DrJBHL DrJBHL

Homeland Security Warning: Disable Java in Browsers: New Zero Day Security Flaw Found

Homeland Security Warning: Disable Java in Browsers: New Zero Day Security Flaw Found

 

It’s a pretty rare event when DHS warns to disable the Java in your browser, but they have because of a Zero Day security flaw which allows infected applets to infect your computer via your browser and allow elevation of privileges to occur.

Once this occurs, your computer will no longer keep your sensitive data private.

The apps and code to do this are out in the wild, so this is not theoretical.

So… do the recommended.

How to do it:

https://www.java.com/en/download/help/disable_browser.xml

Source:

http://www.zdnet.com/homeland-security-warns-to-disable-java-amid-zero-day-flaw-7000009713/

172,026 views 78 replies
Reply #26 Top

JavaScript is a completely separate technology from Java. Java was the "in thing" back in the days when Brendan Eich atNetscape created a programming language that was originally going to be called LiveScript, so unfortunately they decided to rename it from LiveScript to JavaScript in the hope of catching the media’s interest.

 http://kb.mozillazine.org/JavaScript_is_not_Java
Reply #28 Top

Any fix will only be until the flaw is found and exploited. You can take that to the bank.

Reply #29 Top

Hey Doc.....I think they already did. You can hear the 'cha-ching!' all the way to the bank. I remember well getting caught by one of them. Damn near totaled my laptop. I'd get rid of Java except its needed for Libre Office and Gimp. Gimp I can do without but Libre Office is too good to throw away. They say its geared towards version 7 update 10. Would rolling back to a previous version prevent that I wonder or does it make any difference. Probably not.

Reply #30 Top

OpenOffice/LibreOffice needs Java mostly for the database functionality. do you use databases? 

i'm not sure about The GIMP, but if i rember correctly, Java is only needed for a few older plugins.

 

the desktop runtime environment is not the problem though (this time). so you could keep it and still be safe.

anyways: give an uninstall a try. should you ever need Java, you can always install it again. and do not even think about using older Java versions.

Reply #31 Top

Minecraft needs Java so... :P

Reply #32 Top

I use only the writer. I do remember some time ago about Gimp not needing the runtime environment anymore. Perhaps an un-install won't hurt anything. I'll give it a go and see what happens. If everything works as it should then Java will be history. For now.

Reply #33 Top

Writer doesn't require Java. The current problem is Javascript. Different animal.

As for Gimp? Don't know, never used it.

Reply #34 Top

Quoting DrJBHL, reply 33
The current problem is Javascript. Different animal.

.
End of DrJBHL's quote

not at all. the problem is the Java browser plugin.

Javasript has nothing to do with Java except the name. 

Reply #35 Top

I thought the plugin JRE) was Javascript, and connected between the browser and the Java platform.

Reply #36 Top

 

well, it's not.

Quoting moshi, reply 26
JavaScript is a completely separate technology from Java. Java was the "in thing" back in the days when Brendan Eich atNetscape created a programming language that was originally going to be called LiveScript, so unfortunately they decided to rename it from LiveScript to JavaScript in the hope of catching the media’s interest.

 End of moshi's quote
">http://kb.mozillazine.org/JavaScript_is_not_Java[/quote]

 

nowadays the Javascript developers would be have been sued for trademark infringement.

Reply #37 Top

Seems unnecessarily obtuse to me.

Reply #38 Top

All I know is I got rid of the Java on this comouter. IE loads so fast and the computer boots much faster. Would have never thought of that so glad there is a problem with Java and this post to make me aware of it.

Reply #39 Top

I uninstalled Java. There were two on my machine. Version 7 update 10 and update 7. I uninstalled both. No problems so far unless you count a very slow page loading, sometimes as long as 25 minutes. This web connect sucks big time. But its a hotspot so I guess I gotta take the good with the bad. lol

I just got an update notice about a new version of Java. Its called jucheck.exe I don't know what it is but I closed it. Any thoughts

Reply #40 Top

jucheck.exe is the update verification checker for Java by Sun Microsystems. Since you have uninstalled Java, you should probably uninstall that as well.


Reply #41 Top

Thank you Doc. :thumbsup:

Reply #43 Top

The experts say it still has bugs. I won't be taking Java back any time soon.

Reply #44 Top

It's clearly OK to leave JavaScript enabled.  It's getting a little redundant to say so, but it is unrelated to Java, despite the name, and is necessary for many, many websites to function properly, especially financial institution websites.  Java can go away and you'll never notice because almost nothing needs it anymore, except maybe your washing machine.

Reply #45 Top

apparently i missed even the previous update (u10) XD 

 

for those who use java for whatever desktop applications (but not for browser), apparently u10 had a quick tickbox to disable java for browser. which is useful because previous to that, it's a pain to try to disable it from java control panel. the IE box was always ticked even if it's disabled.

 

There were two on my machine. Version 7 update 10 and update 7
End of quote

which is a bit odd, because that's not supposed to happen since some version of java 6 or maybe 5 (before that, every bloody version of java is kept.. but since whichever update it was, you only have 1 version. that is, 1 version of 32 bit and 1 version of 64 bit if you have both installed)

 

and if you have both 32bit and 64bit installed... fun because windows control panel is too stupid to realise 32bit java and 64 bit java are not quite the same thing and shows only 1 icon. thus you have to dig through the correct file folder to change settings on both of them. not to mention autoupdate for 32 bit doesn't work when you have 64bit installed... (64bit doesn't have autoupdate)

Reply #46 Top

Both were 64 bit. I save all installer packages for back up reasons, I just forgot it was there. Thing is Java notifies me of all updates. I do not allow automatic updates because I got burnt once by that. Not gonna happen again! The only app I have that I allow auto updates is Threatfire and I have never had a problem with that. Been using it for over a year now. So far everything on my laptop works just fine without Java installed. So it really isn't necessary to keep it. One less thing to worry about.

Reply #47 Top

very strange.. because they (both sun and oracle) deliberately don't do autoupdate for 64bit java. (unless you mean there's some sort of email notice....)

remember... just because your os is 64bit doesn't mean your java is 64bit. in fact... most browsers aren't even 64bit and won't be able to use 64bit java plugins anyway.

 

---

and i don't mean installer packages..

back when, your java folder will have a load of subfolders, 1 for each update. crazy stuff. something about keeping backward compatibility or some such..

Reply #48 Top

I strongly recommend Msft's EMET [Microsoft Enhanced Mitigation Experience Toolkit] (currently v3.5) for all those whom wish to more-fully secure their online activities

no advanced knowledge required just import stock protection profile that's fully supported (the documentation is included if it doesn't sound straightforward, it really is I think)

 

   ...for those of you still rocking XP for some insane reason (other than to code updates for GC2 of course!!) checkout wehntrust from codeplex to supplement emet's limitations because of nt5's age

Reply #49 Top

 I get a popup when Java says there's an update, no email. I get emails from CCleaner and Glary Utilities and FF, all from cnet which I try to stay away from because of all the bloat they tack onto stuff. When I do update anything I go to the website and dl from there.

Reply #50 Top

Quoting Uvah, reply 49
some insane reason
End of Uvah's quote

Other than financial and the inconvenient truth that XP works just fine for the average user?