Java software security freak-out?

ElectricAye · 2013-01-11 20:57

Anyone know anything about this? The U.S. Department of Homeland Security urged computer users to disable Oracle Corp's Java software???

http://www.nbcnews.com/technology/technolog/us-warns-java-software-security-concerns-escalate-1B7938755

4x5n · 2013-01-11 21:04

I've heard about it but haven't disabled Java on any of my personal machines. I'm not running windows on any of the machines

ElectricAye · 2013-01-11 21:08

4x5n wrote: »

I've heard about it but haven't disabled Java on any of my personal machines. I'm not running windows on any of the machines

Does that mean it's only a flaw on Windoughs? What about Apple stuff? Anybody know?

4x5n · 2013-01-11 21:52

ElectricAye wrote: »

Does that mean it's only a flaw on Windoughs? What about Apple stuff? Anybody know?

I did a bit of looking when I first found it and the report said that the exploit was being used to install malware. My thought was that the malware being installed was windows only. The java exploit exists in java so in theory all OSs are vulnerable in some way shape or form. Of course since most of the malware that would be getting installed are windows only it's windows users that are most at risk.

potatohead · 2013-01-11 22:00

I turned it off. For me, Java only gets used for an installer or two, a CORBA daemon I don't need to use and some web meeting type software. Coupla browser plug ins need it too, and those are largely related to multi-media content I'm not worried about seeing.

There isn't a patch right now and the exploit is deployed out there. Ugly stuff. If you have a VM to surf with, I recommend you do so.

ElectricAye · 2013-01-11 22:32

4x5n wrote: »

... Of course since most of the malware that would be getting installed are windows only it's windows users that are most at risk.

Thanks for looking into this. (Initiate panic attack.)

Mike Green · 2013-01-12 07:35

This sort of thing is why Apple has, by default, disabled Java in browsers in a recent security update (that predates this announcement). You can turn it back on and, if it's not used for a time, the OS will disable it again. You can still run Java applications. It's just the web-browser add-on that's disabled. Seems reasonable given the problems Java has had with security and Oracle's slow response process.

Ron Czapala · 2013-01-12 08:47

Useful links

Disable Java in various web browsers - http://www.java.com/en/download/help/disable_browser.xml

Uninstall Java on Windows PCs - http://www.java.com/en/download/uninstall.jsp

Remove Microsoft Java Virtual Machine - http://www.helpwithwindows.com/WindowsXP/howto-21.html

Mark_T · 2013-01-12 15:28

Only version 7 (aka 1.7) is vulnerable - I'm on an earlier version (why upgrade if it works?). Sounds like someone who doesn't understand
security implications was allowed to monkey with the reflection API.

java -version

will tell you which version you have.

Tor · 2013-01-12 16:05

Anyway, Oracle was informed about the problem in August, and decided to do nothing. Now they scramble, way too late.

And this is exactly how Oracle has reacted to every problem since they bought out Java: By not reacting. To borrow a well-used expression: Watching Oracle and the Java story is like watching a slow motion train crash. It's been a disaster from day one. They simply don't know how to manage a project like Java. It's getting tiring. I've been one of those who kept trying to defend Java and explain the difference between Java applications and Java applets (the latter are those with security problems) to those screaming the loudest, but now I think they were more right than I was: It's simply too impractical to keep them separate.

And I depend on Java applets because all the banks in my country now use them for so-called 'secure login' (yeah...), and every few weeks either the bank software decides that my Java 1.6.x version doesn't have the right 'x' for the week, or Firefox decides to disable it by itself (never mind that my OS distributor actually patches up the problems in that version without upgrading to some newer, untested version - normal practice).
Which leaves me without any possibility to pay my bills, until if and when I have either manually installed some other Java version, or the bank decided it was their fault all along and re-instated my Java version as OK.

As far as I'm concerned Java cannot die fast enough. Tomorrow would be fine with me. If it isn't clear by now that keeping a computer language 'closed' is NOT the right way to do it... are there really anyone believing in that still?

