Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Java 0-Day Vulnerability Being Exploited in the Wild

thenextweb.com

Post reply on HN
Print view View original

61–70 of 80 posts

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#61

Post by pslam »

pjmlp wrote: post #36
pslam wrote: post #35

Earlier quoted context omitted.

Is it actually a JVM exploit, though? From FireEye's blog it sounds more like a library exploit which allows unconstrained clearing of memory, which then leads to a JVM escape because it blows away the JVM state. I wouldn't class that as a JVM exploit.

Yes, however there are hundreds of JVMs available in the wild. Oracle's one is just the reference version.

But the point still stands that this specific exploit is NOT a JVM exploit? Is it an actual exploit of the JVM implementation, or just the libraries?

The problem has always been that Sun shipped way too big a runtime for Java applets - the entire Java SE - when they should have made a third class ("edition") for browsers. That's a huge attack surface, and that's were most of the exploits have been, including this one, unless someone knows otherwise.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#62

Post by limmeau »

martinced wrote: post #52
sixbrx wrote: post #10

Earlier quoted context omitted.

Yes - also even a user who only wants to use client side Java outside of the browsers may be in trouble because of the automatically installed browser plugins that are part of the Java installation process. It's incredible how far and fast client side Java has fallen because of Oracle's tepid response to security concerns. I've developed many internal apps for client-side Java and supported them for over a decade. I…

Oh you don't know my misery : ( I'm actually working on a desktop app used by hundreds of people (and installed by thousands) and my entire business model is being an ISV: trying to sell that Java app to people. The less Java installed, the harder my life becomes ; (

Are there JREs which you can secretly include in your package, so that it looks like a few-hundred MB native application which happens to be implemented in Java?

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#63

Post by trailfox »

dsl wrote: post #43
drzaiusapelord wrote: post #25

Has anyone from Sun/Oracle commented on this yet? Are certain parts of the code being exploited? Have they done anything to secure the VM? Is it all just spaghetti code at this point?

Anyone from Oracle who commented publicly on this would most assuredly be promptly fired and sued. These Java exploits are all pretty low hanging fruit. CVE-2013-0431 basically boiled down to calling "System.setSecurityManager(null)". We haven't even hit the advanced stuff yet.

That's some pretty wild speculation.

As for "boiling down to calling setSecurityManager(null)" you are forgetting to point out how it was achieved via obscure calls to an instrumentation and management api:

https://community.rapid7.com/community/metasploit/blog/2013/...

Their head of security spoke recently about this topic, so I guess they will have to "fire and sue" him: http://www.computerworld.com/s/article/9236230/Oracle_s_Java...

"The plan for Java security is really simple," said Java security lead Milton Smith during a conference call this week with Java user group leaders. "It's to get Java fixed up, number one, and then number two, to communicate our efforts widely. We really can't have one without the other. No amount of talking or smoothing over is going to make anybody happy. We have to fix Java." - See more at: http://www.computerworld.com/s/article/9236230/Oracle_s_Java...

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#64

Post by tomjen3 »

Mahn wrote: post #58

World would be such a better place if we could get rid entirely of Flash and Java for the web. It's not only the exploits, the fact that they are so frequent also means users got to update both Java and Flash almost every single day, which is a terrible user experience.

Get everybody on at least IE 9 and then there is basically no reason to use flash.

Canvas + HTML5 video can basically anything people use to do today.

And yes I know, HTML5 development is my job.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#65

Post by tomjen3 »

JSadowski wrote: post #26
elisee wrote: post #23

To disable the java plugin temporarily in Chrome, you can use chrome://plugins

Or permanently. I have never found a use for the Java plugin in my browser. And for all other plugins I have click-to-play enabled.

Tell that to the entire country of Denmark where we are all bound to use a Java applet for such things as paying taxes or online banking.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#66

Post by pjmlp »

pslam wrote: post #61
pjmlp wrote: post #36

Earlier quoted context omitted.

Yes, however there are hundreds of JVMs available in the wild. Oracle's one is just the reference version.

But the point still stands that this specific exploit is NOT a JVM exploit? Is it an actual exploit of the JVM implementation, or just the libraries? The problem has always been that Sun shipped way too big a runtime for Java applets - the entire Java SE - when they should have made a third class ("edition") for browsers. That's a huge attack surface, and that's were most of the exploits have been, including this one…

Regardless of what is being exploited it is only effective in Oracle's implementation.

Every JVM vendor has their own implementation, both runtime and libraries.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#67

Post by _delirium »

tomjen3 wrote: post #64
Mahn wrote: post #58

World would be such a better place if we could get rid entirely of Flash and Java for the web. It's not only the exploits, the fact that they are so frequent also means users got to update both Java and Flash almost every single day, which is a terrible user experience.

Get everybody on at least IE 9 and then there is basically no reason to use flash. Canvas + HTML5 video can basically anything people use to do today. And yes I know, HTML5 development is my job.

Flash still seems more popular for webgame development. I've run across a handful of HTML5 games, but many more Flash games. Not entirely sure why. Libraries, maybe? Is there something comparable to Flixel for HTML5?

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#70

Post by ambrop7 »

IvyMike wrote: post #46
speeder wrote: post #44

Java should change their logo from a coffee to some swiss cheese. I want to know two things, first: Why huge banks (the sort that net profit 10 billion) and other big organisations (like, governments) insist in using Java Applets for browser security and auth? second: Why JVM is full of holes while JVM clones (like Dalvik and open source JVM substitutes for desktops) seemly are so much less affected?

I would put my money that Dalvik etc is not inherently safer, it's just a matter of the JVM holes being fairly executable-specific attacks, and nobody bothering to target the off-brand JVMs.

I think security bugs in Dalvik have less ramifications, because of at least 2 reasons:

1. Java code doesn't get executed by Dalvik automatically from web sites etc - an attacker has to get the user to install his application.

2. If an attacker manages to get the user to install and run his application, Dalvik security bugs are close to useless to him because Android applications can load native code without needing permission from the user. His problem is going to be circumventing the restrictions enforced by the kernel and system daemons running on the system. Android doesn't enforce permissions at the JVM level AFAIK.

To clarify here I meant vulnerabilities in the JVM that have to be triggered by malicious Java bytecode. Vulnerabilities which make applications themselves vulnerable are more problematic of course.

Post reply on HN