Tech Alert: Update Java NOW
Aug. 31st, 2012 06:00 pm![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
lolmac posting in ![[community profile]](https://www.dreamwidth.org/img/silk/identity/community.png){kind=small}
bethinexileHow recently did you install an update to Java?
If your answer is "Last week" or "Last month" or "Huh? What's that?" or, in fact, anything other than "Yesterday" or "Today", go thou and update. Now. Then come back here and I'll tell you why, but seriously, DON'T WAIT.
http://www.java.com/en/download/inc/windows_upgrade_xpi.jsp
It usually comes as a file named 'jxpiinstall.exe'. The file will also offer to install the Ask toolbar: uncheck this and proceed.
After installation, go into your control panel and un-install any older versions of Java that might be lurking (Versions 6 or less). The patched version is Version 7 Update 7.
ETA: link to all downloads: http://java.com/en/download/manual.jsp -- the Mac update is about mid-page.
So. Why?
Late Sunday night, a 'zero-day exploit' was discovered 'in the wild', using two vulnerabilities in the current version of Java. By late Monday, the exploit had been incorporated into the kits used by malware developers.
- - - - -
Department of Very Basic Geekspeak Translation for Non-Geeks:
Java: a software platform that runs a ton of software all over the friggin' place.
Zero-day exploit: evil code that is a problem RIGHT NOW, for which a defense has not yet been developed and released.
In the wild: It's already out there and can hit your computer.
- - - - -
Translated into English: in the first half of this week, the Bad Guys were handed the key to your computer. This specific hole allows successful infection of a fully patched computer running any standard security software. It doesn't even matter what browser you're using: it can slip through IE, Firefox, and Chrome. It works on Macs as well as PCs, and not even Ubuntu is safe -- the vulnerability is that pernicious. No patch existed to block the hole. And here's the rub: Oracle, the company responsible for issuing security patches, wasn't planning to do anything about it until October.
By Wednesday morning, the IT blogosphere was recommending that people uninstall Java from their computers, or shut it down in their browsers. The catch is that there's a metric buttload of Java out there, running many of the widgets that we use on the web. This kind of translated into "Stop doing anything online."
By Thursday morning, infected code had been found on over a hundred websites, and the IT blogosphere was howling for Oracle's blood -- especially since it was discovered that Oracle had been informed of the vulnerability in April.
Oracle released the patch on Thursday afternoon.
You haven't heard any of this? Well, Oracle hasn't been talking about it. They never said, "Yes, it's a problem, and we're working on it and we'll have your fix ASAP." They didn't say bupkis. They didn't even promote the patch when it was released.
So, if you haven't heard of it before this -- Congratulations! You are among about at least half a billion people who are still at risk, because a patch ain't worth spit until it's applied. Actually, by this point, I REALLY hope you're not at risk any more, because you did go update Java back at the beginning of this post, right? You're safe now?
This isn't entirely over -- you may hear me saying this all over again soon, since Java is the shiny new channel for the malware goons. I don't think they've discovered Tumblr or Pinterest or similar sites yet, but if they do -- well, how many sites can you think of where everyone happily clicks away on any and every link they see?
There's a bright spot: in my earlier posts, I've been a fervent advocate of running AdBlock in whatever browser you favour -- it's available for Chrome now as well as Firefox. (If you use Internet Explorer, except under duress, please schedule me for an intervention, stat.) Guess what? It's not a perfect protection against malware, but it's a damned good first step. Run an adblocker, use an anti-malware scan as well as an anti-virus, don't click on funny links in emails, talk to an IT person when you seen weird stuff going on, and you've already lowered your chances of getting hit by an impressive amount.
And now, go update Java if you haven't yet. Please?
ETA2: the same group that originally identified the vulnerabilities in Java and told Oracle about them has analyzed the patch. They report that there are still holes, although they're different holes from the ones that are already being used by the Bad Guys. This means that the Bad Guys will find them, sooner or later (probably sooner). More patching will be needed.
