Security Market Segment LS
Wednesday, 11 September 2013 03:51

Is their any protection against Java exploits?

By

Research by Kaspersky into one of the most popular methods of infecting computers has revealed that Java exploits are the tool of choice for cybercriminals, with the security firm recording two million users who were targeted between March and August in cyber-attacks exploiting vulnerabilities in legitimate software.

Kaspersky Lab’s experts examined how computers were infected with the help of the BlackHole exploit pack, which it says is one of the most popular packs of its kind on the market.

The BlackHole pack includes exploits targeting vulnerabilities in Adobe Reader, Adobe Flash Player, Oracle Java and other popular software, and because the operation of all exploit packs relies on what is essentially the same algorithm, Kaspersky says its experts picked three Java exploits from BlackHole to illustrate the working principles of exploit packs.

“In the last 12 months alone, over 161 vulnerabilities in Java Environment Runtime were detected. This provides a wide platform from which to exploit vulnerabilities across OS versions, web browsers, installed plugins, and other configurations,” Sam Bryce-Johnson, Kaspersky Lab’s Australian-New Zealand Technical Manager said.

Bryce-Johnson said the BlackHole case study demonstrated how security components could interact with malicious code at various stages targeting specific vulnerabilities, which included:

•    Blocking the start page of the exploit pack (i.e. the first page of the exploit pack after the user is redirected from a legitimate site)

•    Detection using file antivirus (if the user nonetheless reaches the start page of the exploit pack)

•    Signature-based exploit detection (in case the security solution failed to detect the start page of the exploit pack)

•    Proactive exploit detection (used if all signature-based security components fail to detect anything malicious while scanning the contents of the exploit pack, and the exploit manages to launch), and

•    Detection of malicious downloads (if the exploit manages to escape detection, it attempts to download a malicious payload and launch it on the victim computer).

Vyacheslav Zakorzhevsky, Head of the Vulnerability Research Group at Kaspersky, said that the problem of ‘black holes’ remains relevant despite both the availability of studies into the infection mechanism of exploit packs, as well as the comprehensive solutions offered by security vendors.

“End users typically do not rush to install updates, and cybercriminals seize the initiative by creating new malicious programs to attack known vulnerabilities.”

Kaspersky researchers also uncovered a trend which attackers use to prevent the exploit pack’s contents from falling into the hands of experts at anti-malware companies and other researchers. To avoid exposure, cybercriminals may ‘blacklist’ IP addresses used by research companies - such as crawlers, robots, and proxy servers - to block exploits from launching on virtual machines.

For the complete report on how a computer can be infected using the BlackHole exploit kit and the relevant protection mechanisms that can be employed, visit securelist.com


Subscribe to ITWIRE UPDATE Newsletter here

Now’s the Time for 400G Migration

The optical fibre community is anxiously awaiting the benefits that 400G capacity per wavelength will bring to existing and future fibre optic networks.

Nearly every business wants to leverage the latest in digital offerings to remain competitive in their respective markets and to provide support for fast and ever-increasing demands for data capacity. 400G is the answer.

Initial challenges are associated with supporting such project and upgrades to fulfil the promise of higher-capacity transport.

The foundation of optical networking infrastructure includes coherent optical transceivers and digital signal processing (DSP), mux/demux, ROADM, and optical amplifiers, all of which must be able to support 400G capacity.

With today’s proprietary power-hungry and high cost transceivers and DSP, how is migration to 400G networks going to be a viable option?

PacketLight's next-generation standardised solutions may be the answer. Click below to read the full article.

CLICK HERE!

WEBINAR PROMOTION ON ITWIRE: It's all about webinars

These days our customers Advertising & Marketing campaigns are mainly focussed on webinars.

If you wish to promote a Webinar we recommend at least a 2 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site itwire.com and prominent Newsletter promotion https://www.itwire.com/itwire-update.html and Promotional News & Editorial.

This coupled with the new capabilities 5G brings opens up huge opportunities for both network operators and enterprise organisations.

We have a Webinar Business Booster Pack and other supportive programs.

We look forward to discussing your campaign goals with you.

MORE INFO HERE!

BACK TO HOME PAGE
Peter Dinham

Peter Dinham - an iTWire treasure is a mentor and coach who volunteers also a writer and much valued founding partner of iTWire. He is a veteran journalist and corporate communications consultant. He has worked as a journalist in all forms of media – newspapers/magazines, radio, television, press agency and now, online – including with the Canberra Times, The Examiner (Tasmania), the ABC and AAP-Reuters. As a freelance journalist he also had articles published in Australian and overseas magazines. He worked in the corporate communications/public relations sector, in-house with an airline, and as a senior executive in Australia of the world’s largest communications consultancy, Burson-Marsteller. He also ran his own communications consultancy and was a co-founder in Australia of the global photographic agency, the Image Bank (now Getty Images).

Share News tips for the iTWire Journalists? Your tip will be anonymous

WEBINARS ONLINE & ON-DEMAND

GUEST ARTICLES

VENDOR NEWS

Guest Opinion

Guest Interviews

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News

Comments