Feeds

Apple FINALLY fills gaping Java hole that pwned its own devs

Zero-day vuln also downed Facebook staff and other Mac users

Choosing a cloud hosting partner with confidence

Apple has belatedly patched a security hole in the Java engine it ships with Mac OS X - the very hole exploited by hackers to infect Apple's own developers, their counterparts at Facebook and scores of other Mac-using companies.

The vulnerability allowed miscreants to execute malicious code outside of the limited and supposedly secure sandbox each downloaded Java applet runs in, in effect granting wider access to the underlying system. The escaped software has the same level of privileges as the logged-in user but often that's enough to compromise the box's security.

Attackers were able to use this hole to infiltrate and install malware on vulnerable Mac computers at Apple, Facebook and others. That's according to Apple insiders speaking to Reuters in an unprecedented admission of security weaknesses at the iPhone maker, which until the last year or so all but dismissed malware as a Windows-only problem.

Specifically, Facebook and Apple were pwned after their employees visited iPhoneDevSDK.com - a website popular with mobile developers that someone booby-trapped with code to exploit the unpatched Java security hole and install a load of spyware. Reuters reports that the hack attack against Twitter earlier this month has also been linked to the same Java zero-day vulnerability.

Twitter recently admitted it suffered a network security breach that exposed the login credentials of 250,000 early adopters of the social network, but it didn't say how it happened beyond advising everyone to turn off Java in their browser.

All indications are that the Java browser plugin was the gateway to victims' machines for whichever hacking group pulled off the attacks against Apple and Facebook. Their identity remains elusive.

Bloomberg is quoting sources who say it might be Eastern European hackers while Reuters' sources are more inclined to blame China. The motive of the attackers remains unclear.

Apple's Tuesday update aligns the version of Java it supplies with Oracle's latest patch*, which was formally released yesterday as scheduled after an emergency update earlier this month.

"[It's a] bit of a pity that the Fruity Ones didn't do this back at the beginning of February, when Oracle's emergency 'pre-Patch-Tuesday' update came out to fix the hole that Apple is only now closing off," notes Paul Ducklin of Sophos in a blog post.

The fact that Java security releases from Apple arrived weeks after Oracle's updates were a massive factor in the spread of the Flashback botnet last year. The malware infected over 500,000 Macs, forming a zombie network that included 274 bots traced back to Cupertino, California, home of Apple's HQ. This time around the window of Java vulnerability extended for less than three weeks instead of two months but the overall fallout from the delay in pushing out a patch quickly is arguably even more toxic.

Apple released a malware removal tool for Java alongside its Java security update on Tuesday. But to use the malware removal tool you have to install Java and this is perhaps not the best idea especially since the language has become a prime target for hacking attacks of late, as Sean Sullivan of security software firm F-Secure notes.

Meanwhile, three of the five components of Oracle's latest Java security update, also released on Tuesday, hit the maximum security peril rating of 10.

All five of the security vulnerabilities resolved by in the latest Java update might lend themselves to remote exploitation. The critical patch update released on Tuesday includes all fixes provided in an emergency update for Oracle Java SE published at the start of February plus an additional five fixes. Oracle has scheduled its next Java SE (Java Platform, Standard Edition) critical patch update for 16 April. Java 7 Update 13 and earlier as well as Java 6 Update 39 and earlier need updating. ®

* Apple maintains Java 6 for the Mac, Java 7 is maintained directly by Oracle and Mac users need to go to Oracle to install Java 7, as explained in a blog post by Wolfgang Kandek, CTO at Qualys, here.

Remote control for virtualized desktops

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.