9 ms·
Days since last known Java 0-day exploit
- martinced 14y agoSun used to go after companies using "Java" in their names. Even events haven't been spared: Javapolis (in Belgium), where even Gosling came to speak, got renamed "Devoxx" due to trademark issues. I somehow doubt that the french person who registered java-0day.com is in compliance. The idea isn't bad but it's a bad sad that everything is put together: mixing Java applets exploits with server-side exploit with regulard client-side / Java desktop exploits.
- jiggy2011 14y agoThere's a bunch of unaffiliated sites with "java" in their domain name, http://www.javaranch.com/ http://www.javaranch.com/ for one. I think the difference is when you try and trade commercially using someone elses trademark.
- simonster 14y agoA trademark doesn't give you exclusive rights over all use of the mark. You can use it to prevent others from implying their products are associated with yours, as was presumably the case for Javapolis, but it doesn't give you the legal right to prevent others from criticizing your product.
- xradionut 14y agoIf they forced to change the domain name, a hexy alternative might be: BADC0FFEE
- throwawayG9 14y agoNice pun. For those who don't know, Java took his name from a Café's name or something like that.
- solistice 14y agoJava tooks it's name from the Java Coffee bean, which the original team slightly overindulged in. I imagine it went like this. "What should we call this?" one of the devs looks around "Java"
- haakon 14y agoYou forgot that JavaPolis first renamed themselves to Javoxx, thinking that would save them. But no. http://weblogs.java.net/blog/fabriziogiudici/archive/2008/09/javapolis_javox.html http://weblogs.java.net/blog/fabriziogiudici/archive/2008/09...
- hdra 14y agoCould this apply to non-IT related companies? "Java" is a name of a region in Indonesia to begin with, what about companies dealing with tourism or local products such as coffee or fabrics from that region?
- peterwwillis 14y agohttp://istherejava0day.com/ http://istherejava0day.com/ should really link to the 0days for reference. just saying "there is a 0day" with no details is pointless.
- deleted 14y ago[deleted]
- free652 14y agoAll browsers were compromised last Wednesday (except Safari on ML) http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/ http://www.zdnet.com/pwn2own-down-go-all-the-browsers-700001...
- fjarlq 14y agoSafari wasn't. Also, nobody compromised Safari at Pwn2own last year.
- deleted 14y ago[deleted]
- officialjunk 14y agoprobably bc they are saving those safari bug bounty's for iOS: https://twitter.com/i0n1c/status/309585202810867712 https://twitter.com/i0n1c/status/309585202810867712 i highly doubt it was because no one could pwn safari.
- fjarlq 14y agoInteresting perspective. Charlie Miller teased about it and a conversation involving i0n1c ensued: https://twitter.com/0xcharlie/status/310018569058525184 https://twitter.com/0xcharlie/status/310018569058525184
- eksith 14y agoThis may be the cynic in me, but I feel that's because exploits fetch quite a sum in the black market these days.
- Someone 14y agoIf so, why would somebody spend months working on a IE10 exploit (http://threatpost.com/en_us/blogs/pwn2own-browser-exploits-getting-harder-more-expensive-find-030613 http://threatpost.com/en_us/blogs/pwn2own-browser-exploits-g...) and then demo that here instead of selling it in the market? If the market pays lots of money for Mac OS X exploits, why would it pay less for Windows ones? It can't be market share and I doubt it is because Mac users have faster Internet (so that their machines can be bigger DDOS sources, have more money to steal from them (both may or may not be true, but I doubt that fully offsets the difference in market share) Another only thing I can think of why Mac exploits would be more expensive is that buyers expect Mac zero days to last longer, but I doubt that, too. That leaves two reasons: because it is so easy that nobody considers it a challenge, and everybody expects someone else to pick up the price, or because it is too hard. Alternative theories welcome.
- bra1n 14y agoI don't get why it's called a "countdown", when the counter on the page clearly intends to count up... Edit: original page title is "Java 0day countdown".
- eksith 14y ago"Down" sounds sexier than "up". Also there's a connotation of impending... er... something with a countdown vs. count-up, which I guess makes sense for the anticipation of another vulnerability.
- deleted 14y ago[deleted]
- Wilya 14y agoIs navigator.javaEnabled() (used in this page) accurate ? I deactivated Java plugin in Chrome's about://plugins (and restarted everything just to be sure), and it still returns true. Did I do something wrong ?
