SabPub Mac OS X Backdoor: Java Exploits, Targeted Attacks and Possible APT link
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2012-0507 | Type Confusion RCE in Oracle Java SE Concurrency Component CVE-2012-0507 is an 'incorrect type' (type-confusion) vulnerability in the Concurrency component of Oracle's Java Runtime Environment that corrupts memory when crafted Java content is processed. It is triggered by running malicious Java content — classically via the browser Java plugin or an exploited Java application — allowing an attacker to execute arbitrary code with the privileges of the Java process. Anyone running an affected Oracle Java SE installation is exposed, which historically included the vast majority of desktops and many servers, with 2012-era campaigns hitting Mac users via Java exploits (e.g., the SabPub backdoor) and drive-by exploit kits. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03) with known ransomware use, and EPSS assigns a 98.1% probability of exploitation within 30 days (100th percentile). CVSS has not been scored in the source data, but the combined KEV/EPSS signal marks this as actively and widely exploited. Do: Apply Oracle's Java SE updates per CISA's required action — Oracle shipped the fix in its February 2012 Critical Patch Update, so any current, fully patched Java release clears the flaw; verify no legacy unpatched Java builds (including Apple-delivered Java on macOS, given the 2012 OS X exploitation campaigns) remain on endpoints. Remove or disable the Java browser plugin where it is not required, and restrict execution of untrusted applets and Java Web Start content. | — | 98% | KEV ransomware |
| mass≈1 billion+ Java installations worldwide (desktop/server JRE and browser plugin deployments) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | onedumb.com | t, CA. Encoded C&C address (“hostname_en”) in the backdoor “Onedumb.com” is a free dynamic DNS service. Interesting, the C&C at IP |
Full article509 words · extracted from securelist.com · click to collapse
Last week, Apple released two urgent updates to Mac OS X to:
1. Remove the Flashback malware about which we have already written
2. Automatically deactivate the Java browser plugin and Java Web Start, effectively disabling java applets in browsers
Particularly, the second step shows the severity of the CVE-2012-0507 vulnerability exploited by Flashback to infect almost 700,000 users via drive-by malware downloads.
Actually, it was the right decision because we can confirm yet another Mac malware in the wild – Backdoor.OSX.SabPub.a being spread through Java exploits.
This new threat is a custom OS X backdoor, which appears to have been designed for use in targeted attacks. After it is activated on an infected system, it connects to a remote website in typical C&C fashion to fetch instructions. The backdoor contains functionality to make screenshots of the user’s current session and execute commands on the infected machine.
Backdoor connects to remote server to fetch work
The remote C&C website – rt***.onedumb.com is hosted on a VPS located in the U.S, Fremont, CA.
Encoded C&C address (“hostname_en”) in the backdoor
“Onedumb.com” is a free dynamic DNS service. Interesting, the C&C at IP 199.192.152.* was used in other targeted attacks (known as “Luckycat”) in the past.
If we are to believe the timestamps from the Java dropper, it was created on March 16, 2012 – so almost one month ago! The dropper Java class appears to have been sent to the ThreatExpert website on April 12th.
We detect the Java exploit used in the dropper as Exploit.Java.CVE-2012-0507.bf.
One of the components of the dropper, was also sent to the multi-scanner website “VirusTotal” on April 2nd. Ever since, it was sent another time – in both cases, from China.
The Java exploits appear to be pretty standard, however, they have been obfuscated using ZelixKlassMaster, a flexible and quite powerful Java obfuscator. This was obviously done in order to avoid detection from anti-malware products.
At the moment, it is not clear how users get infected with this, but the low number and it’s backdoor functionality indicates that it is most likely used in targeted attacks. Several reports exist which suggest the attack was launched through e-mails containing an URL pointing to two websites hosting the exploit, located in US and Germany.
The timing of the discovery of this backdoor is interesting because in March, several reports pointed to Pro-Tibetan targeted attacks against Mac OS X users. The malware does not appear to be similar to the one used in these attacks, though it is possible that it was part of the same or other similar campaigns.
One other important detail is that the backdoor has been compiled with debug information – which makes its analysis quite easy. This can be an indicator that it is still under development and it is not the final version.
We are continuing our research into this malware and will post updates as necessary.
In the meantime, you may want to check this article for 10 simple steps to boost the security of your Mac.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/sabpub-mac-os-x-backdoor-java-exploits-targeted-attacks-and-possible-apt-link-23/33183/