Forgot your password?
typodupeerror
Java Oracle Security

Another Java Exploit For Sale 150

Posted by samzenpus
from the a-new-flavor dept.
tsamsoniw writes "Mere days after Oracle rolled out a fix for the latest Java zero-day vulnerabilities, an admin for an Underweb hacker forum put code for a purportedly new Java exploit up for sale for $5,000. Though unconfirmed, it's certainly plausible that the latest Java patch didn't do the job, based on an analysis by the OpenJDK community. Maybe it's high time for Oracle to fix Java to better protect both its enterprise customers and the millions of home users it picked up when it acquired Sun."
This discussion has been archived. No new comments can be posted.

Another Java Exploit For Sale

Comments Filter:
  • by Anonymous Coward

    When the fuck did this happen?

    • by mark-t (151149)
      2010
      • Sadly I remember stagnation and security issues too when Sun still owned it too.

        • by SIR_Taco (467460) on Wednesday January 16, 2013 @08:30PM (#42611355) Homepage

          You mean the redundancy issues?

        • by hairyfeet (841228) <bassbeast1968@NOsPAM.gmail.com> on Thursday January 17, 2013 @12:44AM (#42613407) Journal

          The problem is that 2 different security groups have been analyzing the flaws that the malware guys used for the last exploit and say it could be 2 years before a proper fix is in place [zdnet.com] because the underlying code is "a mess".

          Of course any of us who had to deal with Sun's products in the past could have told them this, Sun was pretty piss poor when it came to code and security, this is why I've been saying give the LO guys at least 3 years before we start bitching simply because it'll probably take that long to clean up the mess Sun left.

          The monkey in the wrench though, the fly in the ointment, the pain in the ass, is that Java usage was waaay down among consumers....until that fucking game showed up. I hope the guy who wrote Minecraft is happy because just when we had weened a lot of home users away from the tripe that is Java he had to build a hit game on it and drag us all back into the mess. I don't know which is worse, Micecraft bringing shitty Java back to the consumer desktop or that fact Java will add the browser plugin (along with crapware) every time you update the damned thing. But in any case the malware writers are gonna have a field day as all those Minecraft installs are a botnet waiting to happen and if those security researchers are right all Oracle can do is slap band aids on the mess that is Java..

          • Re: (Score:3, Funny)

            by Anonymous Coward

            Aww. Did a creeper explode your house?

          • Wow Hairy.....your comments are sooo much better when you know what you are talking about. The JRE is awesome. The main problems, or issues rather, have been from the applet plugin and users clicking "yes" on every dialog box they see. Sun created extreme competition in the market by implementing a C-based language with powerful, simple, sensible APIs and a security model. If it had not been for Java then Microsoft would have never developed .NET to the point it is at now. For what it is worth from a J

            • by hairyfeet (841228)

              Riiight, Java is sooo awesome...that if you remove it and Flash you have a practically uninfectable computer. Hell I ran a PC for 4 years at the shop without even an AV, just Firefox with no Java and no Flash, thing never had so much as a close call.

              I'm sorry but I don't give a rat's ass if Java as a language is so fucking good it sends 10,000 dollar hookers to blow you while you write code as that is NOT my concern. To steal a line from Tron Legacy "I stand for the users" and from a security standpoint Jav

  • by Anonymous Coward on Wednesday January 16, 2013 @07:59PM (#42611095)

    So then do like Google and pay the guy for the bug.

    • Exactly.
      Java isn't inherently unsafer than any other software or platform. The reason why so many exploits are being discovered is that Java is currently at the focus of the criminal malware underground. Being so widely deployed makes it a natural target, just as most viruses and trojans target Windows because it's the most widely distributed operating system. Nevertheless all these security issues are causing a lot of bad press to the Java brand. What Oracle needs to do is to reward findings of security ho

    • That would escalate quickly.

  • Kill it with FIRE (Score:5, Insightful)

    by Billly Gates (198444) on Wednesday January 16, 2013 @08:02PM (#42611113) Journal

    Oracle needs to give up on browser plugins. I realize there are some mission critical business apps and a few cases where it is needed just like IE 6. We need to start pressuring the vendors to stop distributing it like we did with obsolete browsers.

    With javascript and HTML 5 and CSS 3 there is no reason to keep such 20th century technology on the modern web. Consumer sites no longer even use it anymore.

