Java exploit used in Red October cyberespionage attacks, researchers say
Seculert researchers identified a Java exploit and corresponding attack pages on Red October command and control servers
IDG News Service - The hundreds of government, military and research organizations targeted in a large-scale cyberespionage operation dubbed Red October were not only attacked using malicious Excel and Word documents as previously believed, but also by using Web-based Java exploits, according to researchers from Israeli IT security firm Seculert.
Researchers from antivirus vendors Kaspersky Lab published the results of their investigation into Red October on Monday. According to their report, the victims were targeted via rogue email messages that contained malicious documents designed to exploit known vulnerabilities in Microsoft Excel and Word.
Costin Raiu, director of Kaspersky's global research and analysis team, said Monday that other methods of distributing the cyberespionage malware might have been used, but hadn't been identified yet.
However, while analyzing the command and control servers used in the campaign, security researchers from Seculert discovered a special folder containing a malicious Java applet -- Web-based Java application -- designed to exploit a Java vulnerability patched in October 2011.
The exploit found on the server was compiled in Feb. 2012, which reinforces the belief that these attackers preferred to target older, known vulnerabilities, not zero-day -- previously unknown -- ones, the Seculert researchers said Tuesday in a blog post.
The discovery was made possible because at some point the attackers switched from using PHP as the server-side scripting language on their command and control servers to CGI. Some older PHP-based attack pages were still left on the servers and accessing them in a browser revealed their source code, the Seculert researchers said.
Evidence suggests that the Web-based attack method continued to be used even after switching the infrastructure to CGI, Aviv Raff, Seculert's chief technology officer, said Tuesday. However, it's not clear if exploits for newer vulnerabilities in Java or other browser plug-ins have been used in the past few months, he said.
Further analysis is impossible at this time because the command and control servers have been shut down, most likely by the attackers in an attempt to cover their tracks, Raff said.
The attackers tricked individuals in the targeted organizations into visiting the attack pages by sending them rogue emails with links pointing to them, the Seculert researchers said. It's not clear what those emails said, because no copy has been recovered yet, but they probably had a news-based theme, Raff said.
The attack pages, the Java exploit itself and even the URL for the malware payload contained strings referencing "news," Raff said. In fact, after the attack page loaded the Java exploit, the victims' browsers were being redirected to legitimate news sites, including one based in Turkey, he said.
Interestingly enough, command and control servers used in the Flame cyberespionage campaign also contained a "NewsForYou" string, suggesting that a news theme was used in those attacks. It's not clear at this time if this is just a coincidence or if there's a connection between the two campaigns, Raff said.
Raff believes that Red October is the work of a group of hackers trying to obtain high-value information which they can later sell to interested parties, rather than the result of a nation state's cyberespionage efforts. Researchers from Kaspersky Lab, who first uncovered this cyberespionage operation, favor the same theory.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
- Is Your Big Data Solution Production-Ready? Read "Is Your Big Data Solution Production-Ready?" now, and discover best practices and actionable steps to implementing a production-ready big data solution.
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Malware and Vulnerabilities White Papers | Webcasts