Slashdot Mirror
Browser Exploit Kits Using Built-In Java Feature
tsu doh nimh writes "Security experts from several different organizations are tracking an increase in Windows malware compromises via Java, although not from a vulnerability in Windows itself: the threat comes from a feature of Java that prompts the user to download and run a Java applet. Kaspersky said it saw a huge uptick in PCs compromised by Java exploits in December, but that the biggest change was the use of this Java feature for social engineering. Brian Krebs writes about this trend, and looks at two new exploit packs that are powered mainly by Java flaws, including one pack that advertises this feature as an exploit that works on all Java versions."
Download and run applet (Y/N)?
Java, or plugins.
Slashdot works fine without Javascript (don't use the newfangled stuff).
Time, NYTimes, many/most other sites are fine without JavaScript.
When you need it, just also use another browser with JavaScript/Java/plugins turned on. I use Chrome for normal browsing, and Chromium when Javascript's needed.
I'm not a lawyer, but I play one on the Internet. Blog
Yeah, I noticed that just about every Youtube downloader site seems to do this.
I refuse to run/install anything from I site I don't know just to leach files as it is inviting trouble.
Browser Exploit Equipment Using Built-In Java Feature
FTFY.
(flashback humor. you would have had to of been here a few days ago.)
You mean wetware is easier to exploit than software? Wow. Who'd a thunk it?
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
People who click "OK" on random dialogs that ask them to confirm installation of something they didn't ask for are targets for malware, and this is news... because it's using Java? Am I missing something?
"You cannot simultaneously prevent and prepare for war." -- Albert Einstein
It's been known for a while (among those in the security field at least) that signed Java applets have been a concern. A little more info:
http://www.cert.org/blogs/vuls/2008/06/signed_java_security_worse_tha.html
Browse without Javascript, Java, or plugins.
Or just browse without Java. I've had Java turned off for years, and don't miss it.
Disabling Javascript leads to degraded performance and a degraded UI on some sites (note I said degraded, not non-functional, just not as nice), so it's not something most people would want to do. Javascript is pretty well sandboxed now in any case, and many exploits are through image file handling or things like that, which you'd still be vulnerable to.
Your recommendation of another browser for Java would unfortunately leave users just as vulnerable, as they can be exploited just as easily through the other browser's Java.
PS Splitting a sentence between the post title and body is annoying, please use the title for an actual title.
... is that a signed Java applet is like any binary running on your box. People have the illusion that any applet is secure, signed or unsigned. And if you have admin rights, the hole will awesome.
I don't have Java installed on my Windows 7 machine. I'd removed it during Firefox install, and never needed it. A few functions in OpenOffice don't work; that's about it.
Whoever decided that the browser scripting language should be "Javascript" needs to be taken out back and shot.
No sig today...
I remove it from my linux boxes as well. I realized one day that there was no software that I use that was written in Java. Not a single thing. Problem solved.
Ha, I had a Java free 2010 because Java is irrelevant, starting on a Java free 2011 because it's a security concern.
I have a theory that the truth is never told during the nine-to-five hours. - Hunter S. Thompson
Build something that's foolproof, and only a fool will use it.
Sometimes the light at the end of the tunnel is the headlight of an oncoming train.
My first attempt at a commercial website, CardMeeting, is built around a large, unsigned applet. Those "Grant, Deny?" dialog boxes are poison to anyone in the know, and I surely would never visit any site with them. Unsigned applets don't need any security warning dialog because they are untrusted and therefore will receive no privileged access to the user's system. Unsigned == heavily sandboxed. "Unsigned" sounds like a bad thing though, so that's something I could never tout to my users. But in reality, I was looking out for them! :D
I had a heck of a time figuring out how to get the CardMeeting applet jar packed up with scripts and making the applet "stream" data the way it does. Yeargh, I remember that pain. Anyhow, it makes me really sad that news like this may lead people to disable java applets; I think the unsigned form of applets is very powerful and much safer for average users than Flash ever was. I wish there was a way in the browser to disable only signed applets. Perhaps Oracle could bring the hammer down and go ahead and disable them by default in the next Java release.
My new website ClubCompy is 100% HTML+JavaScript. I wrote this whole simulated operating environment to teach kids to code with just the browser. I hope I don't start seeing people disable JavaScript on their browsers, then I'd be outta business!
Dave
body is annoying, please use the title for an actual title.
I agree.
I wish there was a way in the browser to disable only signed applets.
Not in the browser, because that's not the browser's job, but it's in the JRE. There's a setting labeled "Allow user to grant permissions to signed content", which, if turned off, will prevent signed applets from ever being run, while still allowing unsigned applets.
It would be nice for Oracle to make the default settings more tightly secured, and let users "unsecure" as they see fit.
"You cannot simultaneously prevent and prepare for war." -- Albert Einstein
Oh, yes of course, in the Java Control Panel. You make a good point on controlling this from the browser. I recall a long time ago there was an "Enable Java" checkbox in the Firefox control panel alongside "Enable JavaScript", which is where I was coming from on that. Looking in my Firefox options panel, I see that checkbox is now gone. So, you are right, times two! :)
Seeing as how average users cannot be trusted to take care of themselves, I think disabling the default for users' granting permissions to applets would be the only responsible thing for Oracle to do!
Layperson to this sort of thing, is there a system that exists in which a group of administrators are simultaneously prompted when any user requires elevation to perform a task? The first administrator to answer kills the non-invasive prompt for all other members of the group, and admins are rated on their decision making and alacrity.
Nay?
Let's start a petition: all exe files should be removed from the internet right now, because they are a big security hole.
Not entirely a bad idea, if not practicable. There should be a bit more security if applications are installed not via visiting different sites each peddling its own software but via central "app stores". While independent developers might find the setup undemocratic in that they can't "sell" their applications directly to users, the "app store" model predates the Apple marketing term by at least a decade (late 1990s), finding its roots in the package management systems developed for Unix and GNU/Linux.
Problem In Chair Not In Computer - an acronym I prefer, it sounds like something people would already know so you can put it in places where it might be read by other techs or supervisors without too much worry that it will come back to haunt you.
The industrial revolution changed the amount of expertise an individual needed to produce a complex and reliable product to make end products generally less expensive and more reliable. It did so by moving specialization into ever smaller areas. The average user is tremendously unprepared to be an expert in every service they need their computer to provide. By pushing more and more of those services into the "cloud" the need for expertise by the end user is decreased. There are trade offs to be sure, but in the end most people are happy to relinquish control in favor of ease of use and reliability.
There has been a lot of speculation about what Apple is planning to do with its massive data centers and capital, so here's my guess:
People will still click dancing bunnies but the problems created by PICNIC errors will decrease as users are protected from themselves. The hearty few who still run local software will be the elite and the truly dangerous. The elite few will make wise system management decisions and the truly dangerous will reboot to a trusted system every couple months.
Yes, I keep putting quotes around "cloud" because I don't think the term is solid yet and I think most of the time it is marketing jargon for "somebody else's problem."
computer virus* - viruses, trojans, malware, worms etc
I'm not saying that this is a good path for the IT industry, computer users or society as a whole. I am saying that something along these lines is likely inevitable. iPods, smart phones, tablet computers and e-readers are all steps in this direction and I foresee the trend continuing and even accelerating. Azure, Chrome OS and Ubuntu One are already making headway into moving services to the cloud, really it is hard to imagine cloud services becoming less common.
B) Eliminate all the stupid users. This is frowned upon by society.