Apple Updates Java To Include Flashback Removal 121
Fluffeh writes "In the third update to Java that Apple has released this week, the update now identifies and removes the most common variants of the Flashback malware that has infected over half a million Apple machines. 'This Java security update removes the most common variants of the Flashback malware,' Apple wrote in the support document for the update. 'This update also configures the Java web plug-in to disable the automatic execution of Java applets. Users may re-enable automatic execution of Java applets using the Java Preferences application. If the Java web plug-in detects that no applets have been run for an extended period of time it will again disable Java applets.'"
Re: (Score:2)
Don't know who modded this offtopic but the number of infected machines seems germane to the discussion. And AC's correct that the infection rate was dropping rapidly [msn.com] even before this tool hit :
"The number of Macs infected by the Flashback malware has gone down by more than half, from 550,000 to 600,000 computers last week to 270,000 in the last 24 hours, Symantec said Wednesday."
Now whether this is because of an overestimation of the original infection or due to the Apple community being energized and taki
Re:No way! (Score:5, Informative)
Macs don't get viruses!
Almost no computer gets viruses anymore. Trojans & malware on the other hand...
I'm new to this conversation but... (Score:5, Funny)
Re:I'm new to this conversation but... (Score:4, Funny)
I think you wanted "were pissed." Apparently you don't work in the communications department. I'll bet the guy who makes your coffee would have gotten it right.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
At least he didn't say "pissed on" which means something else entirely.
Re: (Score:1)
Nope.... in the states ... "pissed" does mean "angry" ... same as "pissed off" ...
ah, you former imperialists ...
immature=no java (Score:5, Interesting)
So to fix the problem, they say lets disable java by default. They are new to the security game.
Lets say using adobe photoshop had a vulnerability, apple's defense is disable the running of photoshop when launching a ps file withotut prompting?
It's like preventing your child walking without your permission every time and then when their grown up and able to make their own decisions and decide to walk, you say, oh you have not walked in a while, you can't walk again.
Re: (Score:2, Insightful)
apple's design philosophy is to progressively remove features, so this fits quite well.
(anyone wanting to knee-jerk at my assertation - give me a counter-example)
Re:immature=no java (Score:5, Informative)
What, you mean a new feature? Wikipedia is your friend, there's a long list of new features for every major OSX version.
e.g.
http://en.wikipedia.org/wiki/Osx_lion [wikipedia.org]
Re: (Score:1)
well... they removed some of the crashes i guess.
i was thinking more hardware and software. Final Cut Pro X is a recent example. they added some interesting stuff if you're shooting multi-cam, and broke EDL, XML, backward compatibility, the ability to share projects and removed Color entirely.
hardware wise... if they could remove the home, power and volume buttons they would. they lost me as a supporter when they removed the "reset" button - an arrogant statement that their (then OS 8.6) machines will ne
Re: (Score:2)
Re: (Score:2)
Re:immature=no java (Score:5, Informative)
They did. Java and Flash have no longer been shipped with OS X for ages now. The primary reason is people keep reinstalling OS X and thus those vulnerable versions. Far better to let the user download and install the latest and greatest from Adobe and Oracle.
Well, Final Cut Pro X is a completely new rewrite. Apple's tradition is new rewrites of software is to get the basics working rock solid first, then add back missing features. This has been true since OS X was first released and didn't have half the stuff (e.g., DVD player) that OS 9 it shipped with also had. It happened again with QuickTime X - there's a reason why OS X supported a dual install of QT X and QT 7. FCP X is more of the same. They also retargeted it for prosumers rather than pros And yes, they still sell FCP 7 - but only by phone sales.
Does a modern PC have a reset button these days? Most of the time if it hard locks, you hold the power button a few seconds and it turns off. You then hit it again to turn it on. Reset's kinda useless since most people found they needed to mollyguard their PCs. Hell, an office full of white box PCs on the floor is a tempting target around family days - little buggers go running off and pushing all the buttons on a PC, including reset. Anyhow, old Macs had them, but they were pin-holes to prevent exactly that sort of problem. (You needed it if you wanted to get into the debugger).
Re: (Score:2)
Final Cut Pro X is a completely new rewrite. Apple's tradition is new rewrites of software is to get the basics working rock solid first, then add back missing features.
ask _any_ editor that doesn't work out of their bedroom what "the basics" of a professional editing package are.
i'm not sure you understand the sheer scale of Apple's fuckup with FCP-x. sure, they've made some amends on a few features, but the entire industry is shell-shocked and afraid to trust again - even my old boss, who was a die-hard mac fanboy (to the extent of installing an xSAN system and having to spend 100k+ on hardware and software getting it to work with the PC, linux, and mac systems in the f
Re: (Score:2)
well... they removed some of the crashes i guess.
