Homeland Security - Keep Java Disabled in Browsers Despite Java Update

by: Hey338Too

Mon Jan 14, 2013 at 16:46:56 PM EST



Over the weekend Oracle, the company that distributes and maintains Java, released a patch to fix the Java vulnerability that was reported last week.  The update to Java is called "Java 7 (Update 11)".  Oracle's release statement for the update can be found here.


As of today, the Department of Homeland Security is still recommending that Java not be enabled in our browsers:


The U.S. Department of Homeland Security has reiterated its warning to Java users that the widely used Web plug-in still poses risks for Internet users, even after Oracle patched the software to prevent hackers from exploiting a zero-day vulnerability.

It comes as some security experts are warning that the new software -- Java 7 (Update 11), which was released on Sunday -- may not actually protect against hackers attempting to remotely execute code on user machines.



In a statement to CBS, a Java security expert at Security Explorations says:
Although Java 7 Update 11 released by Oracle yesterday addresses the 0-day attack spotted in the wild, there are still unpatched security vulnerabilities that affect the most recent version of the software. Just to mention the bug #50 we reported to Oracle on 25-Sep-2012.

The latest status on the Java issue from CERT can be found here.  It contains the warning:
Unless it is absolutely necessary to run Java in web browsers, disable it as described below, even after updating to 7u11. This will help mitigate other Java vulnerabilities that may be discovered in the future.

In my last diary on this subject, there were a lot of excellent suggestions relating to browsers and plug-ins which may help mitigate this kind of attack.  Firefox with the NoScript plugin and Chrome with the NotScript plugin were recommended.  Maybe the more technical among us can assist those with less technical knowledge in assessing which of these options may be best for them, and how to make sure they are browsing safely.

Regardless of the browser you are using now, your system is at risk whether you are on a Windows, Mac, or Linux computer and the Java Plug-in is enabled in that browser (or email client if it supports a Java Plug-in like Thunderbird).  Instructions on disabling Java can be found at this link.

Hey338Too :: Homeland Security - Keep Java Disabled in Browsers Despite Java Update
Tags: , , , , , , , , (All Tags)
Print Friendly View Send As Email

Many thanks to you, Jan, Bubba, and all the techies around here. (2.00 / 11)
I'm a complete Luddite using Win 7/IE. I uninstalled java over the weekend, confirmed my browser isn't using it at java.com, and I await further instructions from y'all.

"Do your little bit of good where you are; it is those little bits of good put together that overwhelm the world." ~ Desmond Tutu

Microsoft released their patch. (2.00 / 10)
The patch is to stop the remote code execution that would be possible if Java is not disabled.

The link is here: Microsoft Security Bulletin MS13-008 - Critical, Security Update for Internet Explorer (2799329)

DO NOT READ THAT BULLETIN, NURSE KELLEY ... YOUR HEAD WILL ASPLODE!!

But what you should do is run Windows Updates as soon as possible.

Do you know how to do that?

Words have meaning. Our words will reflect what is in our souls.


[ Parent ]
I'm scheduled for automatic updates. (2.00 / 9)
When I shut down at night I get a warning that lets me know updates will be installed first. If I don't see that tonight, I'll come grab the link. (Why ASAP if I uninstalled java? Is there still risk?)

"Do your little bit of good where you are; it is those little bits of good put together that overwhelm the world." ~ Desmond Tutu

[ Parent ]
This will make you sad. I know it makes me sad. (2.00 / 8)
Once knotheads know about an exploitable piece of code, they rush to their computers to write stuff to exploit it. So Microsoft engineers looked at how the Java security leak was going to compromise computers running Internet Explorer and closed that hole the best they could.

I saw the Java exploit pop up on a networked computer this morning on a computer that did not have the Java version that Oracle claims is the problem (version 7.n). The corporate anti-virus software I use caught it and quarantined it.

So it is there ... waiting.  

Words have meaning. Our words will reflect what is in our souls.


[ Parent ]
Ran updates, ran a scan. (2.00 / 7)
Thanks, Mom. :)

"Do your little bit of good where you are; it is those little bits of good put together that overwhelm the world." ~ Desmond Tutu

[ Parent ]
So the issue showed up on a patched system? (2.00 / 7)
Or did the issue show up on a computer not running Java at all?

[ Parent ]
not quite... (2.00 / 7)
Oracle claims the problem is with version 7 of java, but the problem is with 7 and previous versions.  It would be like Microsoft saying Windows 7 has a problem, but the problem exists also in Vista and XP.

