Until recently, most of the vulnerabilities exploited by popular exploit kits were found last year or even earlier. Moreover, it would take authors at least a month to update their kits with the new exploits that had been discovered in the wild. However, in the past few weeks, authors released an updated version of their kits with a new recent exploit before a patch had been released.
First, a new version of the Blackhole exploit kit was released, version 1.2.1:
- Live Blackhole Exploit Kit control panel
The Blackhole exploit kit presented above was modified to exploit clients that have Java installed, using the recently discovered CVE-2011-3544 vulnerability. This is the only vulnerability that is actually being exploited.
A few days later, a new version of Phoenix exploit kit 3.0 was released, just a few weeks after the release of its predecessor, Phoenix 2.9.
Live Phoenix Exploit Kit 3.0 control panel
Notice the red boxes in the screen shots above: A new exploit was added to those exploit kits, which is the reason for the upgrade.
A few weeks ago Michael ‘mihi’ Schierl described a design error in Java. Basically this vulnerability is similar to other Java vulnerabilities where an untrusted code is executed in elevated privileges. Rhino is a Javascript engine that runs under the JVM and can interact with Java applets. An attacker can bypass the scripting engine protection by generating an error object, using Rhino script, which runs in elevated privileges and executing code that disables the Security Manager. Once the Security Manager is disabled, the attacker can execute code with full permissions.
Not long after the discovery, an exploit module was published in Metasploit. First, the code binds a Rhino object with the applet:
| import javax.script.*; … ScriptEngine engine = new ScriptEngineManager().getEngineByName(“js”); Bindings b = engine.createBindings(); b.put(“applet”, this); |
The Java code executes a script that bypasses the Security Manager protection by using the “toString” method inside a script context:
| Object proxy = (Object) engine.eval( “this.toString = function() {” + “ java.lang.System.setSecurityManager(null);” + “ applet.callBack();” + “ return String.fromCharCode(97 + Math.round(Math.random() * 25));”+ “};” + “e = new Error();” + “e.message = this;” + “e”, b); |
The script throws an exception, and the rest of the code would be executed.
| catch (ScriptException e) { e.printStackTrace(); } |
The vulnerability is cross-platform and doesn’t require heap spray or buffer overflow techniques. That makes it very effective and therefore authors of exploit kits rushed to add it to their kits. The concerning aspect is that the Blackhole exploit kit was updated even before a patch was released by the vendor.
Customers of all versions of M86 Secure Web Gateway are safe, as it provides zero-day protection against this vulnerability by default.
We highly encourage users to keep their Java updated, or remove it if it is not needed. A patch for this Java vulnerability is available by now: Look for Java 6 Update 29, or Java 7 Update 1.
