Slashdot Mirror
Browser Exploit Kits Using Built-In Java Feature
tsu doh nimh writes "Security experts from several different organizations are tracking an increase in Windows malware compromises via Java, although not from a vulnerability in Windows itself: the threat comes from a feature of Java that prompts the user to download and run a Java applet. Kaspersky said it saw a huge uptick in PCs compromised by Java exploits in December, but that the biggest change was the use of this Java feature for social engineering. Brian Krebs writes about this trend, and looks at two new exploit packs that are powered mainly by Java flaws, including one pack that advertises this feature as an exploit that works on all Java versions."
Download and run applet (Y/N)?
People who click "OK" on random dialogs that ask them to confirm installation of something they didn't ask for are targets for malware, and this is news... because it's using Java? Am I missing something?
"You cannot simultaneously prevent and prepare for war." -- Albert Einstein
It's been known for a while (among those in the security field at least) that signed Java applets have been a concern. A little more info:
http://www.cert.org/blogs/vuls/2008/06/signed_java_security_worse_tha.html
Ignoring the fact that this has nothing to do with Javascript - or IE. Some of the things they listed are simple social engineering attacks. You visit the site, asks you to run the Java Applet, the Java applet is malicious code. And if you can compromise someone's website to redirect you to your own look-alike with a malicious Java Applet asking to run, that looks like another prime strategy.
The Java exploit is basically what takes what should be a seperate application and somehow gets more access than it should have, and probably installs something on the users computer like a trojan or worm.
Browsing in Chrome won't save you from this. This is (sort of) a problem with the way Java Applets are handled - or a problem with the way users interact with the web (take your pick). They're both contributors to the problem really.
... is that a signed Java applet is like any binary running on your box. People have the illusion that any applet is secure, signed or unsigned. And if you have admin rights, the hole will awesome.
Yep, any website which requires either Java or Quicktime is asking not to be viewed.
No sig today...
Yeah. Same with that guy who started calling it "Cloud" Services. I called up that Amazon Rep and he said he didn't know a thing about Fog machines.
Chrome loads mozilla plugins. So yes, it does support Java, and it is vulnerable if you have a mozilla Java plugin installed.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I use java regularly, NOAA's website loads animations, and overlays that way.
I like NOAA as I can get a variety of details that no one else seems to have though i tend to have to dig through their website for them.
i thought once I was found, but it was only a dream.
Build something that's foolproof, and only a fool will use it.
Sometimes the light at the end of the tunnel is the headlight of an oncoming train.
My first attempt at a commercial website, CardMeeting, is built around a large, unsigned applet. Those "Grant, Deny?" dialog boxes are poison to anyone in the know, and I surely would never visit any site with them. Unsigned applets don't need any security warning dialog because they are untrusted and therefore will receive no privileged access to the user's system. Unsigned == heavily sandboxed. "Unsigned" sounds like a bad thing though, so that's something I could never tout to my users. But in reality, I was looking out for them! :D
I had a heck of a time figuring out how to get the CardMeeting applet jar packed up with scripts and making the applet "stream" data the way it does. Yeargh, I remember that pain. Anyhow, it makes me really sad that news like this may lead people to disable java applets; I think the unsigned form of applets is very powerful and much safer for average users than Flash ever was. I wish there was a way in the browser to disable only signed applets. Perhaps Oracle could bring the hammer down and go ahead and disable them by default in the next Java release.
My new website ClubCompy is 100% HTML+JavaScript. I wrote this whole simulated operating environment to teach kids to code with just the browser. I hope I don't start seeing people disable JavaScript on their browsers, then I'd be outta business!
Dave
The name Javascript was picked as a marketing ploy by the developers of Netscape in the 1990's, owing to the Java Programming Language, which at the time was seen as the next big thing for the web. Thus, they were hoping to capitalize on the term. I agree that the similarity of names has caused a lot of confusion, however... although there's squat all that can be done about it now.
File under 'M' for 'Manic ranting'
I wish there was a way in the browser to disable only signed applets.
Not in the browser, because that's not the browser's job, but it's in the JRE. There's a setting labeled "Allow user to grant permissions to signed content", which, if turned off, will prevent signed applets from ever being run, while still allowing unsigned applets.
It would be nice for Oracle to make the default settings more tightly secured, and let users "unsecure" as they see fit.
"You cannot simultaneously prevent and prepare for war." -- Albert Einstein
I don't see strong evidence that Java applets pose a bigger risk than Flash applets or tricking users to download EXEs. I also think that if more attention had been paid to Java applets development and they'd kept up with Flash, we'd be in a lot better position today. Java applets are not specified by web standards, but it's a much more open technology than Flash. Of course, we'll ultimately be able to replace Flash with standard technologies.