3 ms·
If I was a blackhat malware developer, I would be drooling at the scale of Oracle's incorporation of third party affiliate software into a typical Java install.
by cstross 14y ago
If I was a blackhat malware developer, I would be drooling at the scale of Oracle's incorporation of third party affiliate software into a typical Java install. It massively expands the threat surface available for attackers.
Rather than targeting the JRE itself, I would be looking for vulnerabilities in the shovelware -- which is subject to less scrutiny by developers than the language runtime itself, and which is only installed by users whose security practices are less than perfect.
- jtheory 14y agoIt's not impossible there'd be something interesting there... but Java is a more likely attack vector simply because part of its normal functionality is to execute code downloaded from the internet. Before this recent patch, that code would be executed without even prompting the user. Sure, there's a sandbox, but (as we know) sometimes a sandbox has cracks, particularly when the runtime is designed to let code to only enforce the sandbox for some code it runs, not all. (Compare to JavaScript execution, which also runs downloaded code without prompting, but JS in the browser is always in the sandbox -- there are things it simply can't do, vs. Java's "this is do-able but not for you".