A new piece of malware uses the same flaw as the Mac Flashback malware but can infect both Macs and PCs. Can you...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
explain how this is possible? Does this sort of malware add fuel to the argument for disabling Java altogether?
One of the benefits touted by the Java language is "write once, run anywhere." Unfortunately, the same concept can apply just as easily to malware as to standard software. Malware typically exploits vulnerabilities in operating systems or applications. In Java's case, malware usually exploits a vulnerability in the Java Runtime Environment (JRE) and then the OS, not in the programming language. The JRE is responsible for sandboxing and enforcing security within Java. In this instance, an exploit targets JRE vulnerabilities, but the malicious code is still likely to be platform specific so that it can load additional malware or a rootkit on the system. From this point, the malware or rootkit normally takes over the system.
Disabling the Java Runtime Environment on users' desktops is a good idea if they do not need Java applications. This will limit users' ability to view specific website content, play games and other activities, but one of the core tenets of information security is that you don't install what you don't need. Applying this attitude toward enterprise security helps minimize a system's attack surface. If the JRE isn't installed, it can't be attacked. Enterprises might not be able to disable the JRE if it is required by mission-critical applications, but Java applets can still be disabled in Firefox. You can also use something like NoScript for Firefox to limit Java applets to trusted sites or limit browser use to IE when users access the JRE for mission-critical applications.
Ask the expert!
Have questions about enterprise information security threats for expert Nick Lewis? Send them via email today! (All questions are anonymous.)
Dig Deeper on Web Application Security
Related Q&A from Nick Lewis
When it comes to state-sponsored attacks infecting mobile devices, do users have any chance of tracing the attack? Expert Nick Lewis offers some ...continue reading
Microsoft won't patch certain ASLR bypass flaws, but enterprises still need to protect against them. Expert Nick Lewis explains the threat and how to...continue reading
Threat actors in China are using VPN services to hide and anonymize their attacks. Expert Nick Lewis explains how to get a handle on these ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.