Slashdot Mirror

← Back to Stories (view on slashdot.org)

Web Exploit Found That Customizes Attack For Windows, Mac, and Linux

Posted by Soulskill on from the making-everyone-feel-special dept.

phaedrus5001 writes with this quote from Ars: "Security researchers have found a live Web exploit that detects if the target is running Windows, Mac OS X, or Linux and drops a different trojan for each platform. The attack was spotted by researchers from antivirus provider F-Secure on a Columbian transport website, presumably after third-party attackers compromised it. The unidentified site then displayed a signed Java applet that checked if the user's computer is running Windows, Mac OS X, or Linux. Based on the outcome, the attack then downloads the appropriate files for each platform."

136 of 204 comments (clear)

  1. Columbian transport website? by Kenja · · Score: 4, Funny

    Is that where the "domestic pharmaceutical procurement facilitators" meet?

    --

    "Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
    1. Re:Columbian transport website? by Anonymous Coward · · Score: 2, Informative

      This is an open source tool called SET its used for penetration testers -- Applet code here -- https://svn.secmaniac.com/social_engineering_toolkit/src/webattack/java_applet/

    2. Re:Columbian transport website? by Anonymous Coward · · Score: 2, Insightful

      Yep, just more hype and FUD clickbait.

      It's an ordinary Java applet, with all the rights and controls of every other Java applet, except this applet was a pen-tester written by TrustedSec, then found by "researchers" from F-Secure. It downloads a file specific to the OS it's running on and....
      ...no more information from F-Sec

      This has beat up written all over it.

  2. Blah by mystikkman · · Score: 5, Funny

    When are the malware writers going to support BSD?

    1. Re:Blah by leaen · · Score: 1

      They do not support HURD

    2. Re:Blah by MickyTheIdiot · · Score: 1

      They don't support Plan 9? What BS.

    3. Re:Blah by kiriath · · Score: 3, Informative

      Well, OS X is built on BSD so technically they kinda do?

    4. Re:Blah by Gerzel · · Score: 3, Interesting

      No it isn't. The largest BSD distro is Machintosh!

    5. Re:Blah by hairyfeet · · Score: 5, Interesting

      The sad part is the BSD guys would write them a thank you note for bothering to remember them.

      So can we ALL just accept now there is no "Magical OS" that makes one immune from malware please? All OSes are EXTREMELY complex piles of code, having to support tens of thousands of drivers, scheduling and tasking, hell I doubt even Linus can tell you when you launch program Foo every single interaction that is taking place in the system, there is simply more there than any one person can know.

      Now that the retard that made XP run by default as admin has been sent packing on the short bus all three major OSes have limited users, hell Windows even has the browser run as a low rights entity to help lower the risk. Now that all three major OSes have common sense defaults ultimately it all comes down to the USER and whether they will take the time to actually think or will simply allow anything to run. I've seen it a billion times in the shop, a fully patched and AVed machine get infected NOT because of the OS but because it was the USER that refused to listen to the warnings being given him/her and choosing instead to run it anyway.

      At the end of the day the only foolproof way to get rid of malware is to take away the user's right to control their own machine, to instead stick them in a walled garden where only approved apps get run. i think we can all agree having some corporation own our machines would be a BAD thing so all we can do is warn users, try to make ever hardened systems, and be ready to clean up the messes when they happen. After Android became a hit it was only a matter of time before Linux got put in the crosshairs and now that day appears to be here and I for one will be interested to see how the community reacts.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    6. Re:Blah by scialex · · Score: 2

      We'll show them; The year of the Plan-9 desktop is at hand.

    7. Re:Blah by AliasMarlowe · · Score: 4, Informative

      They don't even support Linux properly. Even if it's actually effective on Linux, you'd have to explicitly agree to run the exploit and then type in your password to install the stupid thing. And that would only work if you're in the sudoers group or logged in as root; otherwise, it's no go. What kind of malware is that???

      Interesting note: although example screenshots were given for the malware on Windows and OSX, there were none for Linux. Maybe it does not work at all on Linux, and the code people are foaming over is just a leftover fragment for identifying the client OS.

      --
      Those who can make you believe absurdities can make you commit atrocities. - Voltaire
    8. Re:Blah by sconeu · · Score: 1

      Whoosh.

      --
      General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
    9. Re:Blah by Compaqt · · Score: 5, Insightful

      I haven't tried the exploit, but again:

      On my machine, all the important stuff is in the /home directory.

      There's nothing really interesting in the "system". I don't even really care about the system. It's just an ISO download away from reinstall.

      My files, on the other hand, are what's important.

      --
      I'm not a lawyer, but I play one on the Internet. Blog
    10. Re:Blah by Compaqt · · Score: 1

      What should desktop Linux users do to avoid the malware from the article?

      --
      I'm not a lawyer, but I play one on the Internet. Blog
    11. Re:Blah by Em+Adespoton · · Score: 3, Insightful

      They don't even support Linux properly. Even if it's actually effective on Linux, you'd have to explicitly agree to run the exploit and then type in your password to install the stupid thing. And that would only work if you're in the sudoers group or logged in as root; otherwise, it's no go. What kind of malware is that???

      Interesting note: although example screenshots were given for the malware on Windows and OSX, there were none for Linux. Maybe it does not work at all on Linux, and the code people are foaming over is just a leftover fragment for identifying the client OS.

      Same argument goes for Windows and OS X -- and the argument is wrong. You can have software that happily installs in your home directory and has full access to userland files -- which to be honest is everything that's actually important on your computer; non-userland stuff can just be re-installed from scratch if needed.

      From what I've seen, the stuff normally dropped on Linux systems tends to be shell scripts and the like, and they don't tend to look like much in screen shots.

    12. Re:Blah by Em+Adespoton · · Score: 1

      Never. Netcraft has confirmed it... BSD is dead.

      Netcraft still exists?

    13. Re:Blah by Anonymous Coward · · Score: 1

      Disable/remove the Java plugin from your web browser like you should have done ten years ago.

    14. Re:Blah by Pf0tzenpfritz · · Score: 2

      Now that all three major OSes have common sense defaults ultimately it all comes down to the USER [...] and I for one will be interested to see how the community reacts.

      Pah... We'll just patch the user each first tuesday of the month. No big difference...

      --
      Oh, the beautiful gloss of greality!
    15. Re:Blah by wmbetts · · Score: 4, Insightful

      1) Disable Java by default. I have yet to have a website that I use regularly not work, because Java doesn't run. Whitelist the sites you want to Java on.

      2) Don't blindly click and enter your password at every prompt

      Those two things alone would make you immune to this.

      --
      "Ubuntu" -- an African word, meaning "Slackware is too hard for me". - stolen from Dan C alt.os.linux.slackware
    16. Re:Blah by lipanitech · · Score: 1

      The problem with any OS is once it gains market share it becomes a target. Since Mac OS is running a stroked BSD would not take much to make a pure BSD hack.

      --
      http://thetechnologygeek.org/
    17. Re:Blah by Anonymous Coward · · Score: 1

      Include Adobe Acrobat and Flash Player on point one and you're saiyan.

    18. Re:Blah by Baseclass · · Score: 2

      NoScript

      --
      ^^vv<><>BA
    19. Re:Blah by strikethree · · Score: 3, Interesting

      which to be honest is everything that's actually important on your computer; non-userland stuff can just be re-installed from scratch if needed.

      I keep seeing this meme which seems to be promoting the idea that userland infection >= system level infection by claiming (mostly correctly) that the only important files to the user are in the users own directory.

