Experts Develop 3rd-Party Patch For New Java Zero-Day 154
tsu doh nimh writes "A new exploit for a zero-day vulnerability in Oracle's Java JRE version 7 and above is making the rounds. A Metasploit module is now available to attack the flaw, and word in the underground is that it will soon be incorporated into BlackHole, a widely used browser exploit pack. KrebsOnSecurity.com talked to the BlackHole developer, who said the Java exploit would be worth at least $100,000 if sold privately. Instead, this vulnerability appears to have been first spotted in targeted/espionage attacks that used the exploit to drop the remote control malware Poison Ivy, according to experts from Deep End Research. Because Oracle has put Java on a quarterly patch cycle, and the next cycle is not scheduled until October, experts have devised and are selectively releasing an unofficial patch for the flaw."
A better idea... (Score:4, Insightful)
Re: (Score:3, Insightful)
Can somone explain why this is modded 'funny'? It should be informative. Eliminating attack vectors is the only sure-fire defense. Unless you need Java, you should dump it. If you need it, you should actively find ways to eliminate that dependency.
Re: (Score:3)
you know what's funny? can't log into my web banking without it(it's only the signon flow where it's used, too).
though, I guess I should still just whitelist it on certain sites. however applets can be used in good ways.. it's just that nobody ever does that.
Re: (Score:3)
In Chrome: Wrench-->Settings; Advanced Settings; Content settings; "Click to Play" under plugins.
Problem solved.
Re: (Score:2)
Re: (Score:2)
Last time I checked USAA uses Java to deposit checks online too.
Re: (Score:2)
Re: (Score:2)
For us people living in Denmark, there's pretty much no way to avoid Java. The nation-wide "digital signature" (that's what they call it - in fact it's really just a glorified single-signon) NemID ("Easy ID") requires Java. It's a big fscking mess, it's run by the banking industry but being shoved down our troaths for interfacing with the government, and there's already successful MITM attacks for it.
Oh yeah, and the signed Java applet is just a bootstrap that fetches unsigned applets from "whatever locatio
Re: (Score:1, Insightful)
Can somone explain why this is modded 'funny'? It should be informative. Eliminating attack vectors is the only sure-fire defense. Unless you need Java, you should dump it. If you need it, you should actively find ways to eliminate that dependency.
A modest proposal to improve security. You know what be more effective than uninstalling Java? Uninstalling the network and other input devices. In fact, why don't you turn off the computer entirely?
The number one reason that Java has published security holes is that Java is used heavily. Non-java programs also have security holes. Yes, it makes sense to reduce dependency on Java now, because Java has the current serious security hole. However, your parent wasn't suggesting that. Your parent was sugg
Re: (Score:1)
...Your parent was suggesting that uninstalling Java was better than fixing the security hole.
I think that was because he was implying that Java isn't used anywhere enough now a days to warrant it being installed on client systems, for the most part.
Re: (Score:2, Informative)
Your parent was suggesting that uninstalling Java was better than fixing the security hole.
It *is* better than fixing the security hole. Fixing the security hole fixes ONE security problem. Uninstalling Java fixes that ONE security problem AND all unknown/future Java security problems.
Re: (Score:2)
You shouldn't have posted AC.
Re: (Score:3)
Your parent was suggesting that uninstalling Java was better than fixing the security hole.
It is, given the huge percentage of malware infections directly caused by Java and Adobe plugin exploits.
Patching this particular hole fixes the problem for about 2 weeks till the next 0-day drops. Some of us like to get off of that nasty little merry-go-round, and get rid of a plugin that has basically no use. If you really need it, set your plugins to Click-To-Play (through flashblock for firefox, or as detailed here [slashdot.org] for chrome)
Re: (Score:2)
Sorry, but Java has a really nasty track record of exploits - especially considering that client code runs not just in a sandbox, but a sandboxed virtual machine - and that the platform has had a lot of emphasis on security from day one.
