Friday, October 31, 2014
Search
  
Submit your own News for
inclusion in our Site.
Click here...
Breaking News
Sharp To Produce New Backlight-free LCD Panel For Wearables
New Cameras Boost GoPro's Quarterly Profit
Panasonic AX800 4K ULTRA HD TVs Update Adds Compatibility With Netflix 4K Streaming
YouTube Now Supports 60fps Videos
Samsung Brings Gear S to U.S. Next Week
Corsair Introduces Sabre RGB Mice For Gamers
Ubisoft's Assassin's Creed Unity Included with Purchase of Samsung UD590 Monitor or 850 PRO Series SSD
Apple's Tim Cook Declares His Sexual Orientation
Active Discussions
Copied dvd's say blank in computer only
Made video, won't play back easily
New Features In Firefox 33
updated tests for dvd and cd burners
How to generate lots of different CDs quickly
Yamaha CRW-F1UX
help questions structure DVDR
Questions durability monitor LCD
 Home > News > General Computing > Java Ex...
Last 7 Days News : SU MO TU WE TH FR SA All News

Tuesday, January 15, 2013
Java Exploit Behind "Red October" Cyber Attacks


Security researchers from Seculert discovered that the attackers of the large-scale cyberespionage operation dubbed "Red October" were taking advantage of Web-based Java exploits as well as malicious Excel and Word documents.

Kaspersky Lab's researchers published the results of their investigation into Red October on Monday. According to their report, the victims were targeted via rogue email messages that contained malicious documents designed to exploit known vulnerabilities in Microsoft Excel and Word.

However, after investigating the Command-and-Control (C2) servers used in the "Red October" campaign, Seculert researchers identified a special folder used by the attackers for an additional attack vector. In this vector, the attackers sent an email with an embedded link to a specially crafted PHP web page. This webpage exploited a vulnerability in Java (CVE-2011-3544), and in the background downloaded and executed the malware automatically, the researchers said.

The discovery was made possible because the attackers switched from using PHP as the server-side scripting language on their command and control servers to CGI. Some older PHP-based attack pages were still left on the servers and accessing them in a browser revealed their source code, the Seculert researchers added.

Further analysis is impossible at this time because the command and control servers have been shut down, most likely by the attackers in an attempt to cover their tracks, Seculert's researchers added.

The attack pages, the Java exploit itself and even the URL for the malware payload contained strings referencing "news," in an effort to trick the victims.


Previous
Next
Microsoft Advances the Cloud OS With New Management Solutions        All News        564 Million Chinese Have Internet Access
Microsoft Advances the Cloud OS With New Management Solutions     General Computing News      564 Million Chinese Have Internet Access

Get RSS feed Easy Print E-Mail this Message

Related News
Dropbox, WordPress Used To Spread Malware
Microsoft Says Viruses Are Back On The Rise
First Targeted Attack Utilising Malware for Android Devices Reported
Cyber Attack Targets Nato, Government Websites
Stuxnet Roots Found Back in 2005
FTC Warns Small Businesses Of Spam Email
Kaspersky Says 'Red October' Virus Has Been Targeting Diplomatic and Government Agencies
Kaspersky Discovers New version Of Flams Virus
Microsoft Warns Of New IE Security Breach
Microsoft Disrupts Nitol Botnet
Kaspersky Discovers New IT Virus Linked To Stuxnet
Microsoft Researcher Warns of Android 'botnet'

Most Popular News
 
Home | News | All News | Reviews | Articles | Guides | Download | Expert Area | Forum | Site Info
Site best viewed at 1024x768+ - CDRINFO.COM 1998-2014 - All rights reserved -
Privacy policy - Contact Us .