Slashdot Mirror
Massive Amount of Malware Targets Older Java Flaws
Trailrunner7 writes "It's no secret that Java has moved to the top of the target list for many attackers. It has all the ingredients they love: ubiquity, cross-platform support and, best of all, lots of vulnerabilities. Malware targeting Java flaws has become a major problem, and new statistics show that this epidemic is following much the same pattern as malware exploiting Microsoft vulnerabilities has for years. Research from Microsoft shows that there has been a huge spike in malware targeting Java vulnerabilities since the third quarter of 2011, and much of the activity has centered on patched vulnerabilities in Java. Part of the reason for this phenomenon may be that attackers like vulnerabilities that are in multiple versions of Java, rather than just one specific version."
The problem we (as systems admins) have with Oracle Java is that they don't patch: they give you new versions. Each new version deprecates some things, adds new things, and breaks some things that worked before. So you end up with banking entities (looking at you Citigroup and others) that require you to use old, vulnerable versions in order to perform enterprise money transactions. You end up with the good vendors scrambling to get their code working, while the bad vendors just tell you that you have to run the old version of Java. It is so bad that we are working on a policy to keep new Java based (client) applications out and not allow the business units to bring them it. The damn thing is impossible to manage seeing as how you need the latest version but can't run it if you want your apps to work. Terrible software.
shows that microsoft is no longer the target of attacks, nor the target of use.
Personally I have 3 different versions of Java on my work machine. 1.5 for an old router, 1.6 for relatively current routers (ie still under warranty but no firmware updates forthcoming) and 1.7 for anything coming in the door. For the love of PCs will you vendors stop providing interfaces that require DESKTOP JAVA and IE .
At home I run VMs for this sort of thing. One for IE6, 7,8,9,and now IE10 compatability testing. My work PC is a reject P4 single core from 2004 so VM is not really an option there. I work for a small local government so upgrades also seem to be a pipe dream.
So I continue on with multiple versions of java that are exploitable, but I really have no choice... until one exploit or another infects the entire network (worm style)... then it will be an "issue worth addressing."
Is anyone else in the "can't afford to upgrade" group or is it just me?
gg
People who still use older versions of Java probably aren't up to date on other patches or updates either, making them even easier to exploit or infect. Stupid is as stupid does, and that includes IT policies that don't allow machines to be kept current when it comes to security.
Good, inexpensive web hosting
just wait for the caps to blow on the old p4 systems to force a upgrade.
Wouldn't you be pretty stupid to target the current mostly patched version and ignore the FAR larger pool of older installs.
This is only news if you don't have a clue
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Read these words:
Java.
Malware.
Security.
Flaw.
Now watch this interview (and maybe the blooper reel as well)
and then read these words once again:
Java.
Malware.
Security.
Flaw.
I bet you are reading these in that zombie voice now.
You can't handle the truth.
Some posts above mine, people blame Oracle Java. I blame the updater.
My dad was hit by malware lately, which he got, because of an outdated Java on his system. He told me he always updated everything and blocked the install of everything else like toolbars. The last thing before he got the virus he remembered, was not allowing jusched.exe admin priviledges.
I get it: jusched mean java update scheduler and everytime it's run it asks for admin priviledges. First of all:
1.) This should be updated automatically by a package manager, hence I blame Microsoft
2.) If 1.) is not the case, it should at least be called JAVA UPDATE PROCESS
3.) It should display some kind of information before requesting Admin rights.
Not many people outside of Slashdot know what jusched.exe is. Updating needs to be automated. Actually: We should somehow take this into our own hands and provide OpenJDK for Windows also ourselves and get people to switch. Maybe even without the ASK Toolbar
I keep praying for it every day when memory gulping symantec does its startup scan. We have plenty of spares as every department besides technology is well funded. They will just make me slap in a spare power supply or move the hard disk to another like model tower and have me forge on for a couple more years. I've already replaced the PSU twice. Oh well that's civil servitude for ya I guess. :(
...if you don't have a need for it or don't remember when you last used it, uninstall it.
Microsoft deflecting their own security flaws,
Instead of VMs, could you use more physical boxes and a KVM? As an ancillary benefit, when management complains that you have six PCs under your desk you can say "Well, I could toss all of these if you buy me one new PC." Alternately, wait until another department tosses a better machine than you're using: four and five year old Dells were running Core 2 Duos and Core 2 Quads, so any day now you should be able to pick up a decent system off the discard pile.
What is the break-down by platform of exploitable Java bugs?
In Chrome, Firefox, and all Android browsers, just enable "click to play" for all plugins, instantly 99.9% of your vulnerabilities are gone.
Bonuses: no flashing ads, fewer CPU or RAM chugging browser tabs, no random audio ads, better battery life.
On the few sites where you want it on by default (youtube for example) it's just a two click "enable permanently" whitelist.
WHY isn't this the default on all browsers by now?
Which bit of "Research from Microsoft" did you not understand?
This is just more from the great FUD machine from Redmond.
How many times do I have to repeat this. ALMOST ALL THE VULNERABILITIES TARGET JAVA APPLETS THAT RUN WITH JAVA PLUGIN INSIDE BROWER. This is not java the language in general, this is not even the JVM, this is the stupid applet sandbox. And nobody uses applets for anything anymore, this is obsolete technology maintained for backwards compatibility.
95% of Java today is running on the server-side. And there are very few security problems there.
Given the amount of articles and FUD targeted at Java on Slashdot in recent months, they could have gotten this right by now. Editors, please be explicit about this being java APPLET/BROWSER PLUGIN vulnerability every time this comes up. This is not Java language vulnerability.
--Codera
JS and HTML can't write files to the clients computer.
This may be true of JavaScript and HTML in IE pre-10, but the draft File API allows JavaScript programs to ask the browser to present a "Save As" file chooser and write to the file that the user chose. And because JavaScript's File API does access control through the file chooser, it doesn't require a code signing certificate from a commercial CA in order to be able to write such a file
I had to deal with a client who wanted a .Net application because "JAVA had major vulnerabilities". Who told him this stupidity ? A "specialist" in .Net applications ! WOW ! I had to spend 3 full days to explain to him what is Java, what is an applet, why nobody uses applet anymore except the old dinosaurs who don't want to die and why it is safer and cheaper and better for him to use Java servers and applications.
Stop the bullshit ! Java is as safe as or even safer than any other technologies.
And for the so-called "systems admins" who don't understand the differences between a Java server and a Java-applet, RESEARCH, LEARN OR GO TO HELL !
The reason Java is used so extensively in the enterprise is because managers want bells and whistles.
We built a basic html app and one yahoo wanted rounded corners because they looked nice.
We said "No" due to performance issues. Then he tried to get it in thru the standard backdoor of 'standardization' and we used our strategy of defensive paperwork--the first criteria for standardization was performance, not looks. We couldn't get the other departments to stop using Java to develop apps with rounded corners but eventually, they realized their employees were avoiding the apps at every opportunity. And it broke every time Windoze was updated or we bought new laptops. That sort of canceled out the whole 'enterprise java makes updates and changes easier' idea.
Prove it now that you've got 5 years of data.
Meanwhile, our section has years of useful data and users who defend 'their app' against bureaucratic interference.