In the interim: the safest thing is, well, never to go online. Next safest: uninstall or disable Java. Next safest: stay fully patched, use an adblocker, run regular anti-malware scans, don't click on weird links in email.
For advanced students: one approach is to bifurcate your browsing. If there's a site that you MUST use that requires Java, run that site in one browser -- Chrome, say, or even IE -- and do the rest of your browsing in another browser, such as Firefox. Turn off Java in that browser. This was the approach I had everyone use at work this week, since our daily operations REQUIRED use of a professional website that ran almost entirely on Java.
Revision: see ETA4. There's now a patched version of Java 6.
It's been pointed out (and not just here) that the exploit only works in the most recent version of Java. Can't we just roll back to an older version, or stick with an older version if you haven't updated? Unfortunately, no, not really. The older version has a different set of security holes: that's why the new version came out. If you roll back, you've locked the front door and unlocked the back patio.
On the one hand: this is the newest, most fashionable vector, bringing you the latest in custom tailored malware. This is where the crooks are focusing their efforts. So if you don't update, you're vulnerable to the older threats; if you do update, you may be vulnerable to the newer ones, as they're developed. Personally, I'm staying updated.
ETA3: Thanks to![[livejournal.com profile]](https://www.dreamwidth.org/img/external/lj-userinfo.gif)
dbskyler, here's an outstanding article on the Mac situation, including a good description of bifurcated browsing.
ETA4: Oracle has released a patched version of Java 6: it's Version 6 Update 35, and you can find it here. This may be the best interim solution. Unfortunately, it isn't available for the Mac. If you want to go that route, uninstall Java 7, reboot, and then install 6.35.
Be safe, everyone.
If your answer is "Last week" or "Last month" or "Huh? What's that?" or, in fact, anything other than "Yesterday" or "Today", go thou and update. Now. Then come back here and I'll tell you why, but seriously, DON'T WAIT.
http://www.java.com/en/download/inc/windows_upgrade_xpi.jsp
It usually comes as a file named 'jxpiinstall.exe'. The file will also offer to install the Ask toolbar: uncheck this and proceed.
After installation, go into your control panel and un-install any older versions of Java that might be lurking (Versions 6 or less). The patched version is Version 7 Update 7.
ETA: link to all downloads: http://java.com/en/download/manual.jsp -- the Mac update is about mid-page.
So. Why?
Late Sunday night, a 'zero-day exploit' was discovered 'in the wild', using two vulnerabilities in the current version of Java. By late Monday, the exploit had been incorporated into the kits used by malware developers.
- - - - -
Department of Very Basic Geekspeak Translation for Non-Geeks:
Java: a software platform that runs a ton of software all over the friggin' place.
Zero-day exploit: evil code that is a problem RIGHT NOW, for which a defense has not yet been developed and released.
In the wild: It's already out there and can hit your computer.
- - - - -
Translated into English: in the first half of this week, the Bad Guys were handed the key to your computer. This specific hole allows successful infection of a fully patched computer running any standard security software. It doesn't even matter what browser you're using: it can slip through IE, Firefox, and Chrome. It works on Macs as well as PCs, and not even Ubuntu is safe -- the vulnerability is that pernicious. No patch existed to block the hole. And here's the rub: Oracle, the company responsible for issuing security patches, wasn't planning to do anything about it until October.
By Wednesday morning, the IT blogosphere was recommending that people uninstall Java from their computers, or shut it down in their browsers. The catch is that there's a metric buttload of Java out there, running many of the widgets that we use on the web. This kind of translated into "Stop doing anything online."
By Thursday morning, infected code had been found on over a hundred websites, and the IT blogosphere was howling for Oracle's blood -- especially since it was discovered that Oracle had been informed of the vulnerability in April.
Oracle released the patch on Thursday afternoon.
You haven't heard any of this? Well, Oracle hasn't been talking about it. They never said, "Yes, it's a problem, and we're working on it and we'll have your fix ASAP." They didn't say bupkis. They didn't even promote the patch when it was released.
