[websense] Fake ‘Amazon order’ email exploits recent Java vulnerability CVE 2012-4681

[SX-News]

Fake ‘Amazon order’ email exploits recent Java vulnerability CVE 2012-4681

Description :  
<p class="MsoNormal"]Following our recent blog posts regarding the propagation of
Java vulnerability CVE-2012-4681 (New
Java 0-day used in small number of attacks) and its subsequent inclusion in
the infamous Blackhole Exploit Kit (New
Java 0-day added to Blackhole Exploit Kit), &nbsp;the Websense&reg;
ThreatSeeker&reg; Network has detected a new malicious email campaign purporting to
be an order verification email from Amazon directing victims to a page
containing the recent Java exploit.
<p class="MsoNormal"]&nbsp;
<p class="MsoNormal"]If successful, this exploit could allow the cyber-criminals
behind this campaign to deliver further malicious payloads to the victim&rsquo;s
machine which, for example, could lead to the exfiltration of personal and
financial data.
<p class="MsoNormal"]&nbsp;
<p class="MsoNormal"]Oracle have released an out-of-band patch for this Java
vulnerability (Oracle
release Java 1.7.0_07 to fix CVE-2012-4681) and Websense customers are
protected from this and other threats by ACE&trade;, our Advanced Classification
Engine.
<p class="MsoNormal"]&nbsp;
<p class="MsoNormal"]
<p class="MsoNormal"]On 1^st September, Websense&reg; ThreatSeeker&reg; Network
intercepted over 10,000 malicious emails with the subject &lsquo;You Order With
Amazon.com&rsquo; enticing the recipient to &lsquo;click here&rsquo; to verify a fictitious <span>order </span>as shown in this sample: &nbsp;&nbsp;
&nbsp;
<img alt="" border="0" src="http://community.websense.com/resized-image.ashx/__size/550x0/__key/CommunityServer.Blogs.Components.WeblogFiles/securitylabs/0447.Amazon1_2D00_1.jpg" />
&nbsp;
&nbsp;
<p class="MsoNormal"]Once the victim has clicked the link, they are redirected to
an obfuscated page hosting the Blackhole
Exploit Kit &ndash; in this case, hxxp://atjoviygdm.dnset.com/main.php?page=8e2cf5bb67d777a4
. The Payload view below highlights the Java Archive &lsquo;Leh.jar&rsquo; which is
then used to exploit CVE-2012-4681
should the victim&rsquo;s machine be vulnerable, an analysis of this file can also be
found on VirusTotal.
<p class="MsoNormal"]&nbsp;
<img alt="" border="0" src="http://community.websense.com/resized-image.ashx/__size/550x0/__key/CommunityServer.Blogs.Components.WeblogFiles/securitylabs/5417.Amazon2_2D00_2.jpg" />
&nbsp;
<p class="MsoNormal"]The obfuscated JavaScript above (de-obfuscated version below) attempts to profile the visiting
machine, such as determining the browser type and version as well as the Adobe
Flash, Adobe Reader and Java versions, and then <span>based
on</span> this information select<span>s</span> the
&lsquo;best&rsquo; exploit to use against this particular victim. &nbsp;&nbsp;
&nbsp;
<img alt="" border="0" height="505" src="http://community.websense.com/resized-image.ashx/__size/550x0/__key/CommunityServer.Blogs.Components.WeblogFiles/securitylabs/6518.amazon3.jpg" width="570" />
&nbsp;
&nbsp;
<p class="MsoNormal"]This email campaign further illustrates the ingenuity and
speed at which cyber-criminals package and propagate malicious content along
with social-engineering techniques in order to exploit both recent software
vulnerabilities and the trusting nature of end-users.
<p class="MsoNormal"]&nbsp;<div style="clear: both;"]</div>

Lien : http://community.websense.com/blogs/securitylabs/archive/2012/09/03/amazon-order-email-campaign-lead-to-blackhole-utilizing-new-java-vulnerability.aspx