Feeds

Apple FINALLY fills gaping Java hole that pwned its own devs

Zero-day vuln also downed Facebook staff and other Mac users

Protecting against web application threats using SSL

Apple has belatedly patched a security hole in the Java engine it ships with Mac OS X - the very hole exploited by hackers to infect Apple's own developers, their counterparts at Facebook and scores of other Mac-using companies.

The vulnerability allowed miscreants to execute malicious code outside of the limited and supposedly secure sandbox each downloaded Java applet runs in, in effect granting wider access to the underlying system. The escaped software has the same level of privileges as the logged-in user but often that's enough to compromise the box's security.

Attackers were able to use this hole to infiltrate and install malware on vulnerable Mac computers at Apple, Facebook and others. That's according to Apple insiders speaking to Reuters in an unprecedented admission of security weaknesses at the iPhone maker, which until the last year or so all but dismissed malware as a Windows-only problem.

Specifically, Facebook and Apple were pwned after their employees visited iPhoneDevSDK.com - a website popular with mobile developers that someone booby-trapped with code to exploit the unpatched Java security hole and install a load of spyware. Reuters reports that the hack attack against Twitter earlier this month has also been linked to the same Java zero-day vulnerability.

Twitter recently admitted it suffered a network security breach that exposed the login credentials of 250,000 early adopters of the social network, but it didn't say how it happened beyond advising everyone to turn off Java in their browser.

All indications are that the Java browser plugin was the gateway to victims' machines for whichever hacking group pulled off the attacks against Apple and Facebook. Their identity remains elusive.

Bloomberg is quoting sources who say it might be Eastern European hackers while Reuters' sources are more inclined to blame China. The motive of the attackers remains unclear.

Apple's Tuesday update aligns the version of Java it supplies with Oracle's latest patch*, which was formally released yesterday as scheduled after an emergency update earlier this month.

"[It's a] bit of a pity that the Fruity Ones didn't do this back at the beginning of February, when Oracle's emergency 'pre-Patch-Tuesday' update came out to fix the hole that Apple is only now closing off," notes Paul Ducklin of Sophos in a blog post.

The fact that Java security releases from Apple arrived weeks after Oracle's updates were a massive factor in the spread of the Flashback botnet last year. The malware infected over 500,000 Macs, forming a zombie network that included 274 bots traced back to Cupertino, California, home of Apple's HQ. This time around the window of Java vulnerability extended for less than three weeks instead of two months but the overall fallout from the delay in pushing out a patch quickly is arguably even more toxic.

Apple released a malware removal tool for Java alongside its Java security update on Tuesday. But to use the malware removal tool you have to install Java and this is perhaps not the best idea especially since the language has become a prime target for hacking attacks of late, as Sean Sullivan of security software firm F-Secure notes.

Meanwhile, three of the five components of Oracle's latest Java security update, also released on Tuesday, hit the maximum security peril rating of 10.

All five of the security vulnerabilities resolved by in the latest Java update might lend themselves to remote exploitation. The critical patch update released on Tuesday includes all fixes provided in an emergency update for Oracle Java SE published at the start of February plus an additional five fixes. Oracle has scheduled its next Java SE (Java Platform, Standard Edition) critical patch update for 16 April. Java 7 Update 13 and earlier as well as Java 6 Update 39 and earlier need updating. ®

* Apple maintains Java 6 for the Mac, Java 7 is maintained directly by Oracle and Mac users need to go to Oracle to install Java 7, as explained in a blog post by Wolfgang Kandek, CTO at Qualys, here.

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.