Feeds

Apple FINALLY fills gaping Java hole that pwned its own devs

Zero-day vuln also downed Facebook staff and other Mac users

Top 5 reasons to deploy VMware with Tegile

Apple has belatedly patched a security hole in the Java engine it ships with Mac OS X - the very hole exploited by hackers to infect Apple's own developers, their counterparts at Facebook and scores of other Mac-using companies.

The vulnerability allowed miscreants to execute malicious code outside of the limited and supposedly secure sandbox each downloaded Java applet runs in, in effect granting wider access to the underlying system. The escaped software has the same level of privileges as the logged-in user but often that's enough to compromise the box's security.

Attackers were able to use this hole to infiltrate and install malware on vulnerable Mac computers at Apple, Facebook and others. That's according to Apple insiders speaking to Reuters in an unprecedented admission of security weaknesses at the iPhone maker, which until the last year or so all but dismissed malware as a Windows-only problem.

Specifically, Facebook and Apple were pwned after their employees visited iPhoneDevSDK.com - a website popular with mobile developers that someone booby-trapped with code to exploit the unpatched Java security hole and install a load of spyware. Reuters reports that the hack attack against Twitter earlier this month has also been linked to the same Java zero-day vulnerability.

Twitter recently admitted it suffered a network security breach that exposed the login credentials of 250,000 early adopters of the social network, but it didn't say how it happened beyond advising everyone to turn off Java in their browser.

All indications are that the Java browser plugin was the gateway to victims' machines for whichever hacking group pulled off the attacks against Apple and Facebook. Their identity remains elusive.

Bloomberg is quoting sources who say it might be Eastern European hackers while Reuters' sources are more inclined to blame China. The motive of the attackers remains unclear.

Apple's Tuesday update aligns the version of Java it supplies with Oracle's latest patch*, which was formally released yesterday as scheduled after an emergency update earlier this month.

"[It's a] bit of a pity that the Fruity Ones didn't do this back at the beginning of February, when Oracle's emergency 'pre-Patch-Tuesday' update came out to fix the hole that Apple is only now closing off," notes Paul Ducklin of Sophos in a blog post.

The fact that Java security releases from Apple arrived weeks after Oracle's updates were a massive factor in the spread of the Flashback botnet last year. The malware infected over 500,000 Macs, forming a zombie network that included 274 bots traced back to Cupertino, California, home of Apple's HQ. This time around the window of Java vulnerability extended for less than three weeks instead of two months but the overall fallout from the delay in pushing out a patch quickly is arguably even more toxic.

Apple released a malware removal tool for Java alongside its Java security update on Tuesday. But to use the malware removal tool you have to install Java and this is perhaps not the best idea especially since the language has become a prime target for hacking attacks of late, as Sean Sullivan of security software firm F-Secure notes.

Meanwhile, three of the five components of Oracle's latest Java security update, also released on Tuesday, hit the maximum security peril rating of 10.

All five of the security vulnerabilities resolved by in the latest Java update might lend themselves to remote exploitation. The critical patch update released on Tuesday includes all fixes provided in an emergency update for Oracle Java SE published at the start of February plus an additional five fixes. Oracle has scheduled its next Java SE (Java Platform, Standard Edition) critical patch update for 16 April. Java 7 Update 13 and earlier as well as Java 6 Update 39 and earlier need updating. ®

* Apple maintains Java 6 for the Mac, Java 7 is maintained directly by Oracle and Mac users need to go to Oracle to install Java 7, as explained in a blog post by Wolfgang Kandek, CTO at Qualys, here.

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.