Experts prod Oracle to fix broken Java security
Take a mulligan, redesign Java, urges one
Computerworld - Beset by some very public vulnerabilities in Java, and apparently unable to properly patch those bugs, Oracle must dramatically step up its security game, experts said Monday.
"Oracle should just take a mulligan and redesign Java before everyone completely loses faith in it, and those concerns leak over onto every Oracle product," said Andrew Storms, director of security operations at nCircle Security, in an email.
Storms and others were reacting to the latest "zero-day" vulnerability in Java's browser plug-in, a flaw spotted two weeks ago being exploited by several crimeware kits. Oracle patched the bug on Jan. 13, but researchers quickly pointed out that the patch itself was flawed.
Even after Oracle patched the vulnerability, the U.S. Computer Emergency Readiness Team (US-CERT), part of the U.S. Department of Homeland Security, took the highly unusual step of continuing to urge users to disable Java in their browsers, citing "the number and severity of this and prior Java vulnerabilities" as its reason.
In email interviews, several experts offered explanations for Oracle's inability to properly patch the latest vulnerability, and urged the company to adopt more rigorous development practices, much as did Microsoft almost a decade ago.
Adam Gowdiak, founder and CEO of Security Explorations, has reported dozens of Java vulnerabilities to Oracle. He was the first to assert that the company's emergency update of Jan. 13 introduced two new bugs, and has claimed Oracle should have patched the latest publicly-exploited vulnerability when it addressed an August 2012 flaw in the same section of Java's code.
Today Gowdiak argued that Oracle has been guilty of sloppy work, then cited other failings. "The incidents related to zero-day Java attack code exploiting security issues already known to Oracle show that the company's three-times-a-year Java patch release cycle does not really protect the security and privacy of Java users," Gowdiak said.
Storms chimed in with some harsh criticism, as well.
"Obviously, there's something broken in the Java development or design cycles," Storms said. "Oracle needs to wake up and learn secure software development. [But] that's probably a pipe-dream [because] as usual Oracle seems to be aloof and uninterested in the plight of their customers."
HD Moore, the chief security officer at Rapid7 and the creator of Metasploit, an open-source penetration testing toolkit used by both legitimate and criminal hackers, was willing to cut Oracle some slack on last week's flawed update.
"We have to keep in mind that it was released under duress and did help with the immediate problem of consumers being compromised," said Moore of Oracle's rapid turn-around. He also assumed Oracle engineers are continuing to work the problem for a higher-quality update. "But given its complexity, and requirements with backward compatibility, it may be a while before this class of flaws is finally put to rest," Moore added.
All three experts called on Oracle to adopt a Microsoft-esque approach, where security is an integral part of the development process.
- Single-Vendor Security Ecosystems Offer Concrete Benefits Over Point Solutions IT security decision-makers from companies with 100 to 5,000 employees evaluates the current endpoint security solution market based on Forrester's own market data,...
- Case Study: Intuit Turns to Self-Service IT Intuit empowered its users to resolve their own IT issues with a consumer-like experience to free IT to focus on more strategic initiatives....
- Automation for a Better Tomorrow Check out the five most common annoyances facing enterprise IT service desks today, and how automation can resolve all of them. Download the...
- Beyond the Enterprise App Store Leverage proactive, secure and automated IT Service delivery to move beyond the traditional App Store and empower your users. Read the white paper...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!