Was the list too big, your comprehension abilities too poor, or have you just got a Fox News like ability to deny what's there in front of you? Apple adds lots of new features.
In good design, what you take out is as important as what you leave in. Look at Windows and the PC for what happens when you are afraid to take anything out. You end up with a big pile of shit.
Re: (Score:2)
in design, form must follow function, not dictate it.
Microsoft certainly didn't do it as well as they could, but at least they tried. Apple didn't even try.
i'd be happy if their updates just came with a simple "classic mode", or "expert mode" switch - i know "the masses" (whatever they are) are afraid of too much choice, but any feature will likely have a use, and removing it will likely inconvenience someone. less used features can be shifted out of sight, but should not be removed unless there's a very
Re: (Score:2)
in design, form must follow function, not dictate it.
Microsoft certainly didn't do it as well as they could, but at least they tried. Apple didn't even try.
You are misinterpreting the one thing about design you've heard. "Form follows function" does not mean that everything including the kitchen sink should be included. Designers following form follows function simplify.
Re: (Score:2)
What are you talking about? You just hold down the power button on any model ever made.
Re: (Score:2)
that method takes 5 seconds.
wrenching out the power takes less than a second :)
Re: (Score:2)
That seems to be everyones philosophy of late: Apple, Microsoft, the Gnome Devs, Canonical, the guys which design Android...for crying out loud, I even can't find fitting shoes anymore because they all look the same.
Re: (Score:3, Insightful)
I agree what they should have done is remove java entirely.
Re: (Score:3, Interesting)
You have 3 pieces of software that constantly gets patched for security holes found and they are....
1) Java - Not installed in OS X by default anymore. Doesn't get installed unless its requested like running Adobe Apps, etc.
2) Flash - Not installed anymore by default
3) Quicktime - Rewritten from the ground up starting with QT X. QT 7 and back has always been a security breach.
Re:immature=no java (Score:4, Funny)
Re: (Score:2, Informative)
PDF's are handled internally by Preview.app. It doesn't have the functionality of Acrobat reader but it also doesn't have the attack surface.
Re: (Score:1)
Right.
http://www.cultofmac.com/56302/apple-mac-os-x-security-update-patches-pdf-exploit/ [cultofmac.com]
Re: (Score:1)
Wow. A whole hole. That's equivalent to the patchwork software that is Adobe Reader.
Re:immature=no java (Score:5, Informative)
As of 2010, Adobe Reader was kicking Preview's ass on security. No, that's not a joke. Nor is it fanboyism; I don't use either one. It's just a plain and simple fact. The probable reason? Adobe, like Microsoft, has had many years of being a high-profile target, and has put a lot of effort into finding and fixing security bugs. Apple, quite frankly, has not.
http://net-security.org/secworld.php?id=9725 [net-security.org]
Watch the second video, and jump ahead to 8:57 (almost the end) if you want a simple comparison.
For the lazy, here's the basic facts: Preview had from the same set of 1400 PDFs downloaded from the web, run through a mutational fuzzer to produce 2.8 million test files. Preview had 7 times as many unique crashes as Adobe Reader, and at least 3 times (more realistically, probably 10 times; at worst, 20 times) as many exploitable bugs.
When a guy like Charlie Miller (very well-respected security researcher) can find 7 security bugs in Apple's code for each one he finds in Adobe's (using the exact same test cases), Apple has a serious security problem.
Re: (Score:3)
I think the attack surface of Preview.app actually extends into the OS X kernel itself. One of the iPhone jailbreaks used a kernel-level PDF exploit and it was apparently in code shared with the desktop version.
Re: (Score:1)
It seems silly to blame Java when the entire purpose of Java is to serve as an execution platform for general purpose software. That's like saying "hey we should get rid of executable software, because it could pose a security risk."
Re: (Score:2)
It seems silly to blame Java when the entire purpose of Java is to serve as an execution platform for general purpose software.
That was one purpose of it but not the only one and not the one that has caused the controversy.
Another purpose from java was to provide a SANDBOXED execution platform for running untrusted software (such as applets from the web) while preventing it from damaging the users system. The problem is getting a sandbox like this right is hard and every so often a flaw is discovered that lets malicious code break out of the sandbox.
Re: (Score:2)
Re: (Score:2)
I agree what they should have done is remove java entirely.
Java is not installed by default in Lion, the latest version os OSX. The users is prompted to install it the first time he opens a webpage containing an applet or the first time he invokes "java" on the CLI.
Re: (Score:3)
They're disabling applets, not Java. That would be like prompting if you wanted to open a recently downloaded ps file in your analogy.
Re:immature=no java (Score:5, Informative)
No, the fix to the problem was to ship the latest Java build which had closed the vulnerability. And then to follow that up with an update that removed any infection already there.
