Days since last known Java 0-day exploit
java-0day.com
java-0day.com
Tells you whether it's loaded, and what version you have loaded. No frills, no crap website.
Edit: original page title is "Java 0day countdown".
http://www.zdnet.com/pwn2own-down-go-all-the-browsers-700001...
Also, nobody compromised Safari at Pwn2own last year.
i highly doubt it was because no one could pwn safari.
Charlie Miller teased about it and a conversation involving i0n1c ensued:
If the market pays lots of money for Mac OS X exploits, why would it pay less for Windows ones? It can't be market share and I doubt it is because Mac users have faster Internet (so that their machines can be bigger DDOS sources, have more money to steal from them (both may or may not be true, but I doubt that fully offsets the difference in market share)
Another only thing I can think of why Mac exploits would be more expensive is that buyers expect Mac zero days to last longer, but I doubt that, too.
That leaves two reasons: because it is so easy that nobody considers it a challenge, and everybody expects someone else to pick up the price, or because it is too hard.
Alternative theories welcome.
Some theories:
I don't necessarily think it's because Mac 0-days last longer, but I know they do consider it a challenge; The difficulty may factor in to the price somehow. Maybe because there's the presumption the average user on iOS may have more cash to burn than the average Windows user.
They may have more to gain by hitting Apple employees for trade secrets.
Of course, all this is pure speculation.
Safari on OS X is considered a soft target compared to the other browsers. It is the least difficult and has the fewest users. That is why the payout is less.
It has nothing to do with being after trade secrets from Apple employees. The people who sell both iOS and Mac (OS X) exploits do not sell them to people trying to steal Apple's trade secrets.
Pwn2own bounty for breaking IE9 is only $75,000.
Bug price list 1 year ago:
http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...
It is indeed too bad that the Safari bounty is only $65,000.
And IE9's bounty is only $75,000.
So yeah, perhaps these bugs are being sold to governments instead.
I always thought that, from day one, it was specifically designed to run untrusted code downloaded over the network in a secure sandbox. Java's over 15 years old and has always had the backing of a major company, so it's not like these are the growing pains of a new technology.
I came up with a hypothesis about this kind of stuff not too long ago. Once your product becomes sufficiently crappy, nobody in their right mind will want to work on it. Good people will leave to get away from it. The project gets to a point where the badness "rubs off on you". Anyone who cares about their reputation will run from it.
Obviously, you can't write code without developers, so you start scraping the bottom of the barrel to get anyone who will work on it. You get people who don't care about their reputations and/or quality and are only there for a paycheck. You get green people fresh out of school who think everything is always nice and happy, and haven't been beaten down by the harsh reality of the industry yet.
The bozos got to the project, and broke it. Once that happened, the only people willing to work on it are more bozos (and the unfortunate ignorant folks who don't know any better).
I dubbed it "The Bozo Loop". I originally only intended for this to describe a specific situation (Flash), but since then it's become quite clear that it can extend to Java and many other things.
I assume only having up to IE8 on XP is going to be an issue to full html5 video adoption for some time yet.
Java downloaded an executable with a misleading '.jpg' extension and then executed it (it was a trojan that downloads other malware: http://go.eset.com/us/threat-center/encyclopedia/threats/win... ).
1. Completely secure code is extraordinarily expensive and difficult to write. All cost effective software is going to contain vulnerabilities
2. The only path to security is aggressive discovery and disclosure followed up with an immediate patch and deploy mechanism
This is the new model which Chrome and various other end-user-facing software is running - silent, rapid updates and a product engineered from the ground up to support that without major regressions. Anybody who wants to be a player in the browser market basically has to adopt this model. If Oracle cares about retaining any presence of their browser plugin in modern browsers they need to drastically change course - but I'm not sure they do.
There are ways to structure your code to mitigate this, but Java is almost 20 years old, so I'm sure there are a bunch of dark corners in there.
A more secure way to go about it would probably be to bootstrap the language more and write more of the VM in Java. I guess PyPy is exactly that, although I don't know enough to comment on its security.
All of these are exposed directly to untrusted code from the Internet, and none of them break at anything like the rate that Java seems to have done recently, nor get as much bad press as Java does. The closest analogy I can think of is MSIE in the post-Netscape, pre-Firefox era (c. 2001-2005).
Maybe the conclusion is, security holes don't get fixed if a technology is closed-source, is developed by a single large company, and there are no alternative implementations.
