Slashdot Mirror
Java Zero-Day Vulnerability Rolled Into Exploit Packs
tsu doh nimh writes "The miscreants who maintain Blackhole and Nuclear Pack — competing crimeware products that are made to be stitched into hacked sites and use browser flaws to foist malware — say they've added a brand new exploit that attacks a previously unknown and currently unpatched security hole in Java. The curator of Blackhole, a miscreant who uses the nickname 'Paunch,' announced yesterday on several Underweb forums that the Java zero-day was a 'New Year's Gift,' to customers who use his exploit kit. The exploit has since been verified to work on all Java 7 versions by AlienVault Labs. The news comes days after it was revealed that Paunch was reserving his best exploits for a more closely-held exploit pack called Cool Exploit Kit, a license for which costs $10,000 per month."
At this point does any tech savvy user still have the Java Runtime Environment installed? These days it doesn't seem to be good for much beyond extremely reliable arbitrary remote code execution.
At this point there is no reason for most home user systems to have Java on them at all. Just uninstall it and remove this never ending hole from your life.
If you do need it for something (like Minecraft), you can remove it from the browser, which tends to also solve the security problems (unless the Java updater adds itself back in, which it's been known to do). Still a better option than just leaving it. There's very few websites left that actually use Java for anything today.
It sucks more in the corporate world, where there's a lot more Java and thus no easy answer for the security problems that plague it. But for home users? Just remove it and make your life easier.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
Is this exploit possible via Java Web Start, or only applets?
But Java is supposed to prevent all these security issues according to its evangelists! Seems to be meaningless when its own JVM is a threat vector. Apparetly the JVM writers fail at writing secure code. Throw Java on the trash heap and be done with it. Even Flash Player has less vulnerabilities. And that's really saying something when your software is less secure than shit that Adobe puts out.
The repetitive use of miscreant in TFS begs the question: aren't there more modern pejoratives that might be applied here? You know: blackguard, knave, footpad, malefactor, cad, ...
INTERNET SURFERS: Enforce your browser/s so not run scripts and remove all instances of Java - congratulations, you're almost safe to browse the internet now but have you updated your flash player, Windows and all your non-Windows software? ...there are programs out there that can scan yout machine to alert you of out-of-date software. I seem to remember Trend Micro online scanner doing this, but you needed Java to run it! I know there are others but I can't name them... just use legitimate ones and don't just ask google to look for anitvirus 2013 lol.
There's a hacker called Paunch? You are Kevin Smith and I claim my five pounds!
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
Seriously? This person is licensing an exploit kit for $10,000 per month and nobody has bothered following the money to shut him down? I have a hard time believing anyone could make $10K/mo doing this anyway. Wouldn't the first order of business by the exploit buyers be to make it work without the payments? What's the author going to do? Sue them for non-payment?
Disable Flash and Java. Most websites with video will work fine, even if some require to change your user-agent to "iPad".
What do you mean, your browser can't display H.264 natively? Get a real browser.
Get free satoshi (Bitcoin) and Dogecoins
The Java exploit is much less surprising to me than how casually we include the fact that this guy (and others) are selling exploit kits online. I remember when stuff like this used to be so underground you had to "know someone who knew someone" to find it. Perhaps what he's selling isn't technically illegal, but it's still surprising to read.
Sappeur:
+ Memory Safe
+ No VM
+ No GC but reference-counted smart pointers
+ extremely quick startup times (down to 10ms)
+ almost all C and C++ style high-performance features such as stack allocation, value arrays, destructors available
+ memory safe even for multithreaded applications
+ destructors
+ RAII
http://sourceforge.net/p/sappeurcompiler/code-0/2/tree/trunk/doc/SAPPEUR.pdf?format=raw
http://sourceforge.net/p/sappeurcompiler/code-0/2/tree/trunk/
Is it 100% delivering the security it promises ? Probably not at this point, but my guess is that with the same amount of engineering work as has been put into the JVM, Sappeur could be almost 100% delivering the advertised security. It is actually a quite simple concept.
Currently, it is in the proof-of-concept stage.
