Slashdot Mirror
Brazilian Coders Are Pioneering the First Cross-OS Malware Using JAR Files
An anonymous reader writes: Criminal gangs in Brazil are experimenting with the first malware families that are packaged as JAR files, capable of being deployed to Windows, Linux, Mac, and even Android from the same codebase, instead of relying on 4 different versions. Right now, only the malware dropper, a component used to infect computers with banking trojans, seems to have been coded in Java, but security experts expect a full-blown banking trojan to soon follow.
It wouldn't need to run as a browser plugin. The idea here is to use some other exploit to gain access and drop the .jar file onto the system, then run it as a regular local application. I suspect a lot of people have it because Oracle's made deals to have it included on the manufacturer's images, and those people don't have a clue what Java is or how to remove it so that's a problem.
I am, however, surprised it took them this long to come up with this idea. It's fairly standard on Unix systems, that's how cross-platform scripting of all sorts is done.
Ah, but if the malware needs a Java Runtime Enviroment then it can just install that, too. :)
The bigger question, though, is whether being the language of choice for writing malware is a plus or a minus for a language. I mean, let's say someone writes some very clever malware in C. Does that mean that C is a powerful and expressive language? Or does it mean that C is the devil?
Well, that's a bad analogy because we already know that C is the devil. But you get the picture.
There's no Java for CP/M-Z80, so I'm safe from being target by cross platform malware [or being targeted by applications in general].
But perhaps some day you'll need permission from Oracle to run the malwarez. That'd progress.
Guess all those memories of viruses from the 80's containing executable code valid on multiple processors are all my fevered imagination. Who knew that the first cross-OS malware was definitely only being written now, in 2016, in Java.
Wait, no, just the dropper. Congrats guys, you've discovered a platform-independent way of opening a stream from somewhere on the internet and dumping it to a file. Definitely pushing the envelope of Java to do that, I mean it's not like it comes with any sockets or file API specifically designed for stuff like that.
Give me a break. I was hoping to hear about something actually creative, like PDF or jpeg with multiple exploits for common Windows/Mac/Linux viewers or decode libraries, that causes a jump into the appropriate shellcode for each platform depending on what it's viewed on. This story is a non-event.
tl;dr: nearly all banks require jre here.
As a Brazilian, i must say: a LOT of lazy coders rely on java for everything.
i am not bashing java, i meant relying on it for EVERYTHING.
(even on my cs graduation some teachers where promoting java as the only language you will ever use, forever)
to make things worse, they usually make very sloppy code, that even rely on older, vulnerable and discontinued jre versions.
(not kidding, the government is the main culprit and even run critical web stuff that still require i.e. 6.0 emulation to work)
and well.. awkwardly speaking, nearly all banks require jre. (some do offer workarounds)
is to strip out all of the Java shit for each new session. Lots of Java shit probably for i2p but I don't believe in having Java on any system, Live or Installed.
"First Cross-OS Malware Using JAR Files"
I used to have that one. It was developed by Sun, and called the Java plugin.
Well, that's a bad analogy because we already know that C is the devil. But you get the picture.
Well, any reasonably skilled programmer have several deals with the devil, and for about half of them the devil feels he got the short end of the stick.
My comments are usually ascii pentagrams, but they only show with a tabsize of 4.
*cross-platform scripting* usually involves perl, sh or similar scripting language. There really is no need to use java for that. And no, it isn't standard at all. If I need java on a system for a new fancy software I always have to install it first. You get flash preinstalled more often than java.
It also isn't that hard to deploy a miniperl to provide a runtime on systems without built-in perl (aka windows).
How exactly does this JAR file get downloaded and executed on a Linux system, without enduser action.
Kinda like writing,
German auto workers are faking emissions
or
Catholic priests are molesting children in London
or
Dice employees used to be the lowest form of life
If you catch my drift. If not, the next elevator fart you smell was mine.
I haven't had Java installed for years, so good luck with the JAR.
"Java: write once, run anywhere"
Sorry, couldn't help.
I don't think so.
http://virus.wikidot.com/esperanto
Anyone interested in arduino for starters?
another reason to uninstall java.
Unicode killed the ASCII-art *
You forgot to mention that a lot of people also use Java applications.
Write once, pwn everwhere!
Monstar L
2008: http://citeseerx.ist.psu.edu/v...
2009: https://en.wikipedia.org/wiki/...
2010: https://nakedsecurity.sophos.c...
Look what some moron said about the same subject back in 2011:
http://www.developers.slashdot...
2012: https://www.intego.com/mac-sec...
2012: http://www.zdnet.com/article/c...
2012: http://www.infosecisland.com/b...
etc., etc.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
That's a lot of coders. Gonna be a hard project to manage.
Yeah, I've never installed jre.... until I started android dev roflmo. Shame on google for choosing this shit.
Uhhh...last I checked everyone that has Minecraft has Java, that is a LOT of Java installs.
That is why I hate the git that made Minecraft, after years of watching Java die on the desktop here comes this twirp that makes an insanely popular game in java and BAM! Piles of shitty Java installs cropping up everywhere.
