4 ms·

I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i

I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.

benmmurphy 14y ago
what browser are you using and how are you disabling the plugins?
- jug6ernaut 14y ago
  Google Chrome, under Settings, Advance Settings, Content Settings. I have all mine ether set to not allow or only after click to play.
  - benmmurphy 14y ago
    click to play is not a security feature and will not prevent malicious plugins from running.
    - jug6ernaut 14y ago
      Are you sure? As far as i understand it until you click on the plugin the plugin is not loaded at all.
      - benmmurphy 14y ago
        If you visit a malicious site and click anywhere on the page (not on a plugin) then you could enable a click 2 play plugin. i raised this as a chrome bug and they said click 2 play is not a security feature. there may be even worse bypasses :( the only way to have proper security is to disable the plugin. there is a button on the address bar that allows you to enable plugins on a page when they have been disabled. this gives you a similar experience to click2play but it is quite annoying especially if you are used to click2play.
        jug6ernaut 14y ago
        Wow...well thats good to know! Doesn't really make sense, especially when you load say a YouTube webpage and it says "click to RUN adobe flash". That is really misleading! :\
        sp332 14y ago
        It is "click to run", the problem is, it might be disguised such that ANY click on a webpage might set it off.
        fjarlq 14y ago
        Relevant Chrome click-to-play bug report: Click-to-play doesn't actually require click to play http://crbug.com/174963 http://crbug.com/174963
      - deanclatworthy 14y ago
        I can't reply further down the comment thread, but can you provide an official source on this. I enabled this feature last week, and there's no way of interacting with the plugin until I click on it.
        benmmurphy 14y ago
        firefox has the same problem with it's click to play implementation. bug is not private so i will link to it: https://bugzilla.mozilla.org/show_bug.cgi?id=838999 https://bugzilla.mozilla.org/show_bug.cgi?id=838999
- uglytom 14y ago
  You can disable the java plugin in Firefox by going into tools->add-ons and disabling all the java add-ons.
k3n 14y ago
It makes no difference how prevalent they are in common web apps, the problem is that the Java plugin is still installed and active for a large number of users. This is not the attack sequence: * site has pre-existing Java * site gets compromised somehow * site now infects users This is how it usually plays out: * site gets compromised somehow * exploit includes a 0-day Java attack * site now infects users Literally 0 sites on the net could be hosting Java applets and that would make no difference; it's the number of active Java plugins that creates the potential for mass-infection. So long as you have the Java plugin enabled, you'll be exposed to this attack.
- jug6ernaut 14y ago
  Ah, fair enough.
- sixbrx 14y ago
  Yes - also even a user who only wants to use client side Java outside of the browsers may be in trouble because of the automatically installed browser plugins that are part of the Java installation process. It's incredible how far and fast client side Java has fallen because of Oracle's tepid response to security concerns. I've developed many internal apps for client-side Java and supported them for over a decade. I don't think I'll develop another.
  - pifflesnort 14y ago
    It has nothing to do with Oracle's response -- the Java sandbox is simply broken, and has been known to be broken for at least the last 5 years. There's no fixing it, the approach is fundamentally flawed and fundamental to Java. This doesn't mean that Java for client-side applications is broken, as long as you don't rely on web based distribution and browser sandboxing.
    - tjoff 14y ago
      "This doesn't mean that Java for client-side applications is broken[...]" I don't know. Java on the desktop requires administrator privileges to be able to notify me that an update is available. Also, it tries to install a virus in the form of "Ask toolbar" every frigging time.
epochwolf 14y ago
There are multiple applications I use at work that require java to be active with reduced security.
chime 14y ago
User googles for 'digital camera nokia review' and ends up on a site containing a specially crafted 1x1 pixel Java applet. User doesn't even know it's there but due to the 0-day exploit, the applet can now download a remote executable to the user's machine and execute it. User's computer is now part of a botnet and all the user did was perform an innocuous google search.
- jonknee 14y ago
  Yes or it could be a site they visit regularly that has been hacked. Or a site that hasn't been hacked but that has JS from an ad network on it that has been hacked or let through a vulnerability. These are very scary hacks. Update: I wrote up my recent experience of a shady advertising buy that appears to have spreading malware (likely via Java) as a goal http://news.ycombinator.com/item?id=5305092 http://news.ycombinator.com/item?id=5305092
jonknee 14y ago
Considering Facebook and Apple devs getting owned by these exploits I think the answer is yes. That you even know what a plug-in is does make you in the minority, but considering who has been victim so far you should not sit back with such a smug attitude.
sleepyhead 14y ago
In Norway most banks require payments have to be verified with BankID which uses a Java-applet to enter a one-time password. Most people in larger organisations who makes decisions about IT have no clue what they are doing.
Cigano 14y ago
Not really? And the security plugin from my bank?
- Florin_Andrei 14y ago
  "Java security plugin from my bank" - irony is strong with that one.
  - Cigano 14y ago
    You got my point.
  - martinced 14y ago
    I'm SCJP since the last century and my life has been developing Java since a lloonngg time (and now Clojure, but targetting the JVM). Honestly the retards who decided that a Java applet was a wise decision for a bank should be shot before their genes are passed to a new generation :-/
    - Cigano 14y ago
      You should visit Brazil. There are lots of these wise decisions in IT here.

