Recommended Posts

Critical Java zero-day bug is being ?massively exploited in the wild? (Updated)

Your fully patched installation of Java isn't safe.

A previously unknown and currently unpatched security hole in the latest version of the Java software framework is under attack online, according to security researchers and bloggers.

Attack code that exploits vulnerability in Java's browser plugin has been added to the Blackhole, Cool, Nuclear Pack, and Redkit exploit kits, according to the Malware Don't Need Coffee blog, prompting its author to say that the bug is being "massively exploited in the wild." Miscreants use these products to turn compromised websites into platforms for silently installing keyloggers and other types of malicious software on the computers of unsuspecting visitors. KrebsOnSecurity reporter Brian Krebs said the curators of both Blackhole and Nuclear Pack have taken to the underweb to boast of the addition to their wares. It's not yet clear how many websites have been outfitted with the exploits.

According to researchers at Alienvault Labs, the exploits work against fully patched installations of Java. Attack files are highly obfuscated and are most likely succeeding by bypassing security checks built in to the program. KrebsOnSecurity said the malware authors say the exploits work against all versions of Java 7.

Update: Analysis from antivirus provider Kaspersky Lab indicates the exploits are already deployed on a variety of websites.

"There appears to be multiple ad networks redirecting to Blackhole sites, amplifying the mass exploitation problem," Kaspersky Lab expert Kurt Baumgartner wrote. "We have seen ads from legitimate sites, especially in the UK, Brazil, and Russia, redirecting to domains hosting the current Blackhole implementation delivering the Java 0day. These sites include weather sites, news sites, and of course, adult sites."

People who don't use Java much should once again consider unplugging Java from their browser, while those who don't use it at all may want to uninstall it altogether. The release notes for Java 7 Update 10?the most recent version?say users can disable the program from the browser by accessing the Java Control Panel. KrebsOnSecurity has instructions here for other ways to do this.

Source: Ars Technica

Link to comment
https://www.neowin.net/forum/topic/1130294-critical-java-zero-day-bug-is-being/
Share on other sites

Whoa wait wait is this exploit accessible only over Java or also over Javascript? I'm a newb when it comes to these things but I have Java disabled in Firefox so I guess I'm fine^^

Java only.

JavaScript is different.

I got hit by this darn thing last night going to Houzz.com (a major house renovation site) and I have to have java due to work *grumbles* thanks work..... good thing I have an image of my system to restore from easily

went to the site screen went blank after a second then some pay up to the FBI because you are using copyright images crap that you can't get rid of without a ton of work

Honestly, i think malware writers have another 50 vulns figured out, and theyre just using 1 at a time and will always be ahead of the game, with java. Im so paranoid about it I only run my java apps in a VM lol(yes i know some malware can escape still).

Glad I. banished the jabba runtime enviornment to a single vm with Cisco cp. Wouldn't install it on a production machine

No idea why developers and companies like Cisco use this trash.

  • Like 2

Not only because a lot of people use but also because it's something that too many people never update.

Everytime I get a relatives PC to fix it has usually been blown wide open because of a Java exploit. It seems like it's just too easy to get into peoples systems through Java regardless of whether it's a zero day bug or not.

Not only because a lot of people use but also because it's something that too many people never update.

Everytime I get a relatives PC to fix it has usually been blown wide open because of a Java exploit. It seems like it's just too easy to get into peoples systems through Java regardless of whether it's a zero day bug or not.

All the more reason to kill it with fire, burn the remains, and shun anyone who says otherwise.

Not only because a lot of people use but also because it's something that too many people never update.

Everytime I get a relatives PC to fix it has usually been blown wide open because of a Java exploit. It seems like it's just too easy to get into peoples systems through Java regardless of whether it's a zero day bug or not.

This isn't always an option see cisco cp and sdm

Since Java and flash are so widely exploited but still required in the browser for various reasons (such as SDM and YouTube), the "click to play" feature in Chrome and Firefox adds a nice extra layer of protection. When enabled, you can selectively enable specific plugins (or all plugins) for any web page or website. That way you can still use plugins without worrying about them being exploited by any random, potentially malicious website.

To enable click to play in Chrome, go to Wrench->Settings->Show advanced settings...->Content settings..., check the "Click to play" box under the "Plugins" heading, and restart your browser.

To enable click to play in Firefox, open a new tab, type "about:config" in the address box, type "click_to_play" in the "Search:" filter, change the setting value to true, and restart your browser.

I got hit by this darn thing last night going to Houzz.com (a major house renovation site) and I have to have java due to work *grumbles* thanks work..... good thing I have an image of my system to restore from easily

went to the site screen went blank after a second then some pay up to the FBI because you are using copyright images crap that you can't get rid of without a ton of work

Sandboxie FTW.

I've been preaching the dangers of java for over a year.

December 16th 2011

Java! Uninstall It, Update it, or bend over and grab the ketchup!

http://www.neowin.ne...ab-the-ketchup/

A few months ago I went to a persons house to help them with something after my competitor removed malware from their machine. Not sure why they called me, after he worked on it (Probably because he doesn't do house calls and doesn't do any remote assistance). Anyway, as I was going through the machine I noticed that he not only left java on the machine after cleaning up the malware but left an out of date version. Effectively he left the door wide open that the malware came into to begin with. It would NOT surprise me, if he didn't know the dangers of java.

i guess this one has ended up being the final straw, I'm now seeing everywhere even major companies saying don't use java unless you absolutely have too. even Apple has blocked java 7 in OSX apparently

Unfortunately, there's allot of people that *must* use Java (for financial apps, for example), so uninstalling isn't really a solution. At all.