      You have backups of /home right? So what is the problem with restoring it. Losing /home is NOT the worst thing that can happen to you. Having a virus that you can not detect is. Let's see how happy you are when your files start getting corrupted and keep getting corrupted and you have no idea why. System level infection is far worse than userland so can we let this meme die now please?

      --
      "Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen
    20. Re:Blah by ozmanjusri · · Score: 1

      it was only a matter of time before Linux got put in the crosshairs and now that day appears to be here

      Perhaps.

      But being in the crosshairs isn't the same as being hit. I haven't seen any evidence this "exploit" actually works on Linux.

      For a start, there's only this one article with almost no real information, repeated all over the web. There are no Linux screenshots, and all I can glean from the text is that the malware is actually an open-source pen-testing tool called the Social-Engineer Toolkit (SET), which has always included the Linux compatibility code. In fact, it's no different from any other self-signed Java applet which a user can choose to run by accepting the prompt. SET is being used to download OS-specific payloads, but there's no information about the Linux one except that it's 1Mb in size. It could be a pic of the Colombian transport guy's nanna for all we know.

      It's always disappointing to reports like this hyped up on Slashdot. I keep hoping people here would be a little more informed than average, because this isn't an advanced exploit, or really even an exploit. It's a Java applet.and the "advanced exploit" part is nothing but some if-else code to download an OS-specific file.There's nothing interesting or exciting about that - Java had that capability since it was first built..

      There's no doubt it's possible to write malware for Linux, but the jury's not in on this one being it.

      --
      "I've got more toys than Teruhisa Kitahara."
    21. Re:Blah by r_naked · · Score: 1

      "At the end of the day the only foolproof way to get rid of malware is to take away the user's right to control their own machine, to instead stick them in a walled garden where only approved apps get run."

      That is exactly what I had to do for my parents. I created four non-admin accounts:

      1 - Games (this is for my mom to play online games)
      2 - Mom (This is the account my mom uses for email (whitelisted), and dumping pics, etc). This account has no access to a web browser.
      3 - Dad (ditto for this account).
      4 - Bank (This account has a browser that is pointed at a simple web proxy that has a whitelist of addresses. They can only get to their bank, and various other bill pay sites)

      I trained them to use the "Games" account if they want to browse the web for "fun". I told them to feel free to click on anything they want. If it prompts for an admin password, not only do they not have it, but if they did, they know they should hit cancel.

      This setup has worked great. I was stopping by to check their machine about once a week just to be sure, but I haven't even had to wipe the "Games" account in a LONG time, but when I do the rest of the machine is clean.

      Is this overkill? Maybe, but they are 70+ years old, and it makes my life a WHOLE lot easier.

      Windows 7 is an outstanding OS, it is real shame that MS is fucking it all up with Win 8.

      -- Brian

      --
      -- http://anonet.org -- The internet the way it was meant to be. Check it out, you may be surprised.
    22. Re:Blah by shutdown+-p+now · · Score: 1

      ~ or %HomePath% is where people keep their documents - including things such as, say, filled out tax returns, and other things that have tons of personally identifying information in them that is quite valuable for the kind of people that tend to run malware. Also, a lot of people either use webmail with saved password (or "stay logged in"), or a mail client configured to fetch everything by default with no password prompt, which again makes the contents of your emails directly accessible to any malware running under your account.

    23. Re:Blah by Alastair+Gilfillan · · Score: 1

      They don't even support Linux properly.

      If you can't get it to run normally, try WINE unstable. Possibly one less reason to keep a dual-boot...?

    24. Re:Blah by Anonymous Coward · · Score: 1

      Actually the type of malware which aims at destroying your files or simply annoying you is the exception these days. What counts is whether the malware can run (most home directories are on file systems mounted with execute rights), has access to the network so it can be part of a botnet or communicate with some C&C server (if you didn't have network account, you wouldn't have gotten the web malware in the first place), possibly can intercept your keyboard for grabbing passwords (securing the keyboard for password entry on X seems to have gone out of fashion), and maybe can intercept other things.

      It is still true that malware can do more things when getting root, though (e.g. changing the computer's DNS entriesis not possible on Linux without getting root).

    25. Re:Blah by logicassasin · · Score: 1

      Then don't visit that site. I run noscript on my Windows and Linux desktops, sites that refuse to play nice, don't get my traffic. If more people would stop visiting these sites, their ad revenue will start to be impacted. Once you hurt their bottom line, they will start to wonder why and may stumble across a post like this one and they may get the point.

      Then again, they were stupid enough to do this int he first place... Their response might be "WE NEEDS MOAR ADS FOR TEH MONAYS SO I CAN BUY A NEW BENZ!!!"

      --
      Fifty watts per channel, baby cakes.
    26. Re:Blah by Em+Adespoton · · Score: 2

      which to be honest is everything that's actually important on your computer; non-userland stuff can just be re-installed from scratch if needed.

      I keep seeing this meme which seems to be promoting the idea that userland infection >= system level infection by claiming (mostly correctly) that the only important files to the user are in the users own directory.

      You have backups of /home right? So what is the problem with restoring it. Losing /home is NOT the worst thing that can happen to you. Having a virus that you can not detect is. Let's see how happy you are when your files start getting corrupted and keep getting corrupted and you have no idea why. System level infection is far worse than userland so can we let this meme die now please?

      OK, now let's look at what I said and what you said.

      Me: Most of what is actually important to you is accessible from userland
      You: There's a meme right now about how the only important files to the user are in the user's own directory

      See the difference?

      What I was pointing out is that malware can do most of what it needs to do these days without ever leaving userland. For those tasks like setting up a rootkit, hosts poisoning, cross-user spreading, etc. that DO require more privileges (but which are a small piece of the attack space these days), there's always social engineering and privilege escalation.

      The reason the "meme" is here is that it's not a meme -- these days, organized computer criminals are mostly using malware to exfiltrate data, hold data hostage ("ransomware"), run botnets, send spam, and mine bitcoins -- and NONE of these operations require root. The argument is a direct response to the longstanding "I run linux, and I set up my privilege separation properly, so I'm safe from malware" "meme" which turns out to be mostly beside the point these days.

      It's kind of like saying "drunk driving is not an issue for me because I drive a tank, and no drunk driver is going to damage my tank" -- completely missing the point that you shouldn't (just) be worried about your vehicle (the OS) being damaged by an attack, but the contents of that vehicle, even when they're somewhere else.

      Sure, rootkits are a problem. Securing your OS is a sensible part of layered security (just like securing your hardware). But someone stating that they're safe from malware attack while their userland security is virtually nonexistent is disingenuous at best.

      System level infection is only far worse than userland if you've got a system level infection. If you keep getting userland infections, it doesn't really matter whether it's because the entire system is compromised or just that there's a hole in your userland security that keeps getting exploited remotely. The end result is the same (even if the potential damage from a system level infection is greater).

      As an aside, I actually find that the main issue on Linux is not userland infection at all -- it's service-based infection; MySQL injections, compromised LAMP installs, etc. Same rule goes, as Apache is basically just another user: the attacker gains full access to this space, and can snarf the data, use the service for their own purposes, store their own stuff there, and generally use your computer service as if it was their own.

    27. Re:Blah by hairyfeet · · Score: 1

      And that exact same advice frankly works just as well on Windows but if the user doesn't follow it you are screwed.

