Java Homeland Security warning

Forums › Desktop computing › Java Homeland Security warning

tedzart

99 posts

Master Geek

#113306 13-Jan-2013 03:34

Quote:
The US Department of Homeland Security urged computer users to disable Oracle's Java software, amplifying security experts' prior warnings to hundreds of millions of consumers and businesses that use it to surf the web.

http://www.stuff.co.nz/technology/digital-living/8171464/Java-Homeland-Security-warning

1 | 2 | 3

229 posts

Master Geek

Lifetime subscriber

#743948 13-Jan-2013 06:47

I heard this in the car yesterday, in the news bulletin of some FM station - but calling it JavaScript instead of Java.

It's one of life's asymptotes. With each additional news outlet that repeats a story on Java or JavaScript, the probability that one language will be mistaken for the other approaches 1.

Backblaze

Backblaze Unlimited Backup. World’s easiest cloud backup. Get peace of mind knowing your files are backed up securely in the cloud (affiliate link).

tedzart

99 posts

Master Geek

#743950 13-Jan-2013 07:49

I had disabled this months ago due to security warnings relating to the issue.
However if anyone doesn't know how to deactivate the Plugin in Firefox, Chrome or Safari, then you will find
easy detailed instructions here:
http://techblog.avira.com/2013/01/11/yajze-yet-another-java-zero-day-exploit/en/

gzt

15199 posts

Uber Geek

Lifetime subscriber

#743977 13-Jan-2013 09:31

This is interesting: "Java was responsible for 50 per cent of all cyber attacks last year in which hackers broke into computers by exploiting software bugs, according [to the survey by] Kaspersky. That was followed by Adobe Reader, which was involved in 28 per cent of all incidents. Microsoft Windows and Internet Explorer were involved in about 3 per cent of incidents, according to the survey"

I cannot find the original source for that but it is surprising that Adobe Reader accounts for 28% of attacks. I avoid installing Adobe Reader on my system for many reasons. Mostly because is not just a reader but actually a whole suite of software when all I want and use is pure PDF functions.

Batman

Mad Scientist
29043 posts

Uber Geek

Trusted

Lifetime subscriber

#744011 13-Jan-2013 11:23

how do i do it for ie 9 / 10 ?

freitasm

BDFL - Memuneh
76355 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#744012 13-Jan-2013 11:26

Do you *REALLY* need Java installed on your PC? Do you have any software that uses it? If not, then just uninstall the whole thing, not only disable it.

I don't have Java in any of my Windows PCs and not in any of my servers. I haven't had it installed for years now.

Please support Geekzone by subscribing, or using one of our referral links: Dosh referral: 00001283 | Sharesies | Goodsync | Mighty Ape | Backblaze

freitasm on Keybase | My technology disclosure

Behodar

9246 posts

Uber Geek

Trusted

Lifetime subscriber

#744033 13-Jan-2013 12:13

I needed it twice yesterday, and couldn't use it because Apple's blocked it in an extremely poor way (automatically, with no option to re-enable it if you understand the risk). It's scary that Apple has the ability to block any software at will like that!

dontpanic42

1574 posts

Uber Geek

#744084 13-Jan-2013 15:08

freitasm: Do you *REALLY* need Java installed on your PC? Do you have any software that uses it?

Doesn't CrashPlan use/need it?

freitasm

BDFL - Memuneh
76355 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#744087 13-Jan-2013 15:52

dontpanic42:
freitasm: Do you *REALLY* need Java installed on your PC? Do you have any software that uses it?

Doesn't CrashPlan use/need it?

No, it doesn't. If CrashPlan needed Java I wouldn't use it. I don't install Java on my PCs and if a software needs Java then I look for an alternative.

I am of the "less is more" line of thought.

Please support Geekzone by subscribing, or using one of our referral links: Dosh referral: 00001283 | Sharesies | Goodsync | Mighty Ape | Backblaze

freitasm on Keybase | My technology disclosure

geocom

587 posts

Ultimate Geek

Subscriber

#744098 13-Jan-2013 16:32

Behodar: I needed it twice yesterday, and couldn't use it because Apple's blocked it in an extremely poor way (automatically, with no option to re-enable it if you understand the risk). It's scary that Apple has the ability to block any software at will like that!

