Forest Global Training Partners

Cyber Risks · Cisco Talos

Java Web Start or as it should be called "Sure go ahead and run what you like"

Summary: Immunity published a blog post describing a method to bypass Java security warnings by setting the __applet_ssv_validated parameter to true through the Java Web Start framework's jnlp XML document, allowing older JRE versions to run without user validation. Exploit kit builders, most notably Blackhole, adopted the technique immediately, and writers later obfuscated it using a jnlp_embedded parameter carrying the base64-encoded exploit in its value field.

Key Takeaway: This was described as one of the simplest Java exploits to appear in the prior year, and Blackhole picked it up right away - a low-complexity bypass that commodity exploit kits can fold into their rotation within days of publication.

Read the original at Cisco Talos ↗

Topics
Malware
Related