      Ultimately there is only so much you can do technically against the dancing bunny problem because if the user WANTS to see the bunnies, and you try to stop the user from getting to the bunnies? they will happily thwart any and ALL security measures you put in their way to see the bunnies. Again I've seen this with my very own two eyes, i even had to throw a guy out of the shop once when he removed his fricking AV because it wouldn't let him have "The New Limewire" which I had ALREADY TOLD HIM was a fake trojan and had even gone so far as to give him eMule and BT so he wouldn't be needing it, but in the end he liked Limewire, refused to believe Limewire was dead, and when a malware writer offered him a fake that the AV pointed out was nothing but a trojan he simply removed the AV. His final words as I was pushing him out of the shop was "It says right there its the new limewire so you MAKE IT WORK!"

      In the end OSes and AVs have frankly never been better, but if the user refuses to listen or show even the tiniest bit of common sense? Well you just can't fix stupid.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    28. Re:Blah by hairyfeet · · Score: 1

      I do something similar for my customers, I always make them a low rights account for any friends/kids/etc that come over and when the owner is in their account while i can't lock them down as well as you can I give them Comodo Dragon with ABP, since Dragon runs in low rights mode, and on top of that I give them Comodo CIS AV which has sandboxing and scan before load on web pages. Both are free and since doing so my customers getting nasty bugs has frankly dropped right off the chart. You'd be surprised how much those three little steps help, ABP, low rights browser and sandboxing. you take the web out of the equation and there goes the bugs.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    29. Re:Blah by wmbetts · · Score: 1

      I wasn't talking about javascript. He was talking directly about this attack. Disabling Java not Javascript is what would stop it. I just double checked BofA as well. It worked fine with Java and Flash disabled. It is pretty stupid it won't without javascript though. The only thing I can think of is maybe to try and stop bots, but even that is dumb. It's trivial to embed webkit, use the webbrowser object, etc to parse js.

      --
      "Ubuntu" -- an African word, meaning "Slackware is too hard for me". - stolen from Dan C alt.os.linux.slackware
    30. Re:Blah by npsimons · · Score: 1

      I keep hoping people here would be a little more informed than average

      Ah, see there's your mistake: not in assuming that the general crowd at slashdot is smarter than average (they are); you are overestimating the average level of intelligence.

      --
      Nathan's blog
    31. Re:Blah by Penguinclaw · · Score: 1

      Wonder if it affects android? Users are much more willy nilly at installing anything if it looks cool.........

    32. Re:Blah by Penguinclaw · · Score: 1

      Totally agree with Hairyfeet. Education is the best way to inform people about the real world of modern computing. The number of times I've had people ask for help and they didn't even know they needed to run AV software. I think schools should start this as they can educate parents. In the UK ITC as it's called just concentrates on word, excel etc. No concept of how a pc operates is taught. No basic security training or awareness of malware types and how to harden your system. No basic programming (apparently the first year in a computing degree is wasted by teaching students what they already should know!). Get real those that are responsible for education, we NEED better IT taught at school so that every child has a rounded background and those that want to take it further can do so. One of the IT terachers from a nameless local school hadn't heard of linux (shock in itself) but the schools server was ubuntu!!! Things need to change and hopefully soon.

  3. COLOMBIAN....not "Columbian" by Anonymous Coward · · Score: 2, Informative

    Please learn how to spell.

    1. Re:COLOMBIAN....not "Columbian" by Anonymous Coward · · Score: 2, Informative

      Maybe it was a website about the bus lines in Columbia, South Carolina.

    2. Re:COLOMBIAN....not "Columbian" by saveferrousoxide · · Score: 2

      Because! Damnit. Though I would argue more for spelling proper nouns as the originator would spell them (assuming the phonetics work out -- and the alphabet, but transliteration is a whole different ballgame) since, ya know, it's their name an' all.

    3. Re:COLOMBIAN....not "Columbian" by Baloroth · · Score: 3, Informative

      Ironically, "Columbia" is the correct spelling in English (taken from "Columbus"). "Colombia" is the Spanish spelling (taken from "Colón"). Since English doesn't have the "ó", we use a "u" instead. Now, being a proper name you can use either (English is very flexible), but the English spelling is "Columbia".

      --
      "None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
    4. Re:COLOMBIAN....not "Columbian" by Cinder6 · · Score: 2

      I initially read this as "Coulombian transport website", which had me confused...

      --
      If you can't convince them, convict them.
    5. Re:COLOMBIAN....not "Columbian" by jsepeta · · Score: 2

      or run by the dedicated fanbois of Christopher Columbus?

      --
      Remember kids, if you're not paying for the service, YOU ARE THE PRODUCT THAT IS BEING SOLD.
    6. Re:COLOMBIAN....not "Columbian" by John+Hasler · · Score: 5, Informative

      Perhaps, but in American "Columbia" refers either to the river or to the district while "Colombia" refers to the nation in South America. "Columbia" is also an archaic term for the USA, as in "Columbia Gem of the Ocean".

      --
      Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
    7. Re:COLOMBIAN....not "Columbian" by sosume · · Score: 2

      Wrong. Although both are named after Columbus, the US capital is the District of Columbia, whereas the South American country is Colombia. You have me feeding though.

    8. Re:COLOMBIAN....not "Columbian" by mcgrew · · Score: 1

      Oh?

      --
      Free Martian Whores!
    9. Re:COLOMBIAN....not "Columbian" by KhabaLox · · Score: 1

      Is that why we call him "Hugo Chavez" instead of "Oogo Shavez"?

      --
      Ceci n'est pas un sig.
    10. Re:COLOMBIAN....not "Columbian" by dotbot · · Score: 1

      Apparently travel is expensive as those Coulombians are always charged...

    11. Re:COLOMBIAN....not "Columbian" by gmhowell · · Score: 1

      If American can change the name of everything why the rest of the world can't?

      I have heard 'Estados Unidos' (sp?) more than once on Univision.

      --
      Jesus was all right but his disciples were thick and ordinary. -John Lennon
    12. Re:COLOMBIAN....not "Columbian" by Provocateur · · Score: 1

      Anybody who watches the Miss Universe Pageant has always known Miss Colombia to at least make it as a semifinalist.

      --
      WARNING: Smartphones have side effects--most of them undocumented.
    13. Re:COLOMBIAN....not "Columbian" by Schmorgluck · · Score: 1

      Duuuh, why bring Hugo Chavez in this discussion? Quite irrelevant.

      --
      There's nothing like $HOME
    14. Re:COLOMBIAN....not "Columbian" by konaya · · Score: 1

      Interestingly, this makes "Columbian" the only 100% correct and unambiguous denonym for a person from the USA. "American" could mean anyone from any country from any of the Americas, "North American" could also mean Canadian... Am I missing any candidate demonyms?

    15. Re:COLOMBIAN....not "Columbian" by KhabaLox · · Score: 1

      He's as relevant as Bush and Washington. ;)

      --
      Ceci n'est pas un sig.
    16. Re:COLOMBIAN....not "Columbian" by metrix007 · · Score: 1

      Technically, North American would also include Mexicans. Something Americans and Canadians seem to forget.

      --
      If you ignore ACs because they are anonymous - you're an idiot.
  4. if (linux) by Ynot_82 · · Score: 5, Funny

    if(linux) { exec 'su - root' || die 'shit, I had to try something...'; }

    1. Re:if (linux) by Mr+Z · · Score: 1

      These days, shouldn't it also try "sudo ./pwn" and/or "sudo -s"?

      --
      Program Intellivision!
    2. Re:if (linux) by TheGratefulNet · · Score: 2

      no conditional checks for arduinos?

      for shame! feeling so left out...

