Oracle Java Has Doomed The World's Security

[Kwelwild]

By John Leyden • Get more from this author

Posted in Management, 26th March 2013 14:56 GMT

Java security vulnerabilities - exploited to hack Apple and Facebook this month - are rife across business computers worldwide, according to new research.

The overwhelming majority (94 per cent) of PCs and other endpoints running Java software and surveyed by Websense are vulnerable to at least one Java runtime exploit, according to the web security biz. And the exploitable bugs are not just zero-day holes and recently patched vulnerabilities that get all the publicity.

Three in four computers used to browse the web are using a Java Runtime Environment version that is more than six months out of date. More than 50 per cent of machines are two years behind.

Seizing control of systems by slamming malicious code through holes in Java's security layers is favoured by some state-sponsored hackers and plain old crooks alike, certainly in the last two or three years. For months now, users have been advised to disable Java in their web browsers for exactly this reason, a recommendation echoed in recent alerts from US government's Computer Emergency Readiness Team. Websites that require Java are now the exception not the rule.

Harmful code capitalising on Java holes has been commoditised and packaged up into readily available exploit kits - including Cool, Blackhole and Gong Da - allowing any miscreant with an internet connection to wield these weapons for his or her own nefarious purposes.

For those on a company intranet and anyone else who absolutely must use Java for a particular website, the best advice is to enable Java execution in one web browser and use it solely for that one site - and have another web browser with the Java runtime disabled for all other internet surfing.

Java 1.6 is officially at its end of life after the latest update, numbered 43. Oracle recommends that users migrate to JDK 7 in order to receive any further enhancements and security fixes.

The means that more than 77 per cent of users, based on requests from Websense's research, are using a Java engine that is essentially dead and will not be updated, patched or supported by Oracle.

Websense's stats come from its Java version detection technology added to its ThreatSeeker Network of cloud-based security technology. The figures incorporate real-time telemetry about which versions of Java are actively being used across tens of millions of endpoints, protect by Websense's technology. A blog post from Websense, featuring a pie-graph based on its figures, and additional security commentary, can be found here.

Sursa: Are you in charge of a lot of biz computers? Got Java on them? • The Register