MiniDuke exploits Adobe, Internet Explorer and Java

Spyware designed to infiltrate government networks can exploit Java, Adobe Reader and Internet Explorer vulnerabilities, researchers say.

Research of the malware called MiniDuke by Kaspersky Lab and CrySys Labs initially found that it relied on social engineering to deliver infected PDFs targeting Adobe Reader 9-11.

The attacks exploit CVE-2013-0640 that was patched by Adobe last month, Threatpost reported.

Once on a compromised machine, the attackers are able to copy and move files to their servers, create new directories, kill processes and install additional malware.

However new infection mechanisms have been revealed that rely on vulnerabilities in Java and Internet Explorer to infect victims.

The new vectors were found stored on a MiniDuke command and control (C&C) server that appeared to infect visitors using web-based vulnerabilities, Kaspersky Lab's Igor Soumenkov said.

The first page loaded two frames, a decoy web page and a page for launching attacks. The second page contained 88 lines, mostly JavaScript code, which identified the victim's browser and then served one of two exploits.

“Clients using Internet Explorer version 8 are served with about.htm, for other versions of the browser and for any other browser capable of running Java applets, the JavaScript code loads JavaApplet.html," Soumenkov said.

“Although the exploits were already known and published at the time of the attack, they were still very recent and could have worked against designated targets.

"As previously recommended, updating Windows, Java and Adobe Reader to the latest versions should provide a basic level of defence against the known MiniDuke attacks.”

Last week, Bitdefender discovered that a version of MiniDuke had been operating since 20th June 2011, predating a previous-seen version of the spyware by a year.

Bitdefender said that this sample sought encrypted C&C instructions via an active Twitter account, with a single instruction dated 21st February 2012. The 2011 version does not use Google to search for command and control instructions, but lays dormant if it can't connect to Twitter.

This article originally appeared at scmagazineuk.com