Java server malware targets Windows systems

Share this article:

Researchers have discovered a backdoor delivered by a malicious JavaServer Page (JSP), which targets vulnerable Java-based HTTP servers and allows an attacker to hijack infected systems.

The malware, called “JavaWar,” infects victims via drive-by download or as a file dropped by other malware, and targets Windows operating systems, including 7, Vista, XP, Server 2003 and 2000. So far, however, in-the-wild instances of the threat have been limited.

To launch an attack, saboteurs use a password-cracking tool to gain administrator access to JSP, where they can then delete, edit, download or copy files from the infected server, according to research from Trend Micro, which discovered the threat.

In a blog published last Thursday to Trend Micro's site, researchers said attackers could also gain access to servers by targeting a Java Servlet container, like Apache Tomcat, or by exploiting the Tomcat Web Application Manager used in websites powered by Tomcat, an open source web server that provides software applications for users.

“Aside from gaining access to sensitive information, an attacker gains control of the infected system through the backdoor and can carry out more malicious commands onto the vulnerable server,” the blog post said.

Trend Micro advised users to implement strong passwords to thwart attacks executed with password-cracking tools, as well as visit only trusted sites and maintain software updates.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Information sharing requires breaking down barriers, White House cyber guru says

Information sharing requires breaking down barriers, White House ...

The White House has advanced an agenda to promote and facilitate information sharing on security threats and vulnerabilities.

Worm variant of Android ransomware, Koler, spreads via SMS

Worm variant of Android ransomware, Koler, spreads via ...

Upon infection, the Koler variant will send an SMS message to all contacts in the device's address book.

Patch for Windows flaw can be bypassed, prompts temporary fix from Microsoft

Patch for Windows flaw can be bypassed, prompts ...

The Windows zero-day received a patch last week, but the fix can still be bypassed by crafty attackers.