Apple, Facebook employees hacked via website malware, Java vulnerability

ZDNet's Zack Whittaker detailed the waterhole attack that was injected into a popular iPhone Dev SDK website (no link love due to the potential threat) which compromised the computers of visiting employees from Apple, Facebook (and potentially Twitter, too) using a zero day exploit in the Java web plug-in.

A note posted at the site reads (full text below):

iPhoneDevSDK has learned it was used as part of an attack whose victims included large internet companies. We have no reason to believe user data was compromised, but to be safe, we've reset all user passwords.

Apple on Tuesday revealed that some employees' computers had been hacked, but that no data were exposed. According to a statement:

"We identified a small number of systems within Apple that were infected and isolated them from our network. There is no evidence that any data left Apple"

The breaches are now believed to have occurred when employees visited the iPhone Dev SDK website, which was infected with zero day malware that exploited a vulnerability in the Java browser plug-in, installing malware on their Mac computers.

Apple yesterday released Java for OS X 2013-001 which uninstalls the Apple-provided Java applet plug-in from all web browsers. Users must then download the latest version of the Java applet plug-in from Oracle in order to use Java applets. 

Bloomberg reports that the hacks were the work of an Eastern European gang of hackers attempting to steal company secrets, citing "two people familiar with the matter."

I want to echo Zack's warning to not visit this site in as it may still contain active malware that could lead to infection.

Most importantly: Security holes in Java have been responsible for a number of high-profile attacks recently. All Mac users should install Java for OS X 2013-001 immediately and only install the Oracle Java plug-in if you absolutely need it. Also, heed the rest of Zack's warnings and precautions here, which include:

1. Remove Java immediately
2. Check your logs, history, browsing records
3. Run a full, network-wide malware sweep
4. Take future precautions: Virtualize and isolate risky software

If you run a WordPress blog, patch it up to the latest release, harden it, and never install themes from unknown/insecure sources. If your Wordpress blog has been infected this post will help you clean it.

Update: Eric Romang has posted a forensic timeline of the attacks.

Here's the full text of the warning at the iPhoneDevSDK:

Today, we were alerted that our site was part of an elaborate and sophisticated attack whose victims included large internet companies. We were alerted through the press, via an AllThingsD article, which cited Facebook. Prior to this article, we had no knowledge of this breach and hadn't been contacted by Facebook, any other company, or any law enforcement about the potential breach. You can read more about the attack via Facebook's blog post.
As the most widely read dedicated iOS developer forum, we're targeted for attacks frequently. Security is a top priority for us, which is one reason why we switched to Vanilla Forums to host our site last year. Vanilla manages security like pros, and I should be clear that -- as best we can tell right now -- this attack has nothing to do with their software.
Immediately, we were in contact with Facebook's security team, including Joe Sullivan, Facebook's Chief Security Officer, and his team, to learn what they knew. We also contacted Vanilla, our amazing forum hosts, to ensure the problem was not with their software.
What we've learned is that it appears a single administrator account was compromised. The hackers used this account to modify our theme and inject JavaScript into our site. That JavaScript appears to have used a sophisticated, previously unknown exploit to hack into certain user's computers.
We're still trying to determine the exploit's exact timeline and details, but it appears as though it was ended (by the hacker) on January 30, 2013.
As with Facebook, it's important to stress that we have no reason to believe user data was compromised.
Just to be sure, we've reset all users' passwords. Please use our Forgot Password feature the next time you log in to reset your password.
We're continuing to work with Facebook, Vanilla, other targeted companies, and law enforcement to find out who is behind this sophisticated attack.
We're very sorry for the inconvenience -- we'll work tirelessly to ensure your data's security now and in the future. I want to thank Vanilla Forums for their help in the matter and for keeping the site secure, as well as Facebook for their help quickly after we reached out.