I don't have a Java plugin in my browser, I consider that pretty much security suicide. Because I live in .dk, I have to use a browser with Java plugin from time to time, but I handle that in a locked down virtual machine that I use solely for that purpose.
Also: I kinda like
Re: (Score:3)
So what do you suggest as alternatives? Java does serve a function, you know. There are plenty of things that haven't had an emphasis on security from day one.
The irresponsible thing here is Oracle's update schedule.
Re: (Score:2)
Re: Java is like IE 6 in business (Score:1)
Huge amount of banking and intranet sites in the office not only require it but require a specific version like 9 year old 1.4.2. No not 1.4.1, nor 1.4.3 but just 1.4.2 with 10 exploits. Kronos, bank of america, and others. The same financial institutions that dont require java for us do require ancient IE and old java for corporate functions. These desktops get infected constantly over and over.
Re: (Score:2)
Huge amount of banking and intranet sites in the office not only require it but require a specific version like 9 year old 1.4.2. No not 1.4.1, nor 1.4.3 but just 1.4.2 with 10 exploits. Kronos, bank of america, and others. The same financial institutions that dont require java for us do require ancient IE and old java for corporate functions. These desktops get infected constantly over and over.
In that case, the appropriate solution is to run these tasks from virtual machines, which are then wiped back t
Re: (Score:2)
I would in all honesty change banks if that happened, not just because of the security holes but because it can be a phenomenal pain to get such an old version to play nice with a modern browser. You have to jump through hoops to even get such an old version. It would be sufficiently problematic that I would end up not using the web interface, which is sufficiently annoying that I would want a bank that had useable / secure web access.
Re: (Score:3)
Attack vectors? Like the internet?
Re: (Score:3)
Can somone explain why this is modded 'funny'? It should be informative. Eliminating attack vectors is the only sure-fire defense.
Hmmm... seems you are right... the maximum security for a computer is achieved by uninstalling the OS and keeping the computer powered off. (I'm not saying you advice this, but just to put into evidence that security is not the objective that anyone would like maximized).
Re: (Score:2)
Java is also used heavily on the browser in Colleges and Universities (Higher Ed.) for rich text editors, chat rooms and some other educational content.
Re: (Score:2)
It also happens to be embedded in Oracle Databases, and even though it isn't mentioned wither this 0-day affects Android, the Djarvik Engine is modeled after Java. Java is used in an incredible number of applications, it just doesn't get rubbed in your face all the time. Yeah, nobody uses Java anymore. Except... everybody.
Re: (Score:2)
Well, I don't think it's likely that the exploit is at a level where Djallben would have inadverdently duplicated it.
Re: (Score:2)
When talking about java in a browser executing remote code: agree, avoid it if you can.
When talking about java as platform (like .net or other platforms) for server side applications, then dumping java because of this bug is a bit drastic.
Re: (Score:2)
Re: (Score:3)
Just deleting the network drivers would be enough. It'd simultaneously make the internet a better place too...
Re: (Score:2)
....
Java Zero Day VulnerabilityâoeIn my lab environment, I was able to successfully exploit my test machine against latest version of Firefox with JRE version 1.7 update 6 installed,â he wrote on the company blog.
The exploit was found on a server in China, and if it successfully attacks a given endpoint, the payload that is delivered is hosted on the same server. While the IP address associated with the malicious box has been known to serve malware in the past, it isnâ(TM)t responding to browser connections. Nevertheless, the IP is live. ....
On Monday, the Metasploit Exploit team at Rapid7 said they found the PoC and had developed a working exploit that they say enables a successful attack against a fully patched Windows 7 SP1 with Java 7 Update 6.
âoeAs a user, you should take this problem seriously, because there is currently no patch from Oracle. For now, our recommendation is to completely disable Java until a fix is available,â a blog post from Rapid7 notes.
Once again, itâ(TM)s wise to remove Java if it isnâ(TM)t absolutely needed in your environment. Most home users have little need for the software these days, and most experts agree the risk outweighs the reward when it comes to installing it.
