5 ms·

This happened last month, so it was 0-day THEN, not NOW. The hole in question was patched in the February 1st Java release, plus the way the Java plugin works

• jlgaddis 14y ago
  > ... even if there are still holes remaining in Java, ... Heh > ... the user will have to click through at least one, probably two warnings before they can run the dangerous applet ... Unfortunately, there are still way too many users who will happily click through those warnings (unsigned code, invalid certificates, UAC, and so on) in order to {look at stupid pictures|play retarded games|win a free iPad|...}
  • jtheory 14y ago
    Not many Facebook engineers, though, I suspect. And it's worth noting that even less technical users aren't so likely to click through all of the warnings when they're not expecting some kind of interactive game to play. That also reduces the risk. There will always be some people who click the links in their spam or open the fishy attachments, who give permission to anything and everything, and whose computers are so overloaded with malware, trojans, backdoors, etc. that they collapse under the weight. The main trick is to be sure that savvy users can keep themselves safe, and making sure people doing important things on their computers are savvy. I think Java is finally in a state now where it's safe for savvy users.
• InclinedPlane 14y ago
  "0-day" means "unpatched or unknown exploit". It's a silly and sensationalist term that is hugely overused.
• ghshephard 14y ago
  > This happened last month, so it was 0-day THEN, not NOW. Yes - Facebook made it clear they were exploited prior to the patch getting out. == SNIP == The compromised website hosted an exploit which then allowed malware to be installed on these employee laptops. The laptops were fully-patched and running up-to-date anti-virus software. ... After analyzing the compromised website where the attack originated, we found it was using a "zero-day" (previously unseen) exploit to bypass the Java sandbox (built-in protections) to install the malware. We immediately reported the exploit to Oracle, and they confirmed our findings and provided a patch on February 1, 2013, that addresses this vulnerability. == SNIP == The difference between zero-day and not, is that if you are attacked by an exploit that your vendor hasn't seen (and presumably has no patch available for) - you are particularly vulnerable. Once a CVE has been assigned, then your platform/software vendors are now more "on the hook" for any exploits that occur after that date. Two indications of a security conscious company: 1. They have a very short period of time before the CVE identification and their patch (hopefully automatically) rolled out. 2. They announce security vulnerabilities inline with a patch - thereby reducing the number of zero day exploits. Microsoft, in particular, has been very aggressive in announcing security exploits, and rolling out patches in the last 12-18 months - Adobe and Oracle could learn a lot from them. > So far the latest fixes (in browsers and in Java) seem to have been effective. Unless you have a very specific reason (SSL VPN, Enterprise App, perhaps a youtube video, or specific application) - you should no longer be running plugins in your browser. I've been running with Safari and all plugins disabled for about 14 months, switching to Chrome for youtube videos has been about the the only inconvenience. The last exploit in flash/java/pdf/xxx may have been fixed, but you can certain there will be more in the next few months.