Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Newly-Discovered Java 7 Security Vulnerability Poses Risks to Macs
- Thread starter MacRumors
- Start date
- Sort by reaction score
Java is to JavaScript as Car is to Carnivore. The 2 are not related in the slightest. JavaScript was named that because at the time of it's inception Java was a big thing and they wanted to try and get an additional recognition boost by having Java in the name, even though Java had nothing to do with it.
Java isn't sandboxed using the mandatory access controls found within ML. This is mostly because Java, given its inherent purpose, would have a sandbox profile that didn't provide any access restrictions anyway.
Java contains its own sandbox that basically creates access limitations if the applet is considered untrusted because the applet is unsigned or self-signed. Java's sandbox is the sandbox that is being compromised.
That's one of the beauties of the web and browsers. Anyone with a notepad and a web browser can program (no, not mark up, program) with simple DOM manipulations in very simple HTML documents. Card games can be done by simply manipulating the src attribute of img tags and you can move around div tags to create animations.
That sure takes us back to our DOS/Commodore/Apple II days with BASIC, a text editor and a BASIC interpreter. Unfortunately though, it's completely deficient as a model to teach modern computer science, as now students need to learn about the many layers of abstraction we introduced over the years, as needed by proper MVC applications.
Well, for year 1-2 students, C# is probably just as good for teaching all the fundamentals (flow control, data structs, even OO/PM, etc.), and hell, it's so syntactically/structurally close to Java, if you squint, they read about the same
That's not the issue, the issue is that they're teaching first years to use all the shiny features in Visual Studio, rather than CS problems, problem solving and programming. When I went from first year to second year, we had to use swing and since I had not used a MVC Framework before it wasn't a pretty sight. It's the same at most CS depts in NZ. (We call it spoon feeding the first years) At least at Waikato, in the second year compulsry papers they make you learn C and Java, and in 3rd year you're just expected to learn the Language you need for the paper. At Auckland as far as I'm aware you just stay in Jaca/C# land for the most part.
Another thought, the same people in the CS department also want ADTs taught as Interfaces rather than actual ADTs and their Algorithims. Luckily, they're being ignored.
I've chucked Python at many a teenager, it sticks very well.
I use Haskell for string processing, especially parsing. Monads make it very clear when your string is being altered, which is quite convenient if bugs crop up.
Last edited:
I tried all the tips on the web for deleting java 7 files to be able to reinstall java 6, but java 6 installer still insisted that I had a newer version. I guess I have to live without java till they fix it or take my chances again with 7. I hope they jump on this fix quick. They should have posted something on javas site.
some detailed info:
Java Zero Day Attack: Second Bug Found
Were security researchers irresponsible to detail the zero-day vulnerabilities without first working with Oracle to craft a patch?
By Mathew J. Schwartz InformationWeek
August 29, 2012 11:06 AM
The zero-day Java attack recently discovered by security researchers, which appears to have been launched from China, is more complex than previously thought.
While researchers had identified a Java 7 security-settings bug exploited in the attack, they've since found that it's chained together with a second vulnerability. "Most of the online analysis talks about one vulnerability, where we saw two vulnerabilities being exploited to achieve full execution on a target," according to a blog post from Esteban Guillardoy, who's a Python developer and security researcher working for information security firm Immunity.
"The first bug was used to get a reference to sun.awt.SunToolkit class that is restricted to applets, while the second bug invokes the getField public static method on SunToolkit using reflection, with a trusted immediate caller bypassing a security check." He said the two bugs had to be chained together to create a working exploit. He also noted that the "getField" Java bug was introduced with Java 7.0-- which debuted on July 28, 2011--and suggested that a foreign nation state, or states, may have been "enjoying it non-stop for quite some time now."
"The beauty of this bug class is that it provides 100% reliability and is multiplatform," he said. "Hence this will shortly become the penetration test Swiss knife for the next couple of years."
