138 ms·

I mean that these bugs only solve the "break out of the sandbox" issue. They do not get your code on to the machine to exploit. In other words these flaws are

by waps 13y ago

I mean that these bugs only solve the "break out of the sandbox" issue. They do not get your code on to the machine to exploit. In other words these flaws are the equivalent of "I can upload code, how do I get to shell access to the java account".

toyg 13y ago
Considering the crappy quality of most java-powered "enterprise" software, I'd say this scenario is extremely likely.
cma 13y ago
So basically, if someone browses to a site with an applet and doesn't block Java.
- taspeotis 13y ago
  I wouldn't call that a remote exploit.
  - tptacek 13y ago
    Unlike the whole software security industry, which does.
    - taspeotis 13y ago
      I don't work in the software security industry like you but I don't see how it's a remote exploit. Wikipedia gives a way of discerning the two [1] that makes sense to me, as a software security industry layperson: > Whether they need to be run on the same machine as the program that has the vulnerability (local) or can be run on one machine to attack a program running on another machine (remote). So if a user starts running the code for you on their machine, it's local. If I send a malformed JPG to a Java webservice that process images, and it doesn't process the JPG correctly leading to code execution or a DoS then that's remote. [1] http://en.wikipedia.org/wiki/Exploit_(computer_security) http://en.wikipedia.org/wiki/Exploit_(computer_security)
      - tptacek 13y ago
        That's a 1990s definition of the term "remote", but 51% of Wikipedians now disagree with the whole software security industry, which uniformly considers browser drive-by vulnerabilities to be "remote".
      - meowface 13y ago
        I agree, it's a local exploit, not a remote exploit (I've debated this with people as well), but in the end Java sandbox bypass exploits are (or were) the most effective local exploit possible. And they're arguably far more valuable than the vast majority of remote exploits out there. Silent, cross-browser, cross-platform; browser plugin installed by default with anyone who has Java. And that's a huge number of people, since a ton of corporate and residential users have Java installed on all sorts of devices. Java is responsible for a massive ramp up in infections of computer literate and illiterate users alike between 2010 and now.
        brazzy 13y ago
        An interesting aspect of the whole Java pluigin fiasco is that, as you write, there were very few exploits until a couple of years ago - but the plugin was widely deployed for over a decade before that, and there is no reason to believe that it was somehow more secure before. So why the recent increase?
        benmmurphy 13y ago
        I think it is a combination of third party bug bounty programs (ZDI, etc) which is causing vulnerabilities to be disclosed to the vendor and the blood in the water effect.
        meowface 13y ago
        Could be a combination of many factors, but probably in part due to security researchers and black hats alike truly realizing the potential damage Java sandbox exploits could cause, in comparison to exploits for Flash or Adobe Reader, which are much more fickle, not cross platform, etc.
girvo 13y ago
Java Applets.

by waps 13y ago

toyg 13y ago

Considering the crappy quality of most java-powered "enterprise" software, I'd say this scenario is extremely likely.

cma 13y ago

So basically, if someone browses to a site with an applet and doesn't block Java.

taspeotis 13y ago
I wouldn't call that a remote exploit.
- tptacek 13y ago
  Unlike the whole software security industry, which does.
  - taspeotis 13y ago
    I don't work in the software security industry like you but I don't see how it's a remote exploit. Wikipedia gives a way of discerning the two [1] that makes sense to me, as a software security industry layperson: > Whether they need to be run on the same machine as the program that has the vulnerability (local) or can be run on one machine to attack a program running on another machine (remote). So if a user starts running the code for you on their machine, it's local. If I send a malformed JPG to a Java webservice that process images, and it doesn't process the JPG correctly leading to code execution or a DoS then that's remote. [1] http://en.wikipedia.org/wiki/Exploit_(computer_security) http://en.wikipedia.org/wiki/Exploit_(computer_security)
    - tptacek 13y ago
      That's a 1990s definition of the term "remote", but 51% of Wikipedians now disagree with the whole software security industry, which uniformly considers browser drive-by vulnerabilities to be "remote".
    - meowface 13y ago
      I agree, it's a local exploit, not a remote exploit (I've debated this with people as well), but in the end Java sandbox bypass exploits are (or were) the most effective local exploit possible. And they're arguably far more valuable than the vast majority of remote exploits out there. Silent, cross-browser, cross-platform; browser plugin installed by default with anyone who has Java. And that's a huge number of people, since a ton of corporate and residential users have Java installed on all sorts of devices. Java is responsible for a massive ramp up in infections of computer literate and illiterate users alike between 2010 and now.
      - brazzy 13y ago
        An interesting aspect of the whole Java pluigin fiasco is that, as you write, there were very few exploits until a couple of years ago - but the plugin was widely deployed for over a decade before that, and there is no reason to believe that it was somehow more secure before. So why the recent increase?
        benmmurphy 13y ago
        I think it is a combination of third party bug bounty programs (ZDI, etc) which is causing vulnerabilities to be disclosed to the vendor and the blood in the water effect.
        meowface 13y ago
        Could be a combination of many factors, but probably in part due to security researchers and black hats alike truly realizing the potential damage Java sandbox exploits could cause, in comparison to exploits for Flash or Adobe Reader, which are much more fickle, not cross platform, etc.

girvo 13y ago

Java Applets.