Another Java Zero-Day Vulnerability Hits Black Market

Call it malware cash and carry: Less than 24 hours after Oracle Sunday released a security update that addresses two critical zero-day vulnerabilities in Java that are being actively exploited by attackers, an online vulnerability seller began offering a brand-new Java bug for sale.

"On Monday, an administrator of an exclusive cybercrime forum posted a message saying he was selling a new Java 0day to a lucky two buyers. The cost: starting at $5,000 each," said security reporter Brian Krebs, who was the first to report the vulnerability sales offer.

What does a starting price of $5,000 buy? "The hacker forum admin's message ... promised weaponized and source code versions of the exploit. This seller also said his Java 0day -- in the latest version of Java (Java 7 Update 11) -- was not yet part of any exploit kits," said Krebs.

[ Does your business depend on Java? Here's how to stay secure. 10 Facts: Secure Java For Business Use. ]

But the new zero-day vulnerability was apparently already in at least one attacker's hands. "Code will be sold twice (it has been sold once already). It is not present in any known exploit pack including that very private version of [Blackhole] going for 10$k/month," read the notice, referring to the Cool Exploit Kit that was created by the developers of the Blackhole crimeware kit, which rents for $10,000 per month. "I will be accepting counter-bids if you wish to outbid the competition."

According to the sales notice, the zero-day vulnerability is ready to be used and includes support via personal message (PM) -- presumably via the hacking forum's chat system. "Simply modify the url in the php page that calls up the jar to your own executable url and you are set," read the hacker forum administrator's message. "You may pm me."

Krebs said on Wednesday that the hacking forum thread with the admin's zero-day vulnerability sales pitch has since been deleted, suggesting that the exploit has now been sold to a second buyer.

News that there's yet another zero-day Java vulnerability should lead businesses to ask whether running the Java browser plug-in, or using Java runtime environments to run enterprise applications, is worth the security risk.

Indeed, the two zero-day vulnerabilities spotted last week and patched on Sunday led the Department of Homeland security to warn that the Java browser plug-in should be avoided, if at all possible. If that's not feasible, security experts recommend locking down Java use to minimize the chance that a business will get exploited via some future zero-day vulnerability.

The slow speed with which Oracle patches Java vulnerabilities has also drawn criticism from security experts. Furthermore, some of Oracle's Java patching has been sloppy and has not fully addressed flaws being actively exploited by attackers. For example, while Oracle's Sunday patch fixed one of the two zero-day flaws being actively exploited in Java 7 by attackers, Oracle left the other flaw unpatched, though it used a change in security permissions to make the flaw more difficult for attackers to access.

The worry now is that attackers will be able to use a future zero-day vulnerability -- or perhaps the one that's now being offered for sale -- to access the vulnerability that was spotted last week and that remains unpatched. If exploited, that bug would enable an attacker to execute arbitrary code on a machine. As a result, the attacker could not only compromise the machine, but also steal any data on the device, and turn it into a node -- or zombie PC -- that's part of a larger, attacker-operated botnet.

In light of the vulnerability that wasn't fully addressed by Oracle's rush-patching job, "The message is clear: Java remains a big risk," said Trend Micro vulnerability research manager Pawan Kinger in a blog post.

Your employees are a critical part of your security program, particularly when it comes to the endpoint. Whether it's a PC, smartphone or tablet, your end users are on the front lines of phishing attempts and malware attacks. Read our Security: Get Users To Care report to find out how to keep your company safe. (Free registration required.)