Java Malware Reconsidered, or, Java Brews a Fresh Bot of Malware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2010-0840 | Unspecified Remote Vulnerability in Oracle Java Runtime Environment (JRE) CVE-2010-0840 is an unspecified vulnerability in the Java Runtime Environment (JRE) component of Oracle Java SE that allows remote attackers to affect confidentiality, integrity, and availability through vectors Oracle did not publicly detail. Because the advisory withheld technical specifics, the exact trigger is undocumented, but the flaw is remotely exploitable, and the era's threat reporting (2011 exploit-kit and Java malware headlines) is consistent with drive-by exploitation of Java clients. A successful attacker gains the ability to compromise the confidentiality, integrity, or availability of the affected system, and Java flaws of this period were commonly leveraged to install malware such as bots. Any organization or end user running the affected JRE releases — whether the browser Java plug-in on desktops or server-side Java — is exposed, making the affected population extremely broad. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-05-25), EPSS assigns it a 96.3% probability of exploitation in the next 30 days, and no public proof-of-concept is known. Do: Apply the Oracle Java SE updates specified by the vendor as required by CISA's KEV listing, and remove or disable obsolete or unsupported JRE versions, especially the browser Java plug-in where it is no longer needed. Prioritize internet-exposed and end-user systems, check for lingering legacy Java applets in use, and note that remediation is mandatory for federal agencies under the KEV program. | — | 96% | KEV |
| masshundreds of millions of JRE installations across desktops and servers |
Full article437 words · extracted from securelist.com · click to collapse
At Virus Bulletin 2011, we presented on the exploding level of delivered Java exploits this year with “Firing the roast – Java is heating up again”. We examined CVE-2010-0840 exploitation in detail, along with variants of its most common implementation on the web and some tools and tips for analysis. Microsoft’s security team presented findings for 2011 that mirrored ours in relation to Java exploit prevalence on the web – it is #1! At the same time, aside from the recent, well-known BEAST Java implementation, it is striking that it has been very uncommon to see Java backdoors, Trojans and spyware. But that lack of Java malware variety is beginning to change. My colleague, malware analyst Roman Unucheck, identified a new Java bot with some interesting characteristics that we named “Backdoor.Java.Racac”.
Our “Backdoor.Java.Racac” detection is delivered to the field, but no one shows a detection on Virustotal at this point (another upload wouuld remedy that). What makes this fresh Java sample interesting is its contemporary functionality set:
- Mobile Twitter Communications
- Effective encryption implementation – algorithms include private and public key use, cipher block chaining
- Exhaustive list of DDoS capabilities – HTTP Flooder, UDP Flooders, Raw Socket Flooder along with exhaustive SOCKS proxy capabilities to hide the true source of the bot infection
- Geolocation tracking and reporting
- Download and execute arbitrary code
- Ability to identify automated analysis tools and kill itself to delay family detection
- Proper AWT implementation of cross platform screenshotting
- Full cross platform portability – runs on Windows, Linux, Apple OS X
- Etc
This object oriented code is well developed and its style clear. The jar file itself is only 131 kb, which makes this java bot a size comparable to other common bots and RATs infecting victim systems. With samples like these, we can expect to see more java malware than the usual list of Java exploits that we’ve seen in 2011. We will be posting soon with more, unusual, and recent Java malware.
Latest Webinars
Reports
Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.
Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.
Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.
Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/java-malware-reconsidered-or-java-brews-a-fresh-bot-of-malware/31505/