I don't know why the OP is moderated Funny, maybe they have Java installed on their 'humour sensing unit'.
--
OTOH I wish IBM bought Sun back when Oracle made their bid, this lack of interest by Oracle is just perplexing at this point. If Ellison doesn't see a way to monetize Java environment, why not sell it? Have an auction, put it on Ebay.
Re: (Score:1)
If Ellison doesn't see a way to monetize Java environment, why not sell it? Have an auction, put it on Ebay. [youtube.com]
Re: (Score:1)
If Ellison doesn't see a way to monetize Java environment, why not sell it? Have an auction, put it on Ebay.
It's about the patents. That's why Ellison bought Sun. Java for end-user computing doesn't even factor in at all. He wants to be able to patent troll Android (in large part because of his personal friendship with Steve Jobs).
Re: (Score:2)
Re: (Score:1)
But.. but.. then how can I play Minecraft? :(
Re: (Score:2)
But.. but.. then how can I play Minecraft? :(
I mentally translate "JRE" to "MRE" for Minecraft Runtime Environment.
In all seriousness, many banks run a captive Java application for login authentication using challenge/response as an anti-phishing mechanism to prevent storing the credentials. Given that Java is frequently exploited, this isn't a very effective strategy, given the current generation of online channel-breaking attacks.
Re: (Score:3)
Re: (Score:2)
To elaborate, the mobile version of Minecraft:
- Is limited to a fixed world size, it does not expand as you explore like the PC one does.
- Has only a very limited selection of enemies.
- Lacks many of the tools, blocks, etc.
- Does not include enchanting or bow & arrow
- Doesn't apply gravity to sand and gravel
- Has been declared shit by Notch himself.
and many other restrictions. It's slowly evolving past the original release that was basically just creative mode but it hasn't come too far yet.
An Even Better Idea (Score:2)
Why don't they make it so that you can download the installer (for use on other computers) without using TOP SECRET BURN BEFORE READING links??
oh btw a cool way to get all the "stuff" is http://ninite.com/.net-7zip-air-chrome-firefox-flash-flashie-foxit-java-pdfcreator-shockwave-silverlight/ [ninite.com] download that file and then run it to get everything installed (and yes i did include both chrome and firefox)
Re: (Score:2)
Re: (Score:2)
I would love to uninstall Java. But what would I replace UGENE and ImageJ with? It seems like any free, cross platform, GUI, scientific software is written in Java.
Re: (Score:2)
So uninstall all plugins, etc. and only run pure Java apps. To go one better, only run them in a sandbox (a VM should do the trick). That way, you can still copy/paste the output and even share the files back, but as you aren't doing anything in that sandbox other than running that Java app, that instance of Java won't be exploited. You don't even need to upgrade for new features/security fixes!
Re: (Score:3)
You know what would be better idea than patching Java? Uninstalling it.
I didn't uninstall it; but several months ago I turned it off in my web browser(s). You know what? It hasn't impacted anything I do - none of the web sites I use rely on Java *at all*. Not the fun sites, not the banking sites, not the business sites...
I've certainly got some local software that requires Java; but if it's not available in my browser you're going to have a difficult time getting an exploit onto my computer.
Re: (Score:2)
Exactly! The only thing I ever need it for in a desktop environment is for apps use it, not for web pages.
The real problem, as I see it, would be for all those smartphones out there that use java for everything
Re: (Score:2)
Exactly! The only thing I ever need it for in a desktop environment is for apps use it, not for web pages.
The real problem, as I see it, would be for all those smartphones out there that use java for everything
iOS doesn't do Java, so all those sites out there that want to support iOS devices have to have an alternative. Because of this, Java Applets and J2ME sites always have a usable alternative these days.
Re: (Score:2)
I wonder if it affects Java-powered devices like BD players? Hard to uninstall that. I guess if I see an update for mine I'll know what it's for.
Re:A better idea... (Score:4, Funny)
I locked it down so *only* those 2 things can use it. One of them is not the web browser...
