Slashdot Mirror
A Tidal Wave of Java Flaw Exploitation
tsu doh nimh writes "Microsoft warned today that it is witnessing a huge spike in the exploitation of Java vulnerabilities on the Windows platform, and that attacks on Java security holes now far outpace the exploitation of Adobe PDF bugs. The Microsoft announcement cites research by blogger Brian Krebs, who has been warning for several months that Java vulnerabilities are showing up as the top moneymakers for those peddling commercial crimeware exploitation kits, such as Eleonore, Crimepack and SEO Sploit Pack."
Several days ago, Oracle released a patch that fixed 29 Java security flaws.
The one question this article doesn't really clarify is pretty important: How are these exploits being loaded onto the user's computer?
Are we talking applets, Java web start, or some other mechanism?
There's no -1 for "I don't get it."
Seeing Oracle and Java all in the same sentence gives me a nervous tick...the same nervous tick that I developed when I read MS was in talks to acquire Adobe.
FTA: The Java spike in Q3 is primarily driven by attacks on three vulnerabilities, which all, by the way, have had patches available for them for some time now.
So unpatched machines are vulnerable. Perhaps people don't auto-update Java as often.
People are angry at Oracle for screwing Sun so they are writing exploits for revenge.
Anyone who would deploy a JVMs on windows instead of Linux is probably writing crap code in the first place.
"Seven years of college down the drain. Might as well join the f-ing Peace Corps." - John 'Bluto' Blutarsky
Meanwhile, I continue to be forced to use Java 1.5 at work because a product supplied by Oracle (Discoverer) doesn't run properly on a newer version.
(At least the version our organization has doesn't work. There's a theoretical upgrade coming in November. Let's hope I don't get pwned before then.)
So now not only are PDFs and Java processing landmines, they're now viral landmines as well.
This creates a huge issue for the company I provide support for. We have so far not updated beyond 6u20. That is the last version of the JVM to carry the "Sun Microsystems" label instead of something referencing Oracle.
Some divisions of this company (and I would assume others as well) still run apps that seem to be incompatible with anything above 6u20 for this reason. Oracle's poor stewardship toward the Java platform has lead to a situation where we will have to make a decision on a per workstation basis whether to lose access to some important applications, or remain vulnerable to Java exploits for an unknown and possibly indefinite period of time.
What's annoying is there is no real "patch" as such. You have to install the entire 77mb package from scratch and it installs crap like the yahoo toolbar by default.
I'm still in the process of repairing my Windows system after a Java-transmitted virus. A hacked website was sending out malware to visitors via Java applet, and the only solution I found was a format/reinstall. Since then, I've disabled Java on all my machines; the only things I've seen it used for are crappy browser games and malware.
The latest Java patch comes with a prompt to add the Microsoft Bing toolbar.
+1 Funny (very bad attempt at trolling).
Stick Men
Java is Enterprise(tm).
You know, something that Ubuntu completely isn't. And it is not a thing to be updated willy nilly, by random developers. Here in the Enterprise(tm) world, we generally tend to, y'know, test shit thoroughly before launching/updating it.
/smarmy because I'm tired of people insisting the only valid solution for desktop Linux is also the only valid solution to running a server.
Users of FF + NoScript are relatively safe?
I've said it before and always seem to get modded dowen, but anyone who runs their system setup by default to execute random code from the internet just by visiting a web page is asking for trouble.
You should run things you have a *reason* to run, and a reason to trust. Don't just run anything from anywhere by default, that's stupid. Make a conscious decision. Use your brain! That's what it's there for: to let you make decisions about how to interact with the world around you.
People's computers get jacked because they don't care about what things they run. Even when you think it's sandboxed, there can still be flaws.
Turn off scripting by default! Run scripts on your bank site or whatever, where you have a REASON to and it's for your benefit. Don't just run any random shit that any random web page throws your way, that's idiotic.
You don't have to be vulnerable. The listed exploits were patched in Update 22, last spring.
Update available here.
DoublePlusKarmaWhoreGoodness: For best protection, run a Mozilla browser with the NoScript add-on. (AdBlockPlus and RemoveItPermanently make great complements to NoScript, too.)
I can see the fnords!
"Microsoft warned today ..." - that's how emails from idiots began 5 years ago.
Since MS has posted this list of exploits that were fixed on Update 22(last spring!) is it safe to assume that Microsoft is simply trying to redirect people who complain about Adobe's security vulnerabilities to look at Java with bigger contempt so Microsoft can buy Adobe and still claim that their software is the most secure?
Seems a bit odd to me that Microsoft would be trying to improve Adobe's image when they need to be looking at their own. Perhaps they ARE looking at their own image because Adobe will soon be a part of Microsoft.
Is there a way to disable java across all browsers, but keep it installed for other software like openoffice?
I.e. block all applet functionality, but still allow local java code to run?
