Slashdot Mirror
A Tidal Wave of Java Flaw Exploitation
tsu doh nimh writes "Microsoft warned today that it is witnessing a huge spike in the exploitation of Java vulnerabilities on the Windows platform, and that attacks on Java security holes now far outpace the exploitation of Adobe PDF bugs. The Microsoft announcement cites research by blogger Brian Krebs, who has been warning for several months that Java vulnerabilities are showing up as the top moneymakers for those peddling commercial crimeware exploitation kits, such as Eleonore, Crimepack and SEO Sploit Pack."
Several days ago, Oracle released a patch that fixed 29 Java security flaws.
The one question this article doesn't really clarify is pretty important: How are these exploits being loaded onto the user's computer?
Are we talking applets, Java web start, or some other mechanism?
There's no -1 for "I don't get it."
Seeing Oracle and Java all in the same sentence gives me a nervous tick...the same nervous tick that I developed when I read MS was in talks to acquire Adobe.
FTA: The Java spike in Q3 is primarily driven by attacks on three vulnerabilities, which all, by the way, have had patches available for them for some time now.
So unpatched machines are vulnerable. Perhaps people don't auto-update Java as often.
People are angry at Oracle for screwing Sun so they are writing exploits for revenge.
So now not only are PDFs and Java processing landmines, they're now viral landmines as well.
This creates a huge issue for the company I provide support for. We have so far not updated beyond 6u20. That is the last version of the JVM to carry the "Sun Microsystems" label instead of something referencing Oracle.
Some divisions of this company (and I would assume others as well) still run apps that seem to be incompatible with anything above 6u20 for this reason. Oracle's poor stewardship toward the Java platform has lead to a situation where we will have to make a decision on a per workstation basis whether to lose access to some important applications, or remain vulnerable to Java exploits for an unknown and possibly indefinite period of time.
What's annoying is there is no real "patch" as such. You have to install the entire 77mb package from scratch and it installs crap like the yahoo toolbar by default.
I'm still in the process of repairing my Windows system after a Java-transmitted virus. A hacked website was sending out malware to visitors via Java applet, and the only solution I found was a format/reinstall. Since then, I've disabled Java on all my machines; the only things I've seen it used for are crappy browser games and malware.
So fix your broken government department's IT policy.
Yeah, because nobody ever runs Java applets on Windows...
Remember to maintain your supply of
Yeah, they should have used ActiveX, right?
There's no -1 for "I don't get it."
You are missing the point. If you are distributing a JVM to run your application, chances are you are only running your code, and you are doing so outside a sandbox.
Untrusted Java code is typically run either as a web browser applet, or as a Java web start application. Typical scenerio: User visits bad web page (or sees a bad ad) with a Java applet. It loads, exploits a vulnerability in the Java sandbox, and executes its code. Applets are in the browsers code domain, so it is possible that the web browser may catch that. Java web start is a bit tricker to get the user to start up, but it executes in its own domain.
Many of the vulnerabilities seem to be tied to deserialization, which is not surprising, given that Java deserializes objects using reflection and magic to set fields and bypass execution of the constructor. The approach makes it easier to write serializable objects, but makes it harder to check everything.
+1 Funny (very bad attempt at trolling).
Stick Men
Anyone who would deploy a JVMs on windows instead of Linux is probably writing crap code in the first place.
I can't believe someone Trolled me...
"Seven years of college down the drain. Might as well join the f-ing Peace Corps." - John 'Bluto' Blutarsky
But Lynx lacks that little button with "Allow scripts..." pop-up menu.
You don't have to be vulnerable. The listed exploits were patched in Update 22, last spring.
Update available here.
DoublePlusKarmaWhoreGoodness: For best protection, run a Mozilla browser with the NoScript add-on. (AdBlockPlus and RemoveItPermanently make great complements to NoScript, too.)
I can see the fnords!
