A new worm exploiting a JBoss vulnerability that was patched in April 2010 is targeting unsecured servers and adding them to a botnet, security researchers are reporting. “The problem has been fixed last year, but there are apparently still a number of vulnerable installs out there,” Johannes Ullrich of the SANS Technology Institute writes. The older configuration of JBoss only authenticated GET and POST requests, but did not protect other HTTP request types or interfaces, so attackers could “use other methods to execute arbitrary code without authentication.”
“The worm affects users of JBoss Application Server who have not correctly secured their JMX consoles as well as users of older, unpatched versions of JBoss enterprise products,” Red Hat security response director Mark Cox writes in a blog, which points to both the April 2010 patch and instructions for securing the JMX console. “This worm propagates by connecting to unprotected JMX consoles, then uses the ability of the JMX console to execute arbitrary code in the context of the JBoss user.”
In addition to adding servers to a botnet, the worm can install a remote access tool giving the attacker control over the infected server, Kaspersky Lab reports. One user who set up a honeypot on a deliberately insecure JBoss server reports having explored the contents of the malicious payload and discovered that it “contained Perl Scripts to automatically connect the compromised host to an IRC Server and be part of a BOTNET.”
The new worm taking advantage of a long-fixed flaw points to the need for users to update their systems, both servers and PCs. A recent report by Microsoft found that 3.2 percent of malware was from exploits for which security updates had been available for at least a year, and another 2.4 percent were related to exploits for which an update was available for less than a year.
Read the comments on this post
Charted: Android Fragmentation
Michael DeGusta has done an amazing job charting the fragmentation of Android by visualizing the history of operating system updates on Android smartphones for sale in the United States.
Compare this to iPhone updates (which DeGusta did), and it paints a telling picture.
Writes DeGusta:
I don’t want to steal the guy’s thunder by reblogging the whole thing, so go check out his chart and solid analysis of what’s going on DeGusta’s his Tumblr blog.
Android
android.com
In July 2005, Google acquired Android, a small startup company based in Palo Alto, CA. Android’s co-founders who went to work at Google included Andy Rubin (co-founder of Danger), Rich Miner (co-founder of Wildfire), Nick Sears (once VP at T-Mobile), and Chris White (one of the first engineers at WebTV). At the time, little was known about the functions of Android other than they made software for mobile phones. This began rumors that Google was planning to enter...
Learn more