But the other one is the web browser? ;)
Re: (Score:2)
Yes it is. The .NET runtime has substantially less security issues than Java. Just chek out Secunia.
Re: (Score:2)
In all fairness, Java is no less secure than .NET or any other middleware.
In all fairness, that statement is crap without any supporting data. It is in fact possible for some middleware to be designed and built more poorly than other middleware. That's like saying that, in all fairness, Duke Nukem Forever is every bit as stable and well-designed as any other game.
Re: (Score:2)
In all fairness, Java is no less secure than .NET or any other middleware.
In all fairness, Flash is no less secure or stable than any HTML5 implementation.
Quarterly security patch? (Score:1)
You have to be fucking kidding me.
Re:Quarterly security patch? (Score:5, Funny)
The analysts figured that exploits only come out an average of four times a year, therefore they only need to send updates every quarter. Who can question the CIO's master stroke of logic?
Re: (Score:3)
Don't make fun of this. Metrics don't lie. Seriously.
Re:Quarterly security patch? (Score:4, Funny)
Re: (Score:2)
Luckily for criminals, those exploits are made public the day following the quarterly update.
Seriously though, they don't have out-of-schedule updates for critical security bugs?
Re: (Score:2)
Seriously though, they don't have out-of-schedule updates for critical security bugs?
Well, it's Oracle, so I expect they do, they just cost extra. I mean, you are up to date on your Oracle Certified Java Security Support, right?
(Note: I'm joking. The actual service is called Oracle Premier Support for the Java SE Platform [oracle.com] and you only need it to get security patches for "old" versions of Java.)
Re: (Score:2)
So, in order to play Minecraft safely (requires Sun Java 6, sucks with OpenJDK or later versions for some reason), I need to pay Oracle $3300? Got it.
Re: (Score:2)
Nah, you only will need to pay once Java 6 reaches end of life last month. I mean, November. I mean, next February.
(And, yes, seriously - the Java 6 EOL date has been pushed forward twice so far. Presumably because Java 7 still isn't quite ready on all platforms.)
Re: (Score:2, Informative)
I'm not sure if you are trolling, but here's why:
There is a significant amount of work to test the software before doing a release.
The code base is big and old, there are a lot of targets, and I'm guessing that not all tests are automated.
Also, there is this issue of reducing the number of versions "out in the wild", at least for paying customers,
as more versions that costs money to provide support for.
All this will take resources away from fixing bugs and working on new features.
It's not as if there are no
Re: (Score:2)
Re: (Score:1)
And what happens when it's time to release the next version but no new vulnerabilities have been found?
Don't worry about it, that's never going to happen.
Re: (Score:1)
And what happens when it's time to release the next version but no new vulnerabilities have been found?
You can go GNOME3 on any software anytime.
Re: (Score:2)
Users get upset when the server is rebooted/restarted on short notice.
You get alot of "I need two weeks in advance to prepare for this" complaints.
You know its funny (Score:3, Interesting)
We were told Java was going to be the answer to all our security problems. No more buffer over flows, and few if any other remote code exploits would be possible with applications written in Java.
Its to bad someone finds a critical vulnerability in the platform every other month seemingly.
Re: (Score:1)
Every other month? Seems closer to every other day.
Re: (Score:1)
Maybe it would help if they used Java to program the vm.
Then it would be impossible to have security vulnerabilities.
Re: (Score:3, Insightful)
This isn't a flaw in Java itself but yet another flaw in the browser plugin.
Given that virtually all the major browser plugins technologies I can think of have resulted in an unending stream of exploits, it seems silly to blame this entirely on Java. Adobe PDF, Flash, and the Java plugin have all been the main vectors of attack. Guess what the three most popular browser plugins are?
Maybe the real issue is a shitty plugin API and/or implementation?
Re: (Score:2, Informative)
Not true...
http://dev.metasploit.com/redmine/projects/framework/repository/revisions/52ca1083c22de7022baf7dca8a1756909f803341/entry/external/source/exploits/CVE-2012-XXXX/Exploit.java
It's a bug in how java bean statements interact with security domains, as far as I can tell. Definitely a JRE bug.
