Are you in charge of a lot of biz computers? Got Java on them?
Your ass is 94% hanging in the breeze, my friend
Posted in Management, 26th March 2013 14:56 GMT
Free whitepaper – Hands on with Hyper-V 3.0 and virtual machine movement
Java security vulnerabilities - exploited to hack Apple and Facebook this month - are rife across business computers worldwide, according to new research.
The overwhelming majority (94 per cent) of PCs and other endpoints running Java software and surveyed by Websense are vulnerable to at least one Java runtime exploit, according to the web security biz. And the exploitable bugs are not just zero-day holes and recently patched vulnerabilities that get all the publicity.
Three in four computers used to browse the web are using a Java Runtime Environment version that is more than six months out of date. More than 50 per cent of machines are two years behind.
Seizing control of systems by slamming malicious code through holes in Java's security layers is favoured by some state-sponsored hackers and plain old crooks alike, certainly in the last two or three years. For months now, users have been advised to disable Java in their web browsers for exactly this reason, a recommendation echoed in recent alerts from US government's Computer Emergency Readiness Team. Websites that require Java are now the exception not the rule.
Harmful code capitalising on Java holes has been commoditised and packaged up into readily available exploit kits - including Cool, Blackhole and Gong Da - allowing any miscreant with an internet connection to wield these weapons for his or her own nefarious purposes.
For those on a company intranet and anyone else who absolutely must use Java for a particular website, the best advice is to enable Java execution in one web browser and use it solely for that one site - and have another web browser with the Java runtime disabled for all other internet surfing.
Java 1.6 is officially at its end of life after the latest update, numbered 43. Oracle recommends that users migrate to JDK 7 in order to receive any further enhancements and security fixes.
The means that more than 77 per cent of users, based on requests from Websense's research, are using a Java engine that is essentially dead and will not be updated, patched or supported by Oracle.
Websense's stats come from its Java version detection technology added to its ThreatSeeker Network of cloud-based security technology. The figures incorporate real-time telemetry about which versions of Java are actively being used across tens of millions of endpoints, protect by Websense's technology. A blog post from Websense, featuring a pie-graph based on its figures, and additional security commentary, can be found here. ®
Free whitepaper – Hands on with Hyper-V 3.0 and virtual machine movement
COMMENTS
Upgrading from JRE 1.6
Yeah thanks Oracle, Just let me know when your E-Business suite actually supports either an up to date JRE, or even an up to date browser, and I'll get patched right up.
According to the devs, clients need to be using 6 series JRE and have to be on IE8, because neither the 7 series JRE or IE9+ are certified yet. That's one Java and 2 browsers behind the times for their flagship enterprise product. Either the devs are lying, or Oracle is being sanctimoniously 2 faced in their "you should just upgrade, problem solved" stance.
Srsly ORCL, please to fix? >.<
Re: Updates
And isn't the Java updater the one that also tries to spam you with things like the Ask toolbar and other crap that you don't want, but that it will merrily add if you just click-through rather than remembering to untick the various boxes first?
Of course it also will ask every damn time, rather than remembering that I've said no to the last dozen times it's asked me if I want to weigh down my browser with unwanted junk in the vain hope that I might suddenly want it this time.
Come on, just patch the holes, make it compatible and get it to work without all the nagging and backdoor installs, then we may keep up better.
It always amazes me when people manage to make their Java code reliant on a specific version of the runtime. You have to go out of your way - using classes in the sun.com hierarchy or coding in a home brewed version check - to fuck it up, but so many people do. It's down to the general incompetence of the typical developer frankly, and ironically Oracles's are some of the worst (SQL Developer, I'm looking at you).
Updates
It doesn't help that the updater is such an annoying little **** and seems to always have a new to apply. If I accidentally accept it, I'm then bombarded with UAC prompts at random intervals.
At some point (for me, years ago) people choose to be blind to the constant nagging and just ignore it.
Backwards compatibiliy
A lot of the reason machines and servers end up with old versions of Java is the lack of proper backwards compatibility. All to often there are programs that will only work with a particular version of one particular JVM. As someone who has to deal with this, i do get rather frustrated with Java. My arse is more backwards compatible than this.
The new Office Garage series:
