New Java 0-Day Vulnerability Being Exploited in the Wild
thenextweb.com
New Java 0-Day Vulnerability Being Exploited in the Wild
1–10 of 80 posts
Re: New Java 0-Day Vulnerability Being Exploited in the Wild
#2There have been [__0] days since the last Java exploit.
"You know, one of these days, we're going to use that second digit.” — Stephen Colbert
Re: New Java 0-Day Vulnerability Being Exploited in the Wild
#3I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really.
Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.
Re: New Java 0-Day Vulnerability Being Exploited in the Wild
#4I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.
what browser are you using and how are you disabling the plugins?
Re: New Java 0-Day Vulnerability Being Exploited in the Wild
#5I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.
It makes no difference how prevalent they are in common web apps, the problem is that the Java plugin is still installed and active for a large number of users.
This is not the attack sequence:
* site has pre-existing Java
* site gets compromised somehow
* site now infects users
* site gets compromised somehow
* exploit includes a 0-day Java attack
* site now infects users
Re: New Java 0-Day Vulnerability Being Exploited in the Wild
#6I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.
There are multiple applications I use at work that require java to be active with reduced security.
Re: New Java 0-Day Vulnerability Being Exploited in the Wild
#7Correction, new Oracle Java Virtual Machine exploit.
Re: New Java 0-Day Vulnerability Being Exploited in the Wild
#8I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.
User googles for 'digital camera nokia review' and ends up on a site containing a specially crafted 1x1 pixel Java applet. User doesn't even know it's there but due to the 0-day exploit, the applet can now download a remote executable to the user's machine and execute it. User's computer is now part of a botnet and all the user did was perform an innocuous google search.
Re: New Java 0-Day Vulnerability Being Exploited in the Wild
#9I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.
It makes no difference how prevalent they are in common web apps, the problem is that the Java plugin is still installed and active for a large number of users. This is not the attack sequence: * site has pre-existing Java * site gets compromised somehow * site now infects users This is how it usually plays out: * site gets compromised somehow * exploit includes a 0-day Java attack * site now infects users Literally…
Ah, fair enough.
Re: New Java 0-Day Vulnerability Being Exploited in the Wild
#10I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.
It makes no difference how prevalent they are in common web apps, the problem is that the Java plugin is still installed and active for a large number of users. This is not the attack sequence: * site has pre-existing Java * site gets compromised somehow * site now infects users This is how it usually plays out: * site gets compromised somehow * exploit includes a 0-day Java attack * site now infects users Literally…
Yes - also even a user who only wants to use client side Java outside of the browsers may be in trouble because of the automatically installed browser plugins that are part of the Java installation process.
It's incredible how far and fast client side Java has fallen because of Oracle's tepid response to security concerns. I've developed many internal apps for client-side Java and supported them for over a decade. I don't think I'll develop another.