    With IE 6 and IE 7 gone by 2014 our eyes should focus on Java as the next technology that threatens the security of our networks that needs to bye bye. We need to do our part as IT professionals and inform PHB it is bad security just like IE 6 and demand app vendors to drop it.

    • by Anonymous Coward

      What about www.runescape.com and www.minecraft.com ?

      oracle should just fix it properly.

      they need to spend whatever it takes to fix it once and for all.

      • Re: (Score:1, Informative)

        by Anonymous Coward

        They should die. There is no reason to do that sort of thing in a browser instead of a standalone client.

      • by Anonymous Coward

        Use minetest, it's C++ and scales better.

        X feature missing? Add it, it's open source with lua scripting.

      • by Runaway1956 (1322357) on Wednesday January 16, 2013 @10:50PM (#42612631) Homepage Journal

        "fix it once and for all."

        Please name some softwares that have been fixed, once and for all. I'm not aware of any. It seems that everything is evolving as threats evolve. You could start with the kernels. Microsoft seems to change theirs, Linux changes theirs, etc.

        You might join the chorus, and complain that Oracle evolves to slowly, or that it is incapable of evolving fast enough to remain relevant, but there is no chance in hell that it can be fixed once and for all.

        • by gbjbaanb (229885)

          qmail. I understand the author offered a security bounty [cr.yp.to] that's never been paid out.

          • qmail. I understand the author offered a security bounty [cr.yp.to] that's never been paid out.

            Doesn't mean it's invulnerable.

            • by idontgno (624372)

              True dat. The fact that the security bounty remains unclaimed simply means that approximately no one uses it, so it's worthless as an attack space.

              Hell, by that metric, Amiga OS has been the shining paragon of network and OS security.

    • by Anonymous Coward

      Can we kill the whole DynamicHTMLWebApp thing instead, and return the web to being about lean mean content delivery?

      Separate software in Java or whatever to deliver, well, apps. Not the half-caste "browser app" thing.

      • by Anonymous Coward

        It's too late for that. There are multiple industries built around that functionality, and with HTML5 it's only going to get worse. The only way the web will only return to the days of text-and-maybe-images is if something incredibly drastic happens to make people view the current web and a new, "clean" web as two distinct entities.

        Personally, I think the only chance for it to happen is right after extraplanetary living becomes reasonable, we we have to communicate with the Earth through pencil-thin laser

        • by kestasjk (933987) *
          Yeah I hate interactive websites..
        • by someones (2687911)

          lol no. Just wait for all this cloud crap bubble to burst and people realize that nowadays "in the cloud" means "is online".

          And after that people might realize that "apps" are nonsense too as local data is far more secure than havin data online.
          And the lack of the ability to process data locally instead of "somewhere in the cloud" aka. online will lead people to want normal local programs to do that stuff.

          And with the efforts dome by governments to regulate the internet and lack of usage/interest in online

    • by tjstork (137384) <todd.bandrowsky@gmai[ ]om ['l.c' in gap]> on Wednesday January 16, 2013 @08:40PM (#42611443) Homepage Journal

      Can you really think you can compare a jack of all trades master of none half witted rendering engine that is html 5, coupled with a dull language that isn't even type safe and costs a comparitive fortune to debug, vs well, a -modern- language. I agree plugins can be hokey but html5 sucks.

      • by Anonymous Coward

        Can you really think you can compare a jack of all trades master of none half witted rendering engine that is html 5, coupled with a dull language that isn't even type safe and costs a comparitive fortune to debug, vs well, a -modern- language. I agree plugins can be hokey but html5 sucks.

        Can you really think you can't compare them? If one is so brilliant and the other so terrible I would think that assuming you know what you're talking about you could rattle off a list quite easily. Are you really struggling that much with debugging Javascript? Why are you having so much difficulty with it? Or with comprehending dynamically-typed languages? It's not that complex.

      • by H0p313ss (811249)

        Can you really think you can compare a jack of all trades master of none half witted rendering engine that is html 5, coupled with a dull language that isn't even type safe and costs a comparitive fortune to debug, vs well, a -modern- language. I agree plugins can be hokey but html5 sucks.

