Home page logo

isn logo Information Security News mailing list archives

Red October relied on Java exploit to infect PCs
From: InfoSec News <alerts () infosecnews org>
Date: Tue, 15 Jan 2013 00:23:17 -0600 (CST)


By Dan Goodin
Ars Technica
Jan 14 2013

Attackers behind a massive espionage malware campaign that went undetected for five years relied in part on a vulnerability in the widely deployed Java software framework to ensnare their victims, a security researcher said.

The unknown attackers infected computers operated by the Russian Federation, Iran, the US, and at least 36 other countries. They used highly targeted malware to collect what's believed to be hundreds of terabytes of sensitive data, according to researchers from antivirus provider Kaspersky Lab. The success of the covert operation is largely the result of malware and phishing e-mails that were highly customized for each victim.

Now, Aviv Raff, a researcher with Israel-based Seculert, said he has uncovered a website used to infect some of the victims of Operation Red October (as the campaign has been dubbed). The website exploited a critical Java vulnerability identified as CVE-2011-3544, allowing the attackers to surreptitiously execute malicious code on visitors' computers. Although Oracle developers patched the bug in October, 2011, the malicious Java archive file was compiled the following February.

Raff's discovery provides a window into the inner workings of an espionage campaign that collected passwords, cryptographic keys, and sensitive diplomatic intelligence from some of the world's biggest governments. They include a pseudo-randomly generated unique ID the malicious executable assigned to each newly infected computer.


Visit the InfoSec News Security Bookstore
Best Selling Security Books and More!

  By Date           By Thread  

Current thread:
  • Red October relied on Java exploit to infect PCs InfoSec News (Jan 15)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]