Do you use Java runtime on your pc? better read this.

Western · Jan 12, 2013

Thought those that use java on their pc may be interested in this short alert article

US government advises computer users to disable Java software | Fox News

Copied in case the page link is moved.

US government advises computer users to disable Java software

Published January 12, 2013

Associated Press

javawarning.jpg

April 23, 2007: The Java logo is shown at Sun Microsystems' offices in Menlo Park, Calif. (AP)

WASHINGTON The U.S. Department of Homeland Security is advising people to temporarily disable the Java software on their computers to avoid potential hacking attacks.

The recommendation came in an advisory issued late Thursday, following up on concerns raised by computer security experts.

Experts believe hackers have found a flaw in Java's coding that creates an opening for criminal activity and other high-tech mischief.

Java is a widely used technical language that allows computer programmers to write a wide variety of Internet applications and other software programs that can run on just about any computer's operating system.

Oracle Corp. bought Java as part of a $7.3 billion acquisition of the software's creator, Sun Microsystems, in 2010.

Oracle, which is based in Redwood Shores, Calif., had no immediate comment late Friday.

Ken · Jan 12, 2013

Western said:
Thought those that use java on their pc may be interested in this short alert article

US government advises computer users to disable Java software | Fox News

Copied in case the page link is moved.

US government advises computer users to disable Java software

Published January 12, 2013

Associated Press

javawarning.jpg

April 23, 2007: The Java logo is shown at Sun Microsystems' offices in Menlo Park, Calif. (AP)

WASHINGTON The U.S. Department of Homeland Security is advising people to temporarily disable the Java software on their computers to avoid potential hacking attacks.

The recommendation came in an advisory issued late Thursday, following up on concerns raised by computer security experts.

Experts believe hackers have found a flaw in Java's coding that creates an opening for criminal activity and other high-tech mischief.

Java is a widely used technical language that allows computer programmers to write a wide variety of Internet applications and other software programs that can run on just about any computer's operating system.

Oracle Corp. bought Java as part of a $7.3 billion acquisition of the software's creator, Sun Microsystems, in 2010.

Oracle, which is based in Redwood Shores, Calif., had no immediate comment late Friday.

Dennis turned mine off and thanks for the alert saw this on news also.

Certain types of computer users need to public destroy there computer with a sledge hammer.
then study another line of work,
ken

2LaneCruzer · Jan 12, 2013

Last year, I got a pop-up window message that my Java needed updating. I clicked on the "update", and the next thing I knew I had a virus that completely trashed my computer...even had to replace my hard drive. Don't know for absolute certainty that the Java update scenario was the culprit, but it's certainly a person of interest.

Bird · Jan 12, 2013

I saw the news article, but for us computer dummies, how do you turn it off without just deleting it? And I wonder how many other things won't work after you turn off Java.

mbohuntr · Jan 12, 2013

Ken said:
Dennis turned mine off and thanks for the alert saw this on news also.

Certain types of computer users need to public destroy there computer with a sledge hammer.
then study another line of work,
ken

How did you turn it off? I have version 6. Thanks

Bird · Jan 12, 2013

mbohuntr said:
How did you turn it off? I have version 6. Thanks

Try clicking on "Tools", then "Manage Add-ons" and scroll down to Java and see if it's enabled or disabled. At least that's what I did and find 3 versions listed, all of which show "disabled". If I go to the official U.S time it needs Java and will ask if I want to "allow" it. Doing so still leaves it disabled when I leave that website.

texasjohn · Jan 12, 2013

Info on web site below...can stay with Java 6 or disable it.
Disable instructions included below.

Zero-Day Exploit of Java 7 Prompts Recommendation to Disable Java - Computer Services Help Desk - Missouri State University

Ken · Jan 12, 2013

Bird said:
I saw the news article, but for us computer dummies, how do you turn it off without just deleting it? And I wonder how many other things won't work after you turn off Java.

Bird go to Control panel. select programs and scroll to Java. then in security remove the auto update from Box to no undate choose other panels and remove remote access check box.
read any other boxes for others ability to access your computer.
If you cannot update then malware cannot access your machine.
I also keep my AVG at max.on incoming information. Then most all received e-mail put in junk folder and block domain to stop further messages .
Besides the young finger flickers seldom pick on us old codgers it is the young eager beavers wanting a freebe.to make there life easier. Then give away there bank account # and SS # and use there dogs name as security check.
ken

Bird · Jan 12, 2013

Thanks, Ken. I've got Java 6 & 7, but both disabled for now.

Willl · Jan 12, 2013

Been running Firefox with the NoScript add-on for a while now.