-Tor

Ron Czapala · 2013-01-12 16:17

You can download version 6 at http://www.java.com/en/download/manual_v6.jsp

4x5n · 2013-01-12 16:18

Mark_T wrote: »
Only version 7 (aka 1.7) is vulnerable - I'm on an earlier version (why upgrade if it works?). Sounds like someone who doesn't understand
security implications was allowed to monkey with the reflection API.
java -version
will tell you which version you have.

Older versions of Java have other vulnerabilities as well. Best thing to do is shutdown Java in you web browser.

LoopyByteloose · 2013-01-12 18:03

Tor wrote: »

Anyway, Oracle was informed about the problem in August, and decided to do nothing. Now they scramble, way too late. ......

And I depend on Java applets because all the banks in my country now use them for so-called 'secure login' (yeah...), and every few weeks either the bank software decides that my Java 1.6.x version doesn't have the right 'x' for the week, or Firefox decides to disable it by itself (never mind that my OS distributor actually patches up the problems in that version without upgrading to some newer, untested version - normal practice).
Which leaves me without any possibility to pay my bills, until if and when I have either manually installed some other Java version, or the bank decided it was their fault all along and re-instated my Java version as OK.

As far as I'm concerned Java cannot die fast enough. Tomorrow would be fine with me. If it isn't clear by now that keeping a computer language 'closed' is NOT the right way to do it... are there really anyone believing in that still?

-Tor

I find that this banking issue with secure login very useful information. I've never actually visited my bank in person. First of all it is the USA and I live abroad; secondly, I've only visited the state it is in once when I was 18.

Linux allows Java as well as Windows and some of my sites demand that I use it to gain all their features. So I suppose I need to read up on how to protect myself.

Stockcharts.com requires an active Java for all the charting services to run properly. So this sets up people that follow their investments with a significant problem.

RDL2004 · 2013-01-13 06:09

Java and Javascript are two different things.

Oldbitcollector (Jeff) · 2013-01-13 10:30

This was the last straw here... Uninstalled..

As stated, Oracle has continued on a track of simply not acting when issues arise. As far as I'm concerned they've had plenty of time and have lost my trust.

Jeff

Tor · 2013-01-13 10:33

RDL2004 wrote: »

Java and Javascript are two different things.

That's absolutely correct, but was Javascript mentioned in any of the postings? I didn't see it..

-Tor

Heater. · 2013-01-13 10:37

My bank has been refusing to let me in without an update to Java it seems every time I visit since I don't know when.
So far they have said and done nothing about this latest issue.

That is Java I'm talking about not JavaScript.

4x5n · 2013-01-13 10:43

Heater. wrote: »

My bank has been refusing to let me in without an update to Java it seems every time I visit since I don't know when.
So far they have said and done nothing about this latest issue.

That is Java I'm talking about not JavaScript.

No way I would access my banking info via a Java app!! Your better off (money and identity stolen) not accessing your bank remotely if it accessing it means Java!!

Tor · 2013-01-13 12:56

4x5n wrote: »

No way I would access my banking info via a Java app!! Your better off (money and identity stolen) not accessing your bank remotely if it accessing it means Java!!

Couldn't agree more, but some of us have no choice. Physical bank access isn't an option for most customers in Norway anymore (and I suspect the situation is similar in the rest of Scandinavia, and also in Finland where Heater lives), as long as it's about accessing your money. The only physical services left are for other things, like getting loans and the like. And all the banks here are using the same Java-based system for authentication. It's even proved as broken years ago, proof provided by a university no less - and completely ignored. The paper is out there for everyone to read.

I have a tiny hope that the Java-based solution will be replaced with all the current trouble, but I doubt anything will happen - keeping the head in the sand is a good strategy according to bankers.

-Tor

4x5n · 2013-01-13 22:16

Looks like Oracle has released a patch for Java. I of course have no personal knowledge of how effective it is at dealing with the recently discovered vulnerabilities or if there any new ones but I would recommend that everyone that's running Java in some way or form to apply the patch.

LoopyByteloose · 2013-01-13 23:26

The Latte Report...
Today's "Taipei Times" mentions Oracle is issuing a fix for this. Usually the "Taipei Times" is a day behind in the news cycle as it is published in English.

