Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Mobile Vulnerabilities

  • Zero-Day Alerts

  • Recent Posts

  • Calendar

    September 2015
    S M T W T F S
    « Aug    
  • Email Subscription

  • About Us

    In our 2013 Security Predictions, we predicted that conventional malware will focus mainly on refining tools instead of creating new threats. A perfect example of this prediction is how Blackhole Exploit Kit continuously attempts to circumvent the efforts done by the security industry. True enough, we recently received reports of a Blackhole Exploit Kit (BHEK) run that incorporated an exploit (detected by Trend Micro as JAVA_ARCAL.A) targeting the recently patched CVE-2013-0431.

    If users can still recall, this vulnerability is part of the Java zero-day ruckus last January. This slew of critical incidents led Oracle to release an out-of-band security update to quickly address the issue. However, this release raised some crucial questions.

    This particular BHEK run starts with spammed messages spoofing PayPal. When users click the item number indicated in these messages, they are led to several redirecting sites until they arrive at the page hosting the encrypted BHEK code. This code then checks the vulnerable system for versions of Adobe Reader, Flash Player, and Java. This determines which exploit (and subsequent payload) are downloaded onto the system.


    Figure 1. Sample spoofed PayPal email message

    In the testing we did, the BHEK code found certain versions of Adobe Reader, which prompted it to download and execute a malicious .PDF file (detected as TROJ_PIDIEF.MEX), which exploits an old vulnerability in CVE-2010-0188.

    This BHEK code also downloads and executes JAVA_ARCAL.A from a specific page after checking the Java version of the infected system. JAVA_ARCAL.A then downloads and executes TSPY_FAREIT.MEX by using command.exe in the PATH %user% in a specific URL. This routine opens another page. Based on our analysis, TSPY_FAREIT.MEX attempts to steal information stored in web browsers like Google Chrome, Mozilla Firefox and Internet Explorer. At the end of the infection chain, this BHEK code will access the malicious page below to lead users into thinking that they’re just redirected to a seemingly non-malicious website.


    Figure 2. Final landing page of the infection chain

    Using Trend Micro Smart Protection Network™ data, we looked into the most affected countries by this BHEK run and got some interesting results. The most affected country is the United States, followed by Mexico. This is quite surprising, as Mexico did not generate significant infection counts in the past BHEK runs. Other countries most affected by this wave of BHEK include Germany, Latvia, Japan, Australia, United Kingdom, France, Spain and Italy.

    With several components involved in this threat, BHEK spam runs can overwhelm any user. Fortunately, Trend Micro Smart Protection Network protects users from the related spam, URL, and malware.

    The entry of CVE-2013-0431 into the BHEK narrative proves that this threat won’t be fading anytime soon. To better protect themselves from this threat, users must regularly keep their systems and software up-to-date.

    For the spam component of this threat, it is also crucial for users and security administrators alike to realize that the usual spam and phishing best practices are not effective to address BHEK spam runs. We previously released our report Blackhole Exploit Kit: A Spam Campaign, Not a Series of Individual Spam Runs, which goes into details about our finding regarding the BHEK runs.

    Users can visit the following blog posts for security tips on how to safely use PDF files and Java:

    Hat tip to Max-Emanuel Maurer for initially reporting this incident.

    With additional analysis from Threat response engineer Rhena Inocencio.

    Share this article
    Get the latest on malware protection from TrendLabs
    Email this story to a friend   Technorati   NewsVine   MySpace   Google   Live   StumbleUpon

    • Brad

      Can you use Officescan to block the Java Application on a network? Or can you use WCCP to block java? Basically we have a few thousand computers and not everyone will disable Java in the browser.

      • Q

        Can you use Officescan to block the Java Application on a network?

        Explicitly, no you can’t. OSCE (alone) is not the correct product to do so. If, however, there are binaries that are developed that use this exploit (CVE-2013-0431), then they would be detected and OSCE would take action on them. Examples for these malware that exploits these vulnerabilities would be: JAVA_EXPLOIT.CVE, JAVA_EXPL.BO, JAVA_BLACOLE.PZT, JAVA_EXPLOYT.NEU.

        This CVE, however, is covered in Deep Security/IDF Rule Update DSRU13-007 which can prevent this. If the customer is running OSCE, IDF is a plug-in that can help the endpoint mitigate this kind of .JAR file being executed in the JVM. The data center solution would be to use Deep Security.

        Or can you use WCCP to block java?

        You can – and this is perhaps the correct method to do so. If you integrate your Cisco switch/router with IWSVA via WCCP, IWSVA can be configured to block all applets, or accept and process applets using security settings you specify via Applets and ActiveX scanning.

        If you configured other web content cache (aside from Trend Micro’s IWSVA), please look into your vendor’s documentation.


    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice