c.2013 New York Times News Service
(EDITOR’S NOTE — See also “Java security fix coming ‘shortly’; Up to 850 million machines at risk”: http://www.zdnet.com/java-security-fix-coming-shortly-up-to-850m-machines-at-risk-7000009723/ )
WASHINGTON — The Department of Homeland Security has warned users to disable Java software on their computers, citing a security hole that allows hackers to take control of their machines.
“Java 7 Update 10 and earlier contain an unspecified vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system,” the agency said in an alert issued last week.
“This and previous Java vulnerabilities have been widely targeted by attackers, and new Java vulnerabilities are likely to be discovered.”
A European security researcher who blogs under the name Kafeine first discovered the vulnerability and posted it to his blog Thursday.
The homeland security agency said that it had confirmed that Microsoft Windows, Apple’s Mac OS X and Linux platforms were all affected and that it was “unaware of a practical solution to this problem.”
It recommended that users disable Java in their Web browsers.
Apple stopped shipping its computers with Java enabled last year, but said it was remotely disabling the Java 7 plug-in on Macs where it had already been installed. Windows and Linux users can disable Java by following this guide on Oracle’s Web site: http://www.java.com/en/download/help/disable_browser.xml
Oracle did not return a request for comment on Sunday. (Oracle told ZDNet that a fix will be made available “shortly”; see link, above.)
Java, a widely used programming language that runs on more than 850 million personal computers, has been the source of security problems before.
Last April, hackers exploited a Java vulnerability to infect more than half a million Apple computers with a vicious form of malware in what was the largest-scale attack on the OS X operating system to date.
A month later, the Shadowserver Foundation, a nonprofit group that tracks cyber threats, discovered that hackers had used a Java security hole to infect visitors to several foreign policy Web sites, including the Web sites of the International Institute for Counter-Terrorism, Amnesty International Hong Kong and the Cambodian Ministry of Foreign Affairs.
The exploit was particularly disconcerting because it let attackers download a malicious program onto its victims’ machines without prompting. Users did not even have to click on a malicious link for their computers to be infected.
The program simply downloaded itself.