That would make maintaining friend's pcs a lot easier. They never update on time, and when they do, I always have to remove a new bundled browser toolbar again.
If the infections were coming via Java Applets then it becomes pertinent to ask how did they get on the machine. Java appplets must be signed to write to the user's hard drive. This means the user was prompted to approve an untrusted certificate and they did so, or the malware organisation had a trusted certificate, in which case the trust authority should revoke the certificate. It is not like applets are without protection to the end user.
Not only does Cisco distribute ancient versions of java with most of their software, Cisco actually requires these ancient versions of java full of security holes to work.
And allegedly Cisco takes security seriously. I pointed this out to my sales rep, who didn't think this was a problem. What a POS (both Cisco and the sales rep).
And when you install Java you get the Yahoo toolbar, as well! (Unless you uncheck it.) It's like Sun (or Oracle, I don't know which) sat around a table and brainstormed ways to make Java appear as malware-ific as possible.
Great job guys. You're lucky Flex's mxmlc.exe (and now Minecraft) require Java or I'd have no use whatsoever for your tainted runtimes...
The Microsoft announcement cites research by blogger Brian Krebs, who has been warning for several months that Java vulnerabilities are showing up as the top moneymakers for those peddling commercial crimeware exploitation kits
That's a lot of qualifiers in that statement. Four of them, in fact. They are "commercial", "crimeware", "exploitation", and "kit".
Wow, Microsoft happens to have found one small segment of the malware market where a Microsoft vulnerability ISN'T the top money maker for malware authors.
They appear to have left out the "sold by purple gnomes on Tuesdays to fairies riding on pink ponies."
In other news, Microsoft profits were down somewhat this quarter. Sources at Microsoft cited an increase in overtime expenses as the cause.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
I think this speaks to the need to not run plug-ins in the browser. To only HTML/JavaScript. Ie don't allow the PDF plugin, don't allow Flash, don't allow Silverlight, don't allow Java Applets. All of these proprietary plug-ins cause all kinds of security problems. They have proven to be a bad idea. I think Steve Jobs is on the right track banning them from the iPhone/iPad.
then people would update more often without the worry of installing some additional (spy|crap)ware,
pre-checked toolbar installers should NEVER be included with security updates especially monthly ones and any company that does so should be publicly chastised (or just plain sued)
i guess Oracle isnt the successful billion dollar company we thought it was if they have to resort to installing bottom of the barrel shitty toolbars (which are a night mare in a corpoarte enviroment) to whoever pays them the most, dignity isn't even a consideration.
I think the best for everyone concerned is we simply remove Java from all machines
and stop supporting/recommending it as a platform, same as Adobes horrible Acrobat products,
the numerous security flaws and general incompetence or these companies now outweigh the benefits of using their products, its just easier to remove it permanently and not worry that 10,000 desktops now have some random advertising companies toolbar spying on them than deal with the 3 users that actually need the products specific features in the first place.
In a not-so-unexpected twist, all the buffer overflows leading to remote code execution are present... In the C-written part of the JVM/APIs.
Which is honestly, kinda very lol.
So far there has not been a single buffer overflow targetting pure Java code because, well... The Java specs simply make this impossible (or the hypotetical JVM that would be affected wouldn't be complying with the Sun/Oracle Java specs and hence wouldn't be a "JVM").
So, yup, once again... Buffer-overflow in C-written code. Film at 11.
When I finally had some time (and was fed up with the nagging), I typed "jucheck.exe unknown publisher" in Google. I waded my way through the hits warning me that it was probably a virus and that I should do a "free scan" with their anti-virus software (any .exe seems to bring up these scams). After reading some forums,
I began to feel that it was probably OK, although I didn't
find a crystal clear answer that made me totally confident.
I was a little nervous when I finally allowed it to run, but it
seemed to install the Java update OK.
I don't know how the "cautious" average user is supposed to deal with this. (Of course, an ordinary average user would just let it run, which is why they get viruses.) Why do they give it such a cryptic name? What's the deal with the "Unknown publisher"?
1. Reformat/reinstall.
If something got by an anti-virus app, and managed an infection, a rootkit is almost certainly one of the first things downloaded by the malware (assuming that the malware is botnet-focused rather than just simple vandalism). The initial infection is almost never the one that carries the payload (the software that the person who deployed the malware really wants to run); the usual sequence is infect--rootkit--get instructions from a website/IRC channel--download payload--wait for instructions to execute payload.
So even if you clean the initial infector, the rootkit may still be there, which your AV software may or may not detect. If not, the downloaded payloads have a good chance of being undetected, in which case they appear as just another service or startup item. Payloads seldom do anything exploitative, in that they're doing ordinary appish things (sending emails, reading files, uploading data, visiting a website or IRC channel), and thus can be difficult to detect just from their behavior.
Therefore, if someone's PC is infected, you don't know what other goodies have been downloaded since the initial infection. Nuke it from orbit,t hat's the only way to be sure.