Java is deprecated. As a development platform for OSX it was deprecated going on for a decade ago. And as a platform supported by Apple, back in 2010. With the current version of OSX it doesn't even ship as standard. It only gets downloaded and installed for the minority of people that actually use some software that needs it.
Nevertheless, the only part that is getting switched off when it's not been used for a while is the browser plugin. And reenabling it if required is easy.
Basically it's a bit like Flash - being helped on the road to complete obsolescence because it's not needed and tends to have vulnerabilities.
Perfectly sensible.
Re: (Score:2)
You must be a Java developer. And you're kidding yourself. It's in black and white.
"Note: As of the release of Java for Mac OS X 10.6 Update 3, the Java runtime ported by Apple and that ships with Mac OS X is deprecated. Developers should not rely on the Apple-supplied Java runtime being present in future versions of Mac OS X."
https://developer.apple.com/library/mac/#documentation/Java/Conceptual/Java14Development/00-Intro/JavaDevelopment.html [apple.com]
Re: (Score:1)
Learn to read:
"Apple will work with Oracle on Java SE 7 and future versions where Apple will contribute most of the key components, tools and technology including HotSpot JVM, class libraries, networking stack and the foundation for a new graphical client."
This is exactly what Apple does. The difference is only that they are no longer including Java by default on OS/X.
Re: (Score:2)
It's not a matter of learning to read you penis. It's a different press release. And the word "deprecate" was not withdrawn.
Basically Apple deprecated it's own built-in port of Java, and said go get it from Oracle. 3 weeks later they announced that they'd let Oracle have the pieces remaining from their now deprecated project. And that they'd help them keep their Java working with OSX.
The distinction is important, because it means that right now, it's Apple's responsibility to fix. As of Mountain Lion it's O
Re: (Score:1)
Which is good you fucken inbred shit eating monkey since Apple is incompetent at providing security updates to its users.
Re: (Score:2)
It's also good because as as Apple has taken another step away from Java, even less use will be made of it. Thus hastening the day when Java is dead. Can't happen soon enough.
Re: (Score:1)
Happily you'll be dead before Java.
Re: (Score:2)
Re: (Score:2)
Java is deprecated.
Please don't tell me you're a .NET developer...pretty please...
Re: (Score:2)
Apple used to support Java as a first-class citizen. It was one one level with Carbon (the OS 9/OS X UI toolkit) and Cocoa (the OS X UI toolkit). Carbon has been deprecated because, well, it was only intended to make the switch from 9 to X easier and 9 has been dead forever. Java has been deprecated, too - it's now a second-class citizen like on other platforms and Apple's only officially backed environment for OS X development is Cocoa.
So it's not deprecated as in "you shouldn't use this
Re: (Score:2)
Re: (Score:3)
Deprecated is in multiple dictionaries with the exact meaning I used. Therefore you are unquestionably wrong.
You're also wrong about depreciated. That's not the meaning that is intended when software professionals use the term deprecated.
Re: (Score:2)
> Java is deprecated.
What?
Re: (Score:2)
Another OP gave further info here:
http://slashdot.org/comments.pl?sid=2783397&threshold=0&commentsort=0&mode=thread&cid=39671209 [slashdot.org]
only the beggining (Score:2, Interesting)
apple's "security through scarcity" is starting to fade away as they gain marketshare. any popular OS will get viruses, malware, trojans, etc.
will mac os get a stonger walled garden as a result? i hope not as i was about to buy my first mac.
Re: (Score:2)
Re: (Score:2)
apple's "security through scarcity" is starting to fade away as they gain marketshare. any popular OS will get viruses, malware, trojans, etc.
will mac os get a stonger walled garden as a result? i hope not as i was about to buy my first mac.
The next release of OS X (Mountain Lion) will warn people when trying to run unsigned apps [panic.com]. Apps sold through the Mac App Store will be signed and devs will be able to get their app signed by Apple for free without having to distribute through the App Store. Unsigned apps will also still run if you tell the system to do so. The fact that Apple are doing things shows they will not go full-on walled garden like with iOS but are still trying to get some of its advantages to their users by choosing this middle
Leopard and earlier (Score:1)
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The core OS is still pretty secure (Score:3, Interesting)
Re:The core OS is still pretty secure (Score:5, Interesting)
Most of the problems have been related to people installing software from the internet manually and things like Java.
That's pretty much the case with all platforms, compromise the user and you compromise the security of the system. All the email attachment malware, screensavers, etc... are user exploits and it doesn't matter what platform they are on, of course modern operating systems require explicit privilege escalation but again that's up to the user.
Add ons like Java are always going to be a source of headaches.
What do you mean 'Add ons'? You mean 3rd party software? Or in this case not even that since it's Apple that maintains Java releases for OSX.
