January 17, 2013, 8:22 PM — Trend Micro has spotted a piece of malicious software that masquerades as the latest patch for Java, a typically opportunistic move by hackers.
The latest version of Java is Update 11. Trend Micro wrote on its blog that it was alerted to a fake "Java Update 11" present on at least one website. If a user installs the bogus update, a malicious backdoor program is downloaded.
"Once executed, this backdoor connects to a remote server that enables a possible attacker to take control of the infected system," wrote Paul Pajares, a fraud analyst with Trend.
Hackers often disguise their malware as a legitimate software update in the hope of confusing IT staff. Interestingly in this case, the fake update doesn't actually exploit the vulnerabilities that Oracle patched on Sunday, Pajares wrote. The user is tricked into downloading a different piece of malware.
"The use of fake software updates is an old social engineering tactic," Pajares wrote. "This is not the first time that cybercriminals took advantage of software updates."
Pajares advised users to download updates only from Oracle's website. Trend Micro, along with other computer security firms and experts, are generally advising that users uninstall Java if it isn't needed, which helps eliminate exposure to the risks from software flaws.