Of course you need Java (JRE). More so on servers. Of course you don't need Java plugin, which is the only thing that has security issues. Clueless "security researchers" feeding bad info to clueless consumers.
These are the idiots who make life so difficult for legit network guys. That summary reads like George Washington just raided another British outpost. Whether for curiosity or profit, remember who the bad guys are!
I swear to God...I swear to God! That is NOT how you treat your human!
..is one of the few really good Java apps. But I certainly suggest to disable Java except for these occasions. It is clearly a major security risk, if "on by default".
If that guy had been a real engineer as opposed to something else, this thing would have never been this bag of fleas.
But hey, robustness is not hip. Let's deliver 1001 "standard library classes" and give shit about security. Make it complex as hell, because That's Cool !!
Instead they set up all sorts of cool crap-processes such as the "JCP" and pile more poo on their already sizeable craphill. These guys never understood what really matters, namely reliability and quality. I take a reliable, old Pascal compiler any time over a fancy bag of fleas with all sorts of "cool" features. And yes, I did some serious Java time. Now I am back to C++ for work.
In Opera Preferences you can set that any plugins should only start after you explicitly click on the rectangle in which they appear. Chrome by default does prompts the user before running Java applets. Internet Explorer 9 by default enables installed add-ons everywhere, but you can remove the "*" from the list of allowed sites, and after that it prompts before it runs that plugin. I do not find a solution for Firefox yet.
Bitcoin, TOR.
The IT department would like you to no loner turn on your computer to protect you from harmful viruses. We are going to coming around over lunch and install a safety device (by drilling a hole through your CPU / Disk). After the install you will be safe to use your computer as you see fit.
In the world of MBAs they want CHEAP developers. How do they get that ? Use a "simple" language many people are fluent in. That's Java.
What the MBAs will never grasp that "cheap" is only cheap on the short run. On the long run, using Java means buying whopping amounts of hardware and attracting lots of Junior and generally crappy developers. On the long run, investment into expensive C++ developers and their more expensive development efforts pays off nicely. These people know that the "new" operator comes at a price and use it wisely. Just as an example.
Now, I am a C++ guy, so maybe I am not objective on this. I am confident the darwinism of the market will sort this out. Let's see.
How can a _license_ for an exploit kit cost anything? A license is a legal term, and I would expect that you can't enforce a license for an exploit kit, neither from the position of the buyer nor of the seller.
It's like saying that the Mafia gives out licenses for blackmail.
no more please
and if you use it you're a little bitch.
I have been coding in Java for quite a long time and there are essentially two archetypes of very crappy coders:
1) The people who don't have what it takes to be a decent engineer (in any language) and are just creating horrible crap because that's the only thing they were taught in college.
2) The people who "Would rather be coding something else". Often (but not always) a bit older engineers who might not have had any education in Java and any understanding they do have (whether it's from formal education or from them having read half a book a decade ago) is horribly outdated and incomplete. They stubbornly insist that if some of the architectural structures that they learned decades ago for different type of applications and for different environments end up creating a bad Java application, Java is to blame.
The first archetype are useless but harmless: They write bad code but do so very slowly and don't dare to touch anything that looks intimidating which means they generally can't screw anything important up. The second archetype is who I immediately blame whenever I get a "WTF was someone thinking?" moment when looking at some major design decision.
Folks like Paunch need to get got if for no other reason than to remove a justification for governents around the world (China and the US getting closer to the same page everyday) to regulate the Internet and render online anonymity a crime (all in the name of Snowflake Security, of course).
,,how you defend the absoultely lazy and ignorant approach of Oracle. Everbody is as crappy as Oracle and M$. The Law Of Bill And Larry, I suppose.
Are you a $hill, by chance ?
This guy is doing everbody a service, because he openly sells exploits. He demonstrates what kind of royal crap Java actually is. Then, there is freedom of speech. There are people who do not believe in the infinite wisdom and power of government.
Does the guy kill, rape or maim ? No he does not. He demonstrates how insanely crappy a certain piece of software is. Something to be defended against government meddling - I am quite positive.
But, I will be nice to you Mr $hill and ask you what would happen if we outlawed his activity: Chinese intelligence would silently use Java to subvert thousands of critical computers worldwide. So would the Russian Mafia do.
This guy ensures people simply deinstall or disable this abomination called Java. Thank God this man exists and does his business !
This Paunch guy needs to watch his ass. There are larger, darker players who were using this exploit for their own purposes. Some of them invested heavily in developing it. By bringing it out into the open like this, Paunch has directly limited their use of this vulnerability. I would not be surprised if this is the last we hear of mr. Paunch. A cleanup team has likely been engaged and is working on tracking him down in the physical world as I type this...
Seth
$5 / month hosted VPS on linux = awesome!
The people you refer to use pork-companies such as HBGary. And they do know they need to shut up or the pork will stop flowing.
You should stop viewing cheap men-in-black movies.
..I think you nailed it. But you could explain your opinion next time to those who never got a proper education. Maybe some of them would understand and change their language.
what the guy does is expose crappy work which poses a risk. He earns money in the process. 100% the right thing to do.
If the Java crappers have issues with him, they can switch to Perl, FreePascal, Ada, C++ or Sappeur any time. But these people are so shallow they will never consider this option. It would require some effort without instant reward.
So you need Eclipse to debug other pieces of bloated, randomly freezing crap ?
Hint: there are real languages and real IDEs out there to create excellent, efficient and cross-plaform software.
Here is a little list:
Lazarus
Delphi
Code::Blocks
Qt Creator
"DO YOU READ 'SUTTER CAIN'? (from "the Mouth of Madness") -> http://en.wikipedia.org/wiki/In_the_Mouth_of_Madness
Ah - I see you do! Just a bit of "weird humor" there, per the subject-line above is all... now:
See subject above & this from myself on 1/7/2013 (though I've posted on it many times here before then):
---
http://betanews.com/2012/01/25/the-top-10-web-security-threats-you-should-avoid/
Pertinent quote/excerpt:
"The compromised website is still the most effective attack vector for hackers to install malware on your computer with 47.6 percent of all malware installs occurring in that manner, says security firm AVG. Another 10.6 percent are tricked into downloading exploit code -- many times, without their knowledge -- by clicking on links on pages to sites hosting malware... It also found that faked pharmacy sites are a popular attack method, seen in about 10.4 percent of all attacks. Fake antivirus scanners remain a popular malware injection method at 8.4 percent. "
---
* Fact is, what I noted, in compromised sites, comprises 77% of malware installations - not what users download & install themselves (ala shareware/freeware sites like download.com etc./et al)...
---
Whitelisting COULD help stop that too, per what I stated above, along with other "layered-security"/"defense-in-depth" measures commonly used today already.
Even "walled gardens" do, albeit imo @ least? Not as much due to the above statistics from AVG & imo, lastly, in malscripted sites (only doing what I do in Opera which is in & of itself, a 'whitelisting' approach too, via its "by site preferences" - ONLY allowing scripting, cookies, plugins, frames/iframes, javascript, java, etc. on SOME sites only that REQUIRE THEM FOR FULL FUNCTION - the rest are in global policy, disallowing their usage (lessening the chance of attack))" - by Anonymous Coward on Monday January 07, @12:17PM (#42506533)
---
SO - As I said above & in my subject-line? "Great Minds DO think alike"...
(That is, IF you thought of that yourself, it's very possible you did (or, of course, you saw what I wrote there since it predates your statement)).
It'll work vs. all the things Opera can set "by site" prefs on, including JAVA's browser plugin!
This option built in natively to Opera helps make it "The SUPERIOR WARRIOR" amongst its browser peers with many other things... especially considering what AVG put out this year also quoted above, no less!
(Still - that you should UNLOAD from your system unless you ABSOLUTELY NEED IT, for the time being!).
APK
P.S.=> Either way? You're "spot on" correct...
... apk
what is this now? 4chan?
Java Zero-Day Vulnerability Rolled Into Exploit Packs?
AccountKiller
Does this security hole affect OpenJDK/IcedTea (6 or 7)? Or is it only an issue with Oracle's code? If OpenJDK/IcedTea is affected, which versions (if any) have been fixed?