Attacks/Breaches
1/24/2013
11:31 AM
Connect Directly
RSS
E-Mail
50%
50%

China Accused Of Java, IE Zero Day Attacks

Human rights groups have been victims of "watering hole" attacks using recently discovered -- and patched -- flaws in Java and Internet Explorer, security researcher says.

Recently disclosed vulnerabilities in Java and Internet Explorer have been used in targeted attacks that appear to be aimed at critics of the Chinese government.

Tuesday, Jindrich Kubec, director of threat intelligence for Prague-based antivirus software developer Avast, reported that multiple websites had been compromised by attackers and used to infect visitors via JavaScript drive-by attacks. If successful, the attacks infected PCs with a remote access Trojan (RAT), thus giving attackers direct access to the system, including all stored data.

"Watering hole attacks still continue -- now spotted only on human rights sites -- another [Tibetan] one, HK, chinese, and ... wait for it ... RSF!" said Kubec via Twitter, referring to Paris-based Reporters Sans Frontieres (RSF) -- also known as Reporters Without Borders -- which is a nongovernmental organization which campaigns for freedom of information, as well as press freedoms.

The attacks are part of a campaign that uses so-called "watering hole attacks," which refers to attackers compromising a website and using it to serve malicious code, in advance of their desired target visiting the site. The watering-hole technique has been used in numerous attacks, including exploits of Google committed by the so-called Aurora gang.

In the case of the RSF website attack, Kubec said in a blog post that an infection was first spotted Monday, "then it vanished, but it's back there, which [suggests] attackers have full access to their site," he said. "We've contacted the RSF webmaster and the code should be already removed."

[ Java security warnings raise more questions. Get the facts; read Java Security Warnings: Cut Through The Confusion. ]

According to a blog post from Kubec co-written with independent security researcher Eric Romang, the group behind the RSF watering hole attack last week also targeted "multiple high value websites, including as [an] example, major Hong Kong political parties."

The attacks attempt to exploit a recently discovered IE8 bug (CVE-2012-4792), which was patched by Microsoft this month, as well as one of the two Java vulnerabilities (CVE-2013-0422) spotted earlier this month and recently patched by Oracle with the release of Java 7 Update 11.

The recent watering hole attacks also include an exploit for a Java 6 vulnerability (CVE-2011-3544) patched by Oracle in October 2011. That vulnerability has since been used in numerous attacks, for example against Amnesty International websites in Britain and Hong Kong. The fact that attackers are including exploits for long-patched updates highlights the slow speed with which many people update their systems. "[Attackers] act as opportunists and try to take advantage from the time frame between the patch release and the patch application of some users, companies and non-governmental organizations," said Kubec.

Symantec had previously reported seeing the IE8 bug used in watering hole attacks that seemed to have been launched by the Elderwood group, which operates from China.

Kubec suggested the recent attack against the RSF website -- among other sites -- was likewise launched by China. "Such an organization is an ideal target for a watering hole campaign, as it seems right now the miscreants concentrate only on human rights/political sites -- many Tibetan, some Uygur and some political parties in Hong Kong and Taiwan which are the latest hits in this operation," he said. "In our opinion the finger could be safely pointed to China (again)."

According to a study released this week by Akamai, 33% of all online attacks appear to originate from China, followed by the United States (13%) and Russia (5%).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6335
Published: 2014-08-26
The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1.x before 7.1.0.3 on Linux and AIX, and 5.x and 6.x before 6.1.5.6 on Solaris and HP-UX, does not preserve file permissions across backup and ...

CVE-2014-0480
Published: 2014-08-26
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL ...

CVE-2014-0481
Published: 2014-08-26
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a d...

CVE-2014-0482
Published: 2014-08-26
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors relate...

CVE-2014-0483
Published: 2014-08-26
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.