News for hackers. Stuff that matters.
Re:Java 6 exploit found in the wild by pilif on Tuesday August 27, 2013 @10:17AM (#6283532)
My cynical self would say that this is the perfect training for when XP runs out of support next April. Just because their vendor dropped support doesn't mean that usage will suddenly stop nor does it mean that no exploits are going to be found and used.

Right now it's "just" Java 6 which isn't installed on every machine out there (but still on a huge part of all Java capable machines). Next year it will be Windows XP which still has between 40% and 80% usage.

Me personally, I'm really interested how this is going to turn out. Will we see unofficial patches? Will we see anti virus vendors step up and provide semi-official patches? Will vendors have to cave and continue issuing patches? Will the malware issue just be ignored? What kind of damage does need to happen before something changes?

Re:Java 6 exploit found in the wild by commandar on Tuesday August 27, 2013 @10:22AM (#6283564)
I'm in healthcare. We have a number of clinical applications that are only officially supported on J6 (and sometimes they even go so far as specifying specific updates that are supported). They actually work just fine on J7, it just requires tweaking a couple of security settings. But getting that across to non-technical managers that have had "You must be running J6u17" beat into their heads by idiot vendors is a bit of a nightmare.
Re:Java 6 exploit found in the wild by bilbo0s on Tuesday August 27, 2013 @10:53AM (#6283767)
Guy...

the non-technical managers understand that the FDA only approved the J6 version of the app. If you want to use J7, you have to resubmit to the approval process.

The law is there for a reason.

SOME apps it won't matter... like maybe some billing or hospital transportation apps or something... but certainly anything diagnostic in nature cannot be run in a manner in which it was not approved.

Re:Java 6 exploit found in the wild by commandar on Tuesday August 27, 2013 @12:41PM (#6284537)
> but certainly anything diagnostic in nature cannot be run in a manner in which it was not approved.

Which is why biomedical engineering and IT are different departments. IT doesn't touch anything that directly touches a patient.

Re:Java 6 exploit found in the wild by JohnTHaller on Tuesday August 27, 2013 @11:40AM (#6284101)
J6u17 is honestly fine on a machine disconnected from the internet, as would be the case in any critical equipment requiring it. It's even relatively fine on an internet-connected machine with the browser plugin disabled (heck, Firefox automatically disables it for you).
Re:Java 6 exploit found in the wild by commandar on Tuesday August 27, 2013 @12:39PM (#6284520)
>J6u17 is honestly fine on a machine disconnected from the internet, as would be the case in any critical equipment requiring it.

One of the applications I'm talking about is a physician portal meant specifically to be used over the public internet.

Re:Java 6 exploit found in the wild by JohnTHaller on Tuesday August 27, 2013 @01:02PM (#6284659)
> One of the applications I'm talking about is a physician portal meant specifically to be used over the public internet.

Ouch. That just screams 'this company doesn't understand security at all'.

Re:Java 6 exploit found in the wild by rthomas6 on Tuesday August 27, 2013 @10:35AM (#6283644)
Maybe somebody will make a virus using an XP exploit that does nothing but patch the known exploits, propagate to other XP machines, and then delete itself.
Re:Java 6 exploit found in the wild by superuser2 on Tuesday August 27, 2013 @11:49AM (#6284169)
I'm hoping that after one or two well-publicized and catastrophic breaches, management will realize that it doesn't make business sense to let critical infrastructure rot. I can't wait for the incredible improvements that would follow from no longer depending on applications that were frozen in time 14 years ago.

This might finally be the end of IE6.

Re:Java 6 exploit found in the wild by anonymfus on Tuesday August 27, 2013 @10:30AM (#6283621)
>Next year it will be Windows XP which still has between 40% and 80% usage.

Source?

Re:Java 6 exploit found in the wild by pilif on Tuesday August 27, 2013 @10:34AM (#6283638)
The web log files of the three largest B2B purchasing platforms for gastronomy products in Switzerland. And http://www.tomshardware.com/news/Windows-8-Windows-XP-Market... (first link in Google)
Re:Java 6 exploit found in the wild by superuser2 on Tuesday August 27, 2013 @11:56AM (#6284227)
40-80% usage in healthcare, the single slowest-moving IT environment there is (well, maybe industrial controls and space travel, but those aren't typically targeting Windows).
Re:Java 6 exploit found in the wild by yuhong on Tuesday August 27, 2013 @07:14PM (#6286922)