'Unprecedented wave' of Java exploits hits users, says Microsoft
Java makes a tempting target, adds Symantec
Computerworld - Microsoft said Monday that an "unprecedented wave" of attacks are exploiting vulnerabilities in Oracle's Java software.
According to a manager at Microsoft's Malware Protection Center (MMPC), attempts to exploit Java bugs have skyrocketed in the past nine months, climbing from less than half a million in the first quarter of 2010 to more than 6 million in the third quarter.
"Some of our exploit 'malware' families were telling a scary story ... an unprecedented wave of Java exploitation," said Holly Stewart, a senior program manager at the MMPC, in a post to the team's blog Monday.
Stewart went on to call the jump in Java attacks "scary" and added, "The spike in exploitation was surprising to say the least."
Stewart noted that the bulk of the attacks in the quarter that ended Sept. 30 were exploiting just three Java vulnerabilities, all of which had been patched months or even years ago.
More than 3.5 million of the more than 6 million attacks, for instance, tried to exploit a Java Runtime Environment (JRE) flaw that was patched in December 2008. More than 2.6 million additional attacks targeted a stack-based buffer overflow in Java and JRE in December 2009.
Stewart had a theory why the massive increase in attacks went unnoticed, basing it on what she claimed was "Java blindness" on the part of vendors that produce and sell intrusion-detection and -prevention software, which is designed to sniff out and stop exploits before they reach a company's computers.
"IDS/IPS vendors ... have challenges with parsing Java code," Stewart alleged. "Think about incorporating a Java interpreter into an IPS engine. ... [T]he performance impact on a network IPS could be crippling. [So] the people that we expect to notice increases in exploitation might have a hard time seeing this. Call it Java-blindness."
It makes sense for attackers to work up exploits against Java vulnerabilities, said Marc Fossi, the director of Symantec's security response team. "Since Java is both cross-browser and cross-platform, it can be appealing to attackers," he said via instant message, referring to Java's use by every major browser, and on Windows, Mac OS and Linux.
Others offered their own theories about why Java exploits have boomed.
Last month, security blogger Brian Krebs reported that "Crimepack," one of the many multistrike attack kits hackers use to plant their malware on vulnerable computers, was extremely successful in exploiting a Java flaw patched last April.
According to Crimepack exploit statistics that Krebs found online, 67% of the successful attacks logged by one hacker gang exploited the Java vulnerability.
Attackers using kits like Crimepack typically fire exploits against older vulnerabilities first, explained Symantec's Fossi. "Attack kits tend to include a pretty wide array of exploits targeting the browser, browser plug-ins and other client-side apps," he said. "They typically attempt to exploit older vulnerabilities first. That way the newer exploits aren't seen as much."
Microsoft's Stewart urged users to update Java by applying all available patches. Last Tuesday, Oracle issued a massive 85-patch update that included 29 fixes for Java alone.
Krebs has long offered up stronger advice, telling users to uninstall Java or to at the very least use update tools like Secunia's Personal Software Inspector to automatically install Java security updates.
Oracle did not respond to a request for comment on Microsoft's claims of spiking Java exploits.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
- How Microsoft's CEO sees growth for Windows Phone and Lumia
- Microsoft wants you to forget Windows 8
- Microsoft again writes off Surface inventory, renews profitability doubts
- 'Nadella Effect' makes Ballmer $2.8B richer
- Microsoft reveals bankruptcy of devices strategy by dumping Nokia feature phones
- Microsoft may drag out layoffs for a year
- Surface survives Microsoft cuts, but tablet strategy remains muddled
- As it lays off workers, Microsoft also kills its low-end Nokia X smartphones
- How Microsoft announces layoffs will show the company's PR IQ
- Why Microsoft isn't spooked by the Apple-IBM alliance
Read more about Application Security in Computerworld's Application Security Topic Center.
- Security, Privacy and Trust in Email Management This white paper discusses a SaaS-based email management solution that delivers the security, continuity and archiving capabilities your organization demands.
- Unifying Secuirty Operations Agile enterprises know that the way to quickly identify and react to threats to the business is to break down operational siloes by...
- Is Your Credit Card Data Safe from Hacks? News of recent credit card hacks has rocked consumer confidence. Even talk of a security breach can bring on a PR firestorm. What...
- Big Data, Big Mess: Sound Risk Intelligence Through Complete Context This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope... All Application Security White Papers | Webcasts