- michaelwww 14y agoSame here. Appears to be disabled http://www.java.com/en/download/testjava.jsp http://www.java.com/en/download/testjava.jsp
- kurd_debuggr 14y agoYou can tell if Java is running in your browser by testing it here: http://www.java.com/en/download/testjava.jsp http://www.java.com/en/download/testjava.jsp
- pudquick 14y agoI prefer: http://javatester.org/version.html http://javatester.org/version.html Tells you whether it's loaded, and what version you have loaded. No frills, no crap website.
- speedyrev 14y agoIt made me actually check and make sure that I had disabled the plugin. I thought I had already done it.
- mike_esspe 14y agoIt's the bug (or feature) of Chrome: http://stackoverflow.com/a/13648431/507072 http://stackoverflow.com/a/13648431/507072
- deleted 14y ago[deleted]
- revelation 14y agoSomeone should really spend a second thinking about what use that API with that behavior is to developers. And then not implement it anyway, because it's not in the spec.
- LilValleyBigEgo 14y agoIsn't that a count up?
- X-Istence 14y agoDamn, I created http://isjavavulnerable.com/ http://isjavavulnerable.com/ two days ago :-(.
- icambron 14y agoYours is better, FWIW
- gph 14y ago>Has the counter ever reached ten days yet? Should remove either the "ever" or "yet" from that sentence. Unless it's a redundancy feature :D
- tobyjsullivan 14y agoHas the counter ever reached ten days? Not yet. There! All fixed.
- aj700 14y agoI've given up trying to keep OSX java up to date. I can still use Libreoffice. I just keep the plugins disabled in the browsers. Oracle has made it, or rather left it, unusable.
- darkchasma 14y agoSo it's a static website? ;)
- yakiv 14y agoCan't be. Has to say "0" sometimes.
- swalkergibson 14y agoIs there an API? ;)
- Natsu 14y agoNah, all you need to do is have a number that alternates between 1 and 0 and it'll be close enough for all practical purposes.
- tobyjsullivan 14y agoAs data is collected over time, I would love to see this plotted on a graph. Mostly for purposes of hilarity.
- solistice 14y agoIt'll just look like a sawtooth wave.
- yati 14y agoDo the OOP/Java courses still teach students that Java is "secure"?
- younata 14y agoYes. Or at least, as recently as 2 years ago at my university, they did.
- Moto7451 14y agoYup, instructors of my brother's Java oriented courses still keep that rhetoric going. Really that statement kept confused me from day 1 since examples to the contrary are easily found via google: http://www.symantec.com/security_response/writeup.jsp?docid=2000-121911-0104-99 http://www.symantec.com/security_response/writeup.jsp?docid=... And that one is years prior to when I went to school. People can believe whatever they want about the security of their preferred platform but basically any large project is going to have some sort of vulnerability. All it takes is someone with enough gumption to find it.
- ZoFreX 14y agoJava the language is not insecure, nor is having the JVM installed. The issue comes from the Java browser plugin, which has been a security disaster to the point that it's being disabled in browsers automatically.
- yati 14y agoPeople are (even I was) taught Java to believe that if you embrace Java, you no longer have to worry about security, without detailing them on what kind of security problems are alleviated by Java. And Oracle has proved itself highly inefficient when it comes to responding fast with patches.
- solistice 14y agoAs someone who is still in a beginners course on OOP/Java, I can tell you that that's not the only bull they'll spout.
- CodeCube 14y agoInteresting thought ... have there been any _high profile_ Windows OS vulnerabilities in recent times? I mean, I'm sure there are, there are still tons of patches rolled out on a regular basis. But they're not getting nearly as much media focus as they once were; at least, not in any media that I'm consuming. Is it a case of the OS now really being way more secure than it once was? Lost interest by malware writers? A bigger focus on vulnerabilities in specific products (ie. Browsers)?
- EvanKelly 14y agoMS12-063 was an IE exploit on XP, Vista, and 7. Though not specifically an OS vulnerability, it's a pretty big one. MS08-067 was certainly the goto XP exploit for the longest time. I still find computers vulnerable to that nearly 5 years later. Disclaimer: I only dabble in security and am basically limited to metasploit for my knowledge, so corrections are welcome.
- joshAg 14y agoIt's a case of the OS being way more secure than it once was. The new kernel that came out with vista helped quite a bit, as well as the constant stream of updates. Because the OS is more secure, other parts of the system (ie browsers, flash, java) are now (in comparison to the OS) easier to exploit than they were.