All I know is I rarely have trouble with my Macs but the PCs are another story. One of mine I had to surrender for internet use because it got nailed by a redirect and I tried everything and short of redoing the OS there was no way to scrub it out. I find it safer to use Mac for web surfing and downloading things like software and I use a lot of licensed photos in my work. It's just my personal experience that I run into far fewer issues with the Macs.
I'm equally as careful whether i'm running Windows or OSX, i'm not going to be naive and just install anything downloaded from the net or visit questionable sites on either platform because - as these recent publicized events have highlighted - neither platform is completely secure and it would be pretty irresponsible to tell users that they don't have to worry about security just because it's OSX, best to be just as careful no matter what you use. Sure there are less known issues with OSX - even less for most linux or BSD distros - but as their marketshare increases we are seeing instances of infection increase so best to take as much care no matter which platform you're on.
Re: (Score:2)
What do you mean 'Add ons'? You mean 3rd party software? Or in this case not even that since it's Apple that maintains Java releases for OSX.
I'm not sure about the status of the current Java in OS X, but Apple previously announced that Oracle would be handling the development of Java for OS X for future OS X releases.
http://www.apple.com/pr/library/2010/11/12Oracle-and-Apple-Announce-OpenJDK-Project-for-Mac-OS-X.html [apple.com]
My guess is that this means Java resources at Apple are probably not significant and could explain why Apple took such a long time to release this patch.
Re: (Score:3)
I'm not sure about the status of the current Java in OS X, but Apple previously announced that Oracle would be handling the development of Java for OS X for future OS X releases.
http://www.apple.com/pr/library/2010/11/12Oracle-and-Apple-Announce-OpenJDK-Project-for-Mac-OS-X.html [apple.com]
Well from your link:
Java SE 7 and future versions of Java for Mac OS X will be available from Oracle. [apple.com]
Then in reference to the update targeting the current malware threat:
Java for OS X Lion 2012-003 delivers Java SE 6 version 1.6.0_31 [apple.com]
Even with the OpenJDK Apple will contribute most of the key components, tools and technology required for a Java SE 7 implementation on Mac OS X [apple.com] so i'm still not sure what you're defining as 'Add ons', you mean anything outside of the kernel?
Re: (Score:2)
NOAA satellite loops are, unfortunately, done in Java and were last updated sometime before half of Slashdot's current user base were born.
Re: (Score:1)
Re: (Score:2)
It's also slow as fuck and pisses me off every time I have to log into my account, but it's an unescapable evil.
Phew (Score:2)
When this debarcle started, I mis-parsed an article heading and was worried Apple was trying to erradicate Flashblock, and had grave fears for the web.
Least priv/option reset without consent is malware (Score:4, Insightful)
They're trying to prevent malware by installing their own malware.
It is absolutely right to disable Java by default. Even the behaviour of disabling it if not used for a while COULD have been a useful feature IF they turned that behaviour on by default then provided an option to disable it. By taking it out of the user's hands they're just playing nanny. But like any nanny stuck in an office many years and many miles away they can't anticipate the needs of their entire userbase very well. They have just made it a pain for any user to use Java in a browser on their platform. No one needs a computer that decides not to obey settings the user had set (no matter how long ago). Think of what would happen if every setting on your computer set to defaults every week or two.
I can think of ways around this that don't require any technical savvy. Put a local Java applet in as your homepage for instance. But this is clunky. You should be able to say "no I really do know better" and turn on Java.
This is the problem when applying the principle of least privilege. It is also the principle of least innovation and the principle of most annoyance. The bottom line is no one needs access to a computer just to live and breath. Least privilege is oxygen, water, basic food. Wouldn't be much of a fun life.
One thing I'd like to know - where does it look? (Score:2)
Within a day of the attack being announced various security blogs (and then Ars Technica) were posting directions for finding if you were infected. Each of those assumed that you'd left Safari and Firefox (and any other browser you might have been using) in the Applications folder. Since I get pissed off wading through jumbled, alphabetical lists of totally different programs, I organise my Applications folder into sub-folders. While I can go and check the programs myself from the command line, from my own
Re: (Score:1)
Oh, you're one of those users that takes it upon themselves to "organize" their Apps folder. You make your Mac support people cry and die a little bit inside.
Re: (Score:2)
But... I don't *have* any Mac support people! Maybe I should go and get some - I'd hate to disappoint them.
Re: (Score:2)
Obviously I could, and probably should, have done this, I agree. In future I think I actually will. It was just a lot quicker to quickly drag and drop things around in Finder than to make a load of links - well, by "a lot" I mean "marginally", but it was quicker. It also didn't occur to me that Apple might occasionally need to patch or scan application folders and might assume a set location...
Pity you posted AC, any of those reading this with mod points should probably give you a few.