Risk
4/18/2013
10:16 AM
50%
50%

Java 7 Malicious App Warning System Draws Criticism

Java runtime environment fails to verify that digital certificates used to sign "trusted" applications haven't been revoked.

This week's release of Java 7 update 21 adds a system meant to warn users away from allowing Java apps that haven't been signed with a digital certificate -- from a certificate authority -- to be allowed to execute. But the new Java 7 runtime environment warning system has been criticized on both usability and information security grounds.

On the user interface front, according to Oracle, the Java Control Panel now presents "additional information and [requires] confirmation before being allowed to run" any Java content or apps. That information includes warnings against executing suspect Java apps, although users will still be able to do so. Some warnings come in the form of a yellow triangle, indicating that an application "cannot be identified because the certificate is untrusted or expired," while a yellow shield and alert will caution when an app "is unsigned and/or the certificate is not valid" and thus should not be trusted.

Cue usability concerns. "Logo and shield. Triangle and shield. Shield alone. Triangle alone. Confused yet?" said Paul Ducklin, head of technology for Sophos in the Asia Pacific region, in a blog post. "You're forgiven if you are, because these dialogs end up asking the very questions that you might reasonably expect Java to answer."

That's because Java 7 doesn't know whether the digital certificates it's relying on are still valid, owing to it failing to use the Online Certificate Status Protocol (OCSP) to check the revocation status of a digital certificate, or at least reference some other type of certificate revocation list (CRL).

"Even the latest #Java [release] still does not check for CRL/OCSP. [It] does have some blacklist or something though ... #blah," said Jindrich Kubec, director of threat intelligence at antivirus vendor Avast, via Twitter.

[ Massive interest in current events + Java vulnerabilities = Good news for cyber scammers. See Malware Attackers Exploit Boston Marathon Bombing. ]

Oracle didn't immediately respond to an emailed request for detailed information about how the Java run-time environment assesses certificate validity, and how often this information gets updated.

But according to David Barroso, head of cybersecurity intelligence at London-based Telefonica Digital, the Java runtime environment relies on a blacklist for known-bad Java archive (.jar) files, which contain Java applets. "The blacklist is pretty useless and it only blocks some already known signed vulnerable .jars," he said via Twitter.

According to veteran Java bug-hunter Adam Gowdiak, CEO and founder of Poland-based Security Explorations, the updated Java 7 runtime environment's Java Control Panel changes also put users at risk by allowing them to execute untrusted code. "The only good thing is that users neglecting to update their Java software will be better protected -- unsigned and self-signed Java will not run on their systems," he said. "Users of [the] current Java version will be able to run unsigned and self-signed Java code."

Despite Oracle's Java Control Panel changes, many security experts continue to recommend that people avoid using Java, if possible, or else take suitable precautions. "Disable Java in the browser unless you have a specific business need to run it," said Ross Barrett, senior manager of security engineering at Rapid7, via email. "Ideally, only enable it in an alternate browser and restrict use of that browser to the sites where you need Java."

For anyone who continues to use the browser plug-in, meanwhile, beware exploits that target zero-day Java vulnerabilities. "With a browser plug-in ... as complex as Java -- such as Flash, for instance -- you should always assume that some attacker, somewhere, has at least one zero-day waiting for the right opportunity," said Barrett.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Cybersecurity's 'Broken' Hiring Process
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/11/2017
Ransomware Grabs Headlines but BEC May Be a Bigger Threat
Marc Wilczek, Digital Strategist & CIO Advisor,  10/12/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Search Cybersecuruty and you will get unicorn.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.