- Legion 14y agoAre there any more sites like this, for other languages or frameworks? This and others like it would be a great addition to our chatbot's morning news update. :)
- lawnchair_larry 14y agoAbout ten years ago, a guy named Thor Larholm used to maintain a page of unpatched MSIE vulnerabilities. Anyone could go there and read about 20-30 vulnerabilities currently exploitable at any given time. Check wayback for http://www.pivx.com/larholm/unpatched http://www.pivx.com/larholm/unpatched around 2002 to see some samples. In those days, browser exploits were not really seen as something of value. Everyone thought, "You have to trick the victim into visiting your web page? Pff". That's when hacking was still done by silently hitting vulnerable services, with no user interaction. Crazy how times have changed... (Sorry, not what you were asking for, but reminded me of that page.)
- a1a 14y agoWe have a "space" on the black board that's reserved, in the security class I'm taking. It's commonly know as the "java 0-day calendar". Everyone thought it was funny at first. Yet, lately the professors has started whining about not having enough space left for their lectures. Yeah, now it's basically just sad.
- benmmurphy 14y agoBeware click to play is not a security feature in Firefox or Chrome as recommended by this site. In chrome you want to use 'block all'.
- csense 14y agoWhat about Java so exploit-prone? I always thought that, from day one, it was specifically designed to run untrusted code downloaded over the network in a secure sandbox. Java's over 15 years old and has always had the backing of a major company, so it's not like these are the growing pains of a new technology.
- rachelbythebay 14y agoYou might ask the same thing about Flash. You'd think that after the first dozen or so releases with gaping holes that they'd take a step back and rethink things. I came up with a hypothesis about this kind of stuff not too long ago. Once your product becomes sufficiently crappy, nobody in their right mind will want to work on it. Good people will leave to get away from it. The project gets to a point where the badness "rubs off on you". Anyone who cares about their reputation will run from it. Obviously, you can't write code without developers, so you start scraping the bottom of the barrel to get anyone who will work on it. You get people who don't care about their reputations and/or quality and are only there for a paycheck. You get green people fresh out of school who think everything is always nice and happy, and haven't been beaten down by the harsh reality of the industry yet. The bozos got to the project, and broke it. Once that happened, the only people willing to work on it are more bozos (and the unfortunate ignorant folks who don't know any better). I dubbed it "The Bozo Loop". I originally only intended for this to describe a specific situation (Flash), but since then it's become quite clear that it can extend to Java and many other things.
- chunknug 14y ago╔═════════════════ ೋღ☃ღೋ ════════════════╗ ~ ~ ~ ~ ~ ~ ~ ~ REPOST THIS IF ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~YOU ARE A BEAUTIFUL STRONG PROUD ~ ~ ~ ~ ~ ~ CO-FOUNDER WHO DON'T NEED NO SXSWi ~ ~ ~ ╚═════════════════ ೋღ☃ღೋ ════════════════╝
- j45 14y agoWhy just Java plugins for browsers and not other things?
- hakaaaaak 14y agoSomeone needs a similar site that contains the 0-day for not only Java, but everything: languages, frameworks, jars, gems, projects, etc. For example, how about one for each currently maintained version of Rails, IE, Firefox, Chromium/Chrome, Opera, Safari, Windows, Linux, OS X, etc. Just a big sortable grid for each category type with name, days since 0-day, and a link and/or description of the last vulnerability, with another link to list all reported vulnerabilities and links to reports. That would be awesome.
- lrobb 14y agoDays since a sizable number of hacker newsers confused java the language with the jvm with the browser plugin: also 0
- GhotiFish 14y agoHA! http://gcc.gnu.org/java/ http://gcc.gnu.org/java/ Personally I didn't think a project like that existed until you mentioned it.
- blablabla123 14y agoAt home I have often used not fully patched Windows systems and not fully updated Browser/Plugin stacks. Oh and Java and Flash are always activated. This is the Windows 7 dual boot on my laptop. When really bad news arrives (HN, other tech news) I do updates or other precautions like avoiding crappy web sites, MSIE etc. Until 2 years ago I even had a Windows XP VM with broken update mechanism and IE6 which I used frequently. And guess what, never something happened. But speaking for me, I will keep Flash and Java activated for another few years. I'm no security expert but my explanation why this works is this: I don't install any toolbar, in fact I have only the bare minimum of Firefox add-ons. (Why don't they allow me to uninstall MS Office Live-Plugin anyway? Or this Ubuntu thing?) I hate to install Software on Windows, and if, I really make sure I understand what I install and how trustable the vendor is. Two relatives of mine have been infected with some spam bot net thing more than once. Their systems were like 90% patched, but they were vulnerable through Toolbars. (I think in both cases it was the Yahoo Toolbar.) This is certainly not meant as a general advice, but I guess the lesson is being minimal and careful is as valuable as keeping your system patched. Oh and yes, I do always have an up-to-date Virus scanner.