Microsoft Warns Java Exploits Hit 'Unprecedented Wave' - InformationWeek
Government // Enterprise Architecture
12:57 PM
7 Key Cloud Security Trends Shaping 2017 & Beyond
Dec 15, 2016
Cloud computing is enabling business transformation as organizations accelerate time to market and ...Read More>>

Microsoft Warns Java Exploits Hit 'Unprecedented Wave'

With more than 6 million attacks on vulnerable code in the third quarter, Microsoft is urged to distribute a patch.

Slideshow: Cloud Security Pros And Cons
Slideshow: Cloud Security Pros And Cons
(click image for larger view and for full slideshow)
The third quarter saw more than 6 million Java and PDF exploit attempts, according to the Microsoft Malware Protection Center. That number marked a sharp increase from 2009 and early 2010, when such attacks were more on the order of hundreds of thousands per quarter -- not millions.

However, despite the sharp increase -- mostly involving just three Java vulnerabilities, long since patched -- almost no one has been discussing this trend, said Holly Stewart of the Microsoft Malware Protection Center.

Why is that? The likely scenario is because IDS and IPS vendors, "who are typically the folks that speak out first about new types of exploitation, have challenges with parsing Java code," she said.

Stewart added, "Think about incorporating a Java interpreter into an IPS engine. The performance impact on a network IPS could be crippling. So, the people that we expect to notice increases in exploitation might have a hard time seeing this particular spectrum of light. Call it Java-blindness."

The second reason it hasn't been getting much attention, she said, is that Java exploits make up only a fraction of malware attacks, such as those involving Zeus. But they're still a threat. "What we have to remember is that, with exploits, it's not just about volume -- they happen in a flash and you have to catch them in the act … before they open the door to lots of malware," she said. "So, even small numbers, especially when they're against unpatched vulnerabilities, matter a lot." The problem is also that Java users largely don't patch, at least not quickly. Indeed, according to Wolfgang Kandek, CTO of Qualys, his company's research has found that 80% of workstations have Java installed, and half of those use a version with known critical vulnerabilities. Accordingly, that makes Java not only "the most vulnerable plug-in of all," but also gives malware "an excellent chance to install itself and control the targeted machine," he said.

What can be done to eliminate insecure Java? Kandek suggests more collaboration among vendors. "A possible solution is to include Java in an existing automated update process," said Kandek. "It would be ideal if Oracle/Sun could collaborate with Microsoft" and, in particular, use Windows Server Update Services to distribute Java fixes.

In fact, "if this mechanism could then be extended to all major software vendors, the Internet would become increasingly safer to use for all of us," he said.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
Top IT Trends to Watch in Financial Services
IT pros at banks, investment houses, insurance companies, and other financial services organizations are focused on a range of issues, from peer-to-peer lending to cybersecurity to performance, agility, and compliance. It all matters.
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Join us for a roundup of the top stories on for the week of November 6, 2016. We'll be talking with the editors and correspondents who brought you the top stories of the week to get the "story behind the story."
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll