Slashdot Mirror
Security Expert Says Java Vulnerability Could Take Years To Fix, Despite Patch
An anonymous reader writes "After the Department of Homeland Security's US-CERT warned users to disable Java to stop hackers from taking control of users' machines, Oracle issued an emergency patch on Sunday. However, HD Moore, chief security officer of Rapid7, said it could take two years for Oracle to fix all the security flaws in the version of Java used to surf the web; that timeframe doesn't count any additional Java exploits discovered in the future. 'The safest thing to do at this point is just assume that Java is always going to be vulnerable,' Moore said."
What happened? Most of these exploits seem to rely on rewriting methods / accessing byte code ... how about disabling that access for applets as a temporary measure?
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
This might seriously impede the Year of Java on the Desktop
It looks like he randomly pulled a time frame. I cannot find an explanation for the two year estimate.
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
The solution is to stop running untrusted code in your browser. If you are using a browser's default configuration, then any time you go to a website, the browser will automatically download and execute software from the website, in the form of Flash, Java applets, javascript, and Silverlight, if you have it installed.
And you think there aren't any vulnerabilities in any of those sandboxes?
That's not specific to Java, it applies to all software that's downloaded from an outside source and run on your local machine. That means Adobe Reader (PDF is simply a wrapper for a program written in Postscript), Flash (ditto, written in a special programming language) and even Javascript. It even includes downloaded TrueType fonts (the font hinting program they can include is just that, an executable program). Don't dismiss them just because they're sandboxed. Java was sandboxed, that didn't stop this vulnerability. Sandboxes are software and software has bugs in it, always. The only question is the number and severity of the bugs. The simpler the software, the fewer bugs there tend to be because there's fewer places for them to hide. Their favorite hiding place is in unexpected interactions between different parts of a piece of software, or between the software and the system it runs in, and simpler software has fewer and simpler interactions that're easier to get right.
This even applies to software you buy from a vendor. The difference is that with bought software you tend to download it only a few times and always directly from the source. Contrast this with the Web, where you're downloading multiple pieces of software on virtually every Web page you hit with no idea where they're coming from (and, in the case of advertising networks, the place you download them from may not even know who or where they're coming from).
Running programs from untrusted sources has always been unadvisable. I run java every day, and I'm not worried at all about getting compromised. Apps like ImageJ or UGENE, if they weren't written in Java would be written in a native language which would be just as dangerous to install. So don't be an idiot and run programs from random websites and you'll be fine.
Give me Classic Slashdot or give me death!
HD Moore, chief security officer with Rapid7, a company that helps businesses identify critical security vulnerabilities in their networks, said it could take two years for Oracle to fix all the security bugs that have currently been identified in the version of Java that is used for surfing the Web.
How is Mr. Moore computing this interval? Nothing is offered in these stories about why it would take Oracle "two years" to "fix" the "security bugs".
It didn't take two years to write JDK in the first place...
Just because you're paranoid doesn't mean they aren't out to get you
Sure, Java will be dead in 5 years.. just like COBOL.
The idea is that you are at the same time providing a full language and a sandbox. Together. Java is not inherently more or less secure than any other language (well, mostly), but the above premise is extremely hard to pull off correctly. Think of an applet as some piece of code you download and execute. Would you trust doing that in any special language? Think of Flash, how many flash issues have we seen? And Flash is "less complex" than Java.
Are those security flaws also affecting OpenJDK 6 and/or 7?
This guy isn't a security expert. He doesn't even know that Java is a programming language, and that Oracle's JVM is not "a version of Java used to surf the web". No self respecting expert would misuse terms the way he is, and he should be sued for doing it. It leads to ridiculous situations, where people think Java is inherently bad. I mean, isn't Android based on Java? OMFG ... don't get one of those! Haven't you heard. Java is vulnerable to attack! If the writer got what this guy said correct then his guy is either shilling for Apple or Microsoft against Google/Android, hates Oracle, or is phenomenally incompetent.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Why exactly do we need applets on joe smoe's machine? If your a corporation enable it.
It would be great if all browser had a whitelist of domains that you tag a site for any of this stuff. Yes youtube can play flash, other sites not. Advertisers will just use animated gif\javascript or whatever.
Sure there is this plugin and that to accomplish this...time for FF, Chrome, and IE to build this stuff in and make it off by default and super simple to address. Of course you've got grandma on IE 6/7/8, but even then MS could put out a patch that just turns off applets. The next time IE starts up it ask the user. Group policy would override.
I find it strange that I can install a flash blocker that allows me to whitelist certain websites but that similar functionality seems to be missing for Java... the easy answer is to not allow java to run unless the site or even specific URL is in a whitelist.
The java engine should check whether the code it is about to execute is from a whitelisted location before it executes it. If the code is not, it should warn the user, perhaps prompting to add the site.
That way your banking and ecommerce sites would still work easily while the "bad guys" would at least have to successfully social-engineer you into adding their site, a situation much better than what we currently see where all you have to do is inadvertently browse to a web page with compromized java applets embedded.
That, to me, seems so obvious as a basic security measure, it amazes me that software as old as Java would still have such vulnerabilities.
I can see absolutely no reason to start with an unprivileged app that can somehow give itself privilege it did not start with. In reality, such actions should be up to the user to decide *before* they run the app (although that may still be quite vulnerable to social engineering, it would at least remove the technical aspects of the vulnerability).
File under 'M' for 'Manic ranting'
Running programs from untrusted sources has always been unadvisable. I run java every day, and I'm not worried at all about getting compromised. Apps like ImageJ or UGENE, if they weren't written in Java would be written in a native language which would be just as dangerous to install. So don't be an idiot and run programs from random websites and you'll be fine.
The problem is, the default Java runtime install includes a browser plugin that allows Java applets embedded in a webpage to run automatically. Code delivered this way is supposed to run inside a strict sandbox, but that sandbox has been repeatedly shown to be full of holes.
(Desktop apps written in Java, including UGENE and ImageJ [and Eclipse, and the mostly-not-Java LibreOffice] do not use the browser plugin and will run fine even if the browser plugin is disabled or deleted completely. Your standard don't-be-an-idiot advice does indeed apply to these kinds of apps. But the JRE you installed to run ImageJ will install the browser plugin you never asked for and don't need.)
Oracle really should consider making the browser plugin a separate, optional, non-default installation.
This is like opening an email attachment form the same domain name; don't do that because somehow that PDF file, Excel file, Word document or whatever is harboring some evil code.
But does any of that mean you should remove Excel or PDF readers or Word or Libre Office or anything else from your own machine? Of course not. Java apps are totally safe on your machine and removing Java from your machine makes exactly zero sense.
The only people (mis) representing this situation are people who have an economic stake in "competing " languages and runtimes and language warriors , so that would include M$, consultants who want to be able to bill to rewrite Java apps (for no reason) , authors and evangelists from competing languages etc etc etc . You should all be ashamed of yourselves. C# is a great language , Java is a great language , Perl is a great language , C is a great language, Scala is a great language, Lisp is a great language.. so just GTFU.
The only way that number is within an order of magnitude of being correct is if it is a reference server-side Java, which isn't the issue. In-browser Java is the issue, and very few common websites require in-browser Java to function correctly (in-browser JavaScript, perhaps, but aside from artifacts of early-90s marketing in the naming, the two have nothing in common.)
You know, that's the funny thing I've always found about trying to do accurate software estimates. Because programming is so predominantly a thinking-heavy activity, the time that you're spending trying to figure out how long something is going to take can almost as easily be spent actually doing it.
I've always found it frustrating to try to explain this to people who want estimates on how complex certain tasks are, when you don't actually have enough data on those tasks yet to know, and by the time you do, you'll have already basically solved whatever problem the task was supposed to solve.
File under 'M' for 'Manic ranting'
I think he meant Kobol, the originating planet of the thirteen tribes.... Took a lot longer than 5 years to die but then again, the Galactica found it in ruin and didn't stay for archeological studies...
I have a jar of molasses that seems to be equivalent to this concept.
Javascript has NOTHING to do with java.
So after following the rabbit hole, the article links here (see PDF) and here (same site, just "codes" for the issues) while exclaiming about 50 issues in Java! If you cut out the fluff, the only issue is the Reflection API. C# will and does have the same exact vulnerabilities. And after looking through it, it wouldn't take 2 years to apply these "fixes"; however, some "fixes" remove Java functionality, so it will never be "fixed" because why remove functionality. Any language can do bad things. We can only hope that the general public doesn't read this shill crap.