[ Parent ]
And I was not clear on the version. (2.00 / 6)
I think they call it version 7 but it is actually 1.7 when you go digging around in the Java runtime in their control panel.


Words have meaning. Our words will reflect what is in our souls.


[ Parent ]
A system that was running a version of Java that Oracle (2.00 / 6)
swears is not affected: v1.6.


Words have meaning. Our words will reflect what is in our souls.


[ Parent ]
Lol (2.00 / 8)
I think I'll stick with you Jan.   Too much tech writing gives me a migraine.

[ Parent ]
good instructions for disabling (2.00 / 7)
here.

Java seems like such a mess, why not just get rid of it permanently? (2.00 / 7)


Good question! n/t (2.00 / 7)


"Do your little bit of good where you are; it is those little bits of good put together that overwhelm the world." ~ Desmond Tutu

[ Parent ]
My neighbor was all freaked out about this, (2.00 / 8)
so I went over to give her a hand. Turns out she doesn't have Java at all. Yet strangely she seems quite able to function.

[ Parent ]
Java and JavaScript are difference creatures... (2.00 / 8)
... (kind of like the difference between a clown and a clownfish) without going into the gory details, it makes sense that she can use the web without any problem without Java installed.

[ Parent ]
When I was checking my client's servers, I noticed that one of (2.00 / 6)
them did not have it at all. I scratched my head because Java had been required for a security program that I knew was on that computer. Turns out that at some point the vendor ditched the Java requirement and wrote their software using other tools.

I think that after this latest cluster&%$+, and the manpower wasted to protect from it, more software vendors will avoid using it.

Java provides some common routines for web sites that developers can tap into in order to avoid having to write their own code. So maybe your site needs a dancing bear ... and you can find something written in Java that provides that feature. The Java software is loaded and the bear dances.

One thing I noticed this morning after disabling Java was that some of the ads don't work. Fine with me!!

Words have meaning. Our words will reflect what is in our souls.


[ Parent ]
Is there an English version of this diary and comments? (2.00 / 9)
:)

"When Fascism comes to America, it will come wrapped in teh stupid and waving a gun" ~ Esteev on Wonkette

/cracking up....Hear! Hear! :) n/t (2.00 / 6)


Photobucket

[ Parent ]
Sure... (2.00 / 7)
... what browser are you using?

Also, are you using a Windows, Macintosh or Linux computer?


[ Parent ]
Laptop. Does that help? (2.00 / 4)


"When Fascism comes to America, it will come wrapped in teh stupid and waving a gun" ~ Esteev on Wonkette

[ Parent ]
Not a whole lot... (2.00 / 3)
... but if you look on the menu for your browser, you'll see an option which says "Help".  If you click on that you'll see a line that starts with the word "About".  If you select the "About" option, a box will pop up.  Somewhere on the box it should say "Internet Explorer", "FireFox", "Chrome", or something else.  What does that pop-up box say?

[ Parent ]
Heh - that was a (lame) joke. (2.00 / 2)
:)

"When Fascism comes to America, it will come wrapped in teh stupid and waving a gun" ~ Esteev on Wonkette

[ Parent ]
I was going to be snarky... (2.00 / 1)
... but I'm new here.  So now I can ask, "When was the last time you gave it a warm bath?  Did you pop out all of the keys so you could clean underneath them?"  ;-)

[ Parent ]
! (2.00 / 8)

h/t to Jez for accusing me of talking this way once.


[ Parent ]
EXACTLY!!! /guffaw n/t (2.00 / 7)


Photobucket

[ Parent ]
It was me!!! (2.00 / 5)
I accused you!!

Shake it like a Polaroid picture.

[ Parent ]
really!?!? wow. old age sucks. (2.00 / 5)
Ida sworn I was trying to explain something about retirement investing and Jez popped up with that comparison. Sorry!

[ Parent ]
Oh, well then (2.00 / 5)
maybe we both did it because mine was a while ago and it wasn't about retirement investing and Jan said the part where peppermint patty's head fell back made her laugh. TWO people used this on you bubba, TWO. What do you make of that??? :0

Shake it like a Polaroid picture.

[ Parent ]
Heh, (2.00 / 4)
did you enjoy it? ;)

Shake it like a Polaroid picture.

[ Parent ]
I found it, (2.00 / 4)
you were speaking in some kind of computer jargon. Gibberish I tell ya!

Shake it like a Polaroid picture.

[ Parent ]
+4 ^^^^^^^^^^^^^^^^ (2.00 / 5)
No, there isn't.  