Researchers said the related zero-day attack appears to have been launched from servers in China, and that it's being used to deliver the Poison Ivy remote-access toolkit (RAT) onto infected systems. According to a heatmap of related Poison Ivy infections released by Kaspersky Lab, the greatest number of related infections have been seen in China, followed by Russia.
The discovery of the Java 7 vulnerabilities has led numerous security experts to recommend that enterprises disable Java in browsers. US-CERT Tuesday released a security alert noting that "disabling the Java browser plug-in may prevent a malicious webpage from exploiting this vulnerability." In addition, for Firefox users, it said that "using the ... NoScript extension to whitelist websites that can run scripts and access installed plug-ins will mitigate this vulnerability."
Users of systems targeted by the exploit likely wouldn't notice the attack. "It does not crash browsers, the landing page looks like a blank page, sometimes one may see a flash of a rotating Java logo and the word 'Loading,'" according to an analysis published by Andre' M. DiMino and Mila Parkour at DeepEnd Research.
To help identify vulnerable systems, both Rapid7 and Zscaler are offering free online tools which will review a user's system for the presence of vulnerable Java code. Zscaler also offers a guide to disabling Java in Chrome, Firefox, and Internet Explorer. While the vulnerability affects Windows, Apple OS X, and Linux systems, most Mac users will be protected, since Java 6--not Java 7--is installed on OS X by default, although Java 7 can be added manually.
Oracle releases patches on a quarterly cycle, and its next bug fix isn't due until October. But DeepEnd Research Tuesday began offering its own patch for the vulnerability, though it must be requested directly from the company, which said it's restricting distribution "not to preserve the code but limit it to IT administrators and developers who can test and decide if they want to deploy." In other words, it's a temporary fix, and may break existing systems. "We do not want to push/offer it to 3 billion end Java users, it wasn't tested in all the possible scenarios and systems," said DiMino and Parkour in a blog post.
In addition, DeepEnd said it will share a "commented and stripped-down version of the exploit source, to be run from the command line with a security manager enabled," as well as a copy of the original zero-day attack HTML page--including JavaScript, the Java applet, a copy of the Poison Ivy RAT, and pcap--upon request, provided requesters offer a valid reason for seeing the proof-of-concept (PoC) code.
Whoever built this zero-day attack was extremely skilled in Java programming. "At this moment exploiting [these] vulnerabilities is not hard, in fact the PoC that was released is almost a fully working exploit and with a just few changes, setting a different payload instead of popping up a calculator, you have everything you need," Guillordy told Threatpost. "However finding these vulnerabilities and [using] them in a useful way is a much harder task that requires a wide knowledge of the Java JDK/JRE codebase and deep understanding of the Java security architecture."
But FireEye's initial disclosure of the zero-day attack, followed by detailed analyses from other researchers, has led to criticism that the exploit was irresponsibly disclosed. "The Java 0day activity that we have been monitoring and preventing for almost the past week has been irresponsibly reported on other blogs, with early posts publicly linking to known sites serving the 0day," said Kurt Baumgartner, a security researcher at Kaspersky Lab, in a blog post.
"Would you encourage folks to walk down a mugger's dark alley with no protection or would you work to communicate the muggers' whereabouts to the right folks and work on lighting the alley or giving better directions? Would you provide muggers with some new weapons that they haven't considered? The efforts this time around seem misplaced," he said.
On the other hand, the bug was already being actively exploited by attackers, and researchers reported that numerous antivirus tools--including from McAfee and Symantec--weren't spotting or stopping the threat. Accordingly, did Kaspersky err by spotting the vulnerability, but failing to disclose it publicly?
Cybercriminals are taking aim at your website. Is your security strategy up to the challenge? Also in the new, all-digital 10 Steps To E-Commerce Security special issue of Dark Reading: About half of the traffic to e-commerce sites is machine generated--and much of it is malicious. (Free registration required.)
Java Zero Day Attack: Second Bug Found
Were security researchers irresponsible to detail the zero-day vulnerabilities without first working with Oracle to craft a patch?
