Experts prod Oracle to fix broken Java security
Take a mulligan, redesign Java, urges one
Computerworld - Beset by some very public vulnerabilities in Java, and apparently unable to properly patch those bugs, Oracle must dramatically step up its security game, experts said Monday.
"Oracle should just take a mulligan and redesign Java before everyone completely loses faith in it, and those concerns leak over onto every Oracle product," said Andrew Storms, director of security operations at nCircle Security, in an email.
Storms and others were reacting to the latest "zero-day" vulnerability in Java's browser plug-in, a flaw spotted two weeks ago being exploited by several crimeware kits. Oracle patched the bug on Jan. 13, but researchers quickly pointed out that the patch itself was flawed.
Even after Oracle patched the vulnerability, the U.S. Computer Emergency Readiness Team (US-CERT), part of the U.S. Department of Homeland Security, took the highly unusual step of continuing to urge users to disable Java in their browsers, citing "the number and severity of this and prior Java vulnerabilities" as its reason.
In email interviews, several experts offered explanations for Oracle's inability to properly patch the latest vulnerability, and urged the company to adopt more rigorous development practices, much as did Microsoft almost a decade ago.
Adam Gowdiak, founder and CEO of Security Explorations, has reported dozens of Java vulnerabilities to Oracle. He was the first to assert that the company's emergency update of Jan. 13 introduced two new bugs, and has claimed Oracle should have patched the latest publicly-exploited vulnerability when it addressed an August 2012 flaw in the same section of Java's code.
Today Gowdiak argued that Oracle has been guilty of sloppy work, then cited other failings. "The incidents related to zero-day Java attack code exploiting security issues already known to Oracle show that the company's three-times-a-year Java patch release cycle does not really protect the security and privacy of Java users," Gowdiak said.
Storms chimed in with some harsh criticism, as well.
"Obviously, there's something broken in the Java development or design cycles," Storms said. "Oracle needs to wake up and learn secure software development. [But] that's probably a pipe-dream [because] as usual Oracle seems to be aloof and uninterested in the plight of their customers."
HD Moore, the chief security officer at Rapid7 and the creator of Metasploit, an open-source penetration testing toolkit used by both legitimate and criminal hackers, was willing to cut Oracle some slack on last week's flawed update.
"We have to keep in mind that it was released under duress and did help with the immediate problem of consumers being compromised," said Moore of Oracle's rapid turn-around. He also assumed Oracle engineers are continuing to work the problem for a higher-quality update. "But given its complexity, and requirements with backward compatibility, it may be a while before this class of flaws is finally put to rest," Moore added.
All three experts called on Oracle to adopt a Microsoft-esque approach, where security is an integral part of the development process.
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- 2013 Cyber Risk Report The "Cyber risk report 2013 Executive summary" presents the major findings of HP Security Research's comprehensive dive into today's cyber vulnerability and threat...
- Why You Need a Next-Generation Firewall This white paper explores the reasons for implementing next-generation (NG) firewalls and lays out a path to success for overburdened IT organizations.
- Acxiom Case Study This case study, which focuses on Acxiom, explores how the company was able to secure employee data, reduce migration costs and boost productivity...
- Windows® XP Migration: Protect and Secure Critical Data With the end of the Microsoft Windows XP operating system's lifecycle on April 8, 2014, businesses are faced with the decision to migrate...
- Top 4 Digital Signage Fails Join RMG Networks for a look at four of the most common reasons digital signage fails in corporate businesses. Learn about strategies to...
- Building Tomorrow's Infrastructure Listen to this podcast to discover how Crider Foods worked with PC Connection to update their IT infrastructure, while maintaining compliance and control. All Malware and Vulnerabilities White Papers | Webcasts