Attacks/Breaches
1/24/2013
11:31 AM
Connect Directly
RSS
E-Mail
50%
50%

China Accused Of Java, IE Zero Day Attacks

Human rights groups have been victims of "watering hole" attacks using recently discovered -- and patched -- flaws in Java and Internet Explorer, security researcher says.

Recently disclosed vulnerabilities in Java and Internet Explorer have been used in targeted attacks that appear to be aimed at critics of the Chinese government.

Tuesday, Jindrich Kubec, director of threat intelligence for Prague-based antivirus software developer Avast, reported that multiple websites had been compromised by attackers and used to infect visitors via JavaScript drive-by attacks. If successful, the attacks infected PCs with a remote access Trojan (RAT), thus giving attackers direct access to the system, including all stored data.

"Watering hole attacks still continue -- now spotted only on human rights sites -- another [Tibetan] one, HK, chinese, and ... wait for it ... RSF!" said Kubec via Twitter, referring to Paris-based Reporters Sans Frontieres (RSF) -- also known as Reporters Without Borders -- which is a nongovernmental organization which campaigns for freedom of information, as well as press freedoms.

The attacks are part of a campaign that uses so-called "watering hole attacks," which refers to attackers compromising a website and using it to serve malicious code, in advance of their desired target visiting the site. The watering-hole technique has been used in numerous attacks, including exploits of Google committed by the so-called Aurora gang.

In the case of the RSF website attack, Kubec said in a blog post that an infection was first spotted Monday, "then it vanished, but it's back there, which [suggests] attackers have full access to their site," he said. "We've contacted the RSF webmaster and the code should be already removed."

[ Java security warnings raise more questions. Get the facts; read Java Security Warnings: Cut Through The Confusion. ]

According to a blog post from Kubec co-written with independent security researcher Eric Romang, the group behind the RSF watering hole attack last week also targeted "multiple high value websites, including as [an] example, major Hong Kong political parties."

The attacks attempt to exploit a recently discovered IE8 bug (CVE-2012-4792), which was patched by Microsoft this month, as well as one of the two Java vulnerabilities (CVE-2013-0422) spotted earlier this month and recently patched by Oracle with the release of Java 7 Update 11.

The recent watering hole attacks also include an exploit for a Java 6 vulnerability (CVE-2011-3544) patched by Oracle in October 2011. That vulnerability has since been used in numerous attacks, for example against Amnesty International websites in Britain and Hong Kong. The fact that attackers are including exploits for long-patched updates highlights the slow speed with which many people update their systems. "[Attackers] act as opportunists and try to take advantage from the time frame between the patch release and the patch application of some users, companies and non-governmental organizations," said Kubec.

Symantec had previously reported seeing the IE8 bug used in watering hole attacks that seemed to have been launched by the Elderwood group, which operates from China.

Kubec suggested the recent attack against the RSF website -- among other sites -- was likewise launched by China. "Such an organization is an ideal target for a watering hole campaign, as it seems right now the miscreants concentrate only on human rights/political sites -- many Tibetan, some Uygur and some political parties in Hong Kong and Taiwan which are the latest hits in this operation," he said. "In our opinion the finger could be safely pointed to China (again)."

According to a study released this week by Akamai, 33% of all online attacks appear to originate from China, followed by the United States (13%) and Russia (5%).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0607
Published: 2014-07-24
Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file.

CVE-2014-1419
Published: 2014-07-24
Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.

CVE-2014-2360
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report a high battery voltage.

CVE-2014-2361
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.

CVE-2014-2362
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.