Attacks/Breaches

1/16/2013
12:06 PM
50%
50%

Another Java Zero-Day Vulnerability Hits Black Market

Just 24 hours after Oracle patched two critical flaws in Java, online vulnerability vendor starts selling never-seen Java bug.

Call it malware cash and carry: Less than 24 hours after Oracle Sunday released a security update that addresses two critical zero-day vulnerabilities in Java that are being actively exploited by attackers, an online vulnerability seller began offering a brand-new Java bug for sale.

"On Monday, an administrator of an exclusive cybercrime forum posted a message saying he was selling a new Java 0day to a lucky two buyers. The cost: starting at $5,000 each," said security reporter Brian Krebs, who was the first to report the vulnerability sales offer.

What does a starting price of $5,000 buy? "The hacker forum admin's message ... promised weaponized and source code versions of the exploit. This seller also said his Java 0day -- in the latest version of Java (Java 7 Update 11) -- was not yet part of any exploit kits," said Krebs.

[ Does your business depend on Java? Here's how to stay secure. 10 Facts: Secure Java For Business Use. ]

But the new zero-day vulnerability was apparently already in at least one attacker's hands. "Code will be sold twice (it has been sold once already). It is not present in any known exploit pack including that very private version of [Blackhole] going for 10$k/month," read the notice, referring to the Cool Exploit Kit that was created by the developers of the Blackhole crimeware kit, which rents for $10,000 per month. "I will be accepting counter-bids if you wish to outbid the competition."

According to the sales notice, the zero-day vulnerability is ready to be used and includes support via personal message (PM) -- presumably via the hacking forum's chat system. "Simply modify the url in the php page that calls up the jar to your own executable url and you are set," read the hacker forum administrator's message. "You may pm me."

Krebs said on Wednesday that the hacking forum thread with the admin's zero-day vulnerability sales pitch has since been deleted, suggesting that the exploit has now been sold to a second buyer.

News that there's yet another zero-day Java vulnerability should lead businesses to ask whether running the Java browser plug-in, or using Java runtime environments to run enterprise applications, is worth the security risk.

Indeed, the two zero-day vulnerabilities spotted last week and patched on Sunday led the Department of Homeland security to warn that the Java browser plug-in should be avoided, if at all possible. If that's not feasible, security experts recommend locking down Java use to minimize the chance that a business will get exploited via some future zero-day vulnerability.

The slow speed with which Oracle patches Java vulnerabilities has also drawn criticism from security experts. Furthermore, some of Oracle's Java patching has been sloppy and has not fully addressed flaws being actively exploited by attackers. For example, while Oracle's Sunday patch fixed one of the two zero-day flaws being actively exploited in Java 7 by attackers, Oracle left the other flaw unpatched, though it used a change in security permissions to make the flaw more difficult for attackers to access.

The worry now is that attackers will be able to use a future zero-day vulnerability -- or perhaps the one that's now being offered for sale -- to access the vulnerability that was spotted last week and that remains unpatched. If exploited, that bug would enable an attacker to execute arbitrary code on a machine. As a result, the attacker could not only compromise the machine, but also steal any data on the device, and turn it into a node -- or zombie PC -- that's part of a larger, attacker-operated botnet.

In light of the vulnerability that wasn't fully addressed by Oracle's rush-patching job, "The message is clear: Java remains a big risk," said Trend Micro vulnerability research manager Pawan Kinger in a blog post.

Your employees are a critical part of your security program, particularly when it comes to the endpoint. Whether it's a PC, smartphone or tablet, your end users are on the front lines of phishing attempts and malware attacks. Read our Security: Get Users To Care report to find out how to keep your company safe. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
AnonDeGuerre
50%
50%
AnonDeGuerre,
User Rank: Apprentice
1/16/2013 | 8:02:47 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
delete
safetysw
50%
50%
safetysw,
User Rank: Apprentice
1/16/2013 | 8:26:43 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
Just another reason to never use Java for anything that needs to be safe and/or secure. Not enough thought and care is taken when designing code in any language and starting with a language that while extremely useful but is fundamentally flawed only makes matters worse!
Verdumont Monte
50%
50%
Verdumont Monte,
User Rank: Apprentice
1/16/2013 | 9:10:56 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
If WebEx and GoToMeeting didn't need Java, I wouldn't have installed in the first place.. I've found that you can install their client and that lets you to do away with Java.. Good bye Java.. I have enough to worry about..
Sinn
50%
50%
Sinn,
User Rank: Apprentice
1/19/2013 | 10:18:34 AM
re: Another Java Zero-Day Vulnerability Hits Black Market
So, not only will productivity be compromised, there will be no more playing of favorite games either, eh?
KeyWestDan
50%
50%
KeyWestDan,
User Rank: Apprentice
1/19/2013 | 7:35:45 PM
re: Another Java Zero-Day Vulnerability Hits Black Market
At least the price will keep the kiddies and most hackers away. You'd have to be a serious criminal (or a foreign government) to plunk down that kind of money to exploit some hole in java that is going to be fixed fairly promptly.
Printers: The Weak Link in Enterprise Security
Kelly Sheridan, Associate Editor, Dark Reading,  10/16/2017
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Why Security Leaders Can't Afford to Be Just 'Left-Brained'
Bill Bradley, SVP, Cyber Engineering and Technical Services, CenturyLink,  10/17/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.