Scammers attack payroll outsourcer

By Darren Pauli on Aug 7, 2012 8:09 AM
Filed under Security

Customers faced with Java exploit.

Criminals are targeting customers of business process outsourcing provider ADP with an attack designed to steal sensitive payroll information.

ADP provides outsourced human resources and payroll administration services to 600,000 organisations worldwide, including 7000 in Australia and New Zealand.

The phishing attacks attempt to direct payroll administrators in those customer organisations to malicious websites rigged with exploit kits.

Exploits targeted the recently patched Java Runtime Environment (JRE) HotSpot hole (CVE-2012-1723), and were encrypted and detected by only eight of the 41 anti-virus vendors on VirusTotal.

One attack, reported by some ADP customers, attempted to lure users to the infected sites with warnings that their organisations' digital certificates were close to expiry.

ADP issued an advisory (pdf) warning customers of the attacks and pledging to track down the offenders.

Some of the company's 7000 Australian and New Zealand customers include Beacon Lighting, YMCA Victoria and Turi Foods.

SANS incident handler Daniel Wesemann recommended customers secure the Java hole and warn staff.

“Make sure your HR and payroll folks are treated to another round of ‘don’t click on this link’ training. They are your first line of defence, and - given anti-virus' ineffectiveness - usually even your only line of defence,” Wesemann said.

Customers should examine email logs to learn the distinction between legitimate mail and phishing scams, he said.

“This knowledge is priceless during an incident, and might even help you to automatically block some of the more egregious phishes.”

Wesemann said users should uninstall the JRE if possible.

The scam is the latest of a boom in attacks exploiting CVE2012-1723 over the last month. Attacks had overtaken the previous major JRE hole (CVE-2012-0507) according to Microsoft malware analyst Jeong Wook.

Via Microsoft

The nature of the vulnerability meant that attackers could not hide the internals of exploit, making analysis easier. That made the hole less popular to malware writers, but hadn’t stymied interest.

Wook posted a technical analysis of the exploit and details on how to disable JRE.

 
Follow us on Facebook and Twitter
 

Copyright © SC Magazine, Australia

Scammers attack payroll outsourcer
 
 
 
 
 
Top Stories
Cloud office vendor taps Ingram for Aussie assault
Intermedia 'gets serious' in Australia, hires first local employee.
 
Sydney firm achieves first in SAP-owned marketplace
UltraServe the only cloud platform provider on Hybris Extend.
 
Avnet holds onto x86 in post-IBM era
Lenovo authorises distie globally.
 
Sign up to receive CRN email bulletins
   FOLLOW US...
Polls
Is Microsoft right to limit the reseller channel for Surface?

Latest Comments
CRN Magazine

Issue: 331 | September 2014

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.