/endrant
However, I admit that this is also a good thing to hopefully encourage Oracle to provider quicker updates/patches/etc.
I still don't see a mass migration to other languages happening. JAXB (and annotations in general) is one of the best things Java ever invented. I have yet to find a language with features that make XML reading/writing as easy as JAXB. Unicode, i18n, and l10n were well-done from the beginning. Even though people laugh at the notion of byte code and the cross-platformness of Java, I still have yet to see another language do this better. Java will die when either a better solution emerges or enough corporate shill kills it.
And I still don't understand why Linux is being bogged down with C# mono programs such as Banshee, TomBoy, etc. Don't get me wrong, these are great programs, but why not write them in a language that is more open? It would have been just as easy to do these in Java with GTK+.
The G
To paraphrase a well known saying, I think it's time for the internet to start seeing oracle as damage and route around it.
One really simple thing that seems needed, and that should be extremely simple to do, would be a whitelist/blacklist plugin for java applets in firefox. The vast majority of java applet users are probably people who work in a bank, a law practice, or a medical office and only ever need to use a single applet. They need an option where they can blacklist all java applets by default, but allow applets from medicalrecords.com or whatever. These folks can't just disable the java plugin completely. Setting plugins.click_to_play to true is also a solution, but it breaks sites that use flash, and it doesn't protect the business against an office worker who clicks on stuff without thinking. (I tried setting this flag on my desktop box at home, and was too much of a nuisance. This is what I have flashblock for, and flashblock does the job better.)
Another helpful step would be to make it easier for people to find out which versions of java they have on their computers and easier for them to avoid unsafe versions. On my ubuntu box, managing this is a total mess. If I do "java -version", it tells me I'm running java 1.6, which would be immune to this vulnerability. But if I check inside the directory /usr/lib/jvm , it turns out I actually have 1.5, 1.6, and 1.7 all installed. Well, which one is firefox using? I get zero results from dpkg --get-selections icedtea . In firefox, doing tools:add-ons:plugins tells me I have IcedTea-Web 1.2, which tells me nothing about the java version. Typing about:plugins in the url bar shows me literally two dozen version numbers. Googling turns up somebody's test app at http://javatester.org/version.html , but (a) how do I know this guy isn't a black hat, and (b) even if that showed I was currently running 1.6, what happens if a future apt-get upgrade bumps me into 1.7?
The final thing that should really happen IMO is that the OSS community should get off the java upgrade treadmill. The IcedTea project should designate some version such as 1.6 as a high-security, stable version and focus some real effort on making that version secure. Distros should stop packaging 1.7+ until the dust settles -- and if that take a couple of years, who the heck cares? Hell, I wouldn't care if it took a decade, or forever.
Find free books.
Of course there are hundreds or thousands of native API calls made by the Java stack.
Sooner or later you have to talk to the OS.
I do not fail; I succeed at finding out what does not work.
Perhaps the time is right for a COBOL browser plugin?
Perhaps it's time to rethink the whole "execute in user space" thing and go back to HTML/CSS rendering and server-side CGI.
Near as I can tell, the whole user-space execution thing has been a security and compatibility clusterfark since day one. The "cloud" is a user data loss / privacy nightmare by design, too.
Honestly, it seems to me that outside of the usual HTML uses - reading a blog or a news site, shopping, that sort of thing - most people I know actually use the web to ship video and audio back and forth. Personally, I've done less surfing, emailing and other usual net activities this year than ever before; I have dedicated appliances that stream music from Internet radio stations, deal with video, e-books...
Guess I'm just a desktop kinda guy. Get off my lawn?
I've fallen off your lawn, and I can't get up.
Wrong answer!
no, COBOL was written before software security was invented.
"I think this line is mostly filler"
Three times a year.
Not when they are needed, or when they are wanted, or when they are actually ready... but rather, three times a year.
All you need to know about Oracle is contained in the parent post. They think "three times a year" is taking "security exploits incredibly seriously".
Reminds me of the sewer worker who's proud to take a bath every year, whether he needs it or not, because he's incredibly serious about hygiene.