Attacks/Breaches
1/16/2013
12:06 PM
Connect Directly
RSS
E-Mail
50%
50%

Another Java Zero-Day Vulnerability Hits Black Market

Just 24 hours after Oracle patched two critical flaws in Java, online vulnerability vendor starts selling never-seen Java bug.

Call it malware cash and carry: Less than 24 hours after Oracle Sunday released a security update that addresses two critical zero-day vulnerabilities in Java that are being actively exploited by attackers, an online vulnerability seller began offering a brand-new Java bug for sale.

"On Monday, an administrator of an exclusive cybercrime forum posted a message saying he was selling a new Java 0day to a lucky two buyers. The cost: starting at $5,000 each," said security reporter Brian Krebs, who was the first to report the vulnerability sales offer.

What does a starting price of $5,000 buy? "The hacker forum admin's message ... promised weaponized and source code versions of the exploit. This seller also said his Java 0day -- in the latest version of Java (Java 7 Update 11) -- was not yet part of any exploit kits," said Krebs.

[ Does your business depend on Java? Here's how to stay secure. 10 Facts: Secure Java For Business Use. ]

But the new zero-day vulnerability was apparently already in at least one attacker's hands. "Code will be sold twice (it has been sold once already). It is not present in any known exploit pack including that very private version of [Blackhole] going for 10$k/month," read the notice, referring to the Cool Exploit Kit that was created by the developers of the Blackhole crimeware kit, which rents for $10,000 per month. "I will be accepting counter-bids if you wish to outbid the competition."

According to the sales notice, the zero-day vulnerability is ready to be used and includes support via personal message (PM) -- presumably via the hacking forum's chat system. "Simply modify the url in the php page that calls up the jar to your own executable url and you are set," read the hacker forum administrator's message. "You may pm me."

Krebs said on Wednesday that the hacking forum thread with the admin's zero-day vulnerability sales pitch has since been deleted, suggesting that the exploit has now been sold to a second buyer.

News that there's yet another zero-day Java vulnerability should lead businesses to ask whether running the Java browser plug-in, or using Java runtime environments to run enterprise applications, is worth the security risk.

Indeed, the two zero-day vulnerabilities spotted last week and patched on Sunday led the Department of Homeland security to warn that the Java browser plug-in should be avoided, if at all possible. If that's not feasible, security experts recommend locking down Java use to minimize the chance that a business will get exploited via some future zero-day vulnerability.

The slow speed with which Oracle patches Java vulnerabilities has also drawn criticism from security experts. Furthermore, some of Oracle's Java patching has been sloppy and has not fully addressed flaws being actively exploited by attackers. For example, while Oracle's Sunday patch fixed one of the two zero-day flaws being actively exploited in Java 7 by attackers, Oracle left the other flaw unpatched, though it used a change in security permissions to make the flaw more difficult for attackers to access.

The worry now is that attackers will be able to use a future zero-day vulnerability -- or perhaps the one that's now being offered for sale -- to access the vulnerability that was spotted last week and that remains unpatched. If exploited, that bug would enable an attacker to execute arbitrary code on a machine. As a result, the attacker could not only compromise the machine, but also steal any data on the device, and turn it into a node -- or zombie PC -- that's part of a larger, attacker-operated botnet.

In light of the vulnerability that wasn't fully addressed by Oracle's rush-patching job, "The message is clear: Java remains a big risk," said Trend Micro vulnerability research manager Pawan Kinger in a blog post.

Your employees are a critical part of your security program, particularly when it comes to the endpoint. Whether it's a PC, smartphone or tablet, your end users are on the front lines of phishing attempts and malware attacks. Read our Security: Get Users To Care report to find out how to keep your company safe. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
KeyWestDan
50%
50%
KeyWestDan,
User Rank: Apprentice
1/19/2013 | 7:35:45 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
At least the price will keep the kiddies and most hackers away. You'd have to be a serious criminal (or a foreign government) to plunk down that kind of money to exploit some hole in java that is going to be fixed fairly promptly.
Sinn
50%
50%
Sinn,
User Rank: Apprentice
1/19/2013 | 10:18:34 AM
re: Another Java Zero-Day Vulnerability Hits Black Market
So, not only will productivity be compromised, there will be no more playing of favorite games either, eh?
Verdumont Monte
50%
50%
Verdumont Monte,
User Rank: Apprentice
1/16/2013 | 9:10:56 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
If WebEx and GoToMeeting didn't need Java, I wouldn't have installed in the first place.. I've found that you can install their client and that lets you to do away with Java.. Good bye Java.. I have enough to worry about..
safetysw
50%
50%
safetysw,
User Rank: Apprentice
1/16/2013 | 8:26:43 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
Just another reason to never use Java for anything that needs to be safe and/or secure. Not enough thought and care is taken when designing code in any language and starting with a language that while extremely useful but is fundamentally flawed only makes matters worse!
AnonDeGuerre
50%
50%
AnonDeGuerre,
User Rank: Apprentice
1/16/2013 | 8:02:47 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
delete
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7052
Published: 2014-10-19
The sahab-alkher.com (aka com.tapatalk.sahabalkhercomvb) application 2.4.9.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-7056
Published: 2014-10-19
The Yeast Infection (aka com.wyeastinfectionapp) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-7070
Published: 2014-10-19
The Air War Hero (aka com.dev.airwar) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-7075
Published: 2014-10-19
The HAPPY (aka com.tw.knowhowdesign.sinfonghuei) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-7079
Published: 2014-10-19
The Romeo and Juliet (aka jp.co.cybird.appli.android.rjs) application 1.0.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.