Malicious Java applet sign with stolen certs

Users are being duped into running a malicious Java applet that was signed with a stolen digital certificate and designed to look like a security update.

The malicious file appeared to victims as a “Java ClearWeb Security Update” and was discovered on a German online dictionary site that was compromised by an exploit kit dubbed g01pack. 

According to Security researcher Eric Romang, the stolen private key used to sign the applet belongs to CLEAResult Consulting, a Texas-based energy efficiency firm. The company is listed as the publisher of the application in the fake security update that Romang screen-grabbed.

AVAST threat intelligence director Jindrich Kubec said default security settings in Java exacerbated the threat for users. There is no word yet on what Java vulnerability was being exploited, though there have been a number of bugs in the platform that recently have surfaced.

“My Java has ‘check certificates for revocation,' turned off,” Kubec tweeted, referencing the issue. “[It] also has ‘enable granting elevated access to self-signed apps,' [set] to on.”

This article originally appeared at scmagazineus.com