Words have meaning. Our words will reflect what is in our souls.


[ Parent ]
I just removed Java from my system completely (1.62 / 8)
I'm sure I will end up coming across something that requires it...but, until I do...Meh.

I tried to follow the instructions to disable it, but, my 'version' of the 'Java Control Panel' differed from the one in the instructions and there was no easy box to click...Meh.

So I tried to update Java, only to be told that i had the most current update...Meh.

So I went to my control panel and uninstalled the 3 programs that were Java...Meh.

Hopefully all this will blow over by the time I need the program...if I ever need it...Meh.

Photobucket


Why do I feel this need to click "Meh"? (2.00 / 6)
Must. Not. Meh. Kysen.

Words have meaning. Our words will reflect what is in our souls.


[ Parent ]
/grin...the Meh's make me laugh.... (2.00 / 4)
sorta anticipated being Meh'd.

Is there a reason, though, to NOT do what I did? A full uninstall until things blow over?

Admittedly, the reason I did so was due to my temper...but, temper aside...was it such a bad thing to do?

Photobucket


[ Parent ]
No reason not to uninstall it. (2.00 / 3)
I have a strong suspicion that web sites using Java are going to be looking for alternatives when their customers stop visiting because of fears of crapware infestations.

I need Java for commercial banking applications.


Words have meaning. Our words will reflect what is in our souls.


[ Parent ]
Happy to meh K anytime for ya J! (2.00 / 4)
:~)


Just because they are posting on a progressive site doesn't make them progressives. - John Allen

[ Parent ]
I knew I could count on you!! /grin n/t (2.00 / 4)


Photobucket

[ Parent ]
Ahem. (1.80 / 5)


"When Fascism comes to America, it will come wrapped in teh stupid and waving a gun" ~ Esteev on Wonkette

[ Parent ]
Oops! Sorry about that Happy. (2.00 / 1)
Here ya go!

Just because they are posting on a progressive site doesn't make them progressives. - John Allen

[ Parent ]
Thanks, s! (2.00 / 5)
I need to build up a bit more mojo before I can get away with flaming the moderator.

Words have meaning. Our words will reflect what is in our souls.


[ Parent ]
I can take the flames.... (2.00 / 4)
I have on my flame-retardant skivvies.


(/wonders where people will point for the hover)

/grin

Photobucket


[ Parent ]
Heh. (2.00 / 4)
(/wonders where people will point for the hover)

Right at your batcrotch.

There.

I'm not afraid to admit it.

Come to me in my dreams, and then
By day I shall be well again!
For so the night will more than pay
The hopeless longing of the day.


[ Parent ]
Testing ... testing ... testing (2.00 / 3)





Words have meaning. Our words will reflect what is in our souls.


[ Parent ]
(do it) (2.00 / 3)
.:gollum:.

Just because they are posting on a progressive site doesn't make them progressives. - John Allen

[ Parent ]
Moderator? Kysen? (2.00 / 3)
Ohhhhh!!!

So thaaat's why he gets to wear Bruce Wayne's boxer briefs.  

Just because they are posting on a progressive site doesn't make them progressives. - John Allen


[ Parent ]
I had the same reaction. (2.00 / 3)
Instigator is more like it.

John Askren - "Never get into a pissing match with a skunk."

[ Parent ]
It doesn't have to be an either/or! : ) n/t (2.00 / 3)


Photobucket

[ Parent ]
Search




Advanced Search
Menu

Make a New Account

Username:

Password:



Forget your username or password?


Blog Roll
Angry Bear
Angry Black Lady
Balloon Juice
Black Kos
Booman Tribune
Charles P. Pierce
Crooks and Liars
Daily Kos
Five Thirty Eight
Huffington Post
Juan Cole
Maddow Blog
P.M. Carpenter
Political Wire
RumpRoast
Scholars & Rogues
Smartypants
Stonekettle Station
Talking Points Memo
The Field
Washington Monthly
Wonkette
Moose With Blogs
Atdleft
Barr
BorderJumpers
BTchakir
Canadian Gal
Charles Lemos
Cheryl Kopec
Curtis Walker
Douglas Watts
Hubie Stubert
Intrepid Liberal
ItStands
Janicket
JoeTrippi
John Allen
LibraryGrape
MichaelEvan
National Gadfly
Peter Jukes
Senate Guru
Zachary Karabell




Back to Top

Posting Guidelines  |  FAQ  |  Privacy Policy  |  Contact the Moose  |  Contact Congress
Powered by: SoapBlox