- Microsoft Windows systems running Adobe Reader, Acrobat, or Oracle Java
On May 16, 2013, US-CERT was notified that both www.federalnewsradio[.]com and www.wtop[.]com had been compromised to redirect Internet Explorer users to an exploit kit. As of May 17, 2013, US-CERT analysis confirms that no malicious code remains on either site.
Any systems visiting running vulnerable versions of Adobe Reader or Acrobat or Oracle Java may have been compromised.
The exploit kit, once successful, delivers and executes a known variant of the ZeroAccess Trojan. Additionally, according to open source reporting, the malware also downloads and installs a variant of FakeAV/Kazy malware.
The ZeroAccess Trojan attempts to beacon to one of two hardcoded command-and-control addresses, 194[.]165[.]17[.]3 and 209[.]68[.]32[.]176. The beaconing occurs using an HTTP GET using the Opera/10 user-agent string.
After beaconing, the malware then downloads a custom Microsoft Cabinet file and the malware uses port 16464/udp to connect to the peer-to-peer network. This cabinet file contains several lists of IP addresses, as well as a fake flash installer.
Updated software that addresses the vulnerabilities referenced in this incident has been available for years. It is imperative to apply current security updates to software that is commonly targeted by attackers.
- Adobe provided updates for the Adobe Reader and Acrobat vulnerabilities (CVE-2009-0927 and CVE-2010-0188) in Adobe Security Bulletins APSB09-04 and APSB10-07 respectively.
- Oracle released Oracle Security Alert for CVE-2013-0422 to address the Java vulnerability.
In order to defend against additional vulnerabilities, install the most recent versions of Adobe Reader, Acrobat, and Oracle Java. At the time of publication, Adobe Security Bulletin APSB13-15 documents current security updates for Adobe Reader and Acrobat, and Oracle Java SE Critical Patch Update Advisory - April 2013 documents vulnerabilities addressed by Java 7 Update 21.
Identify Compromised Systems
Monitor activity to the following IP addresses as a potential indicator of compromise where permitted and practical:
Updated Solution section