'Unprecedented wave' of Java exploits hits users, says Microsoft
Java makes a tempting target, adds Symantec
Computerworld - Microsoft said Monday that an "unprecedented wave" of attacks are exploiting vulnerabilities in Oracle's Java software.
According to a manager at Microsoft's Malware Protection Center (MMPC), attempts to exploit Java bugs have skyrocketed in the past nine months, climbing from less than half a million in the first quarter of 2010 to more than 6 million in the third quarter.
"Some of our exploit 'malware' families were telling a scary story ... an unprecedented wave of Java exploitation," said Holly Stewart, a senior program manager at the MMPC, in a post to the team's blog Monday.
Stewart went on to call the jump in Java attacks "scary" and added, "The spike in exploitation was surprising to say the least."
Stewart noted that the bulk of the attacks in the quarter that ended Sept. 30 were exploiting just three Java vulnerabilities, all of which had been patched months or even years ago.
More than 3.5 million of the more than 6 million attacks, for instance, tried to exploit a Java Runtime Environment (JRE) flaw that was patched in December 2008. More than 2.6 million additional attacks targeted a stack-based buffer overflow in Java and JRE in December 2009.
Stewart had a theory why the massive increase in attacks went unnoticed, basing it on what she claimed was "Java blindness" on the part of vendors that produce and sell intrusion-detection and -prevention software, which is designed to sniff out and stop exploits before they reach a company's computers.
"IDS/IPS vendors ... have challenges with parsing Java code," Stewart alleged. "Think about incorporating a Java interpreter into an IPS engine. ... [T]he performance impact on a network IPS could be crippling. [So] the people that we expect to notice increases in exploitation might have a hard time seeing this. Call it Java-blindness."
It makes sense for attackers to work up exploits against Java vulnerabilities, said Marc Fossi, the director of Symantec's security response team. "Since Java is both cross-browser and cross-platform, it can be appealing to attackers," he said via instant message, referring to Java's use by every major browser, and on Windows, Mac OS and Linux.
Others offered their own theories about why Java exploits have boomed.
Last month, security blogger Brian Krebs reported that "Crimepack," one of the many multistrike attack kits hackers use to plant their malware on vulnerable computers, was extremely successful in exploiting a Java flaw patched last April.
According to Crimepack exploit statistics that Krebs found online, 67% of the successful attacks logged by one hacker gang exploited the Java vulnerability.
Attackers using kits like Crimepack typically fire exploits against older vulnerabilities first, explained Symantec's Fossi. "Attack kits tend to include a pretty wide array of exploits targeting the browser, browser plug-ins and other client-side apps," he said. "They typically attempt to exploit older vulnerabilities first. That way the newer exploits aren't seen as much."
Microsoft's Stewart urged users to update Java by applying all available patches. Last Tuesday, Oracle issued a massive 85-patch update that included 29 fixes for Java alone.
Krebs has long offered up stronger advice, telling users to uninstall Java or to at the very least use update tools like Secunia's Personal Software Inspector to automatically install Java security updates.
Oracle did not respond to a request for comment on Microsoft's claims of spiking Java exploits.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
- Microsoft launches toolset for capturing 'ambient intelligence'
- Microsoft kicks off sales of lower-priced Office subscription in bid for iPad dollars
- At Build, mobility gets a boost with universal Windows apps
- Microsoft gets strategic with its Enterprise Mobility Suite
- Microsoft sketches out final Windows XP security updates for next week
- Microsoft teases touch-first Office for Windows
- Cortana's voice is synthesized in part from an AI character in Halo
- Hell freezes over: Microsoft makes Windows free for some devices
- Windows Phone 8.1 confirmed, with Cortana digital assistant
- Ex-Microsoft employee pleads guilty to trade secret theft
Read more about Application Security in Computerworld's Application Security Topic Center.
- Gartner Magic Quadrant for Client Management Tools The client management tool market is maturing and evolving to adapt to consumerization, desktop virtualization, and an ongoing need to improve efficiency.
- Audit Ready and Asset Optimized: The Solid Promise of an Intelligent Software Asset Management Solution In this paper Frost & Sullivan examines the benefits of enterprise-grade Software Asset Management solutions, and how these solutions serve as the convergence...
- Gartner Magic Quadrant for Application Security The market for application security testing is changing rapidly. Technology trends, such as mobile applications, advanced Web applications and dynamic languages, are forcing...
- Five Steps to Achieve Success in your Application Security Program This white paper provides a general framework your organization can use to create or build upon an application security program. It includes guidelines...
- Cloud Knowledge Vault Learn how your organization can benefit from the scalability, flexibility, and performance that the cloud offers through the short videos and other resources...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users? All Application Security White Papers | Webcasts