4 ms·
The applet itself is pretty straightforward: it downloads the real payload, called "AdobeUpdate-Setup1.84.exe", from g2f.nl/0lczsoo and then runs it. By default
by teraflop 14y ago
The applet itself is pretty straightforward: it downloads the real payload, called "AdobeUpdate-Setup1.84.exe", from g2f.nl/0lczsoo and then runs it. By default, applets don't have permission to access the local filesystem or start processes, but this one has a digital signature which means the user is prompted to give it elevated permissions.
- TazeTSchnitzel 14y agoAh, that explains why it could get away with "Runtime.getRuntime().exec(str9);". Now, the thing is, I don't think the forum user mentioned clicking anything. However, it's possible they've stolen the signature from something else, which that person has previously chosen to "Always Accept"? (I don't know if Java lets you do that)
- teraflop 14y agoSince I don't have an mtgox account, and I have a fair degree of confidence that the code posted can't possibly escape the Java sandbox, I decided to live dangerously and try loading the page. Here's the warning screen that comes up when you load it: http://i.imgur.com/sXDoFLt.png http://i.imgur.com/sXDoFLt.png Note the self-signed certificate from "North Sumatra". Gotta say, I have no sympathy for someone who clicks through that warning screen and then complains that their credentials got stolen.
- obilgic 14y agoOps :/ today I just clicked through that screen to run the bitcoin miner i downloaded from bitminter.com. Because I did not realize that, this is a warning from java, really confusing.
- TazeTSchnitzel 14y agoWell, you had downloaded an application and you were fairly sure of its purpose, I can't blame you there.
- pokoleo 14y agoI'm pretty skeptical, so this isn't good enough for me.
- trotsky 14y agoUsually these exploit kits will use useragent and the reported plugins to decide what versions of the page to send. If this is a pro job if you were running an exploitable version of java (which a majority of people tend to be) it would push an applet that used an exploit to load its stage 2. But if it decides it doesn't have an exploit for you it takes a different approach like scareware or prompt to run etc.
- gphil 14y agoI think this may have been possible due to the purported Java exploit mentioned in the post: "I then discovered that the site is loaded with a java script which, based on an initial analysis by my java programmer friend, is a 0 day java exploit with a cross site injection attack, which automatically started."
- amalag 14y agoHow did that executable transfer his bitcoins?
- dolphenstein 14y agoIt didn't. "AdobeUpdate-Setup1.84.exe" is the executable that did the damage.
- amalag 14y agoYes, I understand the java applet executed the next file. How did the "AdobeUpdate-Setup1.84.exe" executable do the transfer?
- jacquesm 14y agoIf it has file access permissions it can scan for wallet.dat in a few likely locations and then simply upload that file to a server, then delete the original and you're pretty sure that you'll have time enough to register a transaction with the bitcoin network.
- amalag 14y agoOK thank you. So is the wallet.dat related to MtGox at all or is it just a standard bitcoin wallet file used by the standard clients?
- ghshephard 14y agoIt's a Bitcoin concept. It's where your actual bitcoins are stored. https://en.bitcoin.it/wiki/Securing_your_wallet https://en.bitcoin.it/wiki/Securing_your_wallet
- phormula 14y agobitcoins were not stolen from a local wallet, rather they were withdrawn from his mtgox account to the thief's address.
- tomjen3 14y agoIt also means that we can find out who made it by looking at the signature. Unless there is somewhere you can buy a java signature with bitcoins.
- teraflop 14y agoThe certificate is self-signed, which narrows it down to "somebody capable of downloading a copy of the JDK".