By Mathew J. Schwartz InformationWeek
August 29, 2012 11:06 AM
The zero-day Java attack recently discovered by security researchers, which appears to have been launched from China, is more complex than previously thought.
While researchers had identified a Java 7 security-settings bug exploited in the attack, they've since found that it's chained together with a second vulnerability. "Most of the online analysis talks about one vulnerability, where we saw two vulnerabilities being exploited to achieve full execution on a target," according to a blog post from Esteban Guillardoy, who's a Python developer and security researcher working for information security firm Immunity.
"The first bug was used to get a reference to sun.awt.SunToolkit class that is restricted to applets, while the second bug invokes the getField public static method on SunToolkit using reflection, with a trusted immediate caller bypassing a security check." He said the two bugs had to be chained together to create a working exploit. He also noted that the "getField" Java bug was introduced with Java 7.0-- which debuted on July 28, 2011--and suggested that a foreign nation state, or states, may have been "enjoying it non-stop for quite some time now."
"The beauty of this bug class is that it provides 100% reliability and is multiplatform," he said. "Hence this will shortly become the penetration test Swiss knife for the next couple of years."
Researchers said the related zero-day attack appears to have been launched from servers in China, and that it's being used to deliver the Poison Ivy remote-access toolkit (RAT) onto infected systems. According to a heatmap of related Poison Ivy infections released by Kaspersky Lab, the greatest number of related infections have been seen in China, followed by Russia.
The discovery of the Java 7 vulnerabilities has led numerous security experts to recommend that enterprises disable Java in browsers. US-CERT Tuesday released a security alert noting that "disabling the Java browser plug-in may prevent a malicious webpage from exploiting this vulnerability." In addition, for Firefox users, it said that "using the ... NoScript extension to whitelist websites that can run scripts and access installed plug-ins will mitigate this vulnerability."
Users of systems targeted by the exploit likely wouldn't notice the attack. "It does not crash browsers, the landing page looks like a blank page, sometimes one may see a flash of a rotating Java logo and the word 'Loading,'" according to an analysis published by Andre' M. DiMino and Mila Parkour at DeepEnd Research.
To help identify vulnerable systems, both Rapid7 and Zscaler are offering free online tools which will review a user's system for the presence of vulnerable Java code. Zscaler also offers a guide to disabling Java in Chrome, Firefox, and Internet Explorer. While the vulnerability affects Windows, Apple OS X, and Linux systems, most Mac users will be protected, since Java 6--not Java 7--is installed on OS X by default, although Java 7 can be added manually.
Oracle releases patches on a quarterly cycle, and its next bug fix isn't due until October. But DeepEnd Research Tuesday began offering its own patch for the vulnerability, though it must be requested directly from the company, which said it's restricting distribution "not to preserve the code but limit it to IT administrators and developers who can test and decide if they want to deploy." In other words, it's a temporary fix, and may break existing systems. "We do not want to push/offer it to 3 billion end Java users, it wasn't tested in all the possible scenarios and systems," said DiMino and Parkour in a blog post.
In addition, DeepEnd said it will share a "commented and stripped-down version of the exploit source, to be run from the command line with a security manager enabled," as well as a copy of the original zero-day attack HTML page--including JavaScript, the Java applet, a copy of the Poison Ivy RAT, and pcap--upon request, provided requesters offer a valid reason for seeing the proof-of-concept (PoC) code.
Whoever built this zero-day attack was extremely skilled in Java programming. "At this moment exploiting [these] vulnerabilities is not hard, in fact the PoC that was released is almost a fully working exploit and with a just few changes, setting a different payload instead of popping up a calculator, you have everything you need," Guillordy told Threatpost. "However finding these vulnerabilities and [using] them in a useful way is a much harder task that requires a wide knowledge of the Java JDK/JRE codebase and deep understanding of the Java security architecture."
