Feeds

Apple FINALLY fills gaping Java hole that pwned its own devs

Zero-day vuln also downed Facebook staff and other Mac users

Choosing a cloud hosting partner with confidence

Apple has belatedly patched a security hole in the Java engine it ships with Mac OS X - the very hole exploited by hackers to infect Apple's own developers, their counterparts at Facebook and scores of other Mac-using companies.

The vulnerability allowed miscreants to execute malicious code outside of the limited and supposedly secure sandbox each downloaded Java applet runs in, in effect granting wider access to the underlying system. The escaped software has the same level of privileges as the logged-in user but often that's enough to compromise the box's security.

Attackers were able to use this hole to infiltrate and install malware on vulnerable Mac computers at Apple, Facebook and others. That's according to Apple insiders speaking to Reuters in an unprecedented admission of security weaknesses at the iPhone maker, which until the last year or so all but dismissed malware as a Windows-only problem.

Specifically, Facebook and Apple were pwned after their employees visited iPhoneDevSDK.com - a website popular with mobile developers that someone booby-trapped with code to exploit the unpatched Java security hole and install a load of spyware. Reuters reports that the hack attack against Twitter earlier this month has also been linked to the same Java zero-day vulnerability.

Twitter recently admitted it suffered a network security breach that exposed the login credentials of 250,000 early adopters of the social network, but it didn't say how it happened beyond advising everyone to turn off Java in their browser.

All indications are that the Java browser plugin was the gateway to victims' machines for whichever hacking group pulled off the attacks against Apple and Facebook. Their identity remains elusive.

Bloomberg is quoting sources who say it might be Eastern European hackers while Reuters' sources are more inclined to blame China. The motive of the attackers remains unclear.

Apple's Tuesday update aligns the version of Java it supplies with Oracle's latest patch*, which was formally released yesterday as scheduled after an emergency update earlier this month.

"[It's a] bit of a pity that the Fruity Ones didn't do this back at the beginning of February, when Oracle's emergency 'pre-Patch-Tuesday' update came out to fix the hole that Apple is only now closing off," notes Paul Ducklin of Sophos in a blog post.

The fact that Java security releases from Apple arrived weeks after Oracle's updates were a massive factor in the spread of the Flashback botnet last year. The malware infected over 500,000 Macs, forming a zombie network that included 274 bots traced back to Cupertino, California, home of Apple's HQ. This time around the window of Java vulnerability extended for less than three weeks instead of two months but the overall fallout from the delay in pushing out a patch quickly is arguably even more toxic.

Apple released a malware removal tool for Java alongside its Java security update on Tuesday. But to use the malware removal tool you have to install Java and this is perhaps not the best idea especially since the language has become a prime target for hacking attacks of late, as Sean Sullivan of security software firm F-Secure notes.

Meanwhile, three of the five components of Oracle's latest Java security update, also released on Tuesday, hit the maximum security peril rating of 10.

All five of the security vulnerabilities resolved by in the latest Java update might lend themselves to remote exploitation. The critical patch update released on Tuesday includes all fixes provided in an emergency update for Oracle Java SE published at the start of February plus an additional five fixes. Oracle has scheduled its next Java SE (Java Platform, Standard Edition) critical patch update for 16 April. Java 7 Update 13 and earlier as well as Java 6 Update 39 and earlier need updating. ®

* Apple maintains Java 6 for the Mac, Java 7 is maintained directly by Oracle and Mac users need to go to Oracle to install Java 7, as explained in a blog post by Wolfgang Kandek, CTO at Qualys, here.

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.