Since MS has posted this list of exploits that were fixed on Update 22(last spring!) is it safe to assume that Microsoft is simply trying to redirect people who complain about Adobe's security vulnerabilities to look at Java with bigger contempt so Microsoft can buy Adobe and still claim that their software is the most secure?
Seems a bit odd to me that Microsoft would be trying to improve Adobe's image when they need to be looking at their own. Perhaps they ARE looking at their own image because Adobe will soon be a part of Microsoft.
Is there a way to disable java across all browsers, but keep it installed for other software like openoffice?
I.e. block all applet functionality, but still allow local java code to run?
That would make maintaining friend's pcs a lot easier. They never update on time, and when they do, I always have to remove a new bundled browser toolbar again.
If the infections were coming via Java Applets then it becomes pertinent to ask how did they get on the machine. Java appplets must be signed to write to the user's hard drive. This means the user was prompted to approve an untrusted certificate and they did so, or the malware organisation had a trusted certificate, in which case the trust authority should revoke the certificate. It is not like applets are without protection to the end user.
In other news, Microsoft profits were down somewhat this quarter. Sources at Microsoft cited an increase in overtime expenses as the cause.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
I think this speaks to the need to not run plug-ins in the browser. To only HTML/JavaScript. Ie don't allow the PDF plugin, don't allow Flash, don't allow Silverlight, don't allow Java Applets. All of these proprietary plug-ins cause all kinds of security problems. They have proven to be a bad idea. I think Steve Jobs is on the right track banning them from the iPhone/iPad.
what is so hard about using the 1.5 jre for this particular app and the modern still supported 1.6 jre for the rest of the system ?
Jehovah be praised, Oracle was not selected
An awful lot of big organisations are terrified of upgrading anything in case things stop working (and of course, nobody wants to be the one who suggested the upgrade if it all goes wrong). I've seen so many places that will not move past IE6 and Java 1.4 because they daren't risk their clunky old systems not working anymore.
Cress, cress, lovely lovely cress
When I finally had some time (and was fed up with the nagging), I typed "jucheck.exe unknown publisher" in Google. I waded my way through the hits warning me that it was probably a virus and that I should do a "free scan" with their anti-virus software (any .exe seems to bring up these scams). After reading some forums,
I began to feel that it was probably OK, although I didn't
find a crystal clear answer that made me totally confident.
I was a little nervous when I finally allowed it to run, but it
seemed to install the Java update OK.
I don't know how the "cautious" average user is supposed to deal with this. (Of course, an ordinary average user would just let it run, which is why they get viruses.) Why do they give it such a cryptic name? What's the deal with the "Unknown publisher"?
I happen to be in charge of our government IT policy. I will henceforth dictate that all government departments' IT policy be fixed to accomodate Oracle products henceforth. There, howzzat?
1. Reformat/reinstall.
If something got by an anti-virus app, and managed an infection, a rootkit is almost certainly one of the first things downloaded by the malware (assuming that the malware is botnet-focused rather than just simple vandalism). The initial infection is almost never the one that carries the payload (the software that the person who deployed the malware really wants to run); the usual sequence is infect--rootkit--get instructions from a website/IRC channel--download payload--wait for instructions to execute payload.
So even if you clean the initial infector, the rootkit may still be there, which your AV software may or may not detect. If not, the downloaded payloads have a good chance of being undetected, in which case they appear as just another service or startup item. Payloads seldom do anything exploitative, in that they're doing ordinary appish things (sending emails, reading files, uploading data, visiting a website or IRC channel), and thus can be difficult to detect just from their behavior.
Therefore, if someone's PC is infected, you don't know what other goodies have been downloaded since the initial infection. Nuke it from orbit,t hat's the only way to be sure.
(boot from a Linux CD, mount your hard drives read-only, back off your data, scan that data, then reinstall your OS and apps including an initial reformat. Anything else and you might miss something.)
Everybody gets what the majority deserves.
It's not a surprise that there are a lot of unpatched systems out there. Java's stealth-mode installation pretty much guarantees it.
