Following
what Oracle called "a veritable media firestorm" about dangerous
vulnerabilities in its Java software, Richard wonders if he should
uninstall it
Oracle described "a veritable media firestorm" about dangerous vulnerabilities in its Java software. Photograph: www.alamy.com
Should I really remove Java from all my Windows 7 machines running MSE and Chrome?
Richard (via Twitter)
I think everyone should uninstall Java from all their PCs and Macs, and then think carefully about whether they need to add it back. If you are a typical home user, you can probably do without it. If you are a business user, you may not have a choice. Many companies have used the Java language to develop business applications that run on servers, and this "server-side" Java is safe. It's the "client-side" Java running via web browser plug-ins that is not safe.
Note that Java has nothing to do with JavaScript, which is another language used to develop websites and apps. JavaScript was originally developed by a different company (Netscape) under a different name (LiveScript). The name was changed for marketing reasons that disgraced both the companies involved, neither of which survived.
Java has been in the news this year because of some "zero day" vulnerabilities exploited by malware writers. (Zero day means there is no patch for the hole, so users cannot protect themselves by updating their software.) This also happened last August, and The Register published a story saying Disable Java NOW, users told, as 0-day exploit hits web.
In fact, Java became the main vehicle for malware attacks in the third quarter of 2010, when they increased 14-fold, according to Microsoft's Security Intelligence Report Volume 10 (PDF). Things got worse, and Kaspersky, a leading anti-virus company, dubbed 2012 The year of Java vulnerabilities. It said: "Java security holes were responsible for 50% of attacks. Windows components and Internet Explorer were only exploited in 3% of incidents." Yes, it's that bad.
I therefore regard Java as an unnecessary security risk, and I removed it from our home PCs years ago. There were a few things I could no longer run, such as KeepVid for downloading YouTube videos and some ASDL speed tests, so I had to find alternatives. I suggest you do the same. Living without Java is much less of a challenge than living without Adobe Flash.
All programs have bugs and may have security holes, so why the Draconian approach? Sorry to say, I don't have enough confidence in Oracle's ability to fix it. Oracle didn't write Java, just inherited it when it bought the failing Sun Microsystems, and according to The Register: "Metasploit founder HD Moore warned Oracle was still sitting on a backlog of Java flaws that will take up to two years to patch, even without the discovery of new flaws."
Oracle is good at selling high-priced products to large enterprises, but Java involves dealing with up to a billion non-paying consumers. In my view, Oracle's belated response to the recent "veritable media firestorm" does not make the right noises about protecting consumers. It seems more concerned with defending its profit-making server-side and embedded Java businesses.
So, start by disabling Java in all your browsers. In Internet Explorer 8, for example, select Tools and then Manage Add-ons, and in Google Chrome, type chrome://plugins in the address bar. Sophos's Naked Security blog has instructions for most popular browsers.
I also recommend uninstalling any other versions of Java that you can find via the Windows Control Panel. You may find three or four: in my experience, old versions of Java are not always removed. After that, run the free CCleaner program to clear out any bits left behind. (If you don't have CCleaner, download it from piriform.com, not some scam site or a Google ad.)
Next, go to the java.com website and click the link that says "Do I have Java?" The answer should be no.
If you are not sure you need Java, try running your PC for a few weeks to see if you can do without it. You will get a notification from any website that needs a Java browser plug-in. However, you must install it from java.com, because some malware pretends to be Java update 11.
Only install Java in a single web browser, and use this browser only for Java sites. For example, if you normally browse the web with IE or Chrome, install the Java plug-in in Firefox or Opera, or vice versa. Java is being attacked, and restricting it to one browser minimises the "attack surface".
Also, whenever you install or update Java, do it carefully. Oracle may try to install other software that you definitely do not want, such as the Ask toolbar. ZDNet's Ed Bott and Harvard Business School's Ben Edelman have analysed the problem in A close look at how Oracle installs deceptive software with Java updates. Don't get caught.
Apple stopped including Java by default in OS X 10.7 (Lion), and has just used its XProtect software to block current versions of Java until they were patched. In effect, it treated Java as malware. This protected customers, but not everyone was pleased. After MacWorld UK reported the story (Apple bans Java from Macs, businesses that rely on Java bereft), editor Karen Haslam quipped on Twitter: "Unfortunately we're one of the businesses affected... perhaps Apple doesn't want us to go to press!"
InfoWorld magazine complained that Apple's Java sabotage is bad IT business. Since Apple is a consumer electronics company, I don't expect it's too bothered about corporate IT.
(1) Always run the latest version of Java and make sure you install all the patches. At the moment, this may mean checking for updates every week, or even every day. You can do this with Secunia's Personal Software Inspector. (I wouldn't trust Java's built-in updater.)
(2) Run extra checks for malware using a different anti-virus product from the one you already have installed, especially if it's MSE (Microsoft Security Essentials). Two good free standalone checkers are Malwarebytes AntiMalware and Kaspersky Security Scan.
(3) Make daily backups, and keep a clone of your hard drive. PCs are cheap but data may be irreplaceable.
Richard (via Twitter)
I think everyone should uninstall Java from all their PCs and Macs, and then think carefully about whether they need to add it back. If you are a typical home user, you can probably do without it. If you are a business user, you may not have a choice. Many companies have used the Java language to develop business applications that run on servers, and this "server-side" Java is safe. It's the "client-side" Java running via web browser plug-ins that is not safe.