It really is just more reason why you should never let your language's runtime get completely out of hand - this kind of stuff should have been in libraries, not in the runtime.
Re: (Score:2)
Basically you're bolting three proprietary, poorly maintained web browsers onto your shiny main webbrowser. Guess where the bugs are going to be?
To be fair, though, Java is open source. Even if you think Oracle wields too much control over it, the source code is there for anyone to read, for security purposes or otherwise.
Re: (Score:3)
Will we ever be safe from all that?
Oh, it's Java bashing time, sorry...
Re: (Score:2)
Assuming they were written by programmers of roughly equal competence Java applications in general probablly are safer than their counterparts in more traditional languages due to the fact that certain categories of exploit basically can't happen.
The java related security problems mainly come from software (most notablly the browser plugin) that uses the java runtime's sandboxing features to run untrusted code. The sandboxing system is highly complex and as such prone to bugs and when bugs do happen they of
Don't browse with Java (Score:5, Informative)
There is no good reason to have Java installed in your primary browser. The only reason why it's everywhere is that it often comes preinstalled for no good reason, and (even worse) the installer shoves its way into all your browsers, for even less reason. If there are specific business sites using Java that you must access, then use IE with Java exclusively for those, and Firefox or Chrome for normal browsing. Using Java on the open web is just asking to get 0wned.
Re:Don't browse with Java (Score:4, Informative)
Re: (Score:2)
All above tools only create mashed soup on top of html with different browser specific quirks.
...while eliminating all security issues around Java. If you think that's a bad tradeoff, please point to the Java version of Facebook, or the Java version of Youtube, or Gmail, etc.
Re: (Score:2)
...while eliminating all security issues around Java.
In exchange for security issues in a bunch of other technologies across a number of implementations, great tradeoff! Like the SVG Remote Execution Exploit in Safari, or the SVG Font Manipulation Vulnerability in Opera, or Mozilla's cross-origin data theft canvas vulnerability or the AJAX Javascript hijacking bug found by Fortify that affected applications built with Xajax, GWT, jQuery, Prototype, Dojo, Moo.fx, Yahoo.UI, Microsoft Atlas, MochiKit, etc...
Re: (Score:2)
Like the SVG Remote Execution Exploit in Safari, or the SVG Font Manipulation Vulnerability in Opera, or Mozilla's cross-origin data theft canvas vulnerability or the AJAX Javascript hijacking bug found by Fortify that affected applications built with Xajax, GWT, jQuery, Prototype, Dojo, Moo.fx, Yahoo.UI, Microsoft Atlas, MochiKit, etc...
Just out of curiosity, what percentage of infections are the result of attacking those exploits? Java is responsible for 37% of infections on Windows machines, how many infections were caused by exploiting Xajax, or MochiKit? Can you point to a reference for anyone using Safari who got an infection via SVG?
More importantly, does installing Java eliminate all of those other vulnerabilities, or does it just add new ones?
Re: (Score:2)
Just out of curiosity, what percentage of infections are the result of attacking those exploits?
I don't know, those were just examples to illustrate that replacing Java will eliminate Java exploits but introduce new ones because not only are there a bunch of replacement technologies there are a bunch of different implementations of them. HTML5/Canvas/SVG/AJAX is demonstrably no more secure than Java, i find the technologies themselves to be better and that would be my case for switching to them but to make a case for them on a security basis is just ignorant of the fact that they are not inherently an
Re: (Score:2)
Well, that was a very measured response.
I tend to think that those vulnerabilities are there already, whether you use them or not. Browsers support SVG and whatnot, so those are already there whether beneficial developers are using them or not. I don't think there are vulnerabilities specific to individual toolkits like jQuery or Prototype, I assume that they all deal with the vulnerabilities inherent in the browser itself. So it's up to the browser vendors to fix those, and for the most part they are do
Re: (Score:2)
I tend to think that those vulnerabilities are there already, whether you use them or not. Browsers support SVG and whatnot, so those are already there whether beneficial developers are using them or not.