I know what I'm doing. The machine on my desk is one I built myself from parts (won't do that again; these days an off the shelf system costs a great deal less than the sum of its parts). Every bit of software is there because I decided it should be--or so I thought. This post got me curious.
I've never consciously installed or enabled java on this machine and yet, in the java program directory there's a jdk and three jre's.
Jdk?! I haven't done any coding in java in over six years, and not on this machine. Two of the jre's have the same time stamp, the third seems to be the most recent.
Let's look at the control panel--yup, there's a java icon. Bring up the dialog and auto update is not enabled. So I have an old version of the jre, an older version of the jdk, and no idea why they're there.
I'm supposed to know they should be patched?
I'm a Programmer. That's one level above Software Engineer and one level below Engineer.
..laughed my cotton socks off. Thanks.
The reason why Java's never updated is that it's automatic updater is annoying. It always shows up as soon as a boot up my computer, and then tells me I need to reboot. Now, given that normal people like to USE their computers; and given that many corporate computers take forever to boot up, something like this is going to remain ignored. Just think, after waiting 5+ minutes while my computer boots up, do you think I'm going to reboot again for something I've never heard of nor, as far as I know, use?
The Java updater needs to be a lot better. It's like that annoying crack addict that hits you up for money every time you walk down the street.
No, I will not work for your startup
So far there has not been a single buffer overflow targetting pure Java code because, well... The Java specs simply make this impossible (or the hypotetical JVM that would be affected wouldn't be complying with the Sun/Oracle Java specs and hence wouldn't be a "JVM")
Clearly the solution is to rewrite the JVM in Java.
Comment removed based on user account deletion
It depends how they are using them. If they are keeping private copies and only using them to run trusted software I don't see any big problem.
OTOH if they are installing old versions systemwide that is BAD.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Unlike the Macrocost implementation of it C# or whatever.
In other news OS2 is the most secure system ever, too bad no one is using it....
Tsukasa: All I really want, is to be left alone...
That's why I suggested this years ago:
http://lists.w3.org/Archives/Public/www-html/2002May/0021.html
http://www.mail-archive.com/mozilla-security@mozilla.org/msg01448.html
I think mozilla are finally trying to do something about it:
https://developer.mozilla.org/en/Security/CSP
But after so many years, worms and exploits...
Thats why you get one computer, update it, spend some time making sure the old apps run and if they do, roll it out companywide.
If they dont run, you either dont roll the updates out or you find newer versions of the apps that do run.
Companies that refuse to update past IE6 or update the JVM or whatever because they have known incompatibilities with important apps are fine. Companies that refuse to update because there MIGHT be issuse (and they dont know either way because no-one has bothered to do some testing) are the problem.
I noticed something like this yesterday, where some idiot's rooted blog was trying to drive-by a bunch of PDFs, which were mime-typed as jars so they spawned the Java quickstart kludge. In my case they didn't get anywhere since my debugger fired up, but I on a non-developer workstation they probably could have had a field day.
Cue endless Java and Adobe bashing in 3...2...1...
-Billco, Fnarg.com
Try Secunia PSI. It will scan your system for any software that needs to be updated. http://secunia.com/vulnerability_scanning/personal/
Two of the three cited vulns aren't actually buffer overflows. It's badly written Java code that other Java code can exploit to escape from the sandbox.
Just to clear up some of the confusion. The news of the recent release fixing 29 vulnerabilities isn't directly related to the 3 vulnerabilities cited as the biggest Java threats, as fixes for these were released earlier.
CVE-2008-5353 was fixed in December 2008 with Java 6 update 11.
CVE-2010-0094 was fixed in the spring of 2010 with Java 6 update 19.
CVE-2009-3867 was fixed with Java 6 update 17 (november 2009?).
Not that the latest version we're all running isn't vulnerable to a ton of other stuff.
Indeed. Most of the Enterprise(tm) world is probably completely safe from these attacks. At least till 2027 when they upgrade to the vulnerable versions.
I always get the stupid bho.
Damnit. Why does Sun not do anything.