ACs don't waste your time replying, your posts are never seen by me.
The idea here is to use some other exploit to gain access and drop the .jar file onto the system, then run it as a regular local application.
If malware gains local application code execution, then the target user is pretty much farked anyways -- the language used is irrelevant.
meep
I only run Minecraft from the launcher, so I can still at least leave the browser plug-in disabled.
That is why I hate the git that made Minecraft, after years of watching Java die on the desktop here comes this twirp that makes an insanely popular game in java and BAM! Piles of shitty Java installs cropping up everywhere.
How about just how fucking incompetent a game programmer he is? There are at least three clones of minecraft which are more technically competent. They don't punch your computer in the nuts half as hard. It's a good thing he got rich on minecraft because he sure didn't have a second chance
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I'm a Brazillian that works with IT, and it's the first time that I'm hearing something about it: it seems to me like a pretty bad-made SCAM :/
* I may be wrong, but I doubt it :P
Who cares.
This is why OS architectures like Qubes are important. This is why Linux systems (and everything else) should work more like that. It is also why the principle of least authority needs to make its way out of textbooks and into real life. Malware like this can work because it is given permission to work. There is no reason things need to be that way, except for laziness of programmers.
John_Chalisque
Brazilians rely on JRE to process their income tax.
Linux is for people who don't mind RTFM.
I wish our crackers were more patriotic. Last week, we learned about some malware that fails to work in computers located in Russia; why can't our malware coders create pieces of malware that *fail* when they find a JRE?
Linux is for people who don't mind RTFM.
It's written like a piece on an OSS project. When I got to the end, I was thinking, "Why are these researchers making malware?" Had to go back and re-read the first two words.
Almost all internet banking systems in Brazil require the JRE to be installed. That's why it is so effective,
Download some Minecraft mods, take a peek inside.
All the more insidious because generally it is children installing said mods.
I am very small, utmostly microscopic.
Well, at least it is an upgrade from MS Word macros.
I need it to play Minecraft. So yes, yes I do.
You say things that offend me and I can deal with it. Can you?
So here we go,
mods for minecraft are jar files, I suppose this "hackers" will target the plethora of kids that install mods without checking if they come from proper source.
Almost every smart phone does. The browser thing is just irrelevant, you obviously do not understand anything about this ecosystem.
Achille Talon
Hop!
Don't mind the little fact that Macs don't even come with Java pre-installed anymore.
and for about half of them the devil feels he got the short end of the stick.
Correction, now they do contracting work for Him.
I have to have Java at home for Arduino programming unfortunately. Otherwise it would not be on my machine. The plug in for the browser is, of course, disabled.. At work most people need it - it is amazing how many enterprise apps from vendors (and from banks like CitiBank) require it and require the browser plugin.
...anything would smell bad to a person living near Guanabara Bay.
Almost every smart phone does.
Almost every smart phone, except for Android and iPhone where the JRE isn't available at all...
jar files will work in some places, but plenty of things' containers don't use anything written in Java, so they don't have Java installed.
The container that runs the web browser and email client would be a good example of one that doesn't need Java. Maybe this malware would be compatible with the OpenHAB container, though. Good luck, guys!
Do you also chmod 666 your every source file?
There are plenty of malware packages in PHP, Perl, Python, and Ruby that will search for vulnerable web apps, infiltrate a hosting account, then set up web-accessible shells written in the same languages and continue on to find more vulnerable apps and accounts.
This is false
it is a lie . WHY have about 2500 cross os malware......and some as old as 1999, in fact enjoy all the zombies and bots people....waves, they were made cross OS via hard work......
all your stupid is belong to publshers
JRE =! JVM. They still have JVMs (android even moved BACK to oracles and ditched Dalvik), properly crafted jars would still run.
Does anyone actually install a JRE any more?
Yeah, I didn't think it was very many.
Yes, lots of people install JREs.
The browser plugin isn't used much anymore, but there's lots of applications that use Java on a desktop (and lots, lots more that use it on servers, but I'll leave them alone for now.)
Some ones that come to mind are Minecraft, Eclipse (and a bunch of other programming IDEs and tools), Roboforge, OpenOffice, Vuze, Runescape, FreeCol, JOSM, Genj ...
There existed for a while a packed program that appeared as a DMG and EXE using Alternate Data streams. On execution it would use assembly to determine the OS ran on and jump to affected payload (INTEL ONLY, not RISC/PowerPC). On MAC would prompt with OpenGL commands, in Windows, visual basic or the like did the same "please put in password" attempts. This virus which I played with personally - was later blocked as Unknown packager in most AVs, and never really shined... But windows and MAC cross platform is still one of the most interesting viruses I have seen. Inspection of the executable showed the packing application was based on an android/iphone SDk platform - heavily tweaked and made to produce the "XZ" file. I saw this in 2012... and did run on both (MAC/windows) and appeared as different file names on each platform.
Hell, I haven't had Java installed in years, maybe a decade.
It was of limited use and screwed up other stuff, and it made my PC slow to a crawl.
Just cruising through this digital world at 33 1/3 rpm...