So, if you haven't heard of it before this -- Congratulations! You are among about at least half a billion people who are still at risk, because a patch ain't worth spit until it's applied. Actually, by this point, I REALLY hope you're not at risk any more, because you did go update Java back at the beginning of this post, right? You're safe now?
This isn't entirely over -- you may hear me saying this all over again soon, since Java is the shiny new channel for the malware goons. I don't think they've discovered Tumblr or Pinterest or similar sites yet, but if they do -- well, how many sites can you think of where everyone happily clicks away on any and every link they see?
There's a bright spot: in my earlier posts, I've been a fervent advocate of running AdBlock in whatever browser you favour -- it's available for Chrome now as well as Firefox. (If you use Internet Explorer, except under duress, please schedule me for an intervention, stat.) Guess what? It's not a perfect protection against malware, but it's a damned good first step. Run an adblocker, use an anti-malware scan as well as an anti-virus, don't click on funny links in emails, talk to an IT person when you seen weird stuff going on, and you've already lowered your chances of getting hit by an impressive amount.
And now, go update Java if you haven't yet. Please?
ETA2: the same group that originally identified the vulnerabilities in Java and told Oracle about them has analyzed the patch. They report that there are still holes, although they're different holes from the ones that are already being used by the Bad Guys. This means that the Bad Guys will find them, sooner or later (probably sooner). More patching will be needed.
In the interim: the safest thing is, well, never to go online. Next safest: uninstall or disable Java. Next safest: stay fully patched, use an adblocker, run regular anti-malware scans, don't click on weird links in email.
For advanced students: one approach is to bifurcate your browsing. If there's a site that you MUST use that requires Java, run that site in one browser -- Chrome, say, or even IE -- and do the rest of your browsing in another browser, such as Firefox. Turn off Java in that browser. This was the approach I had everyone use at work this week, since our daily operations REQUIRED use of a professional website that ran almost entirely on Java.
Revision: see ETA4. There's now a patched version of Java 6.
On the one hand: this is the newest, most fashionable vector, bringing you the latest in custom tailored malware. This is where the crooks are focusing their efforts. So if you don't update, you're vulnerable to the older threats; if you do update, you may be vulnerable to the newer ones, as they're developed. Personally, I'm staying updated.
ETA3: Thanks to
dbskyler, here's an outstanding article on the Mac situation, including a good description of bifurcated browsing.ETA4: Oracle has released a patched version of Java 6: it's Version 6 Update 35, and you can find it here. This may be the best interim solution. Unfortunately, it isn't available for the Mac. If you want to go that route, uninstall Java 7, reboot, and then install 6.35.
Be safe, everyone.
![[identity profile]](https://www.dreamwidth.org/img/silk/identity/openid.png){kind=small}
no subject
Date: 2012-08-31 10:55 pm (UTC)And also signal-boosted. Thanks!
no subject
Date: 2012-09-01 05:17 am (UTC)no subject
Date: 2012-08-31 11:04 pm (UTC)*toodles off to forward news to my family, because their resident geek is my dad and he hates Java / won't support it*
no subject
Date: 2012-09-01 05:17 am (UTC)no subject
Date: 2012-08-31 11:20 pm (UTC)no subject
Date: 2012-09-01 05:12 am (UTC)no subject
Date: 2012-09-01 12:07 am (UTC)The Java 7 patch link goes to a .exe file, which won't run on Macs.
Brute force Mac solution: DISABLE JAVA
1. Go to Applications > Utilities > Java Preferences
2. Under the General tab, uncheck the "On" ticky boxes.
New vulnerabilities found in latest Java update (http://reviews.cnet.com/8301-13727_7-57504640-263/new-vulnerabilities-found-in-latest-java-update/)
no subject
Date: 2012-09-01 05:32 am (UTC)no subject
Date: 2012-09-01 07:02 am (UTC)no subject
Date: 2012-09-01 01:00 am (UTC)no subject
Date: 2012-09-01 05:16 am (UTC)Or -- possibly -- since DW and LJ don't actually require the Java plug-in, it may never have been invoked on the netbook (especially if the netbook is relatively new, and you mostly use it to visit DW and LJ). In that case, it hasn't been installed yet, although it might yet make whiny noises and ask for it.