        That was certainly the intent of Applets back in the day when the web was young and exciting, but it's certainly not the reality that I've seen in the industry in the past 15 years. What I have seen has been a trainwreck of end user frustration, incompatibiity and security holes you could drive a truck through. (Not quite as bad as ActiveX, but close.)

        • At least ActiveX has signed controls as of IE 6 SP1 which the browser will refuse to run anything unsigned.

          With java it executes full privileges from any source! This means an infected ad server can host it via a link and it runs automatically with no user interaction! Most users of WindowsXP run as administrator too which means full privileges.

          In essence it is too powerful as JVM is whole OS really that can do it. TO the user it is non native looking, slow, and does not integrate with Windows so it is an o

          • by aled (228417)

            At least ActiveX has signed controls as of IE 6 SP1 which the browser will refuse to run anything unsigned.

            Unsigned applets run in a sandbox with limited privileges since java 1.3 at least. That's from year 2000. With the last version you can disable applet execution and set a security level for unsigned applets.
            I agree that perhaps the default should be to disable applets.

        • Re: (Score:2, Insightful)

          by Anonymous Coward

          All I ever see is people who constantly complain without helping with whatever they complain about. I've been in the industry now (more or less) for about the same amount of time, and every year, all I ever see is worsening cultural aspects of things ranging from every-inflating egos and deteriorating internet etiquette to constantly-atrophying documentation and increasingly-untested software. You see it on here from time-to-time when those posts pop up on occasion concerning some guy who's miffed over some

      • by gbjbaanb (229885)

        shame then that there are no security holes in html5 (as it does little) compared to the "modern" language that is full of them.

    • by Darkness404 (1287218) on Wednesday January 16, 2013 @08:47PM (#42611497)
      Except that there are still a good chunk of websites that still use Java. For example, Minecraft and RuneScape to name two.

      And sure you -can- have it be fully client side but it doesn't always work. Many schools and workplaces will filter out .exe file extensions but will let you run in-browser applications just fine.

      The web is not just things developed in 2013, but also for things developed back in 1997. And as such, it needs to be at least partially backwards compatible with older technologies.

      The real issue here isn't about browser plugins but it is the terrible management of Java by Oracle. There is nothing that inherently should make Java more unsafe than a generic web browser, the problem is unlike most web browsers, Oracle has time and time again proven to be unable or unwilling to fix gaping holes in their programs. Even when they do create a fix they still try to bundle in crapware such as the "Ask" toolbar and switch my default search engine to Ask. A slimeball tactic that should be reserved for those making keygens and the like.

      There is nothing that makes Java any more insecure than JavaScript except for Oracle. Rather than simply dropping a useful element of the web, we should pressure Oracle to do what a software firm should do: fix the bugs!
      • Re: (Score:1, Interesting)

        by Anonymous Coward

        Except that there are still a good chunk of websites that still use Java. For example, Minecraft and RuneScape to name two.

        Both applications that should be completely client side

        And sure you -can- have it be fully client side but it doesn't always work. Many schools and workplaces will filter out .exe file extensions but will let you run in-browser applications just fine.

        So the Java browser plugin deserves to exist because... otherwise kiddies can't get around Sonicwall? Really?

        Furthermore, that's a terrible argument because an institution that can prevent non-whitelisted applications from launching can also trivially block whatever website hosts the .jar for the program you want to run. And if they do, it's their damn equipment anyway, stop screwing around on it.

        The web is not just things developed in 2013, but also for things developed back in 1997. And as such, it needs to be at least partially backwards compatible with older technologies.

        This is completely true, but people have pretty much gi

      • Re:Kill it with FIRE (Score:4, Informative)

        by Lennie (16154) on Wednesday January 16, 2013 @09:22PM (#42611799) Homepage

        So how many people run Minecraft in the browser ? I thought most run it outside of the browser, right ?

      • Except that there are still a good chunk of websites that still use Java. For example, Minecraft and RuneScape to name two.

        And sure you -can- have it be fully client side but it doesn't always work. Many schools and workplaces will filter out .exe file extensions but will let you run in-browser applications just fine.

        The web is not just things developed in 2013, but also for things developed back in 1997. And as such, it needs to be at least partially backwards compatible with older technologies.

