Symantec Says: Java Exploit, Asians Hackers Behind Attacks

‘Nitro’ gang said to be behind first attacks using zero-day Java flaw used to spread malware

Symantec says an Asian hacker group was behind the first attacks to exploit a flaw in Oracle’s Java software. Photograph: Paul Sakuma/AP

An Asian hacker group dubbed “Nitro”, because its previous targets include chemicals manufacturing companies, was behind the first attacks to exploit a flaw in Oracle’s Java software, says the security company Symantec.

Although little is known about the group, it is thought that they did not discover the flaw themselves but may have bought it from a commercial group that specialises in selling details about “zero-day” flaws in software that can be used to penetrate commercial or government systems, even when they have the most up-to-date cybersecurity in place.

“We can confirm that some of the attackers behind this latest round of attacks are actually the Nitro gang,” Symantec says.

Orla Cox, senior manager for security response, told the Guardian that the gang had first been spotted online in October 2011, using a command server located in Singapore that was used to control the siphoning of information from 29 US, UK and Bangladesh-based chemical manufacturing companies, many listed on the stock market. She declined to name them, citing customer confidentiality.

The latest attacks, which have led to widespread advice that users should disable Java on their browsers, were spotted last week.

But Cox said that new evidence collected by Symantec indicated that the Nitro group was sending out targeted emails, again to chemicals companies, since 22 August – before the vulnerability was spotted by security researchers.

The emails contained a link which, if clicked, would take unsuspecting users to websites. Those then exploited the flaw in Java to load malware on their machine and leave it open to being surreptitiously controlled, so that information on it or its network could be siphoned to the gang.

“They haven’t used a zero-day attack before, which indicates that they don’t as a group have that expertise,” Cox said.

She said that suggests that they acquired it commercially rather than discovering it themselves.

Zero-day flaws are a burgeoning commercial field in the underground hacker economy where some gangs work to order for commercial or government clients which want to break into systems.

Discovering them can take a long time and special expertise; deploying them tends to require much less skill.

Symantec said it could not identify the Nitro gang’s location, as the Singaporean command computer could be controlled from anywhere in the world.

But it seemed likely, said Cox, that the gang is based somewhere in the region.

Technical details
The attackers have been using this zero-day for several days since August 22. We have located two compromised websites serving up the malware:

• ok.XXXX.net/meeting/applet.jar
• 62.152.104.XXX/public/meeting/applet.jar

One sample of malware downloaded by the exploit has been identified as 4a55bf1448262bf71707eef7fc168f7d – “hi.exe” or “Flash_update.exe”

This particular sample connects to hello.icon.pk, which resolves to 223.25.233.244. That same IP was used by the Nitro attackers back in 2011.

The Java exploit is detected by Symantec as Java.Awetook. The vulnerability consists of a privilege escalation due to a class that allows access to protected members of system classes, which should not be accessible. Because of this, malicious code can bypass the restrictions imposed by the sandbox and use the “getRuntime().exec()” function in order to execute a malicious payload. In our tests, we have confirmed that the zero-day works on the latest version of Java (JRE 1.7), but it does not work on the older version JRE 1.6. A proof of concept for the exploit has been published and the vulnerability has already been added in Metasploit.

IPS detections for the exploit are covered under:

• Web Attack: Malicious Java Download 3
• Web Attack: Malicious JAR Download 3 CVE-2012-4681

Oracle has issued a patch—Java SE 7 Update 7—that addresses CVE-2012-4186. Users are advised to download the latest update.

Cross Platform Trojan Then Steals Linux and Mac Passwords

Russian anti-virus company Doctor Web reported about the first cross-platform backdoor to run under Linux and Mac OS X identified as “BackDoor.Wirenet.1“. This malicious program designed to steals passwords entered by the user in Opera, Firefox, Chrome, and Chromium, and passwords stored by such applications as Thunderbird, SeaMonkey, and Pidgin.

BackDoor.Wirenet.1 is the first-ever Trojan that can simultaneously work on these operating systems. BackDoor.Wirenet.1 is still under investigation.

At launch BackDoor.Wirenet.1 creates a copy in the user’s home directory. To interact with the command server located at 212.7.208.65, the malware uses a special encryption algorithm Advanced Encryption Standard (AES). BackDoor.

Security Flaw: SMS Spoofing Bug with iPhone

A rather serious security flaw in the iPhone’s SMS messaging system has been discovered and revealed by well-known security researcher and jailbreak extraordinaire ‘pod2g’. Security flaw affecting all iPhones that he says could facilitate hackers or thieves to access your personal information.

The researcher claims that the flaw has actually been present in Apple’s iPhone software ever since the first iPhone was launched in 2007, but has failed to have been picked up on by anybody, including Apple it seems.

