7 ms·

If your default browser still has the plugins enabled for Java, Acrobat and Flash you are asking for it. In Chrome: go to chrome://plugins and disable all Saf

by nikcub 14y ago

If your default browser still has the plugins enabled for Java, Acrobat and Flash you are asking for it. In Chrome: go to chrome://plugins and disable all Safari: Preferences, Security uncheck 'Enable Plugins' Firefox: Tools > Addons > Plugins Tab > disable all Don't use Flashblock or Javablock or similar extensions, they hide the applet, they don't stop execution. You should always use a browser with all plugins disabled as your default browser. Run a second browser for trusted sites where you enter the URL in yourself.

signed0 14y ago
Firefox started blocking Java plugins in January '13. I wonder how long before other browsers follow suit.
- nikcub 14y ago
  Firefox also has the feature that will block Flash and the other plugins if an update has been released, which is also good IMO all browsers should implement 'click to run' by default for all plugins on all sites
- jakub_g 14y ago
  This works only for outdated Java versions that are known to be vulnerable (they're blacklisted by Mozilla version-by-version). If you happen to have the newest Java version which hasn't been publicly announced as exploitable, it will not be blocked unless you enable `plugins.click_to_play` in `about:config`. Anyway it's still a very good move from Mozilla side to minimize the risks.
  - signed0 14y ago
    That's too bad, I was hoping they had made all Java plugins "click to play" or whitelist only.
deleted 14y ago
[deleted]
anonymouz 14y ago
True. But once those plugins go away, something else will become the new low hanging fruit. Personally, I wonder how well WebGL will hold up, given that 3d graphics drivers are absolutely not written with security mind, and were never really intended to be hooked up to the web...
- nikcub 14y ago
  That is a good point. A bit like how people would switch to Macs to avoid viruses, but all they were really doing was moving to a place that wasn't being targeted yet. I don't like the monolithic design of modern browsers - it is rendering engine, javascript interpreter, sandbox, audio, video, webgl, user management, local store etc. all in one big heap. We will need features to let users swap parts out, highly customize them, apply advanced ACL's to each component (since the browser becomes the new OS) and disable them (chrome://flags)
  - mietek 14y ago
    Can you point out an example of a Mac virus?
    - Genmutant 14y ago
      There are many, but they don't get the publicity other malware gets. One example of Mac-malware would be SabPub: https://www.securelist.com/en/blog/208193467/SabPub_Mac_OS_X_Backdoor_Java_Exploits_Targeted_Attacks_and_Possible_APT_link https://www.securelist.com/en/blog/208193467/SabPub_Mac_OS_X...
    - brownbat 14y ago
      It wasn't self-propagating, but MacDefender scareware still claimed a lot of machines. http://en.wikipedia.org/wiki/Mac_Defender http://en.wikipedia.org/wiki/Mac_Defender Apple also has a poor record at security patching, which allows for more drive by downloads, especially through Java. Further reading: http://voices.washingtonpost.com/securityfix/2009/06/apple_patches_java_flaws_at_la.html http://voices.washingtonpost.com/securityfix/2009/06/apple_p... http://krebsonsecurity.com/tag/mac/ http://krebsonsecurity.com/tag/mac/
jlgaddis 14y ago
> Don't use Flashblock or Javablock or similar extensions, they hide the applet, they don't stop execution. Wow, thanks. I was under the (false, obviously) impression that Flashblock effectively turned Flash objects into "click-to-run".
- Osmium 14y ago
  > they hide the applet, they don't stop execution. The OP is wrong about this. At least for Safari/ClickToPlugin – I just verified it myself. After all, it'd be fairly pointless otherwise...
  - rjbond3rd 14y ago
    OP is also wrong about Flashblock on Firefox.
    - nikcub 14y ago
      I should have clarified that I meant Chrome, my post was originally Chrome only and I added in Firefox and Safari with an edit Chrome extensions are nothing more than loading a JS file onload
      - jonknee 14y ago
        Yet Chrome has a "Click to Play" feature for all plug-ins which is way more handy than having a second browser or a bunch of extensions. Go to chrome://chrome/settings/content and look under plug-ins. There is Run automatically (default), Click to play and Block all.
        nikcub 14y ago
        I am using that in my second browser, but I am not as confident in it as all that stands between the user and executing a plugin again is a clickjack I'd rather have complete separation Doing a proof-of-concept on a 'click to play' to run a plugin is something that I have been meaning to do
hshshzjaj 14y ago
Don't forget that piece of crap rails. I wasted so much time cleaning up my servers because of its last exploit.
larrys 14y ago
Also to verify java not working can use this to test: http://www.java.com/en/download/testjava.jsp http://www.java.com/en/download/testjava.jsp
graue 14y ago
> Don't use Flashblock or Javablock or similar extensions, they hide the applet, they don't stop execution. For Flashblock on Firefox, at least, this is incorrect. And if it were true, you would lose the main benefits of using Flashblock to begin with: better security, privacy, lower CPU and memory use. Which makes using such a plugin rather pointless, so I doubt any blocking plugin works this way.
- dsl 14y ago
  > so I doubt any blocking plugin works this way. That sounds like an assumption based on how you would implement it. Until Chrome implemented its native click to play, most of "click to play" plugins were targeted at advertising and simply blocked visual rendering and audio playback. It's not for lack of trying, the underlying framework for the plugin to stop execution simply didn't exist.
jonknee 14y ago
Chrome has a "Click to Play" feature for all plug-ins which is way more handy than having a second browser or a bunch of extensions. Go to chrome://chrome/settings/content and look under plug-ins. There is Run automatically (default), Click to play and Block all.
- wukkuan 14y ago
  Firefox has one, too. about:config, search for "plugins.click_to_play". Enable!
rplnt 14y ago
Opera: go to opera:config#UserPrefs|EnableOnDemandPlugin To enable all plugins on page, click the play/puzzle icon in the address bar. To permanently enable plugins on certain pages: right click -> Edit site preferences... -> Content. I have this enabled both in Opera and in Chrome. Certain sites are permanently whitelisted. Much better browsing experience.