        The real issue here isn't about browser plugins but it is the terrible management of Java by Oracle. There is nothing that inherently should make Java more unsafe than a generic web browser, the problem is unlike most web browsers, Oracle has time and time again proven to be unable or unwilling to fix gaping holes in their programs. Even when they do create a fix they still try to bundle in crapware such as the "Ask" toolbar and switch my default search engine to Ask. A slimeball tactic that should be reserved for those making keygens and the like.

        There is nothing that makes Java any more insecure than JavaScript except for Oracle. Rather than simply dropping a useful element of the web, we should pressure Oracle to do what a software firm should do: fix the bugs!

        I can replace java with IE 6 too. We can then spend time optimizing for IE 6 and doubling your costs 200% right and making adding hacks for Netscape 4.7? My argument is it is time to move on. Yes not everyone has the state of the art Chrome browser with the latest OS on an iCORE7. However the web is not like 1997 except for www.craigslist.com and it is time to move on. Where do you draw the line with support but also moving foward and making something pretty and functional?

        Java does not belong on the brows

    • by Anonymous Coward on Wednesday January 16, 2013 @08:51PM (#42611539)

      Java applets are billion times more appropriate for running an application in a browser than a combination of
      - markup language created to structure text,
      - stylesheet language created to format it,
      - and some alien abomination to make it all 'dynamic'.

      I do see value in web apps, it is for example extremely useful to have access to Google Drive with it's text editor, regardless of where i am... But I cannot disregard that it has just a big pile of ugly hacks underneath to make it what it is. At least Java has been created exactly for writing applications and it does the job better than whole "HTML5, CSS3" stack.

      The Web turned horribly, horribly wrong way.

      • by Billly Gates (198444) on Wednesday January 16, 2013 @11:23PM (#42612855) Journal

        You are looking at it as a developer. Not a user nor IT support professional.
        Java is:
        -butt ugly
        -take 30 seconds to a minute to load
        -can't run on mobile platforms
        - fonts and widgets are not native and look weird. Are LCD fonts in yet? Ubuntu and debian have the old school non font hinting which is a horrible eye sore
        - Security risk
        - Not every computer has it and those that do have different versions
        - No one uses it that much

        Users hate it and think they are ugly and look like something from the 1980s while Flash is all pretty and fancy and loads instantly. People do not want applications in browsers. They use applets for that on their phones or tablet operating systems hence why Windows 8 was made whether you hate it or not. The browser is for simple logic and a gui platform.

        You may feel the web is horribly wrong but I.T. loves it via the cloud and salesforce.com apps. No need to install software on 5,000 computers anymore.

        • by someones (2687911)

          Guess you never used it as most of the things you say are plain simple false.

        • by lamber45 (658956)
          Several of your arguments are either false these days, or not as bad (especially versus the alternatives) as you make them sound:

          -take 30 seconds to a minute to load

          This load-time is for the first applet in a browsing-session, not each one; and "30 seconds to a minute" is an outer figure, on a reasonably modern system it will be less. I've seen Flash-based games that took a long time to initialize, as well.

          - fonts and widgets are not native and look weird

          Actually, you can have native widgets, with th

      • I have yet to see an HTML5 exploit that can root your machine.

        JRE on the other hand....

        ^^^ This one factor outweighs basically everything else.

        • by FlyingGuy (989135)

          It is only a matter of time. They keep trying to shovel more and more shit into HTML, CSS and javascript and the tipping point is not far off.

          And oh by the way I have yet to see HTML5 prevent drive by's since the same fucked up code that allowed it to happen in the 1st place is still in there. Why that code has not been ripped out with extreme prejudice is beyond me.

        • by Tharkkun (2605613)

          I have yet to see an HTML5 exploit that can root your machine.

          JRE on the other hand....

          ^^^ This one factor outweighs basically everything else.

          Just wait for it to become more popular and they will come. Exploiters aim for the highest user base it can hit and HTML5 is not there yet.

    • by afgam28 (48611) on Wednesday January 16, 2013 @11:08PM (#42612745)

      While I don't disagree with you completely, I think it's sad that JavaScript and HTML have "beaten" Java applets as the standard way to build network applications. Sun really dropped the ball in terms of the UX for desktop Java, and Oracle's security mismanagement has put the final nail in the coffin of Java on the desktop. But despite all of its flaws, the Java platform provides a much nicer programming model compared to "modern" web technologies.

