Java zero day vulnerability actively used in targeted attacks

Java zero day vulnerability actively used in targeted attacks

Summary: Security researchers from FireEye, AlienVault, and DeependResearch have intercepted targeted malware attacks utilizing the latest Java zero day exploit. The vulnerability affects Java 7 (1.7) Update 0 to 6. It does not affect Java 6 and below.

SHARE:
TOPICS: Security
6
Java_zero_day_exploit_obfuscated

Security researchers from FireEye, AlienVault, and DeependResearch have intercepted targeted malware attacks utilizing the latest Java zero day exploit. The vulnerability affects Java 7 (1.7) Update 0 to 6. It does not affect Java 6 and below.

Based on related reports, researchers were able to reproduce the exploit on Windows 7 SP1 with Java 7 Update 6. There's also a Metasploit module available.

Upon successful exploitation, the campaign drops MD5: 4a55bf1448262bf71707eef7fc168f7d - detected by 28 out of 42 antivirus scanners as Gen:Trojan.Heur.FU.bqW@a4uT4@bb; Backdoor:Win32/Poison.E

Users are advised to consider browsing the Web, and interacting with emails in an isolated environment, or to to block Java in their Web browsers until Oracle ships a patch for the security flaw.

Although what we've got here is a clear indication of an ongoing malicious attack utilizing a zero day flaw, on the majority of occassions cybercriminals wouldn't necessarily rely on a zero day flaw in order to infect as many users as possible. Instead, they would stick to using outdated and already patched vulnerabilities taking into consideration the fact that end and corporate users aren't patching their third-party software and browser plugins.

Find out more about Dancho Danchev at his LinkedIn profile.

Topic: Security

Dancho Danchev

About Dancho Danchev

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and cybercrime incident response.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

6 comments
Log in or register to join the discussion
  • Oracle just completed their quarterly update of Java SE 6 and 7 on Aug. 14

    With update 6 for Java SE 7 and update 34 for Java SE 6. Neither of these two updates included security fixes.

    I wonder how long it will take Oracle to update Java SE 7 with a patch for this exploit?
    Rabid Howler Monkey
  • How about a few more details....

    "28 out of 42 antivirus scanners"... Can you add the details of which ones detected it? (And maybe more importantly, which ones did not.)
    cartagenamatthew
  • Click on the link in the story ... MD5: 4a55bf1448262bf71707eef7fc168f7d

    Cmd_Line_Dino
  • now detected by 32 of the 42

    now detected by 32 of the 42 antivirus scanners tested
    https://www.virustotal.com/file/09d10ae0f763e91982e1c276aad0b26a575840ad986b8f53553a4ea0a948200f/analysis/
    trog7
  • once a Java update screwed up my trackpad...

    I don't know what it did and what stupid piece of software it installed on my PC. That moment onward I uninstalled the bloatware. How many independent plugins and things like that will one update, especially if it brings in more troubles...
    sreesiv
  • Update 7?

    I'm running what shows as Java 7 update 7. Is that safe? Are other browsers besides Firefox affected?
    myron62