But FireEye's initial disclosure of the zero-day attack, followed by detailed analyses from other researchers, has led to criticism that the exploit was irresponsibly disclosed. "The Java 0day activity that we have been monitoring and preventing for almost the past week has been irresponsibly reported on other blogs, with early posts publicly linking to known sites serving the 0day," said Kurt Baumgartner, a security researcher at Kaspersky Lab, in a blog post.
"Would you encourage folks to walk down a mugger's dark alley with no protection or would you work to communicate the muggers' whereabouts to the right folks and work on lighting the alley or giving better directions? Would you provide muggers with some new weapons that they haven't considered? The efforts this time around seem misplaced," he said.
On the other hand, the bug was already being actively exploited by attackers, and researchers reported that numerous antivirus tools--including from McAfee and Symantec--weren't spotting or stopping the threat. Accordingly, did Kaspersky err by spotting the vulnerability, but failing to disclose it publicly?
Cybercriminals are taking aim at your website. Is your security strategy up to the challenge? Also in the new, all-digital 10 Steps To E-Commerce Security special issue of Dark Reading: About half of the traffic to e-commerce sites is machine generated--and much of it is malicious. (Free registration required.)
On first glance I read this as "it stinks very well" - but that exposes my opinion of Python.
I didn't say that Fortran was my favorite language for strings, just that I'd take it over ANSI C.
Python is a lovely language. D:
I didn't say that Fortran was my favorite language for strings, just that I'd take it over ANSI C.
I don't even know FORTRAN, so it must stick.
I'd rather learn on something that is actually used professionally. I don't get to learn about the memory management and other features of languages like C. When students go and make iOS apps, they have to learn a whole bunch of new stuff. On top of that, BlueJ is a junky compiler.
Yeah, I kind of followed up with that with my "old cranky programming guy" post
If they want to use C#, use the CLC and a text editor , but yeah, I agree, I don't believe starting with a fancy VIDE is the best idea. I've used it for a couple of POC type projects since it was so easy to quickly put together (used SimpleJSON and BeautifulSoup to build some crawler/parser/API handler engines).
It's a little kooky, lots of -isms, but I suppose that's part of the charm (I did quite a bit of Perl back in the late 90s, reminds me of Python ...). Random FYI, the newsgroup app I use is coded in Python.
I really dig on Ruby, it just hasn't come up as a need for any production work, and my free time isn't usually spent spanking code around
You're in luck, there are thousands of professionals coding in Java
I can only think of one product that is programmed in Java (unless you count TD Ameritrade online trading tools). Everything else is C++ or Objective C.
I can't think of any consumer products coded in Java therefore Java must not be used by industry professionals. Cool story Bro. Java is used plenty for internal software, web applications and in the cloud you'll just never know it if it's done well.
So just to clarify...
Hi everyone,
So just to check, if I un-tick the 'enable java' box but leave the 'enable javascript' box ticked in safari security preferences, then will I be safe from this vulnerability? I don't have any other browsers (although I did at one point have chrome...) Is it safe to leave the 'enable plug-ins' box ticked?
Are there any 'everyday' programs (e.g. - not Adobe CS or developer tools) that also use java? Would they also be vulnerable to the bug?
Thanks!
Hi everyone,
So just to check, if I un-tick the 'enable java' box but leave the 'enable javascript' box ticked in safari security preferences, then will I be safe from this vulnerability? I don't have any other browsers (although I did at one point have chrome...) Is it safe to leave the 'enable plug-ins' box ticked?
Are there any 'everyday' programs (e.g. - not Adobe CS or developer tools) that also use java? Would they also be vulnerable to the bug?
Thanks!
Last edited:
This is especially sad, since so many web applications using Java could probably be rewritten in HTML 5 + Javascript and achieve the same, if not better, functionality today. Java is a language for the web, but developed for a different era. Today, web browsers support powerful web standards so well, that they form their own ecosystems within the OS, but often sandboxed for improved security. Using Java or Flash are problems in both cases for the same reason -- requiring binaries from outside this walled garden. When that binary is either compromised or exploited, that's when we get these problems.