no subject
Date: 2012-09-01 02:29 pm (UTC)no subject
Date: 2012-09-01 02:34 pm (UTC)no subject
Date: 2012-09-01 03:11 pm (UTC)no subject
Date: 2012-09-01 01:10 am (UTC)no subject
Date: 2012-09-01 01:21 am (UTC)no subject
Date: 2012-09-01 04:07 am (UTC)http://java.com/en/download/manual.jsp
That's the general download page. The Mac download is the second main section. I've edited the post to include this.
no subject
Date: 2012-09-01 01:35 am (UTC)Oh, well - better late than never. Thank you!
no subject
Date: 2012-09-01 04:24 am (UTC)This particular exploit only targets the most recent version of Java, so computers running older versions were safe -- but there are other exploits aimed at the older versions, so the safety is pretty much illusory.
no subject
Date: 2012-09-01 02:19 pm (UTC)That pretty much sums up... well, everything to do with computers these days. *sigh*
no subject
Date: 2012-09-01 02:59 pm (UTC)It's not a bad approach -- there are, after all, over a billion campers in total, and several hundred million of them are incredibly clueless. I can't do anything to save most of them, but I can try to help my corner of the campground. If the rest of the campers are lion bait, well, it keeps the lions fed. (Cynicism on the hoof . . . )
no subject
Date: 2012-09-01 03:06 pm (UTC)*hee*
no subject
Date: 2012-09-01 03:13 pm (UTC)no subject
Date: 2012-09-01 03:14 pm (UTC)*shifty eyes*
no subject
Date: 2012-09-01 02:01 am (UTC)Also, I am away from home and using an iPad right now, so updating ... does this apply to mobile devices?
no subject
Date: 2012-09-01 04:43 am (UTC)The answer: Steve Jobs hated Java, and no iWidget will run it without some kind of unsanctioned workaround. The workarounds do exist, but this is one good reason not to do it.
I hope you have an anti-malware scanning app on your iWidget, though. That's another vector that's being targeted a lot by the malware goons.
Re the icon: you can actually blame
Friend at will if you like, and be very welcome! The
Beth
no subject
Date: 2012-09-01 02:28 am (UTC)http://www.macworld.com/article/1168358/java_security_threats_what_you_need_to_know.html
Obviously it's still a major concern that the flaw exists and is being exploited, but I thought I'd pass on a ray of hope for the slightly-behind-the-times people like me.
no subject
Date: 2012-09-01 05:28 am (UTC)The professional consensus is that, for PCs at least, it's riskier to run the older versions, which have their own vulnerabilities. Even if you have a Mac, there's room for concern: one of the more serious attacks earlier this year targeted Macs running Java, as mentioned in the article you linked. The very bright side is that, as detailed in that same article, the new generation of Macs have some very nice safeguards built in. So yay Apple!
no subject
Date: 2012-09-01 03:21 am (UTC)Middle Daughter (who has strenously resisted parental efforts to teach her about computer security vulnerablilities and best practices, because she and her little friends know allabout computers, unlike some of us fogeys who don't know a thing about navigating Facebook, so she doesn't need to heed our warnings, right?) has had her email hacked today. She wouldn't listen to me and do anything about it, so I just sent Beloved Husband in to put the fear of God (or at least hackers) in to her. Let's hope she'll listen to him.
*headdesk* *headdesk* *headdesk*
no subject
Date: 2012-09-01 05:30 am (UTC)Gaaah. One of the biggest issues in my professional life, at present, is dealing with the fallout from clients whose emails have been hacked . . . we're one of the subsequent targets, and it's part of our job to keep our compromised clients safe from fraud and theft.
no subject
Date: 2012-09-01 06:10 am (UTC)Knocking down my 2 TB drive and making it non-functional was its own consequence. She lost most of her music, which she'd uploaded to the drive, and then left the original CD's in a friend's truck, where her then-boyfriend stole them.
