Java Runtime Environment-Latest Version Of Java-Security Vulnerability-Oracle

Newly-Discovered Java 7 Security Vulnerability Poses Risks to Macs

Just two weeks after Oracle officially took over responsibility for Java on OS X with the launch of Java SE 7 Update 6, a new Java vulnerability has been discovered to pose a significant threat to systems running the software. Krebs on Security highlighted the issue yesterday, noting that it affects all versions of Java 7 on most browsers.News of the vulnerability (CVE-2012-4681) surfaced late last week in a somewhat sparse blog post by FireEye, which said the exploit seemed to work against the latest version of Java 7, which is version 1.7, Update 6. This morning, researchers Andre’ M. DiMino & Mila Parkour published additional details on the targeted attacks seen so far, confirming that the zero-day affects Java 7 Update 0 through 6, but does not appear to impact Java 6 and below.
Initial reports indicated that the exploit code worked against all versions of Internet Explorer, Firefox and Opera, but did not work against Google Chrome. But according to Rapid 7, there is a Metasploit module in development that successfully deploys this exploit against Chrome (on at least Windows XP).The report notes that Oracle is moving to a quarterly update cycle for Java, meaning that the next regularly-scheduled update to Java SE 7 is not planned until October, but it is unclear how quickly the company will move to address the issue. In the interim, some security experts are developing an unofficial patch while users are advised to simply disable Java if they do not need it active on their systems.
Computerworld reports that the issue does indeed affect fully-updated Macs running Java 7 on top of OS X Mountain Lion.David Maynor, CTO of Errata Security, confirmed that the Metasploit exploit -- which was published less than 24 hours after the bug was found -- is effective against Java 7 installed on OS X Mountain Lion.
"This exploit works on OS X if you are running the 1.7 JRE [Java Runtime Environment]," said Maynor in an update to an earlier blog post.
JRE 1.7 includes the most-current version of Java 7, dubbed "Update 6," that was released earlier this month.Both Safari 6 and Firefox 14 have been found to be vulnerable to the issue on OS X systems.
Apple has of course had its own issues with Java vulnerabilities, most recently with the Flashback malware that was able to infect over 600,000 Macs by taking advantage of an exploit in Java 6 that had already been patched by Oracle for most platforms but not by Apple for OS X. It is due to smaller, previous incidents similar to Flashback that Apple had already been moving to shift responsibility for Java updates to Oracle, a move that is taking place with Java 7. But while Mac users will now receive Java updates simultaneously with users on other platforms, Java remains one of the highest-profile targets for attackers seeking to compromise systems on a broad basis.
Update: CNET noted earlier today that most Mac users are not currently susceptible to the issue, as Java 7 is not installed by default on Macs. The current version of Java installed on Mac remains Java 6 for the time being, so users would have to have manually updated to Java 7 in order for their systems to be vulnerable. read more..

source:http://bit.ly/Ttt5h7

Apple Updates-Snow Leopard-Java Applets-Java Updates

Apple Updates Java for Lion and Snow Leopard in Sync with Oracle

Apple yesterday released a pair of software updates for Java, issuing versions for both Lion and Snow Leopard. The update in part builds upon an earlier Java update for Lion that disabled automatic execution of Java applets in an attempt to minimize the impact of Java-based malware threats like Flashback.This update configures web browsers to not automatically run Java applets. Java applets may be re-enabled by clicking the region labeled "Inactive plug-in" on a web page. If no applets have been run for an extended period of time, the Java web plug-in will deactivate.As noted by Krebs on Security, the release is notable because it came on the same day that Oracle released updates for Java on other platforms. Apple has long been criticized for lagging on Java updates, a policy which allowed the Flashback malware to flourish as Mac systems remained unprotected against the threat even though Oracle had patched the vulnerability on other systems several months before.The update Oracle released yesterday, Java 6 Update 33 and Java 7 Update 5, fixes at least 14 security flaws in the oft-attacked software that is installed on more than three billion devices worldwide. Apple’s Java update brings Java on the Mac to 1.6.0_33, and patches 11 of the 14 security vulnerabilities that Oracle fixed in Tuesday’s release. It’s unclear whether those other three flaws simply don’t exist in the Mac version of Java, but we’ll take progress where we can get it.With Java SE 7 set to come to the Mac later this year, control over updates is transitioning from Apple to the OpenJDK project, with both Apple and Oracle providing expertise to ensure that updates for Mac roll out on a timely basis. That transition was begun back in late 2010, with Steve Jobs noting at the time that having Apple responsible for Java updates on the Mac "may not be the best way to do it." read more..

source:http://bit.ly/MIBSZa

Flashback Malware-Symantec

Flashback was earning about $10K per day

People often wonder about what motivates the creators of malware. In the case of the Flashback malware that infected several hundred thousand Macs, it turns out that the motivator was money. A post on the Symantec official blog listed the stages of infection from Flashback:

1. A user visits a compromised website.
2. The browser is redirected to an exploit site hosting numerous Java exploits.
3. CVE-2012-0507 is used to decrypt and install the initial OSX.Flashback.K component.
4. This component downloads a loader and an Ad-clicking component.

