With all the Java security problems, it's hardly surprising that malware authors would move to take advantage of the whirlwind. Ironically, a new ransomware campaign is targeting consumers looking to download the latest Java patch to keep their systems safe.
Trend Micro has warned of malware that poses as Java Update 11, created by an unknown publisher. According to Trend Micro, the fake update in question is javaupdate21.jar and it downloads and executes malicious files.
"Once executed, this backdoor connects to a remote  server that enables a possible attacker to take control of the infected system," Paul Pajares, a fraud analyst at Trend Micro, wrote in the company's Security Intelligence Blog.
"Though the dropped malware does not exploit CVE-2012-3174 or any Java-related vulnerability, the bad guys behind this threat are clearly piggybacking on the Java zero-day incident and users' fears. The use of fake software updates is an old social engineering tactic."
Not a New Trick
Pajares noted that this is not the first time that cybercriminals took advantage of software updates. Last year, we reported about malware disguised as Yahoo Messenger, which Trend Micro found in time for Yahoo's announcement of its update for Messenger.
"During our analysis, this ransomware locks users' screen and attempts to access specific sites to display its notification to users," Pajares said. "However, the malware we analyzed failed to download the said notification, thus the user is possibly left with a blank page."
Richard S. Westmoreland, Level III security analyst and team leader at Perimeter E-Security, told us social engineering is still the most successful way of breaching systems.
"Updates, patches and hot-fixes should always come directly from the vendor," Westmoreland said. "Companies should remind their employees to wait for instructions from their management and IT administrators and not try to 'solve' their own computer problems in ways that have not already been authorized."
Malware Is Big Business
Alex Horan of CORE Security said that if you ever wanted proof that malware is an active business, look how quickly the malware providers respond to events.
"They leverage trending events -- like Hurricane Sandy, relief drives, elections -- to increase the likelihood of a victim interacting with their malware and exposing themselves to risk," Horan told us.
"'Trust but verify' should be the maxim for dealing with any messages or requests you receive. Even if it makes perfect sense for the IT department to be warning you of the Java exploit and sending you a link to download the patch, you should still call and verify it is truly an e-mail from them and not from an attacker."
Paul:
Posted: 2013-01-23 @ 8:01pm PT
Very informative. Thank you for letting people know Java has no update, info on a fix is a fraud.
Spade:
Posted: 2013-01-19 @ 3:38pm PT
This again?!
What does Malware even want with us?! I see no reason for them to attack us!
WHAT THE HECK DID WE- THE USERS- EVEN DO?
Here I am, a day after gettind Java Version 7 Update 11 and hear THIS.
YEA, WE'RE PRETTY DARN DOOMED FOR NO REASON.
STUPID MALWARE.
|
NewsFactor.com 
Syrian Electronic Army Hacks Financial Times 
Patch Tuesday Hyper Focuses on IE 8
Surge of Venture Capital Buoys Tech Security Sector 
Cisco Surges After Profit Exceeds Analysts' Estimates 
HP and SAP Team To Advance HANA Database Technology
Square Stand Turns iPad into Digital Cash Register
Google Glass Raises Congressional Privacy Concerns
Windows Phone Now No. 3 in Market, BlackBerry No. 4
Intel Going Mobile with Its New CEO
Cloud Computing Gains Another Competitor with Google
Hackers' New Tool of Choice: Smartphones