Attackers use stolen certificate to sign malicious Java applet

Share this article:

Users are being duped into running a malicious Java applet that was signed with a stolen digital certificate and designed to look like a security update.

Security researcher Eric Romang on Tuesday blogged about the malicious file, which appears to victims as a “Java ClearWeb Security Update” – as shown in a screen cap he posted. The applet was discovered on a German online dictionary site, which was compromised by an exploit kit called “g01pack.” 

According to Romang, the stolen private key used to sign the applet belongs to CLEAResult Consulting, an Austin, Texas-based energy efficiency firm. The company is listed as the publisher of the application in the fake  "security update" that Romang screen-grabbed.

Jindrich Kubec, director of threat intelligence at AVAST, a Czech Republic-based security software company, said default security settings in Java exacerbated the threat for users. There is no word yet on what Java vulnerability was being exploited, though there have been a number of bugs in the platform that recently have surfaced.

“My Java has ‘check certificates for revocation,' turned off,” Kubec tweeted, referencing the issue. “[It] also has ‘enable granting elevated access to self-signed apps,' [set] to on.”

On Monday, Oracle released an update to patch other vulnerabilities in its widely used Java software. The update for Java SE 5, 6 and 7 addressed two flaws, CVE-2013-0809 and CVE-2013-1493. The latter bug was exploited in the wild by attackers to spread the McRAT executable.

SCMagazine.com reached out to Oracle concerning the malicious Java applet, but did not immediately hear back.

Share this article:

Sign up to our newsletters

More in News

Investors aim to 'save' bitcoin exchange Mt. Gox

After suffering a massive bitcoin theft, the exchange faces liquidation of its assets in Japan.

Attackers target Facebook to deliver Android iBanking malware

Attackers target Facebook to deliver Android iBanking malware

A Windows trojan delivered via drive-by download is injecting malicious content into Facebook and ultimately fooling users into downloading Android malware that can allow for the capturing of SMS messages.

Federal watchdog says SEC security issues put financial data at risk

Federal watchdog says SEC security issues put financial ...

According to the U.S. Government Accountability Office (GAO), SEC, among other lapses, failed to adequately oversee a contractor, which migrated its financial system to a new data center.