benmmurphy 14y ago

what browser are you using and how are you disabling the plugins?

jug6ernaut 14y ago
Google Chrome, under Settings, Advance Settings, Content Settings. I have all mine ether set to not allow or only after click to play.
- benmmurphy 14y ago
  click to play is not a security feature and will not prevent malicious plugins from running.
  - jug6ernaut 14y ago
    Are you sure? As far as i understand it until you click on the plugin the plugin is not loaded at all.
    - benmmurphy 14y ago
      If you visit a malicious site and click anywhere on the page (not on a plugin) then you could enable a click 2 play plugin. i raised this as a chrome bug and they said click 2 play is not a security feature. there may be even worse bypasses :( the only way to have proper security is to disable the plugin. there is a button on the address bar that allows you to enable plugins on a page when they have been disabled. this gives you a similar experience to click2play but it is quite annoying especially if you are used to click2play.
      - jug6ernaut 14y ago
        Wow...well thats good to know! Doesn't really make sense, especially when you load say a YouTube webpage and it says "click to RUN adobe flash". That is really misleading! :\
        sp332 14y ago
        It is "click to run", the problem is, it might be disguised such that ANY click on a webpage might set it off.
        fjarlq 14y ago
        Relevant Chrome click-to-play bug report: Click-to-play doesn't actually require click to play http://crbug.com/174963 http://crbug.com/174963
    - deanclatworthy 14y ago
      I can't reply further down the comment thread, but can you provide an official source on this. I enabled this feature last week, and there's no way of interacting with the plugin until I click on it.
      - benmmurphy 14y ago
        firefox has the same problem with it's click to play implementation. bug is not private so i will link to it: https://bugzilla.mozilla.org/show_bug.cgi?id=838999 https://bugzilla.mozilla.org/show_bug.cgi?id=838999
uglytom 14y ago
You can disable the java plugin in Firefox by going into tools->add-ons and disabling all the java add-ons.

k3n 14y ago

It makes no difference how prevalent they are in common web apps, the problem is that the Java plugin is still installed and active for a large number of users. This is not the attack sequence: * site has pre-existing Java * site gets compromised somehow * site now infects users This is how it usually plays out: * site gets compromised somehow * exploit includes a 0-day Java attack * site now infects users Literally 0 sites on the net could be hosting Java applets and that would make no difference; it's the number of active Java plugins that creates the potential for mass-infection. So long as you have the Java plugin enabled, you'll be exposed to this attack.

jug6ernaut 14y ago
Ah, fair enough.
sixbrx 14y ago
Yes - also even a user who only wants to use client side Java outside of the browsers may be in trouble because of the automatically installed browser plugins that are part of the Java installation process. It's incredible how far and fast client side Java has fallen because of Oracle's tepid response to security concerns. I've developed many internal apps for client-side Java and supported them for over a decade. I don't think I'll develop another.
- pifflesnort 14y ago
  It has nothing to do with Oracle's response -- the Java sandbox is simply broken, and has been known to be broken for at least the last 5 years. There's no fixing it, the approach is fundamentally flawed and fundamental to Java. This doesn't mean that Java for client-side applications is broken, as long as you don't rely on web based distribution and browser sandboxing.
  - tjoff 14y ago
    "This doesn't mean that Java for client-side applications is broken[...]" I don't know. Java on the desktop requires administrator privileges to be able to notify me that an update is available. Also, it tries to install a virus in the form of "Ask toolbar" every frigging time.

epochwolf 14y ago

There are multiple applications I use at work that require java to be active with reduced security.

chime 14y ago

User googles for 'digital camera nokia review' and ends up on a site containing a specially crafted 1x1 pixel Java applet. User doesn't even know it's there but due to the 0-day exploit, the applet can now download a remote executable to the user's machine and execute it. User's computer is now part of a botnet and all the user did was perform an innocuous google search.

jonknee 14y ago
Yes or it could be a site they visit regularly that has been hacked. Or a site that hasn't been hacked but that has JS from an ad network on it that has been hacked or let through a vulnerability. These are very scary hacks. Update: I wrote up my recent experience of a shady advertising buy that appears to have spreading malware (likely via Java) as a goal http://news.ycombinator.com/item?id=5305092 http://news.ycombinator.com/item?id=5305092

jonknee 14y ago

Considering Facebook and Apple devs getting owned by these exploits I think the answer is yes. That you even know what a plug-in is does make you in the minority, but considering who has been victim so far you should not sit back with such a smug attitude.

sleepyhead 14y ago

In Norway most banks require payments have to be verified with BankID which uses a Java-applet to enter a one-time password. Most people in larger organisations who makes decisions about IT have no clue what they are doing.

Cigano 14y ago

Not really? And the security plugin from my bank?

Florin_Andrei 14y ago
"Java security plugin from my bank" - irony is strong with that one.
- Cigano 14y ago
  You got my point.
- martinced 14y ago
  I'm SCJP since the last century and my life has been developing Java since a lloonngg time (and now Clojure, but targetting the JVM). Honestly the retards who decided that a Java applet was a wise decision for a bank should be shot before their genes are passed to a new generation :-/
  - Cigano 14y ago
    You should visit Brazil. There are lots of these wise decisions in IT here.