Feeds

Are you in charge of a lot of biz computers? Got Java on them?

Your ass is 94% hanging in the breeze, my friend

Secure remote control for conventional and virtual desktops

Java security vulnerabilities - exploited to hack Apple and Facebook this month - are rife across business computers worldwide, according to new research.

The overwhelming majority (94 per cent) of PCs and other endpoints running Java software and surveyed by Websense are vulnerable to at least one Java runtime exploit, according to the web security biz. And the exploitable bugs are not just zero-day holes and recently patched vulnerabilities that get all the publicity.

Three in four computers used to browse the web are using a Java Runtime Environment version that is more than six months out of date. More than 50 per cent of machines are two years behind.

Seizing control of systems by slamming malicious code through holes in Java's security layers is favoured by some state-sponsored hackers and plain old crooks alike, certainly in the last two or three years. For months now, users have been advised to disable Java in their web browsers for exactly this reason, a recommendation echoed in recent alerts from US government's Computer Emergency Readiness Team. Websites that require Java are now the exception not the rule.

Harmful code capitalising on Java holes has been commoditised and packaged up into readily available exploit kits - including Cool, Blackhole and Gong Da - allowing any miscreant with an internet connection to wield these weapons for his or her own nefarious purposes.

For those on a company intranet and anyone else who absolutely must use Java for a particular website, the best advice is to enable Java execution in one web browser and use it solely for that one site - and have another web browser with the Java runtime disabled for all other internet surfing.

Java 1.6 is officially at its end of life after the latest update, numbered 43. Oracle recommends that users migrate to JDK 7 in order to receive any further enhancements and security fixes.

The means that more than 77 per cent of users, based on requests from Websense's research, are using a Java engine that is essentially dead and will not be updated, patched or supported by Oracle.

Websense's stats come from its Java version detection technology added to its ThreatSeeker Network of cloud-based security technology. The figures incorporate real-time telemetry about which versions of Java are actively being used across tens of millions of endpoints, protect by Websense's technology. A blog post from Websense, featuring a pie-graph based on its figures, and additional security commentary, can be found here. ®

Remote control for virtualized desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.