9 ms·
Java flaw allows “complete” bypass of security sandbox
- foohbarbaz 14y agoAnother browser plugin hole? Yawn. It's disabled in Firefox and Chrome anyway. Let them disable it for good and enable by exception. Who uses Java in browser anyway? WebEx and some weird VPN solutions?
- ComputerGuru 14y agoAnd - get this - banks. Chase requires Java to see pending Checks for business banking w/ fraud protection which lets you OK or reject checks before they're detected from your account. Whereas they have scanned JPEGs for account history check images, the pending fraud control check images require Java.
- bennysaurus 14y agoSome banks are researching into extending that functionality too - creating effectively a disposable browser inside your browser to help mitigate against keylogging and screenshotting account details.
- dools 14y agoWhat's more surprising: banks using Java in the browser or people using cheques in 2012!
- sukuriant 14y agoChecks allow for instant transfer of money between two banks, for free. That's what I still use them for.
- stephengillie 14y agoIt's not free. The cost is paid for by interest you don't receive.
- plorkyeran 14y agoWhich is pretty much irrelevant in these days of 1% interest rates.
- nuclear_eclipse 14y agoMy credit union pays me 3.5% APY on my checking account. And yes, that's 3.5%, not 0.35%.
- ghshephard 14y agoWhich credit union would that be? Given that my cube mate just refinanced his Mortgage at 3.375%, no points, I sense there is an arbitrage opportunity here somewhere. I am willing to wager your credit union is not paying you 3.5% APY on your checking account. That is, if you had $10,000 in your checking account at the end of the year, and you just left it there, you would not have $10,375 at the end of year. There is a restriction/surcharge in there that you haven't mentioned.
- whatusername 14y agoIf you're willing to wear currency risk: http://www.nab.com.au/wps/wcm/connect/nab/nab/home/personal_finance/6/3/nab_article_088716?urid=1348625975506 http://www.nab.com.au/wps/wcm/connect/nab/nab/home/personal_... I wish I could re-finance my mortgage at 3.375% fixed. :(
- ghshephard 14y agoI'm happy to hook you up with my cube-mate's mortgage broker. He isn't bearing any of the costs, no points, not even an appraisal fee. This is a 30 year fixed mortgage. His position is basically, "I'll refinance if you bear 100% of the service charges and I don't give you any money for anything." [Edit - Oh. Australia. :-)]
- steveh73 14y agoDon't they take several days? Does the US seriously not having something equivalent to direct credit?
- bmj 14y agoMany banks will instantly deposit checks up a certain amount (say $500), and deposit some percentage of large checks immediately, with the rest deposited after the check has cleared the writer's bank.
- MikeCodeAwesome 14y agoChecks are frequently turned into ACH transactions. You may be interested in http://www.occ.gov/topics/consumer-protection/depository-services/writing-check.html#whatshappening http://www.occ.gov/topics/consumer-protection/depository-ser....
- ComputerGuru 14y agoWe use ACH direct deposits for all our transactions when possible, but when not, check is really the only other option. Credit card fees are far too expensive for the recipient (3-5%) for large amounts. We are typically asked to write checks by lawyers :) Everyone else has moved to electronic banking. Checks are also handy for one-off payments to people (not companies!) you don't know and won't meet again.
- vibrunazo 14y agoMy bank does that to. I can only make online payments on my bank website if I install a browser java applet they call an "anti-virus". I stopped using it when they did it.
- huxley 14y agoAmazon uses it in the S3 dashboard for their "Enhanced Uploader (BETA)"
- vitno 14y agoall of the damn physics simulations out there... I'm taking a physics course right now...
- shinratdr 14y agoAny 10+ year old web applications (then called 'applets') that wanted to avoid the single browser nature of ActiveX or the mediocre performance of Flash.
- pilif 14y agoWe used it to read bar codes from connected barcode scanners. It worked fine since 2004 but with all the security issues around, I developed another solution this summer which doesn't rely on Java. Of course in the Enterprise where about 50% of our end-users are, it's still easier to tell them that they should install Java rather than something they don't know. Which leads to us having to support both methods.
- ttt_ 14y agoDo you mind elaborating a bit on your solution that doesn't rely on Java? We have a similar case though with printers.
