Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Java 0-Day Vulnerability Being Exploited in the Wild

thenextweb.com

Post reply on HN
Print view View original

41–50 of 80 posts

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#41

Post by martinced »

For the devs on Linux who actually need Java (e.g. Java or Clojure or Scala devs etc.), then there's an easy way out.

Do NOT install Java from your distro. Do NOT install Java by giving the root password (or by directly using the root account): no rpm, no deb.

Fetch, from a regular user account, the Java .tar.gz and install Java in your dev user account.

And then install your browser in another user account.

This is what I do.

This way you can be sure and certain that no amount of Sun / Oracle uber retardedness Java applets can ruin your day....

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#42

Post by yuhong »

martinced wrote: post #41

For the devs on Linux who actually need Java ( e.g. Java or Clojure or Scala devs etc.), then there's an easy way out. Do NOT install Java from your distro. Do NOT install Java by giving the root password (or by directly using the root account): no rpm , no deb . Fetch, from a regular user account, the Java .tar.gz and install Java in your dev user account. And then install your browser in another user account . This…

I wonder if IcedTea could lead by provinding a faster patch cycle.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#43

Post by dsl »

drzaiusapelord wrote: post #25

Has anyone from Sun/Oracle commented on this yet? Are certain parts of the code being exploited? Have they done anything to secure the VM? Is it all just spaghetti code at this point?

Anyone from Oracle who commented publicly on this would most assuredly be promptly fired and sued.

These Java exploits are all pretty low hanging fruit. CVE-2013-0431 basically boiled down to calling "System.setSecurityManager(null)". We haven't even hit the advanced stuff yet.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#44

Post by speeder »

Java should change their logo from a coffee to some swiss cheese.

I want to know two things,

first: Why huge banks (the sort that net profit 10 billion) and other big organisations (like, governments) insist in using Java Applets for browser security and auth?

second: Why JVM is full of holes while JVM clones (like Dalvik and open source JVM substitutes for desktops) seemly are so much less affected?

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#45

Post by IvyMike »

martinced wrote: post #40
pjmlp wrote: post #7

Correction, new Oracle Java Virtual Machine exploit.

To be honest they inherited all these applets (and applets-only) security exploits from Sun. Sun are the ones to blame here. Actually the ones to blame are the uber f^^^tards who thought that Java applets was a technology worth anything. One should go back in time and read Usenet's comp.lang.java.programmer from back in the early Java days. There were two camps: the retards who thought applets were a good idea and go…

> the retards who thought applets were a good idea and going to revolutionize the Web

Didn't this happen? I mean, the "applets" we use are all called "Flash" and not "Java", but Flash is everywhere, from ads to video to music. When the so-called "retards" were envisioning a future web, I though that's what they wanted.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#46

Post by IvyMike »

speeder wrote: post #44

Java should change their logo from a coffee to some swiss cheese. I want to know two things, first: Why huge banks (the sort that net profit 10 billion) and other big organisations (like, governments) insist in using Java Applets for browser security and auth? second: Why JVM is full of holes while JVM clones (like Dalvik and open source JVM substitutes for desktops) seemly are so much less affected?

I would put my money that Dalvik etc is not inherently safer, it's just a matter of the JVM holes being fairly executable-specific attacks, and nobody bothering to target the off-brand JVMs.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#47

Post by ajross »

IvyMike wrote: post #46
speeder wrote: post #44

Java should change their logo from a coffee to some swiss cheese. I want to know two things, first: Why huge banks (the sort that net profit 10 billion) and other big organisations (like, governments) insist in using Java Applets for browser security and auth? second: Why JVM is full of holes while JVM clones (like Dalvik and open source JVM substitutes for desktops) seemly are so much less affected?

I would put my money that Dalvik etc is not inherently safer, it's just a matter of the JVM holes being fairly executable-specific attacks, and nobody bothering to target the off-brand JVMs.

I'm with you on the first part -- certainly there's nothing inherently different between the interpreter security models of the JVM and Dalvik.

But if you're counting by deployed units, the JVM is now the "off brand". Dalvik owns that market. Certainly it's no less an attractive target -- perhaps more so as mobile devices are now a bigger part of the consumer market.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#50

Post by stusmall »

martinced wrote: post #41

For the devs on Linux who actually need Java ( e.g. Java or Clojure or Scala devs etc.), then there's an easy way out. Do NOT install Java from your distro. Do NOT install Java by giving the root password (or by directly using the root account): no rpm , no deb . Fetch, from a regular user account, the Java .tar.gz and install Java in your dev user account. And then install your browser in another user account . This…

Or you can just disable the java plugins in your browsers. I think that might be slight overkill
Post reply on HN