Opportunistic hackers have created a malicious software that masquerades as a Java patch, barely a week after technology giant Oracle released two patches for its Java programming language.
According to fraud analyst Paul Pajeras of Trend Micro, the malware gets downloaded through the backdoor once the user installs a bogus update, enabling the fraudsters to take control of the victim’s computer.
“Once executed, this backdoor connects to a remote server that enables a possible attacker to take control of the infected system,” Pajeras said, adding that users should only download updates from the Oracle websites.
According to some Internet security experts, the malware does not exploit the vulnerabilities in Java that Oracle patched on Sunday, but leads the user to downloading a different piece of malware.
For now, according to the experts, users who have Java in their computers and do not use it frequently should uninstall it to reduce the risk of an attack, or disable its usage under a Web browser.
“So, how can you use Java safely? First, the Java threat largely comes from malicious applets that come from malicious websites. If you have Java installed because an application needs it, then you can disable Java in your browser(s) without affecting your user experience,” said Jonathan Leopando.
Last week Oracle security experts, researchers and analysts discovered a vulnerability in the Java software and advised all users to disable the software.