      --

      --
      "It is now safe to switch off your computer."
  5. Finally some multi-platform support by GameboyRMH · · Score: 4, Funny

    Now if only the major business software companies were this considerate...

    --
    "When information is power, privacy is freedom" - Jah-Wren Ryel
    1. Re:Finally some multi-platform support by Idbar · · Score: 1

      Yay! And they actually have Linux support! How amazing is that!?

  6. Java = security nightmare by Anonymous Coward · · Score: 2, Insightful

    "java applet".

    So in other words, if you VOLUNTEER to run their malware, their malware runs. Wow. Whoda thunk it.

    Java = security nightmare. javascript not much less so. Anyone halfway security conscious only runs scripts based on a whitelist of trusted sites.

    1. Re:Java = security nightmare by Gr8Apes · · Score: 1

      "java applet".

      So in other words, if you VOLUNTEER to run their malware, their malware runs. Wow. Whoda thunk it.

      Java = security nightmare. javascript not much less so. Anyone halfway security conscious only runs scripts based on a whitelist of trusted sites.

      Java is not a security nightmare any more than C or assembly is, and generally less so. Stop spreading FUD.

      --
      The cesspool just got a check and balance.
    2. Re:Java = security nightmare by MikeBabcock · · Score: 1

      You can run straight up machine language with a stack overflow. Does that make machine language a security nightmare?

      Jeez.

      --
      - Michael T. Babcock (Yes, I blog)
    3. Re:Java = security nightmare by amicusNYCL · · Score: 5, Insightful

      You're right, the Java programming language is not a security threat to computers in general. The Java Runtime Environment, and its various browser implementations, however, is definitely a threat. Just like PDF documents are not a threat, but Acrobat Reader is definitely a threat. See here for proof (spoiler: Java was the #1 infection vector, at 37%; Acrobat #2 at 32%).

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    4. Re:Java = security nightmare by Goaway · · Score: 1

      You can with NaCl on Chrome.

      At this point I wouldn't be surprised if it was safer than Java, too.

    5. Re:Java = security nightmare by HarrySquatter · · Score: 1

      It's not FUD. The JRE is one of the most vulnerable and exoitable pieces of software on a machine. If you don't believe me see Secunia for the number of vulnerabilities per version. It averages to nearly 200 per major version which is more than the average of the last 3 major versions of Flash Player.

    6. Re:Java = security nightmare by Gr8Apes · · Score: 1

      Really? J2EE in the last 12 months although that's not too telling, so we'll look at JRE 1.6, all systems, over a couple of years. Feel free to post other data. If you're talking about WebStart or Browser plugins, I'll note first that those are not part of Java, and second, that they are highly affected by their browser's integration and potential lack of security features there.

      --
      The cesspool just got a check and balance.
    7. Re:Java = security nightmare by Gr8Apes · · Score: 1

      Even the JRE is not much of a threat. The browser plugins are another story entirely.

      PDFs, IIRC, just recently were a threat in and of themselves. But that's neither here nor there.

      Your link exposes that the browsers and the Java Deployment Toolkit appear to be the culprits, not the JRE itself.

      --
      The cesspool just got a check and balance.
    8. Re:Java = security nightmare by Gr8Apes · · Score: 1

      (wish I could edit)

      Actually, your statements really prove that C/Assembly are the real culprits, most of those are buffer overflows, a common problem with improperly managing your memory and pointers, something a whole lot less common for code written in Java.

      --
      The cesspool just got a check and balance.
    9. Re:Java = security nightmare by JonySuede · · Score: 1

      The J2SE JVM should ship with a deny by default SecurityManager policies file instead, but it would only add a click between a guy and his purple rabbit...

      --
      Jehovah be praised, Oracle was not selected
    10. Re:Java = security nightmare by amicusNYCL · · Score: 1

      Your link exposes that the browsers and the Java Deployment Toolkit appear to be the culprits, not the JRE itself.

      The study specifically calls out the "Java JRE" (that's right, the Java Java Runtime Environment) as the vector for 37% of Windows infections. But I do see that in the partial list of vulnerabilities that some of the ones related to Java (but not all of them) call out the Java DT. As far as browsers go, the only browser listed as an infection vector is IE, and it was only responsible for 10% of infections. 85% of the infections were the "drive-by" variety exploiting JRE, Acrobat, or Flash.

      PDFs, IIRC, just recently were a threat in and of themselves. But that's neither here nor there.

      The document isn't the problem, it's the reader that opens the document and dutifully executes the code embedded in said document that is the problem. If the reader wasn't set up to execute that code, then there wouldn't be an infection. The Acrobat browser plugin can get exploited with a hidden iframe that loads a malicious PDF document. The user would never even see the PDF appear, and would never know they were infected. They might get some sort of Acrobat dialog to update or something, but still wouldn't see the document that got them.

      The most surprising thing about that study to me is the fact that Flash is in last place among third-party plugins, I was expecting it to be a lot closer to the top. Still, the main takeaway for me is that if I do not have JRE or Acrobat browser plugins, I will not be affected by 69% of the vulnerabilities that are the top causes for drive-by infections. That's a pretty easy step to take in order to gain a lot of protection.

      Actually, your statements really prove that C/Assembly are the real culprits

      No, they don't.

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    11. Re:Java = security nightmare by Gr8Apes · · Score: 1

      Just for grins, I went through the entire list (I've got to find another hobby). The only item that is not either a JDT issue or related specifically to applet / externally provided code is CVE-2010-0842 Java JRE MixerSequencer Invalid Array Index Remote Code Execution Vulnerability, which is a bug in the MIDI file processor.

      --
      The cesspool just got a check and balance.
    12. Re:Java = security nightmare by amicusNYCL · · Score: 1

      Just like the Spanish Inquisition, the list of weapons you see in that study is "amongst" all of their weapons. That's not a complete list of exploits. They claim to have looked at 50 exploit kits. I believe that Metasploit alone contains a database of around 800 exploits. According to Secunia, JRE 1.6.x contains 274 vulnerabilities and 1.7.x contains 53.

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    13. Re:Java = security nightmare by HarrySquatter · · Score: 1

      Yes, really. Going back over 10 years of the JRE.

      JRE 1.7: 53 vulnerabilities
      JRE 1.6: 274 vulnerabilites.
      JRE 1.5: 265 vulnerabilities.
      JRE 1.4: 264 vulnerabilities.

      That's 191 vulnerabilites on average and it's only that low since the 1.7 JRE is only 2 years old. And why did you bring up J2EE? What average user is running J2EE on their desktop?

    14. Re:Java = security nightmare by HarrySquatter · · Score: 1

      JRE versions 1.4, 1.5 and 1.6 all have over 260 vulnerabilities listed on Secunia. Each one has more than the last 3 versions of Flash Player and more than any version of IE other than IE 6 which only has about 2 dozen more vulnerabilities. On the other hand if you look at something like .NET there are an average of maybe 40 vulnerabilities for each major version.

    15. Re:Java = security nightmare by Gr8Apes · · Score: 1

      Only if you've installed the browser plugin and enabled it. Amazingly, 3 of my browsers on my system do not have Java plugins, one does because I need it for a few items.

