FAKEAV Update: Java Vulnerabilities and Improved Fake Alerts

[Peaches]

Oct20

FAKEAV Update: Java Vulnerabilities and Improved Fake Alerts

There have been recent talks within the security industry about the increasing use of Java vulnerabilities by attackers. Last week, security blogger Brian Krebs noted how Java was being used by exploit packs. Earlier this week, Microsoft also reported what they called an “unprecedented wave” of Java exploits.

This is something we’ve been seeing as well. FAKEAV doorway pages (a concept previously discussed in “Doorway Pages and Other FAKEAV Stealth Tactics”) are increasingly using Java vulnerabilities. In cases where these vulnerabilities cannot be exploited, PDF exploits are used instead. We detect the said Java and PDF exploits as JAVA_LOADER.HLL and TROJ_PIDIEF.HLL respectively

Two vulnerabilities we have seen heavily exploited in particular in this manner are:

• CVE-2008-5353
• CVE-2009-3867

More details & screenshots here: http://blog.trendmicro.com/