      HTML was originally designed as a way to display static, hyperlinked documents, and JavaScript was originally just a toy scripting language to do simple things like form validation. They've both evolved to support the creation of rich client interfaces, but creating rich clients using HTML5/JavaScript is not pretty. There's a web server, which spits out dynamically generated client code. Embedded in that client code is a mix of content, markup, JavaScript source code and maybe even inline stylesheets. It runs in one of a number of possible virtual machines (or "web browsers") which are all slightly incompatible, not to mention slow compared to a JIT bytecode interpreter (ironically, one of the early complains about Java applets was performance). Standardizing it all is a nightmare that takes years of political infighting and compromising on things like video formats. And you have to learn at least 3 different languages to even do anything!

      It would've great if, instead of HTML/JavaScript evolving up into a full-blown rich client platform, Java just "devolved" a little bit so that it provided a stricter sandbox for applets. None of this "signed code" bullshit - everyone just clicks through on that, leading to all sorts of security problems. Just restrict all applets under same sandbox (like JavaScript does). Give it a more native UX (e.g. through SWT instead of AWT/Swing) and an App Store, and it would be great!

      There's nothing really inherently wrong with the Java platform, and nothing inherent in its design that makes it less secure than JavaScript. The only problem is Oracle's lack of support, and some small implementation flaws. HTML5/JavaScript on the other hand is just a giant hack. But a standard one.

      • Java is a classic case of great engineering mixed with bad management. Many evolutionary things got killed throughout history where a competitor comes in.

        Sun blew it well before Oracle's acquisition. Not having a native fat binary compiler is one. Before someone jumps at me for making at all soooo non platform compliant I have to say how many are willing to open cmd prompt and type java x? You need a very expensive $$$$$ compiler to have a .exe where the code is written in java. This gave the perception jav

        • by afgam28 (48611)

          Why do you need an expensive compiler to create an .exe file which runs Java? All you need to do is compile this program or similar in any C compiler:

          int main(void) { system("java com.example.App"); }

          Yes, Java bytecodes need to be compiled every time they are loaded, but with a JIT interpreter it's not so bad. Compare that to JavaScript which has to be compiled from source every time! And the JVM does not take any longer to start up than a modern web browser.

          You're right about host OS integration, and yes,

          • by spongman (182339)

            it's significantly easier to parse javascript source, determine its validity and generate machine code from it than it is just to verify java bytecode.

            for example: prove that the stack looks the same for every different way a basic block can be entered.

            • it's significantly easier to parse javascript source, determine its validity and generate machine code from it than it is just to verify java bytecode.

              for example: prove that the stack looks the same for every different way a basic block can be entered.

              Huh? Did you ever take a compiler class? Verifying java bytecode is really not that hard...

              • by spongman (182339)

                well we didn't cover java bytecode verification in my compiler classes because java didn't exist then, but I worked on the java team at one of my past jobs, i wrote a java debugger for them, and i worked closely with the team that wrote the VM.

                I assume you're referring to the bytecode verification as outlined here: http://www.w3.org/Conferences/WWW4/Papers/197/40.html#1 [w3.org]

                I don't think that's simpler than compiling javascript from source.

            • by jpvlsmv (583001)

              it's significantly easier to parse javascript source, determine its validity and generate machine code from it

              Hahahahahaha. Considering that it is quite common now for DOM elements (other than <script>) to contain javascript source, often encoded in ParseInteger with an arbitrarily-chosen base value, then passed to eval(), you clearly don't understand what "javascript source" is these days.

              It all comes down to the ability to run arbitrary untrusted code downloaded from the Internet, thinking that some sort of "sandbox" will protect you. Don't.

              --Joe

          • If you run some unix, you can create a standalone "executable" from java classes:
                  https://coderwall.com/p/ssuaxa [coderwall.com]

            This still needs a JVM, but then your proposal does as well...

        • by someones (2687911)

          again an unqualified post. You obviously never used java.
          anyway do you have any numbers to prove your arguments or are you just a troll/fanboy?

          Also ruining mac expirience is just an excuse to say: if done right it could show users mor than apple wanted users to see.

      • It was Microsoft that killed Java. The last thing they wanted in the late 90's was for Java Applets to become a popular and powerful feature of the Web. So they corrupted and sabatogued the rollout of Java on Windows.