      --
      The cesspool just got a check and balance.
    16. Re:Java = security nightmare by Gr8Apes · · Score: 1

      I dug further (I did mention that I needed a new hobby) - a long long long list of those are all related to the JDT, applets, and in general executing external code, not items related to processing files or operations that the JRE provides. (With exceptions like the one mentioned regarding the MIDI file in GP) So, most of the security issues are related more to someone providing a Trojan and the JRE sandbox not catching it than actual problems with the JRE itself. We can argue this all day, I"ll bet, but what it comes down to is given non-malicious code - ie, known code that you run yourself, can others subvert your JRE? I will argue that it will be exceedingly difficult to do so. Given malicious code, I propose that executing it is as dangerous whether it's Java, C, or even JavaScript. This is a different problem, and wrapping them together and calling the JRE unsound is disingenuous. Finally, what sites require Java that are "normal"? Very few that most people will come into contact with.

      --
      The cesspool just got a check and balance.
    17. Re:Java = security nightmare by Gr8Apes · · Score: 1

      Yes, and a large, if not overwhelming portion of those are related to executing malicious code from external sources. The sandboxing failed in those cases. Running known code would have a very very small footprint of security issues.

      Regarding .NET - IIRC, .NET has no real sandbox in the way Java does, so a host of items that would be vulnerabilities in the JRE have no corresponding vulnerabilities in .NET. If we strip out all the WebStart/Applet type vulnerabilities, we'll have a closer apples to pears comparison with .NET.

      --
      The cesspool just got a check and balance.
    18. Re:Java = security nightmare by amicusNYCL · · Score: 1

      Exactly how Java ends up executing the malicious code isn't really relevant to end users. I don't have any parts of Java installed because I don't trust that it's going to be secure. I don't care enough about Java to go digging through the individual bits and pieces to identify which things are safer to install. It doesn't matter to me whether the DT is at fault, or the JRE, or J2EE or JDK or whatever else, I don't care. What I care about is avoiding infections, and since Java plays a part in 37% of infections, I'm not going to install any of it.

      Given malicious code, I propose that executing it is as dangerous whether it's Java, C, or even JavaScript.

      There's obviously a major difference there. My browser isn't going to happily download and execute a C application because some web page convinced it to. And I don't think there's anything that Javascript alone can do that's going to compromise anything on my system. But if my browser has the JRE set up with defaults then it will certainly be quite happy to download and execute that fine applet you've got there.

      Finally, what sites require Java that are "normal"? Very few that most people will come into contact with.

      Right, that's why I don't feel like I'm missing anything and, due to the fact that the Java ecosystem is the vector for so many infections, I don't see any reason why anyone should have it installed unless they need it for a specific part of their job.

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    19. Re:Java = security nightmare by Gr8Apes · · Score: 1

      Exactly how Java ends up executing the malicious code isn't really relevant to end users. I don't have any parts of Java installed because I don't trust that it's going to be secure. I don't care enough about Java to go digging through the individual bits and pieces to identify which things are safer to install. It doesn't matter to me whether the DT is at fault, or the JRE, or J2EE or JDK or whatever else, I don't care. What I care about is avoiding infections, and since Java plays a part in 37% of infections, I'm not going to install any of it.

      Well, since browsers are responsible for 100% of the infections listed, I expect you don't have them installed, either? And since Windows was also 100% responsible for infections, you don't have that either? For that matter, what are you doing on the internet? It is responsible for 100% of those infections!!!

      Given malicious code, I propose that executing it is as dangerous whether it's Java, C, or even JavaScript.

      There's obviously a major difference there. My browser isn't going to happily download and execute a C application because some web page convinced it to.

      I think you may need to revisit your assumptions.

      Right, that's why I don't feel like I'm missing anything and, due to the fact that the Java ecosystem is the vector for so many infections, I don't see any reason why anyone should have it installed unless they need it for a specific part of their job.

      Again, Java isn't the vector, it's the browser/plugin aspect that is. That's like blaming C for being a vector because windows is largely written with it. The JRE, in and of itself, is no more insecure than anything else your CPU executes. If you enable pieces that allow outside access and code execution, then there is much greater potential for problems. This is an apt comparison, as the JRE's primary purpose is to run specific java code, not random snippets from the web, at least for everything I'm involved in.

      --
      The cesspool just got a check and balance.
    20. Re:Java = security nightmare by amicusNYCL · · Score: 1

      Well, since browsers are responsible for 100% of the infections listed, I expect you don't have them installed, either? And since Windows was also 100% responsible for infections, you don't have that either? For that matter, what are you doing on the internet? It is responsible for 100% of those infections!!!

      Don't be obtuse. IE was only responsible for 10% of infections, and I don't use it. Windows help files were the vector less than 5% of the time, and I assume IE was used there as well, because my browser wouldn't automatically launch a Windows help file.

      I think you may need to revisit your assumptions

      Maybe you misunderstood me. When I referred to "my browser", I was not referring to IE. I don't use IE for the same reason I don't install Java or Acrobat Reader. That's 79% of infections that won't succeed on my machine after very little (or no) effort on my part. Go ahead, ask me about the last time I had to clean up an infection on my personal computer and how it got there.

      If you enable pieces that allow outside access and code execution, then there is much greater potential for problems.

      There's no need for me to have to do that when they're enabled by default. So yes, when Java is installed with the default settings, which includes browser plugins, you end up with something that is the single largest infection vector for Windows computers. This is a fact, this is not my opinion and it is not theoretical. It is reality. You can argue all you want, but this is what the reality of it is. The current implementation and deployment of the Java runtime is a malware author's dream. It's a full-blown high-level language able to interact directly with the system (and indirectly, due to the numerous vulnerabilities), and the code that it runs is downloaded by the browser and subsequently executed. You can't ask for a better infection vector.

      the JRE's primary purpose is to run specific java code, not random snippets from the web, at least for everything I'm involved in.

      Primary purpose for who? For you? For Sun or Oracle? For malware authors? What is the primary purpose of Java Web Start? Do you really want to have a discussion about "primary purpose" versus "unintended use"? Because I would direct you to WD-40, super glue, Teflon, Kleenex, SMS messages, etc.

      You do realize that you're trying to argue that Java isn't a threat in a discussion on an article about a piece of cross-platform malware distributed via Java, correct?

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    21. Re:Java = security nightmare by Gr8Apes · · Score: 1

      Well, since browsers are responsible for 100% of the infections listed, I expect you don't have them installed, either? And since Windows was also 100% responsible for infections, you don't have that either? For that matter, what are you doing on the internet? It is responsible for 100% of those infections!!!

      Don't be obtuse. IE was only responsible for 10% of infections, and I don't use it. Windows help files were the vector less than 5% of the time, and I assume IE was used there as well, because my browser wouldn't automatically launch a Windows help file.

      I'm not being obtuse. You are berating a product for the flaws of a single component that resembles an appendix that 99% of Java users never encounter nor care about.

      I think you may need to revisit your assumptions

      Maybe you misunderstood me. When I referred to "my browser", I was not referring to IE. I don't use IE for the same reason I don't install Java or Acrobat Reader. That's 79% of infections that won't succeed on my machine after very little (or no) effort on my part. Go ahead, ask me about the last time I had to clean up an infection on my personal computer and how it got there.

      mine was 98, IIRC, with Melissa, and I did not have it on my machine. I do have Acrobat Reader, Flash, and Java, including browser plugins installed. I just don't have them in my main browser, plus anti-ad plugins, like ad-block, noscript, and other plugins can keep you quite safe.

      If you enable pieces that allow outside access and code execution, then there is much greater potential for problems.

      There's no need for me to have to do that when they're enabled by default. So yes, when Java is installed with the default settings, which includes browser plugins, you end up with something that is the single largest infection vector for Windows computers. This is a fact, this is not my opinion and it is not theoretical. It is reality. You can argue all you want, but this is what the reality of it is. The current implementation and deployment of the Java runtime is a malware author's dream. It's a full-blown high-level language able to interact directly with the system (and indirectly, due to the numerous vulnerabilities), and the code that it runs is downloaded by the browser and subsequently executed. You can't ask for a better infection vector.

