Technology content trusted in North America and globally since 1999
8,419 Reviews & Articles | 64,457 News Posts

Red October attacks also used Java exploit, according to researchers

Red October attacks also used Java exploits to spread, according to researchers

By Trace Hagan from Jan 15, 2013 @ 15:11 CST

The Red October cyberespionage attacks were thought to have used Excel and Word exploits solely, but new data by a different set of researchers suggest that a Java exploit was also used to spread the infection. Israeli IT security firm Seculert was analyzing the Command and Control servers for the attack and found a special folder containing a malicious Java applet.

red_october_attacks_also_used_java_exploit_according_to_researchers_1

The applet used an exploit that was patched back in October 2011, which suggests that the attackers preferred older, known vulnerabilities and not zero-day ones. The applet was compiled in February 2012, which furthers this theory. This discovery is being credited to the fact that the attackers switched from a PHP server-side scripting language to CGI on the C&C servers.

They left up older PHP-based attack pages, which allowed the source code to be viewed. Full analysis is now impossible as the attackers have shut the C&C servers down, likely to cover their tracks.

NEWS SOURCES:News.idg.no


Related Tags