{"id":5911,"date":"2012-01-30T15:22:55","date_gmt":"2012-01-30T22:22:55","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=5911"},"modified":"2018-01-30T12:10:11","modified_gmt":"2018-01-30T19:10:11","slug":"cybercriminals-generate-malicious-java-applets-using-diy-tools","status":"publish","type":"post","link":"https://www.webroot.com/blog/2012\/01\/30\/cybercriminals-generate-malicious-java-applets-using-diy-tools\/","title":{"rendered":"Cybercriminals generate malicious Java applets using DIY tools"},"content":{"rendered":"<p>Who said there&#8217;s such a thing as a trusted Java applet?<\/p>\n<p>In situations where malicious attackers cannot directly <strong><a href=\"http:\/\/blog.webroot.com\/2012\/01\/25\/researchers-intercept-a-client-side-exploits-serving-malware-campaign\/\">exploit client-side vulnerabilities on the targeted host<\/a><\/strong>, they will turn to social engineering tricks, like legitimate-looking Java Applets, which will on the other hand silently download the malicious payload of the attacker, once the user confirms he trusts the Applet.<\/p>\n<p>Let&#8217;s profile a DIY (do-it-yourself) malicious Java Applet generator currently available for download at selected cybercrime-friendly online communities:<\/p>\n<p><!--more--><\/p>\n<p>Screenshot of the DIY malicious Java Applet generator:<\/p>\n<p style=\"text-align:center;\"><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/01\/malicious_jave_applet_generator_01.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter  wp-image-5921\" title=\"Malicious_Jave_Applet_Generator_01\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/01\/malicious_jave_applet_generator_01.png\" alt=\"\" width=\"368\" height=\"363\" \/><\/a><\/p>\n<p>By default, the DIY generator allows the creation of Java Applets mimicking a Photo Gallery, Camera Chat, Video Streaming, next to making it look like they&#8217;ve been issued by the following publishers &#8211; Adobe Systems Inc., Microsoft Corporation, and Sun Microsystems Inc. Naturally, they allow the use of \u00a0Custom Publisher, making it fairly easy for a malicious attacker to impersonate a well known brand.<\/p>\n<p>Here&#8217;s how a sample malicious Java Applet would look like, once generated:<\/p>\n<p style=\"text-align:center;\"><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/01\/malicious_jave_applet_generator_02.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter  wp-image-5922\" title=\"Malicious_Jave_Applet_Generator_02\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/01\/malicious_jave_applet_generator_02.png\" alt=\"\" width=\"316\" height=\"197\" \/><\/a><\/p>\n<p>As you can see, by default Java will notify the user that the publisher hasn&#8217;t been verified. However in this case, the malicious attacker simply used Facebook (Trusted) instead of just Facebook as a Class Name, attempting to socially engineer users into running the malicious Java Applet.<\/p>\n<p>Users are advised not to execute unsigned Java Applets.<\/p>\n<p><em>You can find more about Dancho Danchev at his\u00a0<strong><a href=\"http:\/\/nl.linkedin.com\/in\/danchodanchev\">LinkedIn Profile<\/a><\/strong>. You can also\u00a0<strong><a href=\"http:\/\/www.twitter.com\/danchodanchev\">follow him on \u00a0Twitter<\/a><\/strong>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Who said there&#8217;s such a thing as a trusted Java applet? In situations where malicious attackers cannot directly exploit client-side vulnerabilities on the targeted host, they will turn to social engineering tricks, like legitimate-looking Java Applets, which will on the other hand silently download the malicious payload of the attacker, once the user confirms he [&hellip;]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[9467,9463,9469,9473,9479,9471,4481,9475,9455,9459,9461,4487,9465,9457,9451,9453,9249,9477,4611],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/5911"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=5911"}],"version-history":[{"count":1,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/5911\/revisions"}],"predecessor-version":[{"id":23623,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/5911\/revisions\/23623"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=5911"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=5911"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=5911"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=5911"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}