- anodari 14y agoWhenever we need to access some hardware (printers, smart cards, cameras, automate file updloads and downloads) we have to rely on a Java applet or Flash. The user must agree to the Java security warning before. Until browsers don't give us a better multi-browser and multi-plataform solution, we still need to use Java. Some of the html5 specs are to solve these issues.
- brown9-2 14y agoThe actual announcement: http://seclists.org/fulldisclosure/2012/Sep/170 http://seclists.org/fulldisclosure/2012/Sep/170
- chuppo 14y agoI like the guy who responded to that with "Full disclosure? This is touching yourself in public." And for sure it is, on a fulldisclosure list, nothing is revealed. My monocle dropped in my morning Java.
- blinkingled 14y agoIt almost sounds like Oracle managed to shoo away all good folks from the JVM team and all they are left with is a bunch of B players. I dont remember it being this bad.
- brown9-2 14y agoIf the vulnerability exists in Java 5, 6 and 7, it seems likely that the underlying problem is pretty old and not a recent development. Version 1.5.0_22 seems to have been released some time around 2009, and that was the end-of-life release for "Java 5" - it's earlier versions were years before this.
- blinkingled 14y agoGood point - but still, isn't it taking Oracle longer to patch the vulnerabilities? (Last one they knew for what - 4 months?)
- eckyptang 14y agoThis is normal for Oracle and has been for at least 20 years. They are too busy milking people for new contracts rather than looking after their existing customers.
- stephen 14y agoGiven what I've seen lately, this is just false. The Java team under Oracle, despite my trollish expectations, is actually doing really well. That they've inherited a huge, complex codebase is unfortunate. I think any program or VM, Ruby, Flash, Python, whatever would end up with the same number of security holes if it had the user base to attract attention from hackers.
- void-star 14y agoNot to diminish your point about Oracle's handling of their inherited codebase (too much). I kindof agree... But, it bears mentioning that Ruby and Python aren't a mainstream part of browsers. And Flash (under Adobe) has actually done some pretty impressive stuff recently with regard to sandboxing.
- boyter 14y agoThis isn't that surprising really. Microsoft's focus on security 10 or so years ago has paid off and its hard to find flaws in their OS now. The next most common platform is probably the JVM so its the new attack vector. I would imagine we are going to see more and more of these exploits unless Oracle takes the same approach that Microsoft took, and even then it will be years before the benefits are felt.
- hakaaak 14y agoWhile it's possible that Java just hasn't been as much of a target, the difference between Windows and IE (which are the two M$ products that particularly got them into trouble with security flaws) and Java's JVM, other than one being an OS, one being a browser, and the other being a runtime environment, is that the former two started off being buggy and got better, and the JVM has been in the news for more security problems since Oracle took over. I think the finger to point is at Oracle. From what I have heard about how things went when they were taking over, I think the issue is that they are too "enterprise" for their own good. Sun's lawyers were pretty awful (or too good depending on whether you like suing) too though, so maybe some was inherited. One other thing before I go- are other JVM languages affected by these bugs?
- daeken 14y agoFirst, this bug existed at least for a year before Oracle acquired Sun. Same with almost all the other bugs that have plagued the JVM in recent years. I don't think pointing the finger at Oracle is worthwhile here. Second, the parent wasn't comparing the products but the security practices followed; MS's hardcore security practices are well known and have served them very well over the last decade. The products they make have little to nothing to do with this. Lastly, the language you use has absolutely nothing to do with this bug -- it's a JVM bug itself.
- foohbarbaz 14y agoIn a sense none of the "JVM languages" are affected: apparently it's a bug in the Web applets sandbox implementation. It's not something used by standalone Java (or whatever) programs. It only matters if you are running Java applets off a web page.
- snambi 14y agowho runs java in browser these days?
- SageRaven 14y agoAnyone who manages hardware via remote console, such as Dell's iDRAC. HP and and Fujitsu have similar systems, and I imagine many more. It's a major pain in the ass, and it sucks, but it's true.
- jermy 14y agoSupermicro's equivalent IPMI remote access (iKVM) is also Java
- marvin 14y agoEvery Norwegian internet banking customer, for instance.
- unabridged 14y agoJava (and flash) should only be ran inside a virtual machine. You have to be a fool to have that installed on your bare computer.