I'd love some clarity on whether the issue is the same in Linux as in Windows, or if LInux remains separate and secure. Unlike Windows, Linux not only offers in-house Java. There are several alternative clones.

Does this security problem apply to IcedTea plug-ins for Firefox as well? IcedTea is a Javal alternative provided to Linux users.

Apple seems to have a problem as well.

http://www.zdnet.com/apple-oracle-move-quickly-to-mitigate-java-security-flaw-7000009755/

LoopyByteloose · 2013-01-14 01:05

After a bit of mucking around, I located this Jave Version tester that resolves questions of whether one is safe or not.

http://www.javatester.org/version.html

Though I run IcedTed-Web plugin on my Firefox in Ubuntu Linux, it seems I have 1.6.0.34 somewhere included... so I am safe ... for now. This site mentions that version 1.6.xx.xx is scheduled to die in February of 2013.

This is NOT just a Windows issue, it seems all OSes might have an issue... though we know that hackers prefer to use Windows for the widest penetration of abuses.

Heater. · 2013-01-14 01:16

The fix is out. http://www.oracle.com/technetwork/java/javase/downloads/index.html

Start your upgrading now.

Everyone can relax...until next time.

LoopyByteloose · 2013-01-14 03:23

Apparently Google Chrome as your browser may be the best protection.

Android seems to not be involved in the current problems.

http://blogs.computerworld.com/cybercrime-and-hacking/21626/how-be-safe-possible-java

Heater. · 2013-01-14 06:20

Cancel that last message, please continue panicking.

Latest news is that Java will continue to be a security liability into the foreseeable future:
http://www.ibtimes.co.uk/articles/423778/20130114/expert-warn-java-security-problems-despite-oracle.htm

LoopyByteloose · 2013-01-15 01:22

This is quite interesting as it seems to only be Java7 and all my computers are running Java6 in Linux and Firefox (I will have to check the Windows side of my dual boots).

Reports claim Android is not affected and the Google Chrome may be the best browser for security at this point.

So far I don't seem to have a serious issue, but with Java6 set to expire in February, that could all change. Oracle could at least extend the useful life of Java6 until they resolve this.

Heater. · 2013-01-15 01:50

Yeah, except the only reason I need Java is to login to the bank.
The bank won't allow access with older versions.
I need a new bank.

LoopyByteloose · 2013-01-19 02:13

Well, the cure may be worse that the problem.
If you do get a security fix... IT has to be from Oracle.

To keep up-to-date, search Google with "Java Malware".

It seems the preditors are more than happy to pretend to be providing the fix.

http://www.informationweek.com/security/application-security/java-security-fix-is-disguised-malware-a/240146589

Heater. · 2013-01-19 02:27

Never mind getting your fix from Oracle. The old fix did not work and they found a bunch more vulnerabilities since that one:
https://threatpost.com/en_us/blogs/latest-java-update-broken-two-new-sandbox-bypass-flaws-found-011813

Martin_H · 2013-01-19 03:16

It just seems a complete disgrace that it is 2013 and we still have Java applets. They were a dead technology ten years ago, but all of the replacements tended to be inadequate, so they shamble along like the undead. Silverlight actually showed some promise, but as usual MS lost interest about halfway through the execution. Now everyone is talking about HTML5, but it's not quite up to the task of rich Internet application development because of uneven support on various platforms.

evanh · 2013-01-19 03:44

Sounds like the last 500 years of IE and javascript. Difference being this one is considered small enough to speak up about it.

Adam Gowdiak, a researcher with Polish security firm Security Explorations, told Reuters he believes that Oracle fails to properly test its software fixes for security flaws. "It's definitely safer for users to stay away from Java 'til Oracle starts taking security seriously," he said.

Lol, funny how that wasn't the stance in the early days of IE. And when Win2k turned up that was even worse but the prevailing recommendation was to move to Win2k on the basis of security!

The media were very mum on the subject for a long time. Only talking about it once M$ was roughly on track.

Java software security freak-out?

Comments