Researcher revealed an SMS spoofing flaw that affects every version of Apple’s mobile OS. Using the flaw, hackers could spoof their identities via text and send messages asking for private information (by pretending to be from a users’ bank, for example), or direct users to phishing sites.

Users would be under the impression they were replying to the sender displayed on the screen of their iPhone, when in fact the text would be routed through to a different number without their knowledge. Pod2g highlights several ways in which malicious parties could take advantage of this flaw, including phishing attempts linking users to sites collecting personal information or spoofing messages for the purposes of creating false evidence or gaining a recipient’s trust to enable further nefarious action.

A rather serious security flaw in the iPhone’s SMS messaging system has been discovered and revealed by well-known security researcher and jailbreak extraordinaire ‘pod2g’. Security flaw affecting all iPhones that he says could facilitate hackers or thieves to access your personal information. The researcher claims that the flaw has actually been present in Apple’s iPhone software ever since the first iPhone was launched in 2007, but has failed to have been picked up on by anybody, including Apple it seems.

Researcher revealed an SMS spoofing flaw that affects every version of Apple’s mobile OS. Using the flaw, hackers could spoof their identities via text and send messages asking for private information (by pretending to be from a users’ bank, for example), or direct users to phishing sites.

Users would be under the impression they were replying to the sender displayed on the screen of their iPhone, when in fact the text would be routed through to a different number without their knowledge. Pod2g highlights several ways in which malicious parties could take advantage of this flaw, including phishing attempts linking users to sites collecting personal information or spoofing messages for the purposes of creating false evidence or gaining a recipient’s trust to enable further nefarious action.

“…In the text payload, a section called UDH (User Data Header) is optional but defines a lot of advanced features not all mobiles are compatible with. One of these options enables the user to change the reply address of the text. If the destination mobile is compatible with it, and if the receiver tries to answer the text, he will not respond to the original number, but to the specified one.”In many cases the malicious party would need to know the name and number of a trusted contact of the recipient in order for their efforts to be effective, but the phishing example shows how malicious parties could cast broad nets hoping to snare users by pretending to be a common bank or other institution.

In the meantime be prepared to update your iOS version as new options become available, as exploits are discovered Apple typically works quickly to fix those issues whenever possible.

Penny-sized Rocket Thruster To Power Smallest Satellites

An extremely small penny-sized rocket thruster has been developed to power the smallest satellites in space, replacing the bulky and heavy engines currently in use.

The device was designed by Paulo Lozano, an associate professor of aeronautics and astronautics at MIT. It shows little resemblance to the bulky satellite engines in use today, which are composed of many valves, pipes and heavy propellant tanks.

In contrast the new design is “a flat, compact square — much like a computer chip — covered with 500 microscopic tips that, when stimulated with voltage, emit tiny beams of ions. Together, the array of spiky tips creates a small puff of charged particles that can help propel a shoebox-sized satellite forward.”

“They’re so small that you can put several [thrusters] on a vehicle,” Lozano says. He adds that a small satellite outfitted with several microthrusters could “not only move to change its orbit, but do other interesting things — like turn and roll.”

“Today, more than two dozen small satellites, called CubeSats, orbit Earth. Each is slightly bigger than a Rubik’s cube, and weighs less than three pounds. Their diminutive size classifies them as ‘nano-satellites’ in contrast with traditional Earth-monitoring behemoths. These petite satellites are cheap to assemble, and can be launched into space relatively easily: Since they weigh very little, a rocket can carry several CubeSats as secondary payload without needing extra fuel.”

“But these small satellites lack propulsion systems, and once in space, are usually left to passively spin in orbits close to Earth. After a mission concludes, the satellites burn up in the lower atmosphere.”

“Lozano says if CubeSats were deployed at higher orbits, they would take much longer to degrade, potentially creating space clutter. As more CubeSats are launched farther from Earth in the future, the resulting debris could become a costly problem.”

“These satellites could stay in space forever as trash,” says Lozano, who is associate director of the Space Propulsion Laboratory. “This trash could collide with other satellites. … You could basically stop the Space Age with just a handful of collisions.”

“Engineering propulsion systems for small satellites could solve the problem of space junk: CubeSats could propel down to lower orbits to burn up, or even act as galactic garbage collectors, pulling retired satellites down to degrade in Earth’s atmosphere.”

“However, traditional propulsion systems have proved too bulky for nanosatellites, leaving little space on the vessels for electronics and communication equipment.”

“In contrast, Lozano’s microthruster design adds little to a satellite’s overall weight. The microchip is composed of several layers of porous metal, the top layer of which is textured with 500 evenly spaced metallic tips. The bottom of the chip contains a small reservoir of liquid — a ‘liquid plasma’ of free-floating ions that is key to the operation of the device.”

