Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

China Accused Of Java, IE Zero Day Attacks

Human rights groups have been victims of "watering hole" attacks using recently discovered -- and patched -- flaws in Java and Internet Explorer, security researcher says.

Recently disclosed vulnerabilities in Java and Internet Explorer have been used in targeted attacks that appear to be aimed at critics of the Chinese government.

Tuesday, Jindrich Kubec, director of threat intelligence for Prague-based antivirus software developer Avast, reported that multiple websites had been compromised by attackers and used to infect visitors via JavaScript drive-by attacks. If successful, the attacks infected PCs with a remote access Trojan (RAT), thus giving attackers direct access to the system, including all stored data.

"Watering hole attacks still continue -- now spotted only on human rights sites -- another [Tibetan] one, HK, chinese, and ... wait for it ... RSF!" said Kubec via Twitter, referring to Paris-based Reporters Sans Frontieres (RSF) -- also known as Reporters Without Borders -- which is a nongovernmental organization which campaigns for freedom of information, as well as press freedoms.

The attacks are part of a campaign that uses so-called "watering hole attacks," which refers to attackers compromising a website and using it to serve malicious code, in advance of their desired target visiting the site. The watering-hole technique has been used in numerous attacks, including exploits of Google committed by the so-called Aurora gang.

In the case of the RSF website attack, Kubec said in a blog post that an infection was first spotted Monday, "then it vanished, but it's back there, which [suggests] attackers have full access to their site," he said. "We've contacted the RSF webmaster and the code should be already removed."

[ Java security warnings raise more questions. Get the facts; read Java Security Warnings: Cut Through The Confusion. ]

According to a blog post from Kubec co-written with independent security researcher Eric Romang, the group behind the RSF watering hole attack last week also targeted "multiple high value websites, including as [an] example, major Hong Kong political parties."

The attacks attempt to exploit a recently discovered IE8 bug (CVE-2012-4792), which was patched by Microsoft this month, as well as one of the two Java vulnerabilities (CVE-2013-0422) spotted earlier this month and recently patched by Oracle with the release of Java 7 Update 11.

The recent watering hole attacks also include an exploit for a Java 6 vulnerability (CVE-2011-3544) patched by Oracle in October 2011. That vulnerability has since been used in numerous attacks, for example against Amnesty International websites in Britain and Hong Kong. The fact that attackers are including exploits for long-patched updates highlights the slow speed with which many people update their systems. "[Attackers] act as opportunists and try to take advantage from the time frame between the patch release and the patch application of some users, companies and non-governmental organizations," said Kubec.

Symantec had previously reported seeing the IE8 bug used in watering hole attacks that seemed to have been launched by the Elderwood group, which operates from China.

Kubec suggested the recent attack against the RSF website -- among other sites -- was likewise launched by China. "Such an organization is an ideal target for a watering hole campaign, as it seems right now the miscreants concentrate only on human rights/political sites -- many Tibetan, some Uygur and some political parties in Hong Kong and Taiwan which are the latest hits in this operation," he said. "In our opinion the finger could be safely pointed to China (again)."

According to a study released this week by Akamai, 33% of all online attacks appear to originate from China, followed by the United States (13%) and Russia (5%).

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/22/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10737
PUBLISHED: 2020-05-27
A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home's user without properly checking the hom...
CVE-2020-13622
PUBLISHED: 2020-05-27
JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns unintended data.
CVE-2020-13623
PUBLISHED: 2020-05-27
JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation.
CVE-2020-13616
PUBLISHED: 2020-05-26
The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.
CVE-2020-13614
PUBLISHED: 2020-05-26
An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.