      Only if you install the browser plugin(s). You don't have to, and IIRC, that's a question the user has to agree to. So, you are incorrect on both counts, they're not enabled by default, and it's not the default settings. The fact that Windows computers are so bullet ridden wrt viruses etc is not the fault of Java, the JRE, nor even the browser plugins, but actually lies deeper in the core of Windows and how it is fundamentally unsound security wise.

      the JRE's primary purpose is to run specific java code, not random snippets from the web, at least for everything I'm involved in.

      Primary purpose for who? For you? For Sun or Oracle? For malware authors? What is the primary purpose of Java Web Start? Do you really want to have a discussion about "primary purpose" versus "unintended use"? Because I would direct you to WD-40, super glue, Teflon, Kleenex, SMS messages, etc.

      You do realize that you're trying to argue that Java isn't a threat in a discussion on an article about a piece of cross-platform malware distributed via Java, correct?

      We could, but it doesn't matter. Sun/Oracle AFAIK don't use or promote the applet model in anything they did/do at this point nor in the relatively distant past. WebStart is an entirely different piece that was promoted for a time, and even used by some, but on the whole, when is the last time you saw a JNLP app that wasn't IT distributed? (Yes, there's a difference).

      And yes, I'm aware of the se

      --
      The cesspool just got a check and balance.
    22. Re:Java = security nightmare by amicusNYCL · · Score: 1

      I'm not being obtuse. You are berating a product for the flaws of a single component that resembles an appendix that 99% of Java users never encounter nor care about.

      OK. Since you're the resident Java security expert, then let me ask you a question. Since Java is responsible for 37% of infections to Windows, and since the study specifically calls out the JRE, but you claim that the JRE is not the problem, then answer these two questions: which component is the problem, and why do end users care which component is the problem? The fact remains - Java is the #1 infection vector. You can claim that 99% of users never "encounter" the faulty components, but that leaves a hell of a lot of infections for the remaining 1%, doesn't it? Are you trying to tell me that only 1% of Java users are responsible for getting the majority of Windows infections from a single source?

      Only if you install the browser plugin(s). You don't have to, and IIRC, that's a question the user has to agree to. So, you are incorrect on both counts

      Am I now? Well, that's easy enough to test, isn't it? I open IE. I go to the page on java.com where it will test for Java. After a couple minutes it says it doesn't detect an installed version. I download the 20MB offline installer for Java 7 r5. I run the installer. The first screen has some basic information and tells me to click Next to accept the license and install Java. I click Next. Java installs. After it finishes, I open IE again and go to the same page. It now detects the correct version I just installed. I click on the Tools menu and select Manage Add-ons. Listed there I see Java Plug-in 10.5.0, I see Java(tm) Plug-In SSV Helper, I see Java(tm) Plug-In 2 SSV Helper, and ... what's that? I see Deployment Toolkit, from Oracle America, Inc., installed on 7/12/2012. The only thing I clicked in the installer was "Next". And now, I uninstall.

      See, that was easy to test, and now we don't need to rely on your memory. Tell me again which of the components in Java is not secure and how 99% of users never encounter them.

      Sun/Oracle AFAIK don't use or promote the applet model in anything they did/do at this point nor in the relatively distant past.

      Who cares? They don't need to. Malware authors know it exists, that's all that matters. Users support it, malware authors use it, it doesn't really matter what Oracle wants to promote. What they want to promote, how they expect Java to be used, and how you personally use Java have zero relevance on the question of how so many people get infected via Java.

      when is the last time you saw a JNLP app that wasn't IT distributed?

      It's been my experience, with regard to drive-by infections, that it's the apps you don't see that are the problem.

      They might as well have said there's a C exploit

      But they didn't, did they? They used Java. The platform of choice for malware authors.

      I do note however, that your argument list has gotten very short by this posting.

      You may also note that I've only ever had one argument - that Java is the single largest infection vector for Windows computers.

      And I'll restate the final point - if you don't install/enable the plugins, you won't have a problem

      Now that we can agree on. I'm glad you agree with that statement.

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    23. Re:Java = security nightmare by Gr8Apes · · Score: 1

      You may also note that I've only ever had one argument - that Java is the single largest infection vector for Windows computers.

      and I disagree. It's Windows that's the single largest vector for infection. Nothing more, nothing less. The fact that other systems run fine with Java really points out this glaring omission on MS's part. Why can't they secure their own software? (this is a rhetorical question, I already know the answer - if you can execute any program on windows, you can own the system. There is no way to secure it from a program run in user space if you can copy a binary file into the system, which is the only challenge you have)

      And I'll restate the final point - if you don't install/enable the plugins, you won't have a problem

      Now that we can agree on. I'm glad you agree with that statement.

      At least that one's done. So you agree the problem is not the JRE, but the plugins/plugin framework.

      --
      The cesspool just got a check and balance.
    24. Re:Java = security nightmare by amicusNYCL · · Score: 1

      At least that one's done. So you agree the problem is not the JRE, but the plugins/plugin framework.

      The problem is that all of the components that people exploit are installed and enabled by default in the download package that Oracle labels the JRE (which is why the report specifically blames "Java JRE").

      It's Windows that's the single largest vector for infection.

      No, Windows is the target. Java is the hole that attackers go through to get there.

      The fact that other systems run fine with Java really points out this glaring omission on MS's part.

      OK, then let me ask you a question. Why do you think it's true that Java is used as the infection vector 37% of the time, while Flash is used 16%? Or that IE is used at only 10%? When a Windows machine gets infected, why is it almost 4 times more likely that the infection happened via Java versus the loathed and vilified IE?

      (also, if you're going to try and point out how great Java works everywhere other than Windows, again, we're talking about cross-platform malware here)

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
  7. Web exploit... by Anonymous Coward · · Score: 1

    Oh noze... a web exploit for Linux! That asks you if you want to install it from within your web web browser. Yeah, your average Linux user will surely fall for that, even though it's not how we ever install software. Does it even work on Linux? The article had no screenshots of it running there, nor what version of Java (if any) it exploits.

    1. Re:Web exploit... by jedidiah · · Score: 1

      The smug Linux user has likely taken steps to avoid running any random untrusted nonsense in a web browser.

      --
      A Pirate and a Puritan look the same on a balance sheet.
    2. Re:Web exploit... by Zero__Kelvin · · Score: 1

      You don't seem to have a strong grasp of what the word "average" means.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    3. Re:Web exploit... by drinkypoo · · Score: 1

      See that red color ? "Vulnerability can be used to run attacker code and install software, requiring no user interaction beyond normal browsing."

      You can see at a glance that most of these vulnerabilities require javascript. As the GP said, the smug Linux user has probably disabled Javascript from random sites. If not, they have no business being smug.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    4. Re:Web exploit... by smash · · Score: 1

      Because of course all of your personal infromation is stored under your non-user account? Err... nope. Identity theft is far more useful these days than simply trying to own your machine. Who cares about owning the machine when they can own your personal data?

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    5. Re:Web exploit... by jellomizer · · Score: 1

      If someone is feeling smug, it is usually because they have no business feeling smug.

      --
      If something is so important that you feel the need to post it on the internet... It probably isn't that important.
  8. Re:Most Macs are probably immune. by Gr8Apes · · Score: 1

    That'd be news to the millions getting new macs and using Java.