The only thing I lost and didn't have backed up was my TurboTax files, because I had hard copy instead, and didn't like the idea of my tax files sitting around where they could be easily hacked.
Paranoia is our friend!
no subject
Date: 2012-09-01 06:52 am (UTC)no subject
Date: 2012-09-01 07:14 am (UTC)But then she comes home crying because somebody hacked her VampireFreaks account and posted all kinds of lascivious stuff perving about various guys she knows, and her boyfriend saw it and had a major insecurity freakout.
You would think she would learn... eventually.
Unfortunately the highly unsuitable boyfriend (he's a red flag capitol, but she refuses to see that) calmed down, she changed the password - AND SHARED IT WITH THE HIGHLY UNSUITABLE BOYFRIEND - and the lesson was forgotten in favor of rejoicing because it was all fixed.
Parenting has taught me that you can model commonsense, discernment, and a heads-up attitude, but you can't actually force them to adopt it!
no subject
Date: 2012-09-01 07:33 am (UTC)One day, a decade from now, she'll say, "Mom, I was such a rotten teen. How did you ever put up with me?"
no subject
Date: 2012-09-01 07:47 am (UTC)After all, how could I know things if my taste in music and my fashion sense is so execrable. Clearly I stopped learning a long time ago.
Everybody has to be young and stupid sometime. Now is her time. She'll learn.
no subject
Date: 2012-09-01 01:50 pm (UTC)(I personally got my initial lesson in it while I was still in grade school. It sucked at the time, but it's actually been a source for plenty of high-quality lemonade.)
no subject
Date: 2012-09-01 07:51 pm (UTC)I used to travel as an unaccompanied minor as an 8 year old, traveling between parents from Philly Airport or JFK to Burlington. Later it was Amtrak, and on one memorable occasion, a Greyhound bus where we came in very late because there was an attempted rape while we were in transit, and witnesses needed to be interviewed by the police! My parents had to make sure that I understood the concept that most of humanity is well-meaning, that a subset is malevolent, and that you can't tell the difference by looking at a tender age. On one flight, the year I was 12, there was a man in his sixties who was clearly grooming me for asking my parents to spend time with him, probably with pedophilia in mind, right there sitting across from me and next to his wife. I found his interest creepy, and wouldn't tell them anything about myself, except that my father would be meeting me as soon as we landed.
It drives me nuts to take my kids into New York City, because they don't understand my "paranoia" they don't understand caution the way I do, and don't see my strictures as reasonable.
Still, I and mine have received some remarkable kindness from strangers. Beloved Husband, in particular, has a knack for wandering (out of ignorance) into Very Bad Corners of cities where Very White Suburban Guys are distinctly unwelcome, and getting plenty of well intentioned help and advice in finding directions back to where he was trying to go. People just seem to like him on sight in some strange and magical way. The good outweighs the bad in the end. It just makes sense to keep a sharp eye out for those rocks and shoals. It saves a whole lot of aggravation.
no subject
Date: 2012-09-01 01:43 pm (UTC)no subject
Date: 2012-09-01 04:55 am (UTC)no subject
Date: 2012-09-01 05:30 am (UTC)no subject
Date: 2012-09-01 07:26 am (UTC)no subject
Date: 2012-09-01 01:51 pm (UTC)no subject
Date: 2012-09-01 04:44 pm (UTC)Thanks for the camel.
Java Update
Date: 2012-09-04 12:08 am (UTC)Re: Java Update
Date: 2012-09-04 01:38 am (UTC)Re: Java Update
Date: 2012-09-07 02:20 pm (UTC)no subject
Date: 2012-09-05 06:26 am (UTC)Me uninstalled Java entirely and no put new Java on. Me okay, right? Me just wait until safe again?
Java not so grate akshully
Date: 2012-09-05 12:44 pm (UTC)Install again if you find you need it. Maybe you won't.
Re: Java not so grate akshully
Date: 2012-09-05 07:47 pm (UTC)