        It's really weird that now, more than a decade later, people are trying to lay the death blow for Microsoft. Just plain weird. And especially sad to see it happen on Slashdot. Are you all Redmondites? (more than a few of you are, it's obvious)

        • Not anti MS at all.

          Java is a better language and is a real platform while javascript is well javascript. I feel people do not like apps in browsers and want a browser. Javascript can manipulate elements on a page. Not with java. It was bolted on a felt foreign. I got modded down to 0 already for this, but I will say it again. Developers love java but its users hate it.

          Flash is all pretty and fast. Java is slloow to load up and butt ugly and the fonts are not even opentype for LCD screens. Eclipse uses a spe

      • For any but the most trivial apps it's write once and run anywhere that you have Java 1.2.3.4.5. Not Java 1.2.3.4.4 or Java 1.2.3.4.6, but only Java 1.2.3.4.5. That's why you see so many machines with Java versions with known exploits. Because so many apps won't run with with newer versions of Java.

        Can you imagine the howls of outrage if every 2nd "Microsoft Patch Tuesday", Access or Word or Excel stopped working? And you had to keep the security patch off your machine if you wanted all your expensive soft

        • by aled (228417)

          That seem more a problem with the applications than with Java. Can you mention real examples?

    • Make an official Java(TM) / Corporate GunkWare(TM) browser that works with whatever stupid crap companies want to use. Problem solved.

    • Nuke it from orbit. It's the only way to be sure.
    • Dell not installing Java is equal to the computer not working for a lot of their customers. Not going to happen.

  • by John Hasler (414242) on Wednesday January 16, 2013 @08:02PM (#42611115) Homepage

    And that is the fundamental bug.

  • Google and others have bug hunts were people gather together to help find and fix bugs. If Oracle wasn't pissing so many people off they could do the same. I guess it couldn't hurt to try something like what Google is doing with Chrome. chrome bug hunt [cnet.com]

    • by gmuslera (3436)

      Is not about knowing about them in advance, Oracle was aware of the previous bug in august [slashdot.org].

      Of course, is tempting to acuse Oracle of malice keeping the details of the bug for itself for giving them to government agencies for their next cyberweapons, after all, even Red October used a java bug [theregister.co.uk] for spreading. But Hanlon's Razor applies to Oracle too (unless their lawyers were involved, of course)

  • by thue (121682) on Wednesday January 16, 2013 @08:14PM (#42611241) Homepage

    Surely the bad publicity from a root exploit is worth more to Oracle than $5000? $5000 is peanuts in this context. Why doesn't Oracle have a bug bounty program to avoid problems like this?

    • by Shoten (260439) on Wednesday January 16, 2013 @08:22PM (#42611303)

      Actually, this sounds off to me. $5K for an exploitable Java vulnerability? That's waaaaaay too cheap for the exploit market...white, grey or black. I think this guy is selling a crock of shit, but he knows that the big-money purchasers would be able to tell. So he's offering it for chump change, which is exactly what a chump happens to have on hand to pay.

      • by Anonymous Coward

        Actually, Java exploits are pretty worthless in the market since they're so damn rampant. That and the fact this is probably a variant of an existing known exploit which can be potentially fixed greatly decreases it's value.

      • by bloodhawk (813939)
        A vulnerabilities value is directly related to how many users you can exploit. While their are still quite a few desktop Java has been spiralling the drain for years now and the recent press of exploits has only hastened it. What value is an exploit to a small market?
    • With as many bugs as Java (and its related technologies) have, Oracle would go bankrupt paying people to find them.
      • Really? Compared to what? I've been programming java since it came out and I've come across far fewer bugs in the the JDK than I have in any of the other languages that have been around for a similar amount of time (PHP, Perl, etc.)
    • by jcoy42 (412359)

      What makes you think he'd only sell it once?

  • by Bob9113 (14996) on Wednesday January 16, 2013 @08:20PM (#42611281) Homepage

    This is not a bug in Java. It is a bug in the Java browser plugin, called a sandbox exploit.

    The Java Virtual Machine (JVM) has access to the filesystem and can fork processes. In an attempt to make this safe to use in a browser, Sun wrote a sandbox, that is supposed to block access to the filesystem and to process execution. The sandbox doesn't work, and may never work. Disabling the Java plugin in your browser is a good thing. It might have been nice if the sandbox worked, but it doesn't. Don't run untrusted code in the JVM, whether in a browser or otherwise -- just like not running untrusted C code.

