Shailesh Shrivastava email: s.shrivastava@mobilenapps.com
Java is once again under security threat because of a recent zero-day exploit, and people out there, including the Department of Homeland Security are shouting "Disable Java."
According to an advisory issued by the Department of Homeland Security, "a vulnerability in Java's Security Manager allows a Java applet to grant itself permission to execute arbitrary code. An attacker could use social engineering techniques to entice a user to visit a link to a website hosting a malicious Java applet. An attacker could also compromise a legitimate web site and upload a malicious Java applet (a 'drive-by download' attack)."
Any system using Oracle Java 7 (1.7, 1.7.0) including, Java Platform Standard Edition 7, Java SE Development Kit, Java SE Runtime Environment have become vulnerable because of the bug.
Any Web browser using the Java 7 plug-in is affected. The Java Deployment Toolkit plug-in and Java Web Start can also be used as attack vectors. Reports indicate this vulnerability is being actively exploited, and exploit code is publicly available, the department added in the advisory.
Talking about the zero-day exploit Kurt Baumgartner, a Kaspersky Lab expert posted on his blog: "There appears to be multiple ad networks redirecting to Blackhole sites, amplifying the mass exploitation problem. We have seen ads from legitimate sites, especially in the UK, Brazil, and Russia, redirecting to domains hosting the current Blackhole implementation delivering the Java 0day. These sites include weather sites, news sites, and of course, adult sites."
Baumgartner also listed down some of the files being directed to vulnerable systems.
Stretch.jar, Edit.jar, UTTER-OFFEND.JAR are among so many files which are being delivered to victim systems by the hackers.
According to a report from Mercury News, Oracle will release a fix on Jan 15 which will contain 86 new security vulnerability fixes. Oracle, which manages Java software, also asked the users of Java to update the software as soon as the fix is released.
For now, as a precautionary measure, the Department of Homeland Security and other experts have recommended users to disable Java from their Web browsers.
In case you are finding it difficult to disable Java from your browser you can refer to this guide.
Apple has already, in a swift move, disabled the Java 7 plug-in on its computers.
Apple has achieved this by updating its "Xprotect.plist" blacklist to require a minimum of an as-yet unreleased 1.7.0_10-b19 version of Java 7. With the current publicly-available version of Java 7 being 1.7.0_10-b18, all systems running Java 7 are failing to pass the check initiated through the anti-malware system built into OS X, Mac Rumors reported.
more stories from News
Discover the key features and security enhancements of Apple's iOS 17.5 update.
ernest hamiltonDiscover top iPhone apps that let you earn real money by playing games, scanning receipts, and staying active.
ernest hamiltonSamsung has reached a remarkable milestone, shipping nearly 3 billion smartphones since 2014. Discover how the tech giant's decade-long dominance and innovative advancements have solidified its leadership in the global smartphone market.
ernest hamiltonLearn about Apple's settlement in the class-action lawsuit over iPhone 7 audio issues, offering up to $349 compensation for eligible users. Dive into the details and implications of this landmark agreement.
ernest hamiltonThousands of Apple users experienced a major iMessage outage on Thursday evening, impacting communication across the U.S., Canada, and the U.K. Downdetector reported over 13,000 disruptions starting at 6 p.m. ET. Stay updated with the latest developments and potential fixes.
ernest hamiltonDelve into the complexities of managing screen time for children as parents navigate between practicality and idealism.
ernest hamiltonDiscover why the Pixel 7a outperforms the new Pixel 8a in this detailed comparison. Learn about the advantages in affordability, color options, and feature parity. Read now to make an informed choice!
ernest hamiltonDiscover the future of smartphone audio with Moondrop's MIAD 01. Explore its dual audio jacks and premium DACs in this in-depth review. Ready to elevate your music experience? Read now!
ernest hamilton