Vyacheslav Zakorzhevsky, a security expert with Kaspersky Lab, has written that a Java exploit first published in October and used in drive-by attacks has found its way into the Black Hole exploit kit, aimed primarily at “users in Russia, the US, the UK and Germany.”
“Java is probably the vector most commonly exploited by cybercriminals,” says SophosLabs security expert Paul Baccas, “and we don't see any sign of this situation changing anytime soon. The Black Hole exploit pack is the most commonly used malicious software installer that SophosLabs have been seeing in the last three months.” Together they make a noxious cocktail.
According to Oracle, there are more than 13 thousand million devices running Java. Criminals are turning to Java because they are businessmen – they tend to perform cost-benefit analyses. “Having so many devices using the same software is a great opportunity,” says Luis Corrons, technical director at Panda Labs. “That’s why cybercriminals have targeted Windows for so many years.” But since Microsoft started to build a more secure operating system, criminals have had to look elsewhere to get a good return. “The main condition,” continues Corrons, “is that it has to be widespread, such as PDF, Flash, and browsers. That’s the case with Java; it is widespread and it is really convenient for everyone, both users and cybercriminals.”
The problem with Java, says ESET senior research fellow David Harley, comes “from the fragmentation of its implementations across platforms and devices,” and he’s not sure “how far it’s possible to fix it across the board.”
If Oracle cannot fix it, it falls on the user to take more care (as it does in all security matters). It is worth noting that according to Microsoft research (Microsoft Security Intelligence Report, v11), the use of an exploit peaks a full two months after the software has been patched. Zealous patching is a great part of the solution.
“Once again we see that malware writers are forging ahead and are continually improving their creations,” concludes Zakorzhevsky. “It is, therefore, critical that all users install Java updates from Oracle in a timely manner.”