Shailesh Shrivastava email: s.shrivastava@mobilenapps.com
Java is once again under security threat because of a recent zero-day exploit, and people out there, including the Department of Homeland Security are shouting "Disable Java."
According to an advisory issued by the Department of Homeland Security, "a vulnerability in Java's Security Manager allows a Java applet to grant itself permission to execute arbitrary code. An attacker could use social engineering techniques to entice a user to visit a link to a website hosting a malicious Java applet. An attacker could also compromise a legitimate web site and upload a malicious Java applet (a 'drive-by download' attack)."
Any system using Oracle Java 7 (1.7, 1.7.0) including, Java Platform Standard Edition 7, Java SE Development Kit, Java SE Runtime Environment have become vulnerable because of the bug.
Any Web browser using the Java 7 plug-in is affected. The Java Deployment Toolkit plug-in and Java Web Start can also be used as attack vectors. Reports indicate this vulnerability is being actively exploited, and exploit code is publicly available, the department added in the advisory.
Talking about the zero-day exploit Kurt Baumgartner, a Kaspersky Lab expert posted on his blog: "There appears to be multiple ad networks redirecting to Blackhole sites, amplifying the mass exploitation problem. We have seen ads from legitimate sites, especially in the UK, Brazil, and Russia, redirecting to domains hosting the current Blackhole implementation delivering the Java 0day. These sites include weather sites, news sites, and of course, adult sites."
Baumgartner also listed down some of the files being directed to vulnerable systems.
Stretch.jar, Edit.jar, UTTER-OFFEND.JAR are among so many files which are being delivered to victim systems by the hackers.
According to a report from Mercury News, Oracle will release a fix on Jan 15 which will contain 86 new security vulnerability fixes. Oracle, which manages Java software, also asked the users of Java to update the software as soon as the fix is released.
For now, as a precautionary measure, the Department of Homeland Security and other experts have recommended users to disable Java from their Web browsers.
In case you are finding it difficult to disable Java from your browser you can refer to this guide.
Apple has already, in a swift move, disabled the Java 7 plug-in on its computers.
Apple has achieved this by updating its "Xprotect.plist" blacklist to require a minimum of an as-yet unreleased 1.7.0_10-b19 version of Java 7. With the current publicly-available version of Java 7 being 1.7.0_10-b18, all systems running Java 7 are failing to pass the check initiated through the anti-malware system built into OS X, Mac Rumors reported.
most read
more stories from News
Check out the latest from Glance! They're piloting their Android Lockscreen Platform in the US. Don't miss it!
ernest hamiltonExciting news! X plans to launch a Smart TV app for an immersive entertainment experience. Stay tuned!
ernest hamiltonT-Mobile unveils new 5G internet plans, promising enhanced home and travel connectivity for customers seeking high-speed internet on the go.
ernest hamiltonHuawei sets sights on global expansion with HarmonyOS, aiming to rival Android and iOS in the competitive mobile operating system market.
ernest hamiltonStay ahead with the latest updates! Apple rolls out third betas for iOS 17.5 and iPadOS 17.5, bringing exciting app ecosystem changes and new features.
ernest hamiltonBillie Eilish fans, get ready! The iconic singer will be performing live at the Fortnite Festival this week. Don't miss out!
ernest hamiltonMoondrop, known for audiophile gear, teases its inaugural smartphone, the MIAD 01, promising a unique blend of audio excellence and mobile technology.
ernest hamiltonAndroid 15 aims to streamline notification channels by hiding unused ones, enhancing user experience and decluttering notification settings.
ernest hamilton