I thought that Java had a pretty good record until recently. As I wrote in a previous comment, what may have happened is that Windows and Flash and other ubiquitous client software really cleaned up their act in the last few years. So hackers started going for the JVM and Adobe Reader as vectors. The JVM wasn't under as much scrutiny when Windows was wide open, although that was quite a few years ago.
I wouldn't rule out other possible reasons either, e.g. the fact that there may have been a huge brain drain in JVM talent after the Oracle acquisition. Or a failure of software engineering processes after a re-org.
I agree that closed source software doesn't have a great security track record... but I think there are some other factors at play here, some of which I'm speculating on.
First of all, the Sun JVM is written in C++, not C. Second of all, the recent security problems are not the result of buffer overflows or other C++ coding problems, but design choices in the Java security model coupled with poor library coding. These vulnerabilities existed for a long time. The fact that they're only coming to light now is just a historical accident more than anything else. Oracle's response has been slow, but they did not create the problem. Sun did. (And I say that as a big fan of the old Sun Microsystems.)
The Java security model is supposed to allow you to keep both trusted and untrusted code in the same process space. Unfortunately, if any trusted library is poorly coded, you can use it to escalate your privileges. You can basically get something a lot like "eval" using the classloader and reflection.
This was a tradeoff that the Java language designers made. They chose to implement a powerful, but complex, sandboxing scheme. It would have been a lot simpler just to run the untrusted code in a separate process, like Chrome does. But that would have required interprocess communication. A lot of these 0-days have used this mechanism, or something like it, to exploit their privileges.
Another decision the Java web plugin designers made was to give plugins the ability to do almost everything native applications could do-- manipulate the filesystem, send network traffic, etc. This was another design choice that could have been made differently-- for example, Javascript historically never offered these kinds of abilities.
There have been a ton of Java 0-days and I don't have time to explain or research them all. But most of them flow directly out of the underinvestment in Java plugins over the last decade (a policy Sun started, and Oracle continued), and the fundamental design decisions made in the early days. I haven't seen any of them that were related to C or C++ (although I haven't examined all of them in detail so maybe there was one somewhere.)
Maybe java security research just had a breakthrough and they found some new attack vector/methodology which uncovers all these vulnerabilites?
Personally I didn't think a project like that existed until you mentioned it.
Until 2 years ago I even had a Windows XP VM with broken update mechanism and IE6 which I used frequently.
And guess what, never something happened. But speaking for me, I will keep Flash and Java activated for another few years. I'm no security expert but my explanation why this works is this: I don't install any toolbar, in fact I have only the bare minimum of Firefox add-ons. (Why don't they allow me to uninstall MS Office Live-Plugin anyway? Or this Ubuntu thing?) I hate to install Software on Windows, and if, I really make sure I understand what I install and how trustable the vendor is.
Two relatives of mine have been infected with some spam bot net thing more than once. Their systems were like 90% patched, but they were vulnerable through Toolbars. (I think in both cases it was the Yahoo Toolbar.)
This is certainly not meant as a general advice, but I guess the lesson is being minimal and careful is as valuable as keeping your system patched. Oh and yes, I do always have an up-to-date Virus scanner.
Is it a case of the OS now really being way more secure than it once was? Lost interest by malware writers? A bigger focus on vulnerabilities in specific products (ie. Browsers)?
MS08-067 was certainly the goto XP exploit for the longest time. I still find computers vulnerable to that nearly 5 years later.
Disclaimer: I only dabble in security and am basically limited to metasploit for my knowledge, so corrections are welcome.
Because the OS is more secure, other parts of the system (ie browsers, flash, java) are now (in comparison to the OS) easier to exploit than they were.
Check wayback for http://www.pivx.com/larholm/unpatched around 2002 to see some samples.
In those days, browser exploits were not really seen as something of value. Everyone thought, "You have to trick the victim into visiting your web page? Pff". That's when hacking was still done by silently hitting vulnerable services, with no user interaction. Crazy how times have changed...
(Sorry, not what you were asking for, but reminded me of that page.)
Should remove either the "ever" or "yet" from that sentence. Unless it's a redundancy feature :D
There! All fixed.
http://www.symantec.com/security_response/writeup.jsp?docid=...
And that one is years prior to when I went to school. People can believe whatever they want about the security of their preferred platform but basically any large project is going to have some sort of vulnerability. All it takes is someone with enough gumption to find it.
I somehow doubt that the french person who registered java-0day.com is in compliance.
The idea isn't bad but it's a bad sad that everything is put together: mixing Java applets exploits with server-side exploit with regulard client-side / Java desktop exploits.
I think the difference is when you try and trade commercially using someone elses trademark.