Java zero day infections increase

An exploit that takes advantage of a gaping hole in Java has exploded across the globe, researchers say.

Kaspersky researcher Kurt Baumgartner said the cases number in the thousands, primarily in the United States, Russia and Germany.

Malware analysts first spotted the Java exploit on 17 Decemeber, but it wasn't until last week that infection rates began soaring. Soon after, news of the zero day became public knowledge.

A chart created by Kaspersky also pointed to a significant number of victims in Italy, Canada, Britain and other parts of Europe, where, in some cases, users that clicked on ads were redirected to malicious web pages that served the malware.

These web pages hosted the BlackHole exploit kit, currently the most prevalent toolkit of its kind on the black market, which is often used to spread malicious code that leverages vulnerabilities in popular software like Java.

“There appears to be multiple ad networks redirecting to BlackHole sites, amplifying the mass exploitation problem,” Baumgartner said.

“We have seen ads from legitimate sites, especially in the UK, Brazil, and Russia, redirecting to domains hosting the current BlackHole implementation delivering the Java zero-day. These sites include weather sites, news sites, and of course, adult sites.”

In addition to BlackHole, the Java zero-day has been added to the Cool, Nuclear and Red Kit exploit kits, which are commercially available in criminal forums.

A patch for the flaw has been released.

This article originally appeared at scmagazineus.com