In our 2013 Security Predictions, we predicted that conventional malware will focus mainly on refining tools instead of creating new threats. A perfect example of this prediction is how Blackhole Exploit Kit continuously attempts to circumvent the efforts done by the security industry. True enough, we recently received reports of a Blackhole Exploit Kit (BHEK) run that incorporated an exploit (detected by Trend Micro as JAVA_ARCAL.A) targeting the recently patched CVE-2013-0431.
If users can still recall, this vulnerability is part of the Java zero-day ruckus last January. This slew of critical incidents led Oracle to release an out-of-band security update to quickly address the issue. However, this release raised some crucial questions.
This particular BHEK run starts with spammed messages spoofing PayPal. When users click the item number indicated in these messages, they are led to several redirecting sites until they arrive at the page hosting the encrypted BHEK code. This code then checks the vulnerable system for versions of Adobe Reader, Flash Player, and Java. This determines which exploit (and subsequent payload) are downloaded onto the system.
Figure 1. Sample spoofed PayPal email message
In the testing we did, the BHEK code found certain versions of Adobe Reader, which prompted it to download and execute a malicious .PDF file (detected as TROJ_PIDIEF.MEX), which exploits an old vulnerability in CVE-2010-0188.
This BHEK code also downloads and executes JAVA_ARCAL.A from a specific page after checking the Java version of the infected system. JAVA_ARCAL.A then downloads and executes TSPY_FAREIT.MEX by using command.exe in the PATH %user% in a specific URL. This routine opens another page. Based on our analysis, TSPY_FAREIT.MEX attempts to steal information stored in web browsers like Google Chrome, Mozilla Firefox and Internet Explorer. At the end of the infection chain, this BHEK code will access the malicious page below to lead users into thinking that they’re just redirected to a seemingly non-malicious website.
Figure 2. Final landing page of the infection chain
Using Trend Micro Smart Protection Network™ data, we looked into the most affected countries by this BHEK run and got some interesting results. The most affected country is the United States, followed by Mexico. This is quite surprising, as Mexico did not generate significant infection counts in the past BHEK runs. Other countries most affected by this wave of BHEK include Germany, Latvia, Japan, Australia, United Kingdom, France, Spain and Italy.
With several components involved in this threat, BHEK spam runs can overwhelm any user. Fortunately, Trend Micro Smart Protection Network protects users from the related spam, URL, and malware.
The entry of CVE-2013-0431 into the BHEK narrative proves that this threat won’t be fading anytime soon. To better protect themselves from this threat, users must regularly keep their systems and software up-to-date.
For the spam component of this threat, it is also crucial for users and security administrators alike to realize that the usual spam and phishing best practices are not effective to address BHEK spam runs. We previously released our report Blackhole Exploit Kit: A Spam Campaign, Not a Series of Individual Spam Runs, which goes into details about our finding regarding the BHEK runs.
Users can visit the following blog posts for security tips on how to safely use PDF files and Java:
- How to Use Java – If You Must
- How To Use PDF Files More Safely
- Disable Java not Bob’s Java Jive (or JavaScript)
Hat tip to Max-Emanuel Maurer for initially reporting this incident.
With additional analysis from Threat response engineer Rhena Inocencio.