    --
    The cesspool just got a check and balance.
  9. Linux by Anonymous Coward · · Score: 1

    Good luck with getting far on Linux, most people on there are nerds and geeks who know NOT to hand over root passwords just cos some program claims it needs it, and on up-to-date systems there won't be any known privilege escalation exploits.

    1. Re:Linux by benjymouse · · Score: 1, Insightful

      ... and on up-to-date systems there won't be any known privilege escalation exploits.

      Think again. An attacker following the kernel source tree will be able to figure out when exploitable bugs are being patched. While such bugs/fixes are generally not called out as security fixes at that time, they are nevertheless identifiable given a small investment.

      And for many distros it takes weeks (sometimes months) for the fixes to come through to the "consumer". During that time (dubbed "high-risk days" by some researchers) the vulnerability information is in the open but systems have not yet been patched. Precisely because some patches are *not* called out as having security implications it has happened that some of the more stable distros have delayed the patch because they didn't see the urgency.

      Someone determined to take down Linux desktop systems has recurring windows of opportunity because of the open nature of the kernel and the distro system.

      --
      Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
    2. Re:Linux by HarrySquatter · · Score: 1

      You mean like the Linux kernel dev who had a trojan installed on his system and subsequently got kernel.org rooted by getting the trojan on two of the servers? Yeah, geeks never get malware on their systems. *rolls eyes*

    3. Re:Linux by Lorien_the_first_one · · Score: 1

      Very interesting analysis.

      --
      The diversity and expression of human opinion is essential to human survival.
    4. Re:Linux by wmbetts · · Score: 2

      I had a friend that did a demonstration of just that. He built an exploit while he was up there doing the talk. It took a couple hours, but when he was done he had a functional 0day. Believe it or not people actually do what he's describing. If the good guys are doing it for pentesting I'd guess the bad guys are doing it as well.

      --
      "Ubuntu" -- an African word, meaning "Slackware is too hard for me". - stolen from Dan C alt.os.linux.slackware
    5. Re:Linux by jvillain · · Score: 1

      I remember when the slammer worm came out. We were all excited that we were finally going to be able to see a real piece of malware on linux. We opened up the apropriate port to a number of test machies to try and get inffected so we could disassemble it. Within a couple of hours there was a patch available for Linux. Every one upgraded (patch fast patch often) and it died out before we could get infected. Open source software is a horrible platform to attack because there are hordes of people who can provide a patch if we know what the problem is.

    6. Re:Linux by smash · · Score: 1

      You don't need to be root to steal someone's shit.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
  10. wasn't that nice of them by slashmydots · · Score: 1

    Well, at least they made it run on Linux. Most software writers just don't bother to put in that kind of effort. Must be one classy virus writing operation over there to not leave any of the major OSes out lol.

  11. Only older Macs. by used2win32 · · Score: 4, Informative

    Quoted: "Surprisingly for such an advanced exploit, it was unable to infect modern Macs unless they were modified to run software known as Rosetta. The software allows Macs using Intel processors to run applications written for Macs using PowerPC processors, which were phased out about five years ago. Rosetta is no longer even supported on Lion, the most recent version of OS X."

    Rosetta not supported on Lion and not installed by default in Snow Leopard.

    So no current Macs and only older Macs that use Rosetta risk infection. That number has to be pretty low...

    I don't any *nix user has much to worry about either...

    --
    Procrastination; I'll think of a sig tomorrow.
  12. Re:Most Macs are probably immune. by Jesus_C_of_Nazareth · · Score: 1

    Yeah, all those SAP and Oracle users. Maybe it has wider usage than I'm aware of, but the vast majority of use I see is enterprise. Of course this doesn't mean that it's not a problem. There are plenty of business users who are one step away from using Typex on their screens.

    --
    JC
  13. Just Checking by carrier+lost · · Score: 1

    So, if I haven't ordered any cocaine in the last couple of weeks, I should be okay?

    --
    XKCD:Xeric Knowledge Comically Dispen
    1. Re:Just Checking by Zero__Kelvin · · Score: 1

      "So, if I haven't ordered any cocaine in the last couple of weeks, I should be okay?"

      If your stash isn't getting low, you should be fine for a while, but if it is then you're headed for big trouble bud. I recommend you stock up on some serious opiates post haste!

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  14. Who Allows All Java Applets? by Anonymous Coward · · Score: 1

    I'm immune to this. I have to explicitly declare the host name that applets will be allowed from. If it's not configured, then the applet tag gets replaced with an HTML comment as it passes through the HTML filter. I'm doing this with an old client side firewall program called atguard, but I'm sure there are many others that do the same. As a result, I only run applets from web sites that I want to run. I see "download plugin" or grey boxes where all the applet ads would be or that are coming from sites that I didn't specifically go to. Why hostname-specific applet blocking isn't built into browsers is beyond me. Maybe it is on some of them...?

  15. Interesting author in source code by sl4shd0rk · · Score: 5, Informative

    If you google getParameter( "ILIKEHUGS" ); from the screen shot in TFA, you can find a java file which looks suspiciously like the one in TFA. I lold at the header comment. I don't think this is a 'new' exploit:
    /**
      * Original Author: Thomas Werth
      * Modifications By: Dave Kennedy, Kevin Mitnick
      * This is a universal Applet which determintes Running OS
      * ...

    --
    Join the Slashcott! Feb 10 thru Feb 17!
    1. Re:Interesting author in source code by Anonymous Coward · · Score: 1

      Why does it need Java to determine the platform? It's right in the browser headers (most of the time anyway).

    2. Re:Interesting author in source code by amicusNYCL · · Score: 1

      The exploit isn't determining which OS they are running. The dropper determines the OS and then delivers the payload for that OS. The exploit in the payload may be new, or it may be exploiting unpatched JREs.

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
  16. Re:Most Macs are probably immune. by EliSowash · · Score: 1, Informative

    Eh? How do you figure? Macs run Apple's version of Java...which means, they'd dutifully execute this applet. If you'd have said 'Mac users have to be running Rosetta in order to be infected' I'd give you your street cred back.

  17. Re:Most Macs are probably immune. by beelsebob · · Score: 2

    Macs do indeed run apple's version of java... If you have jumped through the hoops of clicking the "disabled plugin" button that replaces the applet, then typing in your password. Macs absolutely do not have to be running rosetta (a tech that doesn't even exist any more) to get infected, as neither Java, nor the binary delivered is a PPC binary.

  18. Malware for Linux? by Anonymous Coward · · Score: 5, Funny

    The year of the Linux desktop has arrived!

  19. Re:Most Macs are probably immune. by Anonymous Coward · · Score: 1

    Eh? How do you figure? Macs run Apple's version of Java...which means, they'd dutifully execute this applet.

    Because, as the OP said, Macs don't ship with Java anymore. It's not installed by default with the current version of Mac OS. Also, even if the user installs it, recent Mac OS security updates will actually disable it if it is not being actively used.

    That is probably why the exploit only bothers to target obsolete versions of the OS X with Rosetta (or on PowerPC hardware.) A version for newer versions of OS X would be blocked before it could even get downloaded.

  20. Re:Most Macs are probably immune. by Yaztromo · · Score: 4, Informative

    That'd be news to the millions getting new macs and using Java.

    The GP is correct. Apple stopped shipping Java with OS X with the release of Lion.

    That said, if you try to run something the requires Java, OS X will offer to download and install it for you. However with the latest OS X updates the Java browser plug-in and Java Web Start are now disabled by default, and have to be explicitly enabled by the user in the Java Preferences app. And if they do explicitly enable it, it will auto-disable itself again if it hasn't been used in some time.

