Latest Java poison romps on as ok.XXX4.net

Aug 28, 2012 by Nancy Owano report

(Phys.org)—Yet another Java-related computer threat, cross-platform, has been nailed by security researchers. An exploit was seen by FireEye researchers on Sunday, being hosted on a domain ok.XXX4.net. When successful, the exploit downloads and executes a malicious binary, which calls to another IP address/domain. The Java threat was reported by FireEye's security researcher Atif Mushtaq, who said on August 26 that the initial exploit "is hosted on a domain named ok.XXX4.net. Currently this domain is resolving to an IP address in China." Subsequent reports are that it was discovered on a server with a domain name that resolved to an IP address located in China, and that the malware once installed on systems attempted to connect to a command-and-control server believed to be in Singapore.

Numerous security watchers are calling this a worrying vulnerability in the latest version of Oracle's framework, which could get worse. The attackers have found a way to get at a vulnerability that affects the latest version of —Update 6—in order to infect computers with malware. More specifically, the affects Java 1.7 update 6.

Most recent Java run-time environments are vulnerable, added Mushtiuqe. "In my lab environment, I was able to successfully exploit my test machine against latest version of FireFox with JRE version 1.7 update 6 installed," he said.

Security experts warn that the exploit code works on several browsers and computer platforms. Once the initial attack is made, a second piece of software referred to as Poison Ivy is released that lets hackers gain control of the computer.

Numerous computer security firms are telling PC users to disable Java software until a patch is released. As of this writing, there was no patch from Oracle.

Oracle typically patches Java at given points throughout the year. The next patch is scheduled for October. The updates are supposed to be collections of for Oracle products. Oracle says on its site, however, that "Oracle will issue Alerts for vulnerability fixes deemed too critical to wait for distribution in the next Critical Patch Update."

As such, Java is gaining a dubious distinction as being not only globally ever-present but also among the apps most frequently exploited, taking its place on the throne alongside Adobe Reader and Flash. According to Oracle, 97% of enterprise desktops run Java. Under different circumstances, that factoid would sound far less menacing.

Explore further: Researchers find parking space solution in PocketParker

More information: blog.fireeye.com/research/2012… is-not-over-yet.html

Related Stories

Oracle Issues 36 Patches

Apr 18, 2007

The Critical Patch Update is among the smallest since Oracle began quarterly updates.

Recommended for you

Researchers find parking space solution in PocketParker

2 hours ago

Looking for a parking spot? Circling round and round in a lot, feeling the heat of no luck no matter where you look? Could smartphone-tracking movements be of any help? Caleb Garling in MIT Technology Review ...

Tokyo Game Show: On the hunt for the next Minecraft

20 hours ago

The staggering $2.5 billion that Microsoft has just shelled out for Minecraft and its quirky graphics will be foremost in developers' minds at the Tokyo Game Show this week, where simple yet immersive games ...

Better non-functional security tests for software

Sep 15, 2014

The integration of digital expert knowledge and automation of risk analyses can greatly improve software test procedures and make cloud computing more secure. This is shown by the latest results of a project ...

User comments : 2

Adjust slider to filter visible comments by rank

Display comments: newest first

Expiorer
1 / 5 (2) Aug 28, 2012
like taking candy from a baby
kevinrtrs
1 / 5 (6) Aug 28, 2012
Seems like someone has it in for Oracle. Plenty of enemies around, what with Mr Ellison being so outspoken and definitely rubbing the competition up the wrong way.
The response will have to be really big - the company's future depends on it.