Oracle should put more assets to make Java more secure.

that's why I use this http://portableapps.com/apps/utilities/java_portable and http://portableapps.com/apps/utilities/java_portable_launcher
This topic is now closed to further replies.
  • Posts

    • A coalition of publishers sued OpenAI and Microsoft over scraping content without consent by Hamid Ganji Image via Depositphotos.com AI companies often rely on readily available internet content to train their chatbots and provide users with instant answers. This method of AI training is fast and relatively inexpensive, but using a website’s content without permission or compensation is not something publishers like to see, and this is exactly why Microsoft and OpenAI are now being sued. As reported by Bloomberg, a group of publishers that collectively own nearly 400 newspapers has filed a lawsuit against OpenAI and Microsoft. The coalition argues that the two companies scraped their content to build AI chatbots like ChatGPT and Copilot without paying any compensation. The complaint, filed in the U.S. District Court for the Southern District of New York, argues that while AI products have generated billions of dollars in market value using publishers’ work, none of that value has been shared with the publishers. The plaintiffs are seeking statutory damages and injunctive relief for alleged copyright infringement and violations of the Digital Millennium Copyright Act. “Defendants systematically and secretly crawled the Publishers’ websites—including content behind paywalls and other access restrictions—and copied the Publishers’ articles, stories, and other original works onto their own servers without authorization,” the complaint states. The publishers also described the AI boom as a “death knell for local journalism” if AI companies that scrape content for free are not held accountable. Former New Jersey Attorney General Matthew Platkin and his law firm, Platkin LLP, are representing the publishers. “Our models empower innovation, are trained on publicly available data, and are grounded in fair use,” OpenAI spokesperson Drew Pusateri told Bloomberg. This is not the first lawsuit involving the unauthorized use of publishers’ content by AI firms, but it is one of the largest coalitions ever formed against the free use of content by AI chatbots. In 2024, OpenAI and Microsoft also faced a similar lawsuit from eight newspapers that claimed AI products were benefiting from their content without permission.
    • Rufus alternative Ventoy now supports Windows 11's mandatory update, fixes major boot bug by Sayan Sen While Microsoft has its own official Media Creation Tool used for making bootable USB media, there are some popular third-party utilities as well which offer additional options like bypassing system requirements, Microsoft Account creation, and more. One of these is Ventoy, and the software has received its latest update today. In fact, the app actually got a slew of updates over the last couple of days, three version releases in total, to be specific. The first release, version 1.1.13, was pulled as there was some unspecified error in the update, and as such, the corrected version 1.1.14 was pushed out. Following that on very short notice, 1.1.15 was published as well. For those unfamiliar, Ventoy is an open-source utility that lets users create a bootable USB drive once and then simply copy ISO, WIM, IMG, VHD, or EFI files onto it without repeatedly formatting the drive. It supports both legacy BIOS and UEFI boot modes, Secure Boot, and a wide range of operating systems, making it one of the most versatile tools in the category. The biggest change in version 1.1.14 is an updated Secure Boot shim file aimed at resolving the UEFI CA 2023 issue, which is basically a compatibility problem that has affected Secure Boot environments on some systems. If you recall, we reported about severe boot issues on HP devices following the release of updated Secure Boot 2023 keys. For anyone who may not be aware, back in early 2024, Microsoft announced that it was updating Secure Boot keys as they were going to become 15 years old in 2026, which is also when they are set to expire. As such, the new 2023 certificates have been rolling out with the newest Windows 11 updates. Updated boot manager and Secure Boot certificates are crucial for protection against malware like bootkits. These are mandatory updates. Alongside that, the VentoyPlugson graphical plugin configurator was updated in sync with the release. The update also introduces a new VTOY_SECURE_BOOT_POLICY option within the Global Control plugin, giving users more flexibility in managing Secure Boot behavior. Ventoy has also received a fix for a startup issue when Secure Boot was disabled. Microsoft does officially allow users to boot systems without Secure Boot as long as the PC is Secure Boot capable. The full changelog is given below: Update secure boot shim file to solve the UEFI CA 2023 issue. The new release use a new CA, so you need to enroll the new key for the first boot time. VentoyPlugson update synchronously. Global control plugin add a VTOY_SECURE_BOOT_POLICY option. Fix the boot issue when Secure Boot is disabled in the UEFI firmware. You can download the latest version of the app here on Ventoy's official GitHub repo or from Neowin software stories.
    • Windows 11 is fine, no issues on any of the machines I've run it on since release. The stricter security requirements are a good thing, sometimes the baseline needs to change and people will winge, but it is what it is. Happened with the move from 9x to NT - broke compatability Happened with XP SP2 when security started to become a serious consideration Certainly happend with Vista that brought in UAC, the concept of not running as admin (something that has been the norm in Linux/Unix from pretty much the start) and a completely new driver stack. Windows 11 will probably get looked back at as the point where even consumer and SMB IT was dragged kicking and screaming into a somewhat secure by default configuration.
    • Bluestacks has been emulating Android on Windows for fifteen years. It's janky and riddled with ads though, so WSA looked like it was going to be a huge improvement over the emulator experience. Too bad Microsoft dropped the ball on that.
    • Classic. China would be nothing without Western, Japanese, and South Korean technology.
  • Recent Achievements

    • Rookie
      krychek57 went up a rank
      Rookie
    • Grand Master
      Jaybonaut went up a rank
      Grand Master
    • One Year In
      Philsl earned a badge
      One Year In
    • Dedicated
      Scoobystu earned a badge
      Dedicated
    • First Post
      Tom Schmidt earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      441
    2. 2
      +Edouard
      172
    3. 3
      PsYcHoKiLLa
      134
    4. 4
      Michael Scrip
      78
    5. 5
      Xenon
      77
  • Tell a friend

    Love Neowin? Tell a friend!