    You can Java on a server, open a port, expose that port to the Internet, and as long as you haven't written a hole, nothing bad will happen. That is because this is not a Java exploit. It is a Java sandbox exploit.

    • This is not a bug in Java. It is a bug in the Java browser plugin, called a sandbox exploit.

      While that distinction is important to the people exploiting the bugs and the people fixing or mitigating them, to consumers it doesn't matter. It doesn't matter if the bug is in "Java Plug-In", or "Java(tm) Plug-In SSV Helper", or "Java(tm) Plug-In 2 SSV Helper" or "Deployment Toolkit". What matters is that they got attacked because of a bug somewhere inside the Java Platform. If most people who don't care about the distinction between the various components also have no use for Java outside of the brow

      • by afgam28 (48611) on Wednesday January 16, 2013 @10:23PM (#42612407)

        Well, that depends on what kind of "consumer" they are. If they're a user who only has the Java plugin installed, then yeah, you're right.

        But for people who are running non-browser-based desktop apps like Vuze [vuze.com], PHBs who oversee server-side Java projects, and the poor bastards who have to work under them, the advice that "Java is unsafe!!" is misleading and sensationalist.

        I'd wager that most Java applications are not applets, and so they are safe from this exploit and similar ones. So the distinction between the Java platform in general and the browser plugin is a valid one.

      • by ChunderDownunder (709234) on Wednesday January 16, 2013 @10:33PM (#42612485)

        I wouldn't be too keen to blame the plugin per se anyway.

        The whole Java library (rt.jar and others) relies on a security model. Each class invoked has checks to see if a security manager is running and if yes then possibly deny a request based on permissions.

        Poor development practices in not vetting the codebase for security checks have caused this. Specifically, this security breach is via new functionality included in JRE 1.7, where any assumptions of security requirements have been invalidated.

        An audit of every class included in the JRE needs to occur with unit tests for expected behaviour inside a sandbox and outside.

        Applets in a browser are the most common usage of a SecurityManager but pointing a finger at the plugin itself won't fix the underlying library code...

  • by mark-t (151149) <`markt' `at' `lynx.bc.ca'> on Wednesday January 16, 2013 @08:40PM (#42611447) Journal

    I can't help but observe that the rate at which Java exploits started pouring forth really started skyrocketing after Oracle's acquisitiion of Sun.

    I mean, seriously... look at the history. It shot up by multiple orders of magnitude in the first six months of 2010 alone, which was right after the Oracle acquisition. This, following a period where Java had actually been getting increasingly *more* secure over time, and as individual vulnerabilities were fixed, Java exploits were getting rarer and rarer.

    But in 2010, it was like some sort of switch flipped. The number of exploits not only went up for the first time in many years, but it jumped at a rate previously unparallelled at any time in Java's history.

    What the fuck is going on?

    • by thoth (7907) on Wednesday January 16, 2013 @09:04PM (#42611671) Journal

      Well, the obvious conspiracy theory is that disgruntled former Sun engineers, people with extremely deep knowledge about Java, are angry at Oracle and venting their frustrations by poking holes in their former product. ;)

    • Re:This is insane (Score:5, Informative)

      by trims (10010) on Wednesday January 16, 2013 @09:34PM (#42611917) Homepage

      Simple:

      • Oracle completely screwed up the acquisition, and made major changes to the Java division. Management was completely redone, and the release/bug process was made much worse (not that it was great under Sun).
      • All the old Sun personnel got pissed off at Oracle, for a variety of reasons. Less than 25% of those there in 2008 are still in the Java division; and, that's from an organization where people averaged 10+ years of work at Sun. Oracle hasn't been able to replace this brain drain, and is unlikely to ever succeed in restaffing to an acceptable level. The JDK codebase is incredibly complex - far worse than practically anything else I can think of, including the Linux kernel. The number of people on the planet who are good VM coders numbers maybe a hundred or two. That's it. And the rest of the organization has been decimated, too.

      I worked at Sun for 6 years in the JVM group before the acquisition. I stayed on for another 1.5 years before I left. I only know a handful of people there anymore, and they're staying simply to ride it out to retirement (all are in their 50s). Over three dozen people I used to work with are gone, and there's no decent replacements.