They still have JVMs
No they don't. all of he "JVM" stuff for ios runs on the development machine and does static translation to native code.
(android even moved BACK to oracles and ditched Dalvik)
No they didn't. They ditched the harmony project and started using the openjdk libraries.
The VM itself is still dalvik only instead of going right from dalvik opcodes to native code it goes dalvik->llvm->native code.
Android does not and has never supported java bytecode. You must recompile java bytecode to dalvik bytecode on your development ahead of time. Just like if you want to use java with ios. This means a jar file containing java bytecode will not and can not run on iPhones or android phones.
automatically converts and runs JRE files in Android?
I don't believe it.
You're kidding, right?
"So long and thanks for all the fish."
It's much more efficient to write the malware to be cross-platform and write droppers for different systems than to write and maintain several versions of the same malware for different systems. Use your fucking head.
It's quite easy to write a batch file that starts with shell shebang and a goto... No runtime, it works out of the box for most systems. Big problem with this approach is that you write the payload in two languages. Hence the jar which is a zip file, and can be shar-ed and uncompressed by either launchers.
All you need is java, really.
Yea he is so incompetent to get the idea to execution first and a billion on the way. Your just Jealous
If information wants to be free, why does my internet connection cost so much?
If we assume they are written in Java... then certainly we can do some profiling... just look for people with less hair.
Yea he is so incompetent to get the idea to execution first and a billion on the way. Your just Jealous
He wasn't the first to get the idea into a game, though. He was the first to make it popular. Sadly, popular and good are orthogonal axes on the chart.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Or in Ruby, or Python, or any number of other languages. Java's just another entry in the list here. Frankly I'd've expected the first cross-platform malware to be in Perl, and to have shown up at least 10 years ago. I'm not sure AV tools would even recognize a Perl program as malware...
All the more reason to quit using Java. The only thing that even uses it is Minecraft, and THAT game runs like molasses compared to the Mobile/Console versions which aren't Java.
If you write malware in C and compile in the CRT (C Runtime) then it doesn't need anything on the host OS to run as long as the host OS knows how to run it. So DOS/Win16, Win32, and Win64 all require separate binaries, but on the Mac "Fat binaries" can run on 64-bit, 32-bit, or PPC versions of OS X. Linux can technically run binaries meant for Mac, FreeBSD, or Windows so if the malware is designed to run on the common aspects of all the OS's (eg only uses raw sockets, no file i/o) it can technically run on anything.
But that's oversimplification. The reality is that you're more likely to get Malware on Android/Linux than you are MacOS X, and you only get Malware on Windows if you're not paying attention. This is the difference between Linux/OSX/BSD users and Windows users. The Unix-like OS's make a lot of assumptions and give little or no warning about what is running in the background and what is launching it, and effectively you have to run things as root in order to do a lot of maintenance activities. Windows users on the other hand just get a "Do you want to run this dangerous thing?" and click OK anyway, because they have no other option because they aren't provided with a reason why they might not want to. For example downloading a codec pack from sharky007 triggers this "this software is dangerous" warning and even Chrome won't allow it to be downloaded. Does it contain malware? I sure hope not. But then again the same software codecs are often used to engage in piracy, so I wouldn't put it past users to ignore the warnings if they are into the piracy business. I only installed it to try and get an old game with a stupid indeo 5 codec to work, and it still didn't work. Turns out I can just play the video files from the game directly in VLC.
This is what I mean though. The Indeo codec was disabled for security reasons, but because I want to play some damn game produced 18 years ago when Windows 98 was the OS everyone used and was totally swiss cheese for security, I can no longer play that part of the game without re-introducing the same security hole.
If you want to see a way to blow a hole in all operating systems security models, ffmpeg (libav) is available on every operating system, and finding an exploitable bug in a video advertisement (usually 300x250) in all web browsers that use libav is probably the path of least resistance.
Isn't that sweet of them? I bet they like to boil babies for a hobby.
Are you REALLY this fucking dumb or are you just such a giant fangirl that the thought of anybody pointing out that "ur fav game its bestest evar!" had a very poorly thought out backend make you rush to post without engaging your tiny brain? That is if it does exist.
I don't give a rat's ass if he made a good game or not what I DO give a fuck about is he used the most dangerous runtime in existence to make the fucking thing, for fucks sake he may have well used ActiveX for the level of risk he put his customers in. in this day and age when there are literally dozens of game engines to choose from makes his brain dead fucking choice all the more egregious and the only nice thing I can say about it is since MSFT bought it I'm sure it'll end up porting off Java which will be a truly wonderful day for everyone...well except for you who are apparently too dumb to understand anything complex like PC security or risk factors. Sorry I don't have time to break out MS Paint and draw you some pictures to explain in a way you can understand but I have grown up things to do kid.
ACs don't waste your time replying, your posts are never seen by me.
What the fuck are you talking about. The most dangerous run time environment? What the fuck are you talking about? because Someone finally after fucking years wrote a trojan in java? What about every buffer overflow, every other piece of malware ever written in the last 30 years! Yea because writing in C++ will be SOO much more secure? You are possibly the most technologically ignorant person on /.!