The missing link connecting the attacks against Apple, Facebook and possibly Twitter is a popular iOS mobile developers’ forum called iphonedevsdk which was discovered hosting malware in an apparent watering hole attack that has likely snared victims at hundreds of organizations beyond the big three.
This appears to be a textbook watering hole attack where unconnected victims linked by a common interest visit a compromised website which redirects them to the attack site hosting malware. The malware then would enable an attacker to maintain some type of persistence within the target organization.
“In the purest sense, you’ll see very subtle and graceful attempts to compromise sites that have virtually nothing to do with one another in terms of content, but at a higher geo-political level such as with the high tech or defense industrial base, there is a commonality,” said Will Gragido, senior manager for RSA Security’s FirstWatch Advanced Research Intelligence team. “They’ll look for vulnerabilities on the site, post a redirection tag and catch some targets of opportunity affiliated with a target of interest; by doing that, they can go upstream to compromise the target of interest.”
Romang proposed these attacks were not highly targeted against a particular company, and he may be right with a number of reports surfacing that the attacks against Facebook and Apple hit Mac OS X machines with a Java zero-day exploit, and that hundreds of tech and defense industrial base firms may have been hit as well. The attackers may have been trying to gain a widespread foothold inside some popular mobile applications, rather than simply attack Apple or Facebook developers.
“I don’t think it is a ‘highly’ targeted attack, because it is just another watering hole campaign with another Java 0day,” Romang told Threatpost via email. “Maybe what was sophisticated in this case is that the deployed malware was hitting Mac OS X computers.”
Yesterday, Chris Wakelin, a researcher, posted on Twitter that an exploit for CVE-2013-0431 had been discovered in the Cool Exploit Kit. This vulnerability is the second bug discovered by Adam Gowdiak in the MBeanInstantiator in Java in early January which was incompletely patched by Oracle; it enables a complete Java sandbox bypass, Gowdiak wrote on the Full Disclosure mailing list.
Facebook disclosed last Friday that a number of its employees’ laptops had been compromised by malware that targeted a Java zero day and was able to bypass the platform’s sandbox. Apple made its disclosure yesterday that it had been hit by the same crew that attacked Facebook and by the same exploit. The company said that a small number of Mac OS X machines had been infected, but a report by Reuters said that the same attack was used against Apple machines at many other companies.
Twitter, meanwhile, has not fessed up to being part of the same attack, but the timeline corresponds, Romang said. Twitter reported on Feb. 1 that it was alerting users that up to 250,000 accounts may have been compromised and that session tokens and passwords may have been accessed. It also recommended that users disable the Java browser plug-in.
In the meantime, the Java security world has been in total flux during since late last year. Similar watering hole attacks against the Council on Foreign Relations website, as well as a number of human rights and manufacturing sites worldwide, were blamed on fresh Java exploits against previously unreported vulnerabilities. Oracle had also sent out three Java updates between Dec. 11 and Feb. 1, including Java SE 7 Update 11 which changed by default the security settings in Java from medium to high, requiring manual approval for the execution of unsigned Java applets. Likely, the developers compromised in this attack weren’t running an up to date version of Java, or were allowing the execution of untrusted Java apps, Romang said.