by nikcub 14y ago

signed0 14y ago

Firefox started blocking Java plugins in January '13. I wonder how long before other browsers follow suit.

nikcub 14y ago
Firefox also has the feature that will block Flash and the other plugins if an update has been released, which is also good IMO all browsers should implement 'click to run' by default for all plugins on all sites
jakub_g 14y ago
This works only for outdated Java versions that are known to be vulnerable (they're blacklisted by Mozilla version-by-version). If you happen to have the newest Java version which hasn't been publicly announced as exploitable, it will not be blocked unless you enable `plugins.click_to_play` in `about:config`. Anyway it's still a very good move from Mozilla side to minimize the risks.
- signed0 14y ago
  That's too bad, I was hoping they had made all Java plugins "click to play" or whitelist only.

deleted 14y ago

[deleted]

anonymouz 14y ago

True. But once those plugins go away, something else will become the new low hanging fruit. Personally, I wonder how well WebGL will hold up, given that 3d graphics drivers are absolutely not written with security mind, and were never really intended to be hooked up to the web...

nikcub 14y ago
That is a good point. A bit like how people would switch to Macs to avoid viruses, but all they were really doing was moving to a place that wasn't being targeted yet. I don't like the monolithic design of modern browsers - it is rendering engine, javascript interpreter, sandbox, audio, video, webgl, user management, local store etc. all in one big heap. We will need features to let users swap parts out, highly customize them, apply advanced ACL's to each component (since the browser becomes the new OS) and disable them (chrome://flags)
- mietek 14y ago
  Can you point out an example of a Mac virus?
  - Genmutant 14y ago
    There are many, but they don't get the publicity other malware gets. One example of Mac-malware would be SabPub: https://www.securelist.com/en/blog/208193467/SabPub_Mac_OS_X_Backdoor_Java_Exploits_Targeted_Attacks_and_Possible_APT_link https://www.securelist.com/en/blog/208193467/SabPub_Mac_OS_X...
  - brownbat 14y ago
    It wasn't self-propagating, but MacDefender scareware still claimed a lot of machines. http://en.wikipedia.org/wiki/Mac_Defender http://en.wikipedia.org/wiki/Mac_Defender Apple also has a poor record at security patching, which allows for more drive by downloads, especially through Java. Further reading: http://voices.washingtonpost.com/securityfix/2009/06/apple_patches_java_flaws_at_la.html http://voices.washingtonpost.com/securityfix/2009/06/apple_p... http://krebsonsecurity.com/tag/mac/ http://krebsonsecurity.com/tag/mac/

jlgaddis 14y ago

> Don't use Flashblock or Javablock or similar extensions, they hide the applet, they don't stop execution. Wow, thanks. I was under the (false, obviously) impression that Flashblock effectively turned Flash objects into "click-to-run".

Osmium 14y ago
> they hide the applet, they don't stop execution. The OP is wrong about this. At least for Safari/ClickToPlugin – I just verified it myself. After all, it'd be fairly pointless otherwise...
- rjbond3rd 14y ago
  OP is also wrong about Flashblock on Firefox.
  - nikcub 14y ago
    I should have clarified that I meant Chrome, my post was originally Chrome only and I added in Firefox and Safari with an edit Chrome extensions are nothing more than loading a JS file onload
    - jonknee 14y ago
      Yet Chrome has a "Click to Play" feature for all plug-ins which is way more handy than having a second browser or a bunch of extensions. Go to chrome://chrome/settings/content and look under plug-ins. There is Run automatically (default), Click to play and Block all.
      - nikcub 14y ago
        I am using that in my second browser, but I am not as confident in it as all that stands between the user and executing a plugin again is a clickjack I'd rather have complete separation Doing a proof-of-concept on a 'click to play' to run a plugin is something that I have been meaning to do

hshshzjaj 14y ago

Don't forget that piece of crap rails. I wasted so much time cleaning up my servers because of its last exploit.

larrys 14y ago

Also to verify java not working can use this to test: http://www.java.com/en/download/testjava.jsp http://www.java.com/en/download/testjava.jsp

graue 14y ago

> Don't use Flashblock or Javablock or similar extensions, they hide the applet, they don't stop execution. For Flashblock on Firefox, at least, this is incorrect. And if it were true, you would lose the main benefits of using Flashblock to begin with: better security, privacy, lower CPU and memory use. Which makes using such a plugin rather pointless, so I doubt any blocking plugin works this way.

dsl 14y ago
> so I doubt any blocking plugin works this way. That sounds like an assumption based on how you would implement it. Until Chrome implemented its native click to play, most of "click to play" plugins were targeted at advertising and simply blocked visual rendering and audio playback. It's not for lack of trying, the underlying framework for the plugin to stop execution simply didn't exist.

jonknee 14y ago

Chrome has a "Click to Play" feature for all plug-ins which is way more handy than having a second browser or a bunch of extensions. Go to chrome://chrome/settings/content and look under plug-ins. There is Run automatically (default), Click to play and Block all.

wukkuan 14y ago
Firefox has one, too. about:config, search for "plugins.click_to_play". Enable!

rplnt 14y ago

Opera: go to opera:config#UserPrefs|EnableOnDemandPlugin To enable all plugins on page, click the play/puzzle icon in the address bar. To permanently enable plugins on certain pages: right click -> Edit site preferences... -> Content. I have this enabled both in Opera and in Chrome. Certain sites are permanently whitelisted. Much better browsing experience.