Not that this is the greatest issue with these external technologies. That would rather be all exploits we are unaware of, potentially happening -- right now.
----------
Not that this is the greatest issue with these external technologies. That would rather be all exploits we are unaware of, potentially happening -- right now.
----------
Very impressive Objective-C graph there. Wow. I really need to get myself that Mac for development work. This could be a deal breaker for me in my business.
Cool story Bro. Java is used plenty for internal software, web applications and in the cloud you'll just never know it if it's done well.
Image
Thanks to Adobe and Minecraft I guess it'll take some time till I can uninstall that sucker... >_>
(Oh and college programming, but I don't mind that, can always throw up a VM for that)
Glassed Silver:mac
(Oh and college programming, but I don't mind that, can always throw up a VM for that)
Glassed Silver:mac
Umm just going to point out that even the memory management stuff in the colleges that go C heavy do not get touch on much if at all. Hell C is not a good OO language at all.
Also going to point out really does not matter what language you learn in school. It is not that hard to pick up another programming language later on in the work world if your foundation are solid. Hell right now I program in a language that most people have never heard of.
Hell I will go on and add in my CS degree most of my classes were about programming theory and algrorithims.
I had 1 class on C, 2 required classes on Java and an elective on C#. Of those C was more of a foundation class, 1st java class was teaching Java and C# and 2nd Java class was more on OO with lit bits of those respective languages thrown in. Vast majority of the stuff I learned in advance Java and C# class is very transferable to any OO language or school of thought.
Now my algroritium classes we were allowed to program in any language we wanted with in reason because really it was all about the concepts. I went with Java and C# depending on the semester but the professor was more about the concepts of how that worked.
Java is used professionally. I don't know why you would think otherwise. It is in fact based on the TIOBE index, the most popular language, with 19% market share (thanks to business applications being mostly written using J2EE and platforms such as JBoss, WebSphere, Oracle IAS and other such Application servers).
Learning language quirks like C memory management or "how to make iOS apps is not computer science. If you want to learn those things, crack a book open.
BlueJ is not the only Java compiler out there. You can use gcj or Oracle's include compiler in the J2SE SDK. If you find BlueJ "junky", use something else.
You sound like every college kid I knew in college and that I know today : You think learning to code is what you're in school for. I was like that too. You come to learn that languages are a dime a dozen and that school teaches you how to think, analyse and design software. Coding it is simply a matter of writing down what you've built. You can learn languages and their quirks in your own time.
----------
Then you obviously don't know about the industry you're about to enter after a degree in computer science.
It's too bad I can't post a screenshot of our internal WebSphere management console. There's about 5 pages of deployed application EARs in there, all serving quite a different solution (from eCommerce to telephony to mapping to inventory management to process management...)
That's not even starting to count our SAP Netweaver custom code in our ERP systems.
Anyway, for consumer use of Java, you obviously failed to think about this :
https://play.google.com/store
Plenty of Java right there, even if its not J2SE code.
I might to like add to Knight about programming languages are a dime a dozen saying that a good/experienced programmer should be able to pick learn a new language in about 3 months. At the end of 3 months they can put out good stuff and after 6 months they should be at the point of someone that one should not be able to tell the difference between someone who been in that language for their entire career and someone who moved into it assuming they have been in development for roughly the same number of years.
The key part are the foundations. Everything else is just syntax and framework.
This may have been always true. I went to Stanford for a graduate degree (Electrical Engineering, not Computer Science) in 1971. Stanford was one of two hotbeds for AI and the LISP language at the time. I thought that this would be a great school to learn LISP, so I took the introductory course. The instructor in the first lecture said we had two weeks to learn the language, on our own! The lectures (and homework) were all about application of LISP to solve problems. FWIW, I did end up with an "A" in that course.
That was quick! Although perhaps not quick enough. Just think how long it would be if Apple was still distributing Java.