SRL Archive - NOTA

Apparently the US Homeland of Security has warned all businesses and people to stop using any kind of Java immediately and disable it

Hackers have discovered a weakness in Java 7 security that could allow the installation of malicious software and malware on machines that could increase the chance of identity theft, or the unauthorized participation in a botnet that could bring down networks or be used to carry out denial-of-service attacks against Web sites.

http://www.zdnet.com/homeland-security-warns-to-disable-java-amid-zero-day-flaw-7000009713/
http://appleinsider.com/articles/13/01/11/zero-day-flaw-prompts-apple-to-block-java-7-from-os-x

I don't have Java 7, am I safe?

Most of us have 6 though so SRL > Java 7 hackers

Damn thanks for the warning. Disabled java 7 for now.

To do that find Java in your control panel. Then go to the Java tab and in the Java Runtime Environment Settings click view and make sure that 1.7 is not ticked.

Edit: I don't know if this helps ^ because of all the java plugins in browsers etc.

Edit:
Basically this means that any unsigned java applet could install malware on your computer without asking for user permission. So don't visit random websites at least not with java 7 enabled! Be warned!

Thanks for the warning, and thanks for the instructions above.

Anyone know the details on how this gets people? Fot instance, could a JDB attack without me manually allowing Java?

From: BMWxi
Anyone know the details on how this gets people? Fot instance, could a JDB attack without me manually allowing Java?

Yes, I think it basically allows for unsigned applets to do the same as a signed applet could do.

From: weequ
Yes, I think it basically allows for unsigned applets to do the same as a signed applet could do.

Damn, that's serious. Hopefully not too many people get ratted. :(

From: weequ
Damn thanks for the warning. Disabled java 7 for now.

To do that find Java in your control panel. Then go to the Java tab and in the Java Runtime Environment Settings click view and make sure that 1.7 is not ticked.

Edit:
Basically this means that any unsigned java applet could install malware on your computer without asking for user permission. So don't visit random websites at least not with java 7 enabled! Be warned!

Thank you :)
Just un-checked mine

From: weequ
Damn thanks for the warning. Disabled java 7 for now.

To do that find Java in your control panel. Then go to the Java tab and in the Java Runtime Environment Settings click view and make sure that 1.7 is not ticked.

Edit:
Basically this means that any unsigned java applet could install malware on your computer without asking for user permission. So don't visit random websites at least not with java 7 enabled! Be warned!

I can't uncheck mine? :s

From: The Killer
I can't uncheck mine? :s

Remove it completely..

From: The Killer
I can't uncheck mine? :s

At which step does it go wrong?

Pretty much all Java versions are vulnerable to exploits at the moment. Mozilla disables JRE until patch has been done for your safety.

Latest exploit poc:
http://www.youtube.com/watch?feature=player_embedded&v=r3LnsCl8qQs

How they'd be implemented in a malicious way:
http://www.mediafire.com/?gev35s6fx84lu3w

From: weequ
At which step does it go wrong?

The checkbox, Can't uncheck it :/

thanks for the warning i just uninstalled java myself…

From: weequ
Damn thanks for the warning. Disabled java 7 for now.

To do that find Java in your control panel. Then go to the Java tab and in the Java Runtime Environment Settings click view and make sure that 1.7 is not ticked.

Edit: I don't know if this helps ^ because of all the java plugins in browsers etc.

Edit:
Basically this means that any unsigned java applet could install malware on your computer without asking for user permission. So don't visit random websites at least not with java 7 enabled! Be warned!

From: Kave
Pretty much all Java versions are vulnerable to exploits at the moment. Mozilla disables JRE until patch has been done for your safety.

Latest exploit poc:
http://www.youtube.com/watch?feature=player_embedded&v=r3LnsCl8qQs

How they'd be implemented in a malicious way:
http://www.mediafire.com/?gev35s6fx84lu3w

Thanks both of you :)

Well, I go to my Control Panel and search "Java", but I click it and it says "Application not found." I'm getting scared right now :(
I think my Java got deleted, but I don't recall deleting it…
Anyone know where to get the Java 6 download?

This exploit is used for several silent jdbs for months now. (Without asking for permission)

Could this be how YoHoJo got hit?

Apparently Jagex doesnt care, i posted the news article and within 2 minutes they hid my thread lol

^ inb4 jagex getting sued because they used this exploit to spy on their customers

From: x[Warrior]x3500
^ inb4 jagex getting sued because they used this exploit to spy on their customers

you mean "used the exploit for botwatch" lol

Dis shizz be serious.
~Rez

Is it browser only version? I just uninstalled the crap on this computer for now..

From: grats
Is it browser only version? I just uninstalled the crap on this computer for now..

Hey you are back from that month off. Wb!

OT: This is some sketch stuffs; my professor announced to the class earlier when he was aware of it. Also found another video on YT of what it might do;

[YOUTUBE]jyLAUESuLwU[/YOUTUBE]

http://www.youtube.com/watch?v=jyLAUESuLwU

Java 7 removed. Can someone confirm that I should be more protected now?

No need to uninstall it if you have Firefox, it disables the plugin automatically unless you click on the applet manually to start it.

From: Justin
Java 7 removed. Can someone confirm that I should be more protected now?

I can confirm this.
Why? - Because you are uninstalling the java security manager, as well as reflection API, both of which are used to carry out the exploit. Uninstalling Java is effective in the case that your machine has not already been affected by this abuse, let alone other malicious abuse. However, again, afaik, there should be no thread from java if it is uninstalled.

Hope this helps,
Cheers,
Lj.ref

Say I have Java 6, would I be safe?

Woah that's not good. I bet you this can be linked to pure hacking even runescape related

Wow.. McAfee just caught this.. Even when I had java turned off? The fk?

So if you have firefox and don't start the java applet first you are fine?

Oh dear. Maybe i should stay away from java for a while until they fix this up. no rs?

From: Jakee
Wow.. McAfee just caught this.. Even when I had java turned off? The fk?

lol Mcafee :')
This isn't good :S

From: Jakee
Wow.. McAfee just caught this.. Even when I had java turned off? The fk?

Why is the directory to an avast temp folder, is it a false positive from McF?

btw, someone told me it got fixed already.

Sweet, Thanks Jingle, Java 7.09 removed, 6.29 remains installed :)

Thanks for the warning Jake!

Just having a look around, it seems like 7.10 was the only java that was able to be exploited? I had 7.09 installed so I am going to (and I shouldn't) assume I was unable to be infected?

From: Kyle Undefined
Could this be how YoHoJo got hit?

From memory it was found on the 10th of this month, I think YoHoJo was hit before that

First signs of this bug were on October iirc. Though I do not know since when this bug was exploited on big scale.

http://villavu.com/forum/showthread.php?p=1157865#post1157865

I made a guide with pictures to disable it (:

I read about this two days ago and the blog I read on had a patch, search around.
(I don't even have java installed on this PC so I haven't done anything about it)

From what i've been reading, there isn't much info about it, only that it hasn't been fixed >.<

java 6 seems to be affected as well…

From: The Killer
lol Mcafee :')
This isn't good :S

I know what you're thinking… lol

Confirming it does block on Firefox, and that it is NOT fixed/patched yet

Maybe Rez got hit by this…

From: Justin
Just having a look around, it seems like 7.10 was the only java that was able to be exploited? I had 7.09 installed so I am going to (and I shouldn't) assume I was unable to be infected?

From memory it was found on the 10th of this month, I think YoHoJo was hit before that

It has been around for awhile, from what I've read.

From: masterBB
First signs of this bug were on October iirc. Though I do not know since when this bug was exploited on big scale.

From my research, it went big scale before October.