“To explain how the thruster works, Lozano invokes the analogy of a tree: Water from the ground is pulled up a tree through a succession of smaller and smaller pores, first in the roots, then up the trunk, and finally through the leaves, where sunshine evaporates the water as gas. Lozano’s microthruster works by a similar capillary action: Each layer of metal contains smaller and smaller pores, which passively suck the ionic liquid up through the chip, to the tops of the metallic tips.”

“The group engineered a gold-coated plate over the chip, then applied a voltage, generating an electric field between the plate and the thruster’s tips. In response, beams of ions escaped the tips, creating a thrust. The researchers found that an array of 500 tips produces 50 micronewtons of force — an amount of thrust that, on Earth, could only support a small shred of paper. But in zero-gravity space, this tiny force would be enough to propel a two-pound satellite.”

“Lozano and co-author Dan Courtney also found that very small increases in voltage generated a big increase in force among the thruster’s 500 tips, a promising result in terms of energy efficiency.”

“It means you have a lot of control with your voltage,” Lozano says. “You don’t have to increase a lot of voltage to attain higher current. It’s a very small, modest increase.”

“Timothy Graves, manager of electric propulsion and plasma science at Aerospace Corp. in El Segundo, Calif., says the microthruster design stands out among satellite propellant systems for its size and low power consumption.”

“Normally, propulsion systems have significant infrastructure associated with propellant feed lines, valves [and] complex power conditioning systems,” says Graves, who was not involved in the research. “Additionally, the postage-stamp size of this thruster makes it easy to implement in comparison to other, larger propulsion systems.”

“The researchers envision a small satellite with several microthrusters, possibly oriented in different directions. When the satellite needs to propel out of orbit, onboard solar panels would temporarily activate the thrusters. In the future, Lozano predicts, microthrusters may even be used to power much larger satellites: Flat panels lined with multiple thrusters could propel a satellite through space, switching directions much like a rudder, or the tail of a fish.”

“Just like solar panels you can aim at the sun, you can point the thrusters in any direction you want, and then thrust,” Lozano says. “That gives you a lot of flexibility. That’s pretty cool.”

Lozano and his group of researchers in MIT’s Space Propulsion Laboratory and Microsystems Technology Laboratory presented their new thruster array at the American Institute of Aeronautics and Astronautics’ recent Joint Propulsion Conference.

Anonymous Attacks Ukrainian Government After Demonoid Takedown

After suffering a major outage last week due to a DDoS, Demonoid, a popular BitTorrent tracker, was taken offline by Ukrainian authorities, allegedly so that the government could earn some brownie points with the United States. In response, Anonymous has launched OpDemonoid, an operation that is targeting sites in the Ukraine.

According to sources speaking to Kommersant, a Russian newspaper, and as reported by TorrentFreak, “the raid on Demonoid was timed to coincide with the very first trip of Deputy Prime Minister Valery Khoroshkovsky‘s trip to the United States. On the agenda: copyright infringement.”

“Ukraine had promised the United States that it would improve its attitude and efforts towards enforcing copyright and no doubt its Western partner will be very pleased indeed that Demonoid’s head has been presented on a platter.”

This is what led to Anonymous taking a stance. So far, DDoS attacks against the National Television and Radio Broadcasting Council of Ukraine (nrada.gov.ua), the Ukrainian Agency for Copyright and Related Rights (uacrr.kiev.ua), and the Ukrainian Anti-Piracy Association (apo.kiev.ua), have been the opening salvo.

However, the operation’s planning notes also call for Web defacement too. Should the Ukrainian president’s page (president.gov.ua) be defaced, a prepared replacement page outlines other goals for OpDemonoid.

First, the main objective is to restore Demonoid services by “any means necessary” and facilitate a series of mirrors online. After that, there is retaliation, which is currently ongoing.

“Sergei Burlakov of Ukraine’s Ministry of Internal Affairs has confirmed that a criminal case in Mexico against the owners of Demonoid has been initiated and the tracker is charged with intellectual property rights violations. A future without public trackers is a bleak one my friends. For most of us Demonoid and other public trackers have been about much more than music or movies. They are an incredibly powerful educational tool, facilitating much more than just open piracy. Corporations and governments fear them. Anonymous will not tolerate a world without them,” the text from Anonymous states.

 

In a previous statement to the public, Anonymous reminded the Ukrainian government that they had faced their wrath before, asking: “Haven’t you, Ukraine, learned anything from the Anonymous Collective? You were attacked once, and yet feel the need to keep censoring us, your people, and every day hard working citizens?”

For this reason alone, the statement concludes, “Ukrainian government, You should have expected us.”

Ukraine Government Shuts Down Demonoid As A Gift To The U.S. – pulse2.com