That ad-clicking component is what made the money for the scoundrels who wrote the malware. As the Symantec post explains, the malware specifically targets searches made on Google. Depending on the search query, the malware redirected the Mac user to another page chosen by the attacker, and the attacker received revenue from the click-through. Since Google never received the intended ad click, they lost revenue. Symantec analyzed a similar botnet last year and determined that about 25,000 infected machines could net the attacker about US$450 per day. Based on the breadth of the Flashback attack, they estimated that the malware was earning its creators almost $10,000 per day. If you haven't updated your Mac to counteract a possible Java malware attack, or run Apple's free tool for removing the malware from Macs that don't have Java installed, be sure to run Software Update as soon as possible to protect yourself. [via Macworld]Flashback was earning about $10K per day originally appeared on TUAW - The Unofficial Apple Weblog on Tue, 01 May 2012 12:30:00 EST. Please see our terms for use of feeds.Source | Permalink | Email this | Comments read more..

source:http://aol.it/IDCcsC

Unofficial Apple Weblog-Flashback Infections

Flashback infections down from over half a million to under 150,000 in eight days

According to Symantec, the OSX.Flashback.K infection is declining each day. The current number of infected Macs is now around 140,000, down from 600,000 a week ago. If you think you may be infected, you can run a Flashback removal tool from either Kapersky or F-Secure. Apple also has a tool for Lion users without Java installed. OS X users should install the latest Java update from Apple which will protect you from a future infection.Flashback infections down from over half a million to under 150,000 in eight days originally appeared on TUAW - The Unofficial Apple Weblog on Wed, 18 Apr 2012 09:37:00 EST. Please see our terms for use of feeds.Source | Permalink | Email this | Comments read more..

source:http://aol.it/J7tlk8

Automatic Execution-Java Implementation-Java Applets-Flashback-Java Web

Apple Releases Java Update to Remove Flashback Malware

Apple just released Java for OS X 2012-003, an update to the Java implementation in OS X. The update removes "the most common variants of the Flashback malware." Interestingly the update disables the automatic execution of Java applets, and, if automatic execution is re-enabled, will again disable it if no applets have been run for "an extended period of time".
It was reported earlier this week that Apple was in the process of creating software to remove Flashback. It's been claimed that the Flashback malware infected more than 600,000 Macs at its peak, though there have been a number of programs created to quickly and easily cleanse infected machines.
This Java security update removes the most common variants of the Flashback malware.
This update also configures the Java web plug-in to disable the automatic execution of Java applets. Users may re-enable automatic execution of Java applets using the Java Preferences application. If the Java web plug-in detects that no applets have been run for an extended period of time it will again disable Java applets.
This update is recommended for all Mac users with Java installed.
For details about this update see: http://support.apple.com/kb/HT5242
The update can be downloaded via Software Update. A separate Java for Mac OS X 10.6 Update 8 is available for users on Mac OS X Snow Leopard. read more..

source:http://bit.ly/Iunl0a

Malicious Website-Trojan

How to find/remove the Flashback trojan

According to Russian antivirus firm Dr. Web, over 600,000 Macs worldwide are infected with the Mac flashback trojan. The trojan can be installed if you visit a malicious website, and it will attempt to connect your Mac to a botnet. Fifty-seven percent of infected machines are located in the US and 20 percent are in Canada. There are even 24 infected machines supposedly connected to the botnet from Apple's Cupertino campus. This trojan targets a Java vulnerability in Mac OS X that was recently patched. It should be noted that in OS X 10.7 Lion, Java isn't included by default; only those who have deliberately installed it are potentially vulnerable to this exploit (or those running Snow Leopard or earlier OS X versions). If you installed it at some point but no longer have a reason to run Java, you should probably turn it off completely or at a minimum disable it in Safari. F-Secure has provided a set of diagnostics that'll let you know if you have been infected. If you have the malware on your machine, F-Secure's page can walk you through the steps to remove the infection. Thanks to everyone who sent this in. [Via The Loop]How to find/remove the Flashback trojan originally appeared on TUAW - The Unofficial Apple Weblog on Thu, 05 Apr 2012 10:15:00 EST. Please see our terms for use of feeds.Source | Source | Permalink | Email this | Comments read more..

source:http://aol.it/IgSMfp