Attacks/Breaches
1/24/2013
11:31 AM
Connect Directly
RSS
E-Mail
50%
50%

China Accused Of Java, IE Zero Day Attacks

Human rights groups have been victims of "watering hole" attacks using recently discovered -- and patched -- flaws in Java and Internet Explorer, security researcher says.

Recently disclosed vulnerabilities in Java and Internet Explorer have been used in targeted attacks that appear to be aimed at critics of the Chinese government.

Tuesday, Jindrich Kubec, director of threat intelligence for Prague-based antivirus software developer Avast, reported that multiple websites had been compromised by attackers and used to infect visitors via JavaScript drive-by attacks. If successful, the attacks infected PCs with a remote access Trojan (RAT), thus giving attackers direct access to the system, including all stored data.

"Watering hole attacks still continue -- now spotted only on human rights sites -- another [Tibetan] one, HK, chinese, and ... wait for it ... RSF!" said Kubec via Twitter, referring to Paris-based Reporters Sans Frontieres (RSF) -- also known as Reporters Without Borders -- which is a nongovernmental organization which campaigns for freedom of information, as well as press freedoms.

The attacks are part of a campaign that uses so-called "watering hole attacks," which refers to attackers compromising a website and using it to serve malicious code, in advance of their desired target visiting the site. The watering-hole technique has been used in numerous attacks, including exploits of Google committed by the so-called Aurora gang.

In the case of the RSF website attack, Kubec said in a blog post that an infection was first spotted Monday, "then it vanished, but it's back there, which [suggests] attackers have full access to their site," he said. "We've contacted the RSF webmaster and the code should be already removed."

[ Java security warnings raise more questions. Get the facts; read Java Security Warnings: Cut Through The Confusion. ]

According to a blog post from Kubec co-written with independent security researcher Eric Romang, the group behind the RSF watering hole attack last week also targeted "multiple high value websites, including as [an] example, major Hong Kong political parties."

The attacks attempt to exploit a recently discovered IE8 bug (CVE-2012-4792), which was patched by Microsoft this month, as well as one of the two Java vulnerabilities (CVE-2013-0422) spotted earlier this month and recently patched by Oracle with the release of Java 7 Update 11.

The recent watering hole attacks also include an exploit for a Java 6 vulnerability (CVE-2011-3544) patched by Oracle in October 2011. That vulnerability has since been used in numerous attacks, for example against Amnesty International websites in Britain and Hong Kong. The fact that attackers are including exploits for long-patched updates highlights the slow speed with which many people update their systems. "[Attackers] act as opportunists and try to take advantage from the time frame between the patch release and the patch application of some users, companies and non-governmental organizations," said Kubec.

Symantec had previously reported seeing the IE8 bug used in watering hole attacks that seemed to have been launched by the Elderwood group, which operates from China.

Kubec suggested the recent attack against the RSF website -- among other sites -- was likewise launched by China. "Such an organization is an ideal target for a watering hole campaign, as it seems right now the miscreants concentrate only on human rights/political sites -- many Tibetan, some Uygur and some political parties in Hong Kong and Taiwan which are the latest hits in this operation," he said. "In our opinion the finger could be safely pointed to China (again)."

According to a study released this week by Akamai, 33% of all online attacks appear to originate from China, followed by the United States (13%) and Russia (5%).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7407
Published: 2014-10-22
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2014-3675
Published: 2014-10-22
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.

CVE-2014-3676
Published: 2014-10-22
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

CVE-2014-3677
Published: 2014-10-22
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

CVE-2014-3828
Published: 2014-10-22
Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.