Feeds

Are you in charge of a lot of biz computers? Got Java on them?

Your ass is 94% hanging in the breeze, my friend

Providing a secure and efficient Helpdesk

Java security vulnerabilities - exploited to hack Apple and Facebook this month - are rife across business computers worldwide, according to new research.

The overwhelming majority (94 per cent) of PCs and other endpoints running Java software and surveyed by Websense are vulnerable to at least one Java runtime exploit, according to the web security biz. And the exploitable bugs are not just zero-day holes and recently patched vulnerabilities that get all the publicity.

Three in four computers used to browse the web are using a Java Runtime Environment version that is more than six months out of date. More than 50 per cent of machines are two years behind.

Seizing control of systems by slamming malicious code through holes in Java's security layers is favoured by some state-sponsored hackers and plain old crooks alike, certainly in the last two or three years. For months now, users have been advised to disable Java in their web browsers for exactly this reason, a recommendation echoed in recent alerts from US government's Computer Emergency Readiness Team. Websites that require Java are now the exception not the rule.

Harmful code capitalising on Java holes has been commoditised and packaged up into readily available exploit kits - including Cool, Blackhole and Gong Da - allowing any miscreant with an internet connection to wield these weapons for his or her own nefarious purposes.

For those on a company intranet and anyone else who absolutely must use Java for a particular website, the best advice is to enable Java execution in one web browser and use it solely for that one site - and have another web browser with the Java runtime disabled for all other internet surfing.

Java 1.6 is officially at its end of life after the latest update, numbered 43. Oracle recommends that users migrate to JDK 7 in order to receive any further enhancements and security fixes.

The means that more than 77 per cent of users, based on requests from Websense's research, are using a Java engine that is essentially dead and will not be updated, patched or supported by Oracle.

Websense's stats come from its Java version detection technology added to its ThreatSeeker Network of cloud-based security technology. The figures incorporate real-time telemetry about which versions of Java are actively being used across tens of millions of endpoints, protect by Websense's technology. A blog post from Websense, featuring a pie-graph based on its figures, and additional security commentary, can be found here. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.