A new piece of malware uses the same flaw as the Mac Flashback malware but can infect both Macs and PCs. Can you...
explain how this is possible? Does this sort of malware add fuel to the argument for disabling Java altogether?
One of the benefits touted by the Java language is "write once, run anywhere." Unfortunately, the same concept can apply just as easily to malware as to standard software. Malware typically exploits vulnerabilities in operating systems or applications. In Java's case, malware usually exploits a vulnerability in the Java Runtime Environment (JRE) and then the OS, not in the programming language. The JRE is responsible for sandboxing and enforcing security within Java. In this instance, an exploit targets JRE vulnerabilities, but the malicious code is still likely to be platform specific so that it can load additional malware or a rootkit on the system. From this point, the malware or rootkit normally takes over the system.
Disabling the Java Runtime Environment on users' desktops is a good idea if they do not need Java applications. This will limit users' ability to view specific website content, play games and other activities, but one of the core tenets of information security is that you don't install what you don't need. Applying this attitude toward enterprise security helps minimize a system's attack surface. If the JRE isn't installed, it can't be attacked. Enterprises might not be able to disable the JRE if it is required by mission-critical applications, but Java applets can still be disabled in Firefox. You can also use something like NoScript for Firefox to limit Java applets to trusted sites or limit browser use to IE when users access the JRE for mission-critical applications.
Ask the expert!
Have questions about enterprise information security threats for expert Nick Lewis? Send them via email today! (All questions are anonymous.)
Dig Deeper on Web Application Security
Related Q&A from Nick Lewis
An HTTPS session with a reused nonce is vulnerable to the Forbidden attack. Expert Nick Lewis explains how the attack works, and how to properly ...continue reading
The Irongate malware has been discovered to have similar functionality to Stuxnet. Expert Nick Lewis explains how enterprises can protect their ICS ...continue reading
APT groups have been continuously exploiting a flaw in Microsoft Office, despite it having been patched. Expert Nick Lewis explains how these attacks...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.