Note that Java has nothing to do with JavaScript, which is another language used to develop websites and apps. JavaScript was originally developed by a different company (Netscape) under a different name (LiveScript). The name was changed for marketing reasons that disgraced both the companies involved, neither of which survived.
Java has been in the news this year because of some "zero day" vulnerabilities exploited by malware writers. (Zero day means there is no patch for the hole, so users cannot protect themselves by updating their software.) This also happened last August, and The Register published a story saying Disable Java NOW, users told, as 0-day exploit hits web.
In fact, Java became the main vehicle for malware attacks in the third quarter of 2010, when they increased 14-fold, according to Microsoft's Security Intelligence Report Volume 10 (PDF). Things got worse, and Kaspersky, a leading anti-virus company, dubbed 2012 The year of Java vulnerabilities. It said: "Java security holes were responsible for 50% of attacks. Windows components and Internet Explorer were only exploited in 3% of incidents." Yes, it's that bad.
I therefore regard Java as an unnecessary security risk, and I removed it from our home PCs years ago. There were a few things I could no longer run, such as KeepVid for downloading YouTube videos and some ASDL speed tests, so I had to find alternatives. I suggest you do the same. Living without Java is much less of a challenge than living without Adobe Flash.
All programs have bugs and may have security holes, so why the Draconian approach? Sorry to say, I don't have enough confidence in Oracle's ability to fix it. Oracle didn't write Java, just inherited it when it bought the failing Sun Microsystems, and according to The Register: "Metasploit founder HD Moore warned Oracle was still sitting on a backlog of Java flaws that will take up to two years to patch, even without the discovery of new flaws."
Oracle is good at selling high-priced products to large enterprises, but Java involves dealing with up to a billion non-paying consumers. In my view, Oracle's belated response to the recent "veritable media firestorm" does not make the right noises about protecting consumers. It seems more concerned with defending its profit-making server-side and embedded Java businesses.
So, start by disabling Java in all your browsers. In Internet Explorer 8, for example, select Tools and then Manage Add-ons, and in Google Chrome, type chrome://plugins in the address bar. Sophos's Naked Security blog has instructions for most popular browsers.
I also recommend uninstalling any other versions of Java that you can find via the Windows Control Panel. You may find three or four: in my experience, old versions of Java are not always removed. After that, run the free CCleaner program to clear out any bits left behind. (If you don't have CCleaner, download it from piriform.com, not some scam site or a Google ad.)
Next, go to the java.com website and click the link that says "Do I have Java?" The answer should be no.
Re-installing Java
If you know you must have Java installed, you can now do a clean installation of the latest version, either Java 6 to Update 39, or Java 7 Update 13. Java 6 is on the way out and won't be updated again. Some companies have stuck with it, possibly because of Java 7's terrible security reputation, but it has most of the same vulnerabilities. Mac users must update to the Java 7 Update 13 for Mac OS X.If you are not sure you need Java, try running your PC for a few weeks to see if you can do without it. You will get a notification from any website that needs a Java browser plug-in. However, you must install it from java.com, because some malware pretends to be Java update 11.
Only install Java in a single web browser, and use this browser only for Java sites. For example, if you normally browse the web with IE or Chrome, install the Java plug-in in Firefox or Opera, or vice versa. Java is being attacked, and restricting it to one browser minimises the "attack surface".
Also, whenever you install or update Java, do it carefully. Oracle may try to install other software that you definitely do not want, such as the Ask toolbar. ZDNet's Ed Bott and Harvard Business School's Ben Edelman have analysed the problem in A close look at how Oracle installs deceptive software with Java updates. Don't get caught.
Java on Macs
Java is a cross-platform system, so the same vulnerabilities may be present on other operating systems besides Windows. Apple users have also suffered. In 2010, for example, there was a Mac OS X version of the Koobface worm. Last year's Mac Flashback Trojan led to more than 600,000 infected Macs being added to a botnet, including 274 in Apple's home town, Cupertino.Apple stopped including Java by default in OS X 10.7 (Lion), and has just used its XProtect software to block current versions of Java until they were patched. In effect, it treated Java as malware. This protected customers, but not everyone was pleased. After MacWorld UK reported the story (Apple bans Java from Macs, businesses that rely on Java bereft), editor Karen Haslam quipped on Twitter: "Unfortunately we're one of the businesses affected... perhaps Apple doesn't want us to go to press!"
InfoWorld magazine complained that Apple's Java sabotage is bad IT business. Since Apple is a consumer electronics company, I don't expect it's too bothered about corporate IT.
Extra precautions
I think everybody should be free to run whatever operating system and applications they like. However, you should be aware that running Java in the browser brings extra risk, and therefore you should take extra precautions.(1) Always run the latest version of Java and make sure you install all the patches. At the moment, this may mean checking for updates every week, or even every day. You can do this with Secunia's Personal Software Inspector. (I wouldn't trust Java's built-in updater.)
(2) Run extra checks for malware using a different anti-virus product from the one you already have installed, especially if it's MSE (Microsoft Security Essentials). Two good free standalone checkers are Malwarebytes AntiMalware and Kaspersky Security Scan.
(3) Make daily backups, and keep a clone of your hard drive. PCs are cheap but data may be irreplaceable.
0 commentaires:
Enregistrer un commentaire