NoScript handles which web sites get to use Java and which don't via my discretion.

I miss out on some flashy adverts but oh well, my loss.

Western · Jan 12, 2013

I have Java on my desktop. but have it's off most of the , this isn't the 1st time Java has had vulnerabilities.

I never allowed it on this lap-top, dont need enough. I never allow auto update anything if I can help it, I want to know whats going in, even reputable companies have updates that have bugs, so on major updates I will usually put them off. Most security updates from Microsoft I'll update quick, but when a new browser version or something similar comes out, I wait.

CompactTractorFan · Jan 12, 2013

My dad (who is in the IT industry) told me about this, so I disabled it for now. In Firefox it tells you which java plugin is the problem, but I disabled them all.

texasjohn · Jan 12, 2013

I run noScript as well...love it...best for people who are familiar with how the internet works...I was amazed at the large number of URL's that were seeking to mess with me and my apps at every site I visit. Sometimes it blocks stuff I want to see...but it is easy to selectively allow links, one at a time if desired.

Redbug · Jan 12, 2013

An FYI - There's Java and there's Javascript. The security issue pertains to Java, not Javascript. Disabling Javascript will break a lot of pages.

So make sure you disable Java (plug-in in firefox) not Javascript (in options/content in firefox).

whistlepig · Jan 12, 2013

Do you even know how many manufacturing systems and CNC machines are communicated to by Java? Do you know what Oracle is?

dave1949 · Jan 12, 2013

whistlepig said:
Do you even know how many manufacturing systems and CNC machines are communicated to by Java? Do you know what Oracle is?

How wide-spread is Java these days? I know what Oracle is, it's the product that allowed me to not have a mortgage :laughing:

whistlepig · Jan 12, 2013

I can not believe this. This is "Chicken Little" saying that the "The sky is falling."

Bird · Jan 13, 2013

whistlepig said:
I can not believe this. This is "Chicken Little" saying that the "The sky is falling."

The more I read about this, the more I think you're right.:laughing:

dmccarty · Jan 13, 2013

This is a serious vulnerability. Hackers use software tools that contain exploits. This exploit is supposed to have been incorporated into at least a few of these hacking tools.

CERT is one of the US organizations that handles security vulnerabilities. When CERT talks, the information is very reliable.

This vulnerability is for Java applets, not Java applications, thus the attack is through a web page that gets you to run an applet. I run some Java applications. These applications are NOT run in a browser and they are not vulnerable UNLESS the program included a web browser. Some Java applications DO include web browsers so the user has to be aware. I don't think many Java applications contain their own web browser. The vulnerability is also only on Java 7. What is a wee bit disturbing to me is,

Note that applications that use the Internet Explorer web content rendering components, such as Microsoft Office or Windows Desktop Search, may also be used as an attack vector for this vulnerability.

I don't use Office and I don't think I use Windows Desktop Search.

These vulnerabilities are scored on a scale of 1 to 10 with 10 being highest aka most severe. This vulnerability is a 10. To fix this problem, Oracle will have to release an updated Java.

Vulnerability Note VU#625617 - Java 7 fails to restrict access to privileged code

Overview
Java 7 Update 10 and earlier Java 7 versions contain an unspecified vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

...

Impact
By convincing a user to visit a specially crafted HTML document, a remote attacker may be able to execute arbitrary code on a vulnerable system. Note that applications that use the Internet Explorer web content rendering components, such as Microsoft Office or Windows Desktop Search, may also be used as an attack vector for this vulnerability.

Solution
We are currently unaware of a practical solution to this problem. Please consider the following workarounds:
Disable Java in web browsers

...

This vulnerability is only for Java 7. At this point, previous versions of Java would have been tested for the vulnerability, and since they are not being mentioned, they should be ok.

https://www.us-cert.gov/cas/techalerts/TA13-010A.html

Systems Affected
Any system using Oracle Java 7 (1.7, 1.7.0) including
Java Platform Standard Edition 7 (Java SE 7)
Java SE Development Kit (JDK 7)
Java SE Runtime Environment (JRE 7)
All versions of Java 7 through update 10 are affected. Web browsers using the Java 7 plug-in are at high risk.

To see if Java is installed on your system, go to, Verify Java Version

The only thing you need to do is disable the Java execution in your web browser IF you system has installed Java 7. Well, it would be safer to just disable your browser from using Java.

This link tells how to secure a web browser and includes disabling Java. https://www.us-cert.gov/reading_room/securing_browser/#Safari. It is kinda long and quick google with "disable java in browser" will likely turn up short instructions.

I have read multiple news reports and everyone of them had inaccurate information.

Later,
Dan