I see your point, yes they are there to a degree but at this stage no browser even fully implements the 'standards' yet and they aren't widely used, much better to target Java as you know just about everyone has it installed. Once everyone has a HTML5/Canvas/SVG/AJAX/etc... compliant browser installed that will become a much larger target
I don't think there are vulnerabilities specific to individual toolkits like jQuery or Prototype
Those were specifically generating vulnerable code.
So it's up to the browser vendors to fix those, and for the most part they are doing a decent job at it.
The real concern there is that browser makers have enough trouble with vulnerabilities without taking everything Java is
Re: (Score:2, Informative)
Better yet, disable all plugins by default (or set for "click to run"), and whitelist sites you regularly visit and trust. You should have a minimal attack surface when visiting *any* site you don't explicitly trust.
Re: (Score:2)
It's exploits like this which make me pine for someone to re-implement VMS security mechanisms for modern operating systems. If I could get that kind of granular control at the IP level of a network, I'd be even happier. "Prohibit all traffic from to anywhere except sites x, y, z". It wouldn't be a fix, but it'd sure help.
I know I can do it with layer 7 filtering, but it's still a huge headache today.
Re: (Score:2)
I have it disabled 99% of the times. My work's time card system and online classes/courses require Java. Lame, I know! :(
If I remind well (Score:5, Interesting)
During SUN's era, the motto for Java was : "if there is a vulnerability, stop everything until it's fixed"... Sun was quite responsive in order to keep java's secure reputation...
But now, it's Oracle... Oracle screwed on OpenOffice... Oracle is screwing up over MySQL... And it looks like Oracle is screwing up over Java... I wonder what treatement gets VirtualBox...
Re: (Score:3)
Oracle screwed on OpenOffice... Oracle is screwing up over MySQL... And it looks like Oracle is screwing up over Java... I wonder what treatement gets VirtualBox...
Larry Ellison glances at his screwdriver...
Re: (Score:2)
Larry Ellison glances at his screwdriver...
...then laughs manically, and screws everybody over. Again.
Re: (Score:3)
During SUN's era, the motto for Java was : "if there is a vulnerability, stop everything until it's fixed"... Sun was quite responsive in order to keep java's secure reputation...
But now, it's Oracle... Oracle screwed on OpenOffice... Oracle is screwing up over MySQL... And it looks like Oracle is screwing up over Java... I wonder what treatement gets VirtualBox...
Well, Oracle doesn't need to fix Java. Oracle is "Unbreakable"[TM]
Re: (Score:2)
They didn't replace non-free by free... They did replace GPL by non-GPL (ASL) component.
To provide a mechanical analogy, they didn't replace tri-wing, pentalobe or such screw by flat screw but standard cruciform screws by slot screws...
Before the donation to Apache, Oracle managed to have OpenOffice fork (LibreOffice) because of political issues from Oracle... that's never good for an opensource project...
And this is why I don't have Java Installed (Score:1)
Simply put, I have absolutely no apps that depend on JAVA and this is exactly why. As someone else said, the best solution is to removed JAVA entirely and never let it near your system again. Friends don't let friends install Java and we don't do windows
Vendors shipping custom Java versions (Score:2)
Re: (Score:2)
Quarterly update cycle? Um... whut? (Score:3)
My JRE wants to update itself every time I turn around, and I say "why, yes, go ahead". Where does this "quarterly update cycle" statement come from?
quarterly, huh? (Score:2)
Install an alternative JRE if you need it (Score:3)
For GNU/Linux users, there are a lot of choices to avoid this, if our platforms are even targeted. For Windows and Mac OSX users, I've been recommending:
1. Uninstall all versions of Sun/Oracle Java JRE
2. Install OpenJDK 6, only if needed (easy install packages here http://www.openscg.com/se/openjdk/index.jsp [openscg.com] )
^ that link also has install packages for GNU/Linux, but obviously you'll want to use your distro's package manager if you have one. Also, I recommend uninstalling *all versions* of Sun/Oracle Java, not just 7, because it's a simpler instruction for users. I find a lot of people hit a cognitive wall when they have to check software versions, even if the info is right in front of them.
