Java server malware targets Windows systems

Share this article:

Researchers have discovered a backdoor delivered by a malicious JavaServer Page (JSP), which targets vulnerable Java-based HTTP servers and allows an attacker to hijack infected systems.

The malware, called “JavaWar,” infects victims via drive-by download or as a file dropped by other malware, and targets Windows operating systems, including 7, Vista, XP, Server 2003 and 2000. So far, however, in-the-wild instances of the threat have been limited.

To launch an attack, saboteurs use a password-cracking tool to gain administrator access to JSP, where they can then delete, edit, download or copy files from the infected server, according to research from Trend Micro, which discovered the threat.

In a blog published last Thursday to Trend Micro's site, researchers said attackers could also gain access to servers by targeting a Java Servlet container, like Apache Tomcat, or by exploiting the Tomcat Web Application Manager used in websites powered by Tomcat, an open source web server that provides software applications for users.

“Aside from gaining access to sensitive information, an attacker gains control of the infected system through the backdoor and can carry out more malicious commands onto the vulnerable server,” the blog post said.

Trend Micro advised users to implement strong passwords to thwart attacks executed with password-cracking tools, as well as visit only trusted sites and maintain software updates.

Share this article:

Sign up to our newsletters

More in News

Report: SQL injection a pervasive threat, behavioral analysis needed

Report: SQL injection a pervasive threat, behavioral analysis ...

Long lag times between detection and resolution and reliance on traditional methods impair an organization's ability to combat SQL injection attacks.

WhatsApp bug allows for interception of shared locations

Researchers identified a vulnerability in WhatsApp that could enable an attacker to intercept shared locations using a man-in-the-middle attack, or a rogue access point.

Google tweaks its terms of service for clarity on Gmail scanning

The company is currently dealing with a lawsuit that challenges its email scanning practices.