News for hackers. Stuff that matters.

A comment on Oracle to issue huge security patch addressing 36 Java vulnerabilities. Parent comment

Re:Oracle to issue huge security patch addressing 36 Java vu... by meowface on Tuesday January 14, 2014 @01:28AM (#7055708)
I agree, it's a local exploit, not a remote exploit (I've debated this with people as well), but in the end Java sandbox bypass exploits are (or were) the most effective local exploit possible. And they're arguably far more valuable than the vast majority of remote exploits out there.

Silent, cross-browser, cross-platform; browser plugin installed by default with anyone who has Java. And that's a huge number of people, since a ton of corporate and residential users have Java installed on all sorts of devices. Java is responsible for a massive ramp up in infections of computer literate and illiterate users alike between 2010 and now.

[ Parent | on HN ]
Re:Oracle to issue huge security patch addressing 36 Java vu... by brazzy on Tuesday January 14, 2014 @04:54AM (#7056210)
An interesting aspect of the whole Java pluigin fiasco is that, as you write, there were very few exploits until a couple of years ago - but the plugin was widely deployed for over a decade before that, and there is no reason to believe that it was somehow more secure before. So why the recent increase?
[ Parent | on HN ]
Re:Oracle to issue huge security patch addressing 36 Java vu... by benmmurphy on Tuesday January 14, 2014 @05:22AM (#7056279)
I think it is a combination of third party bug bounty programs (ZDI, etc) which is causing vulnerabilities to be disclosed to the vendor and the blood in the water effect.
[ Parent | on HN ]
Re:Oracle to issue huge security patch addressing 36 Java vu... by meowface on Thursday January 16, 2014 @10:23PM (#7074092)
Could be a combination of many factors, but probably in part due to security researchers and black hats alike truly realizing the potential damage Java sandbox exploits could cause, in comparison to exploits for Flash or Adobe Reader, which are much more fickle, not cross platform, etc.
[ Parent | on HN ]