Re:It's Worse for Apple Users (Score:5, Informative)
Re: (Score:2)
Re:It's Worse for Apple Users (Score:4, Funny)
It's up to Sun to release a JVM for OS X now
Boy, are you Apple users in trouble!
Re: (Score:1)
Apparently Sun IS now releasing a JVM for OS X. Yay!
So we were both wrong.
Some more than others. 2009 called and asked to tell you that. 4/20 to be exact.
Re: (Score:2)
Or what. :)
xxx - something else has that which has been allowed through the domain filters because "xxx" doesn't always designate pornography, it can also be part of the size of a t-shirt or a movie [imdb.com] perhaps.
.exe download - many larger organizations let their users download executable files from the Internet because their job requires downloading these sorts of things and having requests to let someone else download it becomes a department road block.
downloads .exe to temp directory and tries to run it - g
Re: (Score:2)
xxx - something else has that which has been allowed through the domain filters because "xxx" doesn't always designate pornography, it can also be part of the size of a t-shirt or a movie [imdb.com] perhaps.
You don't need to be shirt-shopping or checking out a Vin Diesel movie at work. Block remains in effect.
So you are providing a Internet connection for what reason at work? And your staff isn't allowed to use it for personal things during lunch or breaks?
.exe download - many larger organizations let their users download executable files from the Internet because their job requires downloading these sorts of things and having requests to let somepony else download it becomes a department road block.
HAHAHAHAHAHA. No.
Up to you whether or not you want your IT staff to download requested items. For your IT staff to do it, it becomes a support ticket and puts in the delay that your ticketing and support organization will put into the request.
downloads .exe to temp directory and tries to run it - group policy may block but legacy applications (that you can't rewrite or replace because a department or division runs on it) may require the same type of behavior.
Which will be given exceptions on a case-by-case basis. Not letting everything on the whole system just go nuts with permissions.
Depends on the app. Case-by-case - if everyone is running an app that requires that sort of access, your case has just been shot - o
Re: (Score:2)
If you allow the systems to do Wi-Fi, your internet filters are one personal smart-phone away from being bypassed - so instead of letting your staff know that you monitor internet connections and let them go about and willy-nilly do things (which means they aren't working, which is a management issue) you force them to do things that can put you in a deeper pickle (such as bridge your internal network to the Internet via their personal hot spot). They blow up their system, you wipe it and restore from ima
Re: (Score:2)
I read this "my work requires it!" claim a lot.
I think it is hogwash.
Work requires a stable system.
True - but "stable system" varies depending on the type of work done. If you have a typical office environment (accounting, marketing, etc) you are correct. If you have a software development shop, it changes things...
Work does not require access to xxx, download of .exe, run of .exe outside of installed apps, change of the system.
xxx <> porn -- blocking based on character strings may have unintended side effects. (I was looking for tape DLTXXX29...)
Things outside of installed apps -- so how does your Dev staff grab a copy of something to install and test out?
The admins are just hiding that they don't know how to implement measures like this.
Or they are more experienced than you think becau
Re: (Score:2)
Don't confuse an exploit with a specific piece of malware. This invalidates all your above points.
Also, keep in mind that there's (public-and-patched as well as private-0day) privilege escalation exploits available for all major operating systems. This directly invalidates your point #4, and indirectly #3. #2 and #5 are relatively trivial to overcome... but the funny/sad thing is that you don't need any of this trickery in order to be effective. You can get a zillion zombie bots all running in user-mode wit
Re: (Score:2)
Does your software rely on the sandboxing features of java to prevent code from accessing things it shouldn't? and if so are you trying to protect against malice or just against accidents?
If you are relying on the sandboxing features of java to protect against malice you might want to reconsider your strategy. If not you are probablly ok.