Its part of gatekeeper if it is not signed it will not run. To run non signed java apps you will need to turn off gatekeeper. Not the best option but it will get things working again. Just wish they had done the same as unsigned mac apps where you can right click and option click open.

Geoff E

Behodar

9246 posts

Uber Geek

Trusted

Lifetime subscriber

#744099 13-Jan-2013 16:35

Nothing to do with Gatekeeper; I have GK disabled and Java still doesn't run.

geocom

587 posts

Ultimate Geek

Subscriber

#744116 13-Jan-2013 16:44

Behodar: Nothing to do with Gatekeeper; I have GK disabled and Java still doesn't run.

Always been an issue with gatekeeper for me I have one java app that is not signed and would only run with GK disabled and the Arduino IDE which is java works all the time.

It could be that Java is not installed as by default it was not installed. However if it is not when you open a java program it will ask if you want to install it, but it may only ask if the application is signed. The first Java app I open is usually the Arduino IDE

Geoff E

JamesL

956 posts

Ultimate Geek
Inactive user

#744134 13-Jan-2013 17:44

freitasm: Do you *REALLY* need Java installed on your PC? Do you have any software that uses it? If not, then just uninstall the whole thing, not only disable it.

I don't have Java in any of my Windows PCs and not in any of my servers. I haven't had it installed for years now.

Unfortunately the Citrix NetScaler interface requires Java, otherwise I wouldn't install java

I believe Citrix are slowly migrating the gui to html5 anyway which ended up breaking IE functionality

dontpanic42

1574 posts

Uber Geek

#744291 13-Jan-2013 22:11

Apparently some UK banks have a requirement for using Java for online banking, credit card verification etc.

Anyone know if there's any truth to this, and have any experience with it?

Reference:
https://twitter.com/oakinger/status/290380993158848512

Crap, I've just realised that I've uninstalled Java, and now I can't play Minecraft. (Not Sarcasm)

gzt

15199 posts

Uber Geek

Lifetime subscriber

#744297 13-Jan-2013 22:26

No idea. Might be a product of the Java misunderstanding. Java is not Javascript. Javascript is not Java.

Can't play minecraft lol. That kind of revelation will be spreading around the world at lightspeed ; ). Minecraft have a linux client so a Minecraft linux client VM is a good solution for that one.

Edit: On the other hand the Java exploit in the news requires a browser plugin. Disable the browser plugin for every browser on your system and even with Java installed on your system you are not vulnerable to that exploit.

alexx

856 posts

Ultimate Geek

#744607 14-Jan-2013 15:31

freitasm: Do you *REALLY* need Java installed on your PC? Do you have any software that uses it? If not, then just uninstall the whole thing, not only disable it.

On my home pc, OpenOffice/LibreOffice. If (like me) you have a webOS phone or Tablet, then mostly likely you have WebOS Quick Installer and if you brick your webOS device, then you need webOS Doctor to fix it. I believe the LibreOffice people are working on removing the Java dependency, but they aren't there yet. Some people use Eclipse for development and not just for Java development either. I don't have that one installed on my main home pc at the moment, but think I still might have it installed on another machine that my son used for his Uni work.

On my work pc I have too many to mention. Quite a lot of applications target multiple platforms and the developer doesn't want to write a different one for Windows, Linux, OSX, Solaris...

freitasm: not in any of my servers. I haven't had it installed for years now.

But you would have java if you had a server with something like an Oracle RDBMS or IBM WebSphere. In any case it would appear that the attack mechanism requires a browser, so perhaps the real question is, why even have a web browser on a server?

So the answer is yes, I *REALLY* need Java installed on my home pc. I also need it on my work pc and I work with servers with Oracle and WebSphere, so I need it there too.

#include <standard.disclaimer>

1 | 2 | 3