Java and Flash vulnerabilities being exploited by cyber-spies

Cyber-spies have planted Java- and Flash-exploiting malware on web sites focused on human rights, defence and foreign policy. Over the last two weeks, the Shadowserver Foundation, a nonprofit group that tracks internet threats, has discovered several such compromised web pages that download the malware through visitors' browsers. The malware, which exploits known flaws in Adobe Flash and Java, is aimed at Mac and Windows systems.

Sites that were serving malware at the beginning of this week were for the Centre for Defence Information, a research group for US national security; Amnesty International Hong Kong, the Cambodian Ministry of Foreign Affairs, and the International Institute of Counter-Terrorism at the Interdisciplinary Centre in Herzliya, Israel, Shadowserver said. Last week, security vendor Websense reported that the site of Amnesty International United Kingdom was serving Java-exploiting malware.

Such targeted attacks have become a major problem for corporations, particularly those within the defence industry or manufacturing. In its 2011 annual security report, network equipment maker Cisco found that cyber criminals were moving from large-scale attacks using spam to working for organisations that pay handsomely for electronic documents stolen from particular international corporations and law firms, government agencies and research organisations.