      Basically, people used to working "the Sun Way" detested the new "Oracle Way" and decamped en masse between 2009 and 2011. The whole Java division is a shadow of itself, and won't ever recover.

      • by mark-t (151149)

        Your description of what happened seems to carry a tone of some sadness to it... almost bereavement, in fact.

        I'm a bit curious, however... if you don't mind going into detail, could you describe what you mean by the "Oracle Way", and what was it about it that people detested so much?

      • Well since the acquisition was announced in April 2009, there have been a total of 25 updates to the JRE 1.6 u14-u39. That represents about 150 security fixes (according to wikipedia) to a 'stable' product for which development commenced at least as early as Mustang's release in Sept 2004.

        I'd suggest a fair number of those bugs lurked in the codebase back in 2008, back in the days of "the Sun Way".

        So while we can blame Oracle for the current crisis in not vetting new 'method handle' code for invokedynamic f

      • The JDK codebase is incredibly complex - far worse than practically anything else I can think of, including the Linux kernel. The number of people on the planet who are good VM coders numbers maybe a hundred or two. That's it. And the rest of the organization has been decimated, too.

        That's a little bit troubling, since a popular method of writing Android apps employs the JDK. People can talk about how the JRE platform can die, or be put to sleep. Android doesn't use the Sun/Oracle VM, but Java is importan

      • Re:This is insane (Score:4, Interesting)

        by idontgno (624372) on Thursday January 17, 2013 @12:56PM (#42617695) Journal

        It's so weird. This betrayal at acquisition seems to play out over and over. A great team is disbanded by the heavy-handed and mouth-breathing attitude of the new boss.

        I'm reminded of the Easter egg in Amiga OS 1.2, which was a secret message accessible by an obscure sequence of keystrokes, UI mouse clicks, and floppy disk ejection/insertion.

        Now press both Alts, both shifts, press F1 and eject DF0: all at once and you'll see:

        The Amiga, Born a Champion

        Whilst holding this click the left mouse button on the "screen to back" gadget and re-insert the disk. You'll see:

        We [wikipedia.org] made Amiga, They [wikipedia.org] fucked it up

    • by airfabio (6375)

      I would say it probably has to do more with Microsoft doing a lot of work to make ActiveX safer and browsers like Firefox and Chrome taking increasing market share.
      Before that Internet Explorer had such a large market share and so many easier attack vectors than Java plugins.
      And after constant stream of security updates Flash is probably a bit harder nut to crack than Java is.

  • Marking data as code at runtime then executing it is dumb.
    JIT is bad, mmkay?

    • So the consensus is that Javascript and HTML5 are also bad and to be shunned?

      Near as I can tell, with both those technologies, all that an httpd does is shovel some data over the wire to a browser that then executes it.

      • by FlyingGuy (989135)

        The problem is that everything in http is text, no binary data. It is connectionless and the hacks that have come along to try and fix that are a joke and don't really work. So now we have shit like Avro, or JSON all this cruft that takes binary data, turns it into text, then javascript has turn that into code, then turn the results back into text, to send that data back to the server, to then get it turned back into binary data to then actual do something with it.

        The web browser was never intended to be

  • Is the value Oracle bought from Sun going down the toilet one piece at a time.

    A couple weeks ago, it looked as if they were trying to rehabilitate Java's image and now DHS recommends that everyone disable or uninstall it.

    • by JDG1980 (2438906)

      The only reason Oracle bought Sun was so that Larry Ellison could use its patents to wage war against Google and Android. Java's security problems don't impair his abilities to do that, so he doesn't care.

  • It is a horrible language anyways. Unfortunately, there are some far better languages running on the same broken virtual machine.

  • Can I use the IcedTea Web Plugin on Linux, or is that also vulnerable?

  • It's been in Chrome for a while and landed in FF with version 16 or so. Once it's enabled ("under the hood" settings in Chrome, plugins.click_to_play=true in about:config for FF) sites can't run plugins without you giving some form of explicit permission (either whitelisting a trusted site or clicking to play the plugin elsewhere).

    It really should be the default. In fact, it should have been this way ever since NPAPI came on the scene back in Netscape 2.0. Countless security problems would have been much mu

I don't want to achieve immortality through my work. I want to achieve immortality through not dying. -- Woody Allen

Working...