Attacks/Breaches
1/16/2013
12:06 PM
50%
50%

Another Java Zero-Day Vulnerability Hits Black Market

Just 24 hours after Oracle patched two critical flaws in Java, online vulnerability vendor starts selling never-seen Java bug.

Call it malware cash and carry: Less than 24 hours after Oracle Sunday released a security update that addresses two critical zero-day vulnerabilities in Java that are being actively exploited by attackers, an online vulnerability seller began offering a brand-new Java bug for sale.

"On Monday, an administrator of an exclusive cybercrime forum posted a message saying he was selling a new Java 0day to a lucky two buyers. The cost: starting at $5,000 each," said security reporter Brian Krebs, who was the first to report the vulnerability sales offer.

What does a starting price of $5,000 buy? "The hacker forum admin's message ... promised weaponized and source code versions of the exploit. This seller also said his Java 0day -- in the latest version of Java (Java 7 Update 11) -- was not yet part of any exploit kits," said Krebs.

[ Does your business depend on Java? Here's how to stay secure. 10 Facts: Secure Java For Business Use. ]

But the new zero-day vulnerability was apparently already in at least one attacker's hands. "Code will be sold twice (it has been sold once already). It is not present in any known exploit pack including that very private version of [Blackhole] going for 10$k/month," read the notice, referring to the Cool Exploit Kit that was created by the developers of the Blackhole crimeware kit, which rents for $10,000 per month. "I will be accepting counter-bids if you wish to outbid the competition."

According to the sales notice, the zero-day vulnerability is ready to be used and includes support via personal message (PM) -- presumably via the hacking forum's chat system. "Simply modify the url in the php page that calls up the jar to your own executable url and you are set," read the hacker forum administrator's message. "You may pm me."

Krebs said on Wednesday that the hacking forum thread with the admin's zero-day vulnerability sales pitch has since been deleted, suggesting that the exploit has now been sold to a second buyer.

News that there's yet another zero-day Java vulnerability should lead businesses to ask whether running the Java browser plug-in, or using Java runtime environments to run enterprise applications, is worth the security risk.

Indeed, the two zero-day vulnerabilities spotted last week and patched on Sunday led the Department of Homeland security to warn that the Java browser plug-in should be avoided, if at all possible. If that's not feasible, security experts recommend locking down Java use to minimize the chance that a business will get exploited via some future zero-day vulnerability.

The slow speed with which Oracle patches Java vulnerabilities has also drawn criticism from security experts. Furthermore, some of Oracle's Java patching has been sloppy and has not fully addressed flaws being actively exploited by attackers. For example, while Oracle's Sunday patch fixed one of the two zero-day flaws being actively exploited in Java 7 by attackers, Oracle left the other flaw unpatched, though it used a change in security permissions to make the flaw more difficult for attackers to access.

The worry now is that attackers will be able to use a future zero-day vulnerability -- or perhaps the one that's now being offered for sale -- to access the vulnerability that was spotted last week and that remains unpatched. If exploited, that bug would enable an attacker to execute arbitrary code on a machine. As a result, the attacker could not only compromise the machine, but also steal any data on the device, and turn it into a node -- or zombie PC -- that's part of a larger, attacker-operated botnet.

In light of the vulnerability that wasn't fully addressed by Oracle's rush-patching job, "The message is clear: Java remains a big risk," said Trend Micro vulnerability research manager Pawan Kinger in a blog post.

Your employees are a critical part of your security program, particularly when it comes to the endpoint. Whether it's a PC, smartphone or tablet, your end users are on the front lines of phishing attempts and malware attacks. Read our Security: Get Users To Care report to find out how to keep your company safe. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
KeyWestDan
50%
50%
KeyWestDan,
User Rank: Apprentice
1/19/2013 | 7:35:45 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
At least the price will keep the kiddies and most hackers away. You'd have to be a serious criminal (or a foreign government) to plunk down that kind of money to exploit some hole in java that is going to be fixed fairly promptly.
Sinn
50%
50%
Sinn,
User Rank: Apprentice
1/19/2013 | 10:18:34 AM
re: Another Java Zero-Day Vulnerability Hits Black Market
So, not only will productivity be compromised, there will be no more playing of favorite games either, eh?
Verdumont Monte
50%
50%
Verdumont Monte,
User Rank: Apprentice
1/16/2013 | 9:10:56 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
If WebEx and GoToMeeting didn't need Java, I wouldn't have installed in the first place.. I've found that you can install their client and that lets you to do away with Java.. Good bye Java.. I have enough to worry about..
safetysw
50%
50%
safetysw,
User Rank: Apprentice
1/16/2013 | 8:26:43 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
Just another reason to never use Java for anything that needs to be safe and/or secure. Not enough thought and care is taken when designing code in any language and starting with a language that while extremely useful but is fundamentally flawed only makes matters worse!
AnonDeGuerre
50%
50%
AnonDeGuerre,
User Rank: Apprentice
1/16/2013 | 8:02:47 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
delete
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.