    That's a lot of extra hoops to jump through to get this to work on a modern, up-to-date Mac. Then again, the people who develop and propagate malware such as this tend to target those who don't keep their systems up-to-date, ensuring it is still a concern for many users (with those at most risk being the ones least knowledgable to do much about it, or even be aware that anything is wrong).

    Yaz

  21. Re:Most Macs are probably immune. by Ossifer · · Score: 2

    More correctly:

    1. Macs ship with a hook that offers to install Java if you ever attempt to use it.

    2. OSX does not disable Java itself, but the Safari application disables the use of Java applets. If you run Firefox, this doesn't happen at all.

  22. Re:Source by tylutin · · Score: 1

    Right, because most Windows machines have a C compiler installed ...

  23. Re:Most Macs are probably immune. by Yaztromo · · Score: 1

    Eh? How do you figure? Macs run Apple's version of Java...which means, they'd dutifully execute this applet.

    With OS X Lion, Apple stopped shipping Java with OS X. And with the latest revision, the ability to run Applets or Java Web Start is disabled by default, and has to be explicitly enabled (and even then will self-disable if you don't use it for some time).

    So to amend your statement, Macs run Apple's version of Java -- if you've tried to run something written in Java, responded to the resulting pop-up that you'd like to download and install Java, entered an Admin password (or username and password if you're not running as admin), waited for Java to download and install, then went into the Java Preferences app, turned on the "Enable apple plug-in and Web Start applications" setting, closed the Preference app, and then gone back and reloaded the infected page...at which point they'd dutifully execute this applet.

    (Older versions of OS X are, of course, still at risk from this sort of Java applet based attack vector).

    Yaz

  24. Re:Infected Linux? by marcosdumay · · Score: 2

    F-Secure wans't eager to tell us the details. It doesn't work anymore on OSX, no word about Linux.

    Anyway, it wasn't a proof of concept. It was found on the wild.

    --
    Rethinking email
  25. Re:Anonymous Colombian by jjjhs · · Score: 1

    About 100 or so people pointed that out already.

  26. Re:Source by tylutin · · Score: 1

    woops, of course if the code is JAVA, then ...

  27. Re:Infected Linux? by jsepeta · · Score: 1

    because nobody in the wild tests their proof of concepts. programmers always use a sandbox feature for that.

    not.

    --
    Remember kids, if you're not paying for the service, YOU ARE THE PRODUCT THAT IS BEING SOLD.
  28. So BSD users are safe? by BLToday · · Score: 1

    FreeBSD FTW.

    1. Re:So BSD users are safe? by jakemann · · Score: 1

      Not as safe as I am running VMS Mosaic on OpenVMS!

  29. very convincing by Cyko_01 · · Score: 5, Funny

    On linux you need to download the source code from the repository and compile it yourself

    1. Re:very convincing by PuZZleDucK · · Score: 1

      I'm too lazy... could someone wrap this up in a .deb package for me?

      --
      Can a person program a new solution to a problem? Why should anyone be able to stop such a thing? -Richard Stallman
  30. Re:Most Macs are probably immune. by hobarrera · · Score: 2

    Most Linux distros don't ships the java applet thingy either.

  31. Re:Advice anyone??? by Jeng · · Score: 1

    It really is not complicated.

    Get up, go to the bathroom, go to a stall, take off your underwear, wipe yourself off, put pants back on without your underwear, get out of the stall, throw away your soiled underwear and get back to work.

    --
    Don't know something? Look it up. Still don't know? Then ask.
  32. Re:Most Macs are probably immune. by Gr8Apes · · Score: 1

    I was aware of the WebStart and applets being disabled - it was the first quick fix to the Flashback trojan and all related malware.

    Not having upgraded to Lion except on a test system, I was unaware of the Java no longer being installed in Lion by default. I guess Apple caught up to the rest of the world. Still, that doesn't really bug me because I've been managing multiple versions of Java on my system for years, so I've had to download them myself anyways.

    --
    The cesspool just got a check and balance.
  33. Re:Signed? by wmbetts · · Score: 1

    They use fake names when getting it signed.

    --
    "Ubuntu" -- an African word, meaning "Slackware is too hard for me". - stolen from Dan C alt.os.linux.slackware
  34. STOP MAKING SHIT UP by rgbrenner · · Score: 1

    In English, Colombia is spelled with an O. Not a U. SO STOP MAKING SHIT UP.

    Here, look it up for yourself:
    https://maps.google.com/
    https://www.cia.gov/library/publications/the-world-factbook/geos/co.html
    http://en.wikipedia.org/wiki/Colombia
    http://www.state.gov/r/pa/ei/bgn/35754.htm
    http://www.colombiaemb.org/
    http://news.bbc.co.uk/2/hi/americas/country_profiles/1212798.stm

    1. Re:STOP MAKING SHIT UP by konaya · · Score: 1

      Yup. Colombia is spelt with an O and Columbia is spelt with a U. Why are we stating obvious things?

  35. Web exploit drops a different trojan by dgharmon · · Score: 1

    "a live Web exploit that detects if the target is running Windows, Mac OS X, or Linux and drops a different trojan for each platform".

    I typed 186.87.69.249:8081 into the address bar and this came up. Besides which, explain to me again why I would run a Java Applet from an unknown source and give it my root password?

    --
    AccountKiller
    1. Re:Web exploit drops a different trojan by Riceballsan · · Score: 2

      well the greater concern is what the virus is and intends to do. Something doesn't need a root password to say, run an individual keylogger for what that user types, ftp that log file in addition to everything in ~/Documents to a server in sealand, or whatever. If just ruining someones day is the goal rm -rf ~ would pretty much be the kiss of death. Linux's greater strength in the more robust, harder to break root privileges compared to windows, actually doesn't really come into play until linux hits a point where it is targeted well enough to use antivirus software. The main thing I see windows virus's doing with admin rights, is disabling windows updates and preventing AV software from getting the new updates, to ensure it's own position at being ahead in the arms race, stays the same.

  36. Re:lol by Anonymous Coward · · Score: 1

    lol java, java lol

  37. welcome, Linux by smash · · Score: 1

    To becoming relevant enough to malware authors.

    --
    I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
  38. IT Support by minstrelmike · · Score: 1

    That sounds way kewl. I wish our IT support group could detect which browser/os a user was using but that's apparently waaaaaaay beyond their expertise. (It requires two functions instead of one).

  39. MacOS hole: by metaforest · · Score: 1

    Userland apps should never request admin rights.
    If they do request escalated privileges you should abort the installation and confirm with the publisher and demand that they explain in gory detail WHY they chose to require escalation to install their app.

    Blackbox drivers and middlewear should not be tolerated. If you want to have wheel/admin rights on my machine you'd better be damn clear on why you need those rights and what you do with them. IN WRITING.
    If I find out later that you lied to me.... you can expect to get sued.

    At the end of the day it is the users and reviewers that determine what gets accepted in the market. We need to put our collective foot down on apps that demand privileges that they really don't need, just because it makes their development process cheaper, or enhances their DRM.

  40. not that hard... by hesaigo999ca · · Score: 1

    There is a way with a browser identification script on the server side, to then realize a redirect based on the type of browser....that would be a very mundane thing for any adept web developer to do.... in any language.

  41. Re:OSX does NOT have common sense default by smash · · Score: 1

    lol. stating fact = troll :D

    --
    I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.