[OT] New Java Based Malware

[ImAMacGuy]

Source: http://arstechnica.com/security/2014/01/java-based-malware-driving-ddos-botnet-infects-windows-mac-l...

Researchers have uncovered a piece of botnet malware that is capable of infecting computers running Windows, Mac OS X, and Linux that have Oracle's Java software framework installed.

The cross-platform HEUR:Backdoor.Java.Agent.a, as reported in a blog post published Tuesday by Kaspersky Lab, takes hold of computers by exploiting CVE-2013-2465, a critical Java vulnerability that Oracle patched in June. The security bug is present on Java 7 u21 and earlier. Once the bot has infected a computer, it copies itself to the autostart directory of its respective platform to ensure it runs whenever the machine is turned on. Compromised computers then report to an Internet relay chat channel that acts as a command and control server.

The botnet is designed to conduct distributed denial-of-service attacks on targets of the attackers' choice. Commands issued in the IRC channel allow the attackers to specify the IP address, port number, intensity, and duration of attacks. The malware is written entirely in Java, allowing it to run on Windows OS X and Linux machines. For added flexibility, the bot incorporates PircBot, an IRC programming interface based on Java.

The malware also uses the Zelix Klassmaster obfuscator to prevent it from being reverse engineered by whitehat and competing blackhat hackers. Besides obfuscating bytecode, Zelix encrypts some of the inner workings of the malware.

[mm2270]

Thanks, but, Java7u21? That's like ancient history. If anyone out there is still using that version of Java then its their own fault if they get compromised.

[damienbarrett]

However, by inference then, the bundled version of Java6 that Apple provides is vulnerable too, right? No?

[mm2270]

I'm not certain about that, but the article only mentions the flaw being in Oracle's Java 7. No mention of Java 6. Given how the media just loves to jump on anything negative around Apple I'd say if Apple's Java was vulnerable too it would have been mentioned, no?

[ImAMacGuy]

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

within the Ars link is the CVE link - which lists as updated Jan 8th 2014, but originally found June '13.