(boot from a Linux CD, mount your hard drives read-only, back off your data, scan that data, then reinstall your OS and apps including an initial reformat. Anything else and you might miss something.)
Everybody gets what the majority deserves.
It's not a surprise that there are a lot of unpatched systems out there. Java's stealth-mode installation pretty much guarantees it.
I know what I'm doing. The machine on my desk is one I built myself from parts (won't do that again; these days an off the shelf system costs a great deal less than the sum of its parts). Every bit of software is there because I decided it should be--or so I thought. This post got me curious.
I've never consciously installed or enabled java on this machine and yet, in the java program directory there's a jdk and three jre's.
Jdk?! I haven't done any coding in java in over six years, and not on this machine. Two of the jre's have the same time stamp, the third seems to be the most recent.
Let's look at the control panel--yup, there's a java icon. Bring up the dialog and auto update is not enabled. So I have an old version of the jre, an older version of the jdk, and no idea why they're there.
I'm supposed to know they should be patched?
I'm a Programmer. That's one level above Software Engineer and one level below Engineer.
i bet Larry Ellison is regretting his purchase now, maybe wondering how big a can of worms Java really is... a platform indepedent can of worms that is.
..laughed my cotton socks off. Thanks.
Welcome to Java
Java provides safe and secure access to the world of amazing Java content.
Huh?
The reason why Java's never updated is that it's automatic updater is annoying. It always shows up as soon as a boot up my computer, and then tells me I need to reboot. Now, given that normal people like to USE their computers; and given that many corporate computers take forever to boot up, something like this is going to remain ignored. Just think, after waiting 5+ minutes while my computer boots up, do you think I'm going to reboot again for something I've never heard of nor, as far as I know, use?
The Java updater needs to be a lot better. It's like that annoying crack addict that hits you up for money every time you walk down the street.
No, I will not work for your startup
We run Ubuntu and I keep up with the automatic updates. Regardless, I am curious what damage is possible considering my family members have no sudo access.
So far there has not been a single buffer overflow targetting pure Java code because, well... The Java specs simply make this impossible (or the hypotetical JVM that would be affected wouldn't be complying with the Sun/Oracle Java specs and hence wouldn't be a "JVM")
Clearly the solution is to rewrite the JVM in Java.
It was only a matter of time, first everyone uses activeX and it's many holes, when more people began using other browsers they went after swf/pdf holes, but Adobe is apparently catching up, and the announced sandboxing in the next big version of reader, they're probably begining to migrate their efforts elsewhere, which basically leaves mostly just Java that is present on most machines.
Comment removed based on user account deletion
Unlike the Macrocost implementation of it C# or whatever.
In other news OS2 is the most secure system ever, too bad no one is using it....
Tsukasa: All I really want, is to be left alone...
I saw this go thru us-cert list the other day. IIRC there were some 85 vulnerabilities in Oracles database suite.
I was pissed to say the least. How stupid do you have to be to allow such a huge number of vulnerabilities accumulate into a single massive patch set? I can't say I'm surprised one bit that this shit is being explioted the way it is. Idiots.
I noticed something like this yesterday, where some idiot's rooted blog was trying to drive-by a bunch of PDFs, which were mime-typed as jars so they spawned the Java quickstart kludge. In my case they didn't get anywhere since my debugger fired up, but I on a non-developer workstation they probably could have had a field day.
Cue endless Java and Adobe bashing in 3...2...1...
-Billco, Fnarg.com
Try Secunia PSI. It will scan your system for any software that needs to be updated. http://secunia.com/vulnerability_scanning/personal/
Two of the three cited vulns aren't actually buffer overflows. It's badly written Java code that other Java code can exploit to escape from the sandbox.
Just to clear up some of the confusion. The news of the recent release fixing 29 vulnerabilities isn't directly related to the 3 vulnerabilities cited as the biggest Java threats, as fixes for these were released earlier.
CVE-2008-5353 was fixed in December 2008 with Java 6 update 11.
CVE-2010-0094 was fixed in the spring of 2010 with Java 6 update 19.
CVE-2009-3867 was fixed with Java 6 update 17 (november 2009?).
Not that the latest version we're all running isn't vulnerable to a ton of other stuff.
... people actually start using Java and find loads of bugs in it
What are the chances that a whole bunch of the same exploits going to attack NET? Or has that already happened? Remember, this is Microsoft we're talking about. They create a half-baked clone of a popular program, add some cheap veneer and a few dubious "features" and then go to market and hype the hell out of it.
http://secunia.com/advisories/product/12878/
That's for the JAVA runtime...
(NOW: If you wish to see more on the vulnerabilities in ANY of Sun Microsystems' other product lines, see here instead -> http://secunia.com/advisories/vendor/15/ )
APK
P.S.=> Hope that helps... apk
I always get the stupid bho.
Damnit. Why does Sun not do anything.
where is this java control panel please?