Security researchers from antivirus vendor Trend Micro have uncovered a piece of backdoor-type malware that
infects Java-based HTTP servers and allows attackers to execute malicious commands on the underlying systems.
The threat, known as BKDR_JAVAWAR.JG, comes in the form of a JavaServer Page (JSP), a type of Web page that can only be deployed and served from a specialized Web server with a Java servlet container, such as Apache Tomcat. (See also
"Security in 2013: The rise of mobile malware and fall of hacktivism.")
Once this page is deployed, the attacker can access it remotely and can use its functions to browse, upload, edit, delete, download or copy files from the infected system using a Web console interface. This is similar to the functionality provided by PHP-based backdoors, commonly known as PHP Web shells.
"Aside from gaining access to sensitive information, an attacker gains control of the infected system thru the backdoor and can carry out more malicious commands onto the vulnerable server," Trend Micro researchers said last week in a
blog post.
