5 ms·

What about Java so exploit-prone? I always thought that, from day one, it was specifically designed to run untrusted code downloaded over the network in a secu

by csense 14y ago

What about Java so exploit-prone? I always thought that, from day one, it was specifically designed to run untrusted code downloaded over the network in a secure sandbox. Java's over 15 years old and has always had the backing of a major company, so it's not like these are the growing pains of a new technology.

rachelbythebay 14y ago
You might ask the same thing about Flash. You'd think that after the first dozen or so releases with gaping holes that they'd take a step back and rethink things. I came up with a hypothesis about this kind of stuff not too long ago. Once your product becomes sufficiently crappy, nobody in their right mind will want to work on it. Good people will leave to get away from it. The project gets to a point where the badness "rubs off on you". Anyone who cares about their reputation will run from it. Obviously, you can't write code without developers, so you start scraping the bottom of the barrel to get anyone who will work on it. You get people who don't care about their reputations and/or quality and are only there for a paycheck. You get green people fresh out of school who think everything is always nice and happy, and haven't been beaten down by the harsh reality of the industry yet. The bozos got to the project, and broke it. Once that happened, the only people willing to work on it are more bozos (and the unfortunate ignorant folks who don't know any better). I dubbed it "The Bozo Loop". I originally only intended for this to describe a specific situation (Flash), but since then it's become quite clear that it can extend to Java and many other things.
- csense 14y ago
  If they're both similar in this way, why did Flash win, or at least stay alive, while Java lost, to the point where most people can be told to turn it off and won't notice the difference?
  - khuey 14y ago
    Because Flash plays streaming video well and Java doesn't?
  - mattmanser 14y ago
    Only way to watch a video
    - solistice 14y ago
      HTML 5 video?
      - robryan 14y ago
        We are only just now hitting the point where you could use HTML 5 video only for a broad reaching consumer site. Once this is no longer an issue flash will probably drop off a lot more. I assume only having up to IE8 on XP is going to be an issue to full html5 video adoption for some time yet.
        solistice 14y ago
        I just found out from W3S that there's still 19.1% of users using XP. I see where that could become problematic.
      - tracker1 14y ago
        Only way with 98% (at peak) market availability... Also, the tools for working with flash (for creative content) are better than those for Java.
- modarts 14y ago
  I'm using this if you don't mind.
logn 14y ago
It's actually pretty hard to find details, maybe because I don't know any good security-related blogs, but I did find this about a recent exploit: http://www.security-faqs.com/another-day-another-java-0-day.html http://www.security-faqs.com/another-day-another-java-0-day.... Java downloaded an executable with a misleading '.jpg' extension and then executed it (it was a trojan that downloads other malware: http://go.eset.com/us/threat-center/encyclopedia/threats/win32mcrata/ http://go.eset.com/us/threat-center/encyclopedia/threats/win... ).
zmmmmm 14y ago
I don't think there's anything about Java the language, any more than any plugin. It is the development and deployment methodology that is dated. Oracle (and the same went for Sun) issues updates on a scale of months. I think this is now turning out to be an unviable strategy for any platform that has to survive in the wild and run untrusted code. It's hard to swallow, but we have to accept: 1. Completely secure code is extraordinarily expensive and difficult to write. All cost effective software is going to contain vulnerabilities 2. The only path to security is aggressive discovery and disclosure followed up with an immediate patch and deploy mechanism This is the new model which Chrome and various other end-user-facing software is running - silent, rapid updates and a product engineered from the ground up to support that without major regressions. Anybody who wants to be a player in the browser market basically has to adopt this model. If Oracle cares about retaining any presence of their browser plugin in modern browsers they need to drastically change course - but I'm not sure they do.
chubot 14y ago
Because the JVM is written in C, and thus EVERY line of C code in it (which is millions, maybe tens of millions) has to be trusted. That's just the way C is (but not Java, to its credit). Anybody can introduce a security hole at any point, essentially. There are ways to structure your code to mitigate this, but Java is almost 20 years old, so I'm sure there are a bunch of dark corners in there. A more secure way to go about it would probably be to bootstrap the language more and write more of the VM in Java. I guess PyPy is exactly that, although I don't know enough to comment on its security.
- csense 14y ago
  Javascript interpreters are also written in C. Flash is written in C. HTML parsers are written in C. All of these are exposed directly to untrusted code from the Internet, and none of them break at anything like the rate that Java seems to have done recently, nor get as much bad press as Java does. The closest analogy I can think of is MSIE in the post-Netscape, pre-Firefox era (c. 2001-2005). Maybe the conclusion is, security holes don't get fixed if a technology is closed-source, is developed by a single large company, and there are no alternative implementations.
  - chubot 14y ago
    I'm willing to guess that the JVM source is an order of magnitude larger than any JS interpreter or Flash interpreter (I'd be interested in being corrected if wrong). The number of security holes is proportional to the trusted code size. I thought that Java had a pretty good record until recently. As I wrote in a previous comment, what may have happened is that Windows and Flash and other ubiquitous client software really cleaned up their act in the last few years. So hackers started going for the JVM and Adobe Reader as vectors. The JVM wasn't under as much scrutiny when Windows was wide open, although that was quite a few years ago. I wouldn't rule out other possible reasons either, e.g. the fact that there may have been a huge brain drain in JVM talent after the Oracle acquisition. Or a failure of software engineering processes after a re-org. I agree that closed source software doesn't have a great security track record... but I think there are some other factors at play here, some of which I'm speculating on.
darec1 14y ago
I wonder if these are new vulnerabilities or if the maybe existed all along? Would an adapted exploit work against Java 5? Maybe java security research just had a breakthrough and they found some new attack vector/methodology which uncovers all these vulnerabilites?

