41 and Java 7u15 versions, we urge users to disable Java in your browser until a patch has been released; alternatively, set your Java security settings to 'High' and do not execute any unknown Java applets outside of your organization."

Oracle did not immediately respond to a request for comment regarding its patching plans for this vulnerability.

This is the third time this year attackers have used zero-day Java exploits. The increased frequency of attacks has forced Oracle to reduce the time between scheduled Java patches from four months to two months and set the security controls for Java applets in browsers to "High" by default.

Following the Java-based attacks on Twitter, Facebook, Apple and Microsoft engineers that were launched from a compromised community forum for iOS developers, Oracle broke out of its patching cycle to release an emergency security update on Feb. 1.

The company followed that up with another patch on Feb. 19. The next security updates for Java are scheduled for April 16, but it's possible that Oracle will be forced to release an emergency patch again in order to fix this actively exploited vulnerability.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Security ExplorationssecurityFireEyeOraclekaspersky lab

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?