Attacks/Breaches
1/24/2013
11:31 AM
50%
50%

China Accused Of Java, IE Zero Day Attacks

Human rights groups have been victims of "watering hole" attacks using recently discovered -- and patched -- flaws in Java and Internet Explorer, security researcher says.

Recently disclosed vulnerabilities in Java and Internet Explorer have been used in targeted attacks that appear to be aimed at critics of the Chinese government.

Tuesday, Jindrich Kubec, director of threat intelligence for Prague-based antivirus software developer Avast, reported that multiple websites had been compromised by attackers and used to infect visitors via JavaScript drive-by attacks. If successful, the attacks infected PCs with a remote access Trojan (RAT), thus giving attackers direct access to the system, including all stored data.

"Watering hole attacks still continue -- now spotted only on human rights sites -- another [Tibetan] one, HK, chinese, and ... wait for it ... RSF!" said Kubec via Twitter, referring to Paris-based Reporters Sans Frontieres (RSF) -- also known as Reporters Without Borders -- which is a nongovernmental organization which campaigns for freedom of information, as well as press freedoms.

The attacks are part of a campaign that uses so-called "watering hole attacks," which refers to attackers compromising a website and using it to serve malicious code, in advance of their desired target visiting the site. The watering-hole technique has been used in numerous attacks, including exploits of Google committed by the so-called Aurora gang.

In the case of the RSF website attack, Kubec said in a blog post that an infection was first spotted Monday, "then it vanished, but it's back there, which [suggests] attackers have full access to their site," he said. "We've contacted the RSF webmaster and the code should be already removed."

[ Java security warnings raise more questions. Get the facts; read Java Security Warnings: Cut Through The Confusion. ]

According to a blog post from Kubec co-written with independent security researcher Eric Romang, the group behind the RSF watering hole attack last week also targeted "multiple high value websites, including as [an] example, major Hong Kong political parties."

The attacks attempt to exploit a recently discovered IE8 bug (CVE-2012-4792), which was patched by Microsoft this month, as well as one of the two Java vulnerabilities (CVE-2013-0422) spotted earlier this month and recently patched by Oracle with the release of Java 7 Update 11.

The recent watering hole attacks also include an exploit for a Java 6 vulnerability (CVE-2011-3544) patched by Oracle in October 2011. That vulnerability has since been used in numerous attacks, for example against Amnesty International websites in Britain and Hong Kong. The fact that attackers are including exploits for long-patched updates highlights the slow speed with which many people update their systems. "[Attackers] act as opportunists and try to take advantage from the time frame between the patch release and the patch application of some users, companies and non-governmental organizations," said Kubec.

Symantec had previously reported seeing the IE8 bug used in watering hole attacks that seemed to have been launched by the Elderwood group, which operates from China.

Kubec suggested the recent attack against the RSF website -- among other sites -- was likewise launched by China. "Such an organization is an ideal target for a watering hole campaign, as it seems right now the miscreants concentrate only on human rights/political sites -- many Tibetan, some Uygur and some political parties in Hong Kong and Taiwan which are the latest hits in this operation," he said. "In our opinion the finger could be safely pointed to China (again)."

According to a study released this week by Akamai, 33% of all online attacks appear to originate from China, followed by the United States (13%) and Russia (5%).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2010-5075
Published: 2014-12-27
Integer overflow in aswFW.sys 5.0.594.0 in Avast! Internet Security 5.0 Korean Trial allows local users to cause a denial of service (memory corruption and panic) via a crafted IOCTL_ASWFW_COMM_PIDINFO_RESULTS DeviceIoControl request to \\.\aswFW.

CVE-2011-4720
Published: 2014-12-27
Hillstone HS TFTP Server 1.3.2 allows remote attackers to cause a denial of service (daemon crash) via a long filename in a (1) RRQ or (2) WRQ operation.

CVE-2011-4722
Published: 2014-12-27
Directory traversal vulnerability in the TFTP Server 1.0.0.24 in Ipswitch WhatsUp Gold allows remote attackers to read arbitrary files via a .. (dot dot) in the Filename field of an RRQ operation.

CVE-2012-1203
Published: 2014-12-27
Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add user accounts via a save_user action.

CVE-2012-1302
Published: 2014-12-27
Multiple cross-site scripting (XSS) vulnerabilities in amMap 2.6.3 allow remote attackers to inject arbitrary web script or HTML via the (1) data_file or (2) settings_file parameter to ammap.swf, or (3) the data_file parameter to amtimeline.swf.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.