by csense 14y ago

rachelbythebay 14y ago

You might ask the same thing about Flash. You'd think that after the first dozen or so releases with gaping holes that they'd take a step back and rethink things. I came up with a hypothesis about this kind of stuff not too long ago. Once your product becomes sufficiently crappy, nobody in their right mind will want to work on it. Good people will leave to get away from it. The project gets to a point where the badness "rubs off on you". Anyone who cares about their reputation will run from it. Obviously, you can't write code without developers, so you start scraping the bottom of the barrel to get anyone who will work on it. You get people who don't care about their reputations and/or quality and are only there for a paycheck. You get green people fresh out of school who think everything is always nice and happy, and haven't been beaten down by the harsh reality of the industry yet. The bozos got to the project, and broke it. Once that happened, the only people willing to work on it are more bozos (and the unfortunate ignorant folks who don't know any better). I dubbed it "The Bozo Loop". I originally only intended for this to describe a specific situation (Flash), but since then it's become quite clear that it can extend to Java and many other things.

csense 14y ago
If they're both similar in this way, why did Flash win, or at least stay alive, while Java lost, to the point where most people can be told to turn it off and won't notice the difference?
- khuey 14y ago
  Because Flash plays streaming video well and Java doesn't?
- mattmanser 14y ago
  Only way to watch a video
  - solistice 14y ago
    HTML 5 video?
    - robryan 14y ago
      We are only just now hitting the point where you could use HTML 5 video only for a broad reaching consumer site. Once this is no longer an issue flash will probably drop off a lot more. I assume only having up to IE8 on XP is going to be an issue to full html5 video adoption for some time yet.
      - solistice 14y ago
        I just found out from W3S that there's still 19.1% of users using XP. I see where that could become problematic.
    - tracker1 14y ago
      Only way with 98% (at peak) market availability... Also, the tools for working with flash (for creative content) are better than those for Java.
modarts 14y ago
I'm using this if you don't mind.

logn 14y ago

It's actually pretty hard to find details, maybe because I don't know any good security-related blogs, but I did find this about a recent exploit: http://www.security-faqs.com/another-day-another-java-0-day.html http://www.security-faqs.com/another-day-another-java-0-day.... Java downloaded an executable with a misleading '.jpg' extension and then executed it (it was a trojan that downloads other malware: http://go.eset.com/us/threat-center/encyclopedia/threats/win32mcrata/ http://go.eset.com/us/threat-center/encyclopedia/threats/win... ).

zmmmmm 14y ago

I don't think there's anything about Java the language, any more than any plugin. It is the development and deployment methodology that is dated. Oracle (and the same went for Sun) issues updates on a scale of months. I think this is now turning out to be an unviable strategy for any platform that has to survive in the wild and run untrusted code. It's hard to swallow, but we have to accept: 1. Completely secure code is extraordinarily expensive and difficult to write. All cost effective software is going to contain vulnerabilities 2. The only path to security is aggressive discovery and disclosure followed up with an immediate patch and deploy mechanism This is the new model which Chrome and various other end-user-facing software is running - silent, rapid updates and a product engineered from the ground up to support that without major regressions. Anybody who wants to be a player in the browser market basically has to adopt this model. If Oracle cares about retaining any presence of their browser plugin in modern browsers they need to drastically change course - but I'm not sure they do.

chubot 14y ago

Because the JVM is written in C, and thus EVERY line of C code in it (which is millions, maybe tens of millions) has to be trusted. That's just the way C is (but not Java, to its credit). Anybody can introduce a security hole at any point, essentially. There are ways to structure your code to mitigate this, but Java is almost 20 years old, so I'm sure there are a bunch of dark corners in there. A more secure way to go about it would probably be to bootstrap the language more and write more of the VM in Java. I guess PyPy is exactly that, although I don't know enough to comment on its security.

csense 14y ago
Javascript interpreters are also written in C. Flash is written in C. HTML parsers are written in C. All of these are exposed directly to untrusted code from the Internet, and none of them break at anything like the rate that Java seems to have done recently, nor get as much bad press as Java does. The closest analogy I can think of is MSIE in the post-Netscape, pre-Firefox era (c. 2001-2005). Maybe the conclusion is, security holes don't get fixed if a technology is closed-source, is developed by a single large company, and there are no alternative implementations.
- chubot 14y ago
  I'm willing to guess that the JVM source is an order of magnitude larger than any JS interpreter or Flash interpreter (I'd be interested in being corrected if wrong). The number of security holes is proportional to the trusted code size. I thought that Java had a pretty good record until recently. As I wrote in a previous comment, what may have happened is that Windows and Flash and other ubiquitous client software really cleaned up their act in the last few years. So hackers started going for the JVM and Adobe Reader as vectors. The JVM wasn't under as much scrutiny when Windows was wide open, although that was quite a few years ago. I wouldn't rule out other possible reasons either, e.g. the fact that there may have been a huge brain drain in JVM talent after the Oracle acquisition. Or a failure of software engineering processes after a re-org. I agree that closed source software doesn't have a great security track record... but I think there are some other factors at play here, some of which I'm speculating on.

darec1 14y ago

I wonder if these are new vulnerabilities or if the maybe existed all along? Would an adapted exploit work against Java 5? Maybe java security research just had a breakthrough and they found some new attack vector/methodology which uncovers all these vulnerabilites?