{"id":1964,"date":"2012-02-27T21:14:41","date_gmt":"2012-02-27T21:14:41","guid":{"rendered":"http:\/\/daviddilworth.com\/it\/?p=1964"},"modified":"2016-07-15T09:15:22","modified_gmt":"2016-07-15T16:15:22","slug":"javas-security-problems-are-systemic-not-incidental","status":"publish","type":"post","link":"https:\/\/daviddilworth.com\/it\/javas-security-problems-are-systemic-not-incidental\/","title":{"rendered":"Java’s Security Problems are Designed-in. Problems are Not Solvable. I Do NOT Use ROES."},"content":{"rendered":"

What’s with the dangerous insistence on Java ?<\/strong><\/p>\n

\"Don't<\/a>

Don’t Allow Java on Your Computer<\/p><\/div>\n

The programming language Java has a history of serious security problems<\/a>, yet several major photography printing services not only use Java – they FORCE YOU to use Java with online ordering software called ROES<\/a>.<\/strong><\/p>\n

Whats worse, they refuse to accept photograph files for printing sent any other way ! No email, No FTP, some won’t even accept them if you walk in with a CD or a flash drive.<\/strong> These clearly don’t need my business.<\/p>\n

I recommend no photographer should ever order prints online using ROES<\/a> because it requires you install Java on your computer While<\/span> it is connected to the web, only after<\/span> you DISable your anti-virus software<\/strong> <\/em>!<\/p>\n

Are they insane? Don’t they know it only takes seconds for your unprotected computer to get irreversibly infected?<\/strong><\/p>\n

Perhaps they don’t realize millions of Robotic programs are testing every computer connected to the web every few minutes, sometimes every few seconds. When it finds your computer available – zap ! Robots rapidly try to infect your computer so they can silently take control. (Any Bank IT Manager that allows a Java install should get the death penalty.)<\/p>\n

Whatever the case, the photography printing companies are dangerously ignorant or just don’t give a hoot about your computer security.<\/strong><\/p>\n

(Don’t confuse JavaScript<\/a> with Java. They are both programming languages – but they are wholly independent of each other.)<\/p><\/blockquote>\n

Here’s some recent examples of your potential danger if you merely have Java installed (you don’t even have to start up Java – lots of viruses will be happy to do that for you – secretly.) —<\/p>\n

1. January 2013: US Homeland Security Recommends Disabling Java – warns of software ‘vulnerability.’<\/a><\/p>\n

2. Oracle Issues Emergency Java Patch, Feb 9, 2011<\/a><\/p>\n

3. “Oracle issues emergency Java security patch. Hackers exploiting zero day vulnerability, by Gregg Keizer, Computerworld, 16 April 2010”<\/a><\/p>\n

4. Here’s an history of Java’s “serious” security issues: “Securing Java: Attack Applets: Exploiting Holes in the Security Model<\/a>”<\/p>\n

5. And a historical perspective – Java is the most exploited Windows program<\/a>.<\/p><\/blockquote>\n

The problem is the fundamental design of Java.<\/p>\n

If you allow Java to run on your machine it can run any other program on your computer<\/i><\/span>.<\/strong><\/p>\n

Think about that for a moment . . .<\/p>\n

Java can run your Format program and erase everything, or it can allow a Trojan<\/a> to install a Deadly Rootkit<\/a>, or it can CHANGE your data in subtle ways or perhaps the most harmful – it can send a copy of your most valuable information (your client list, your financial data, your Bank passwords) to a hacker or your meanest competitor – anywhere in the world.<\/strong><\/p>\n

Now the “Java Security Manager” is intended to prevent improper and dangerous access. However, any program larger than 100 lines of code inherently has bugs and flaws<\/a>. The bigger the program the more serious the bugs. And Java is a huge program — 30 megabytes<\/strong> in Fall 2012 (including some 166 packages with over six hundred classes with over six thousand methods).<\/p>\n

To be fair, Java was intended to be a powerful programming language. So they put in very high-powered access to computer functions. The trouble is the authors didn’t, and simply can not, adequately protect computers actually connected to the web.<\/strong><\/p>\n

All it takes is one not very skilled cracker<\/strong> – and your system is toast, or your financial data and passwords are in Russia, China<\/strong> and Libya<\/strong> in seconds.<\/p>\n

What to do ?<\/strong><\/p>\n

I disable and remove Java on all our machines that attach to the Web<\/strong> and pleasantly – we’ve never endured a successful attack using Java.<\/p>\n

Update Oct<\/strong> 31, 2012: It gets worse. I tried to do a Java install for a client who had no other option. During install, Java Demanded we disable the anti-Virus guard software<\/i><\/span> – and yet remain connected to the web — or it would not continue !<\/p>\n

Are you kidding !<\/strong><\/p>\n

Again I advised the client not to continue and to find another option. We ended up finding a computer that wasn’t used for normal business and tried to install it on that one. This time Java’s install locked up. So the client gave up and sent the form Fed Express – and his computer security remained intact.<\/p><\/blockquote>\n

As for those “reason challenged” (or dangerously ignorant<\/strong>) photograph printing services that demand we use ROES\/Java<\/strong> – I simply give my printing to businesses run by actual humans that allow us to send files FTP<\/strong> or by email – or OMG – bring them a CD or a flash drive.<\/p>\n

Update Feb<\/strong> 2013:
\nHere’s a note from one of the offending Photography printing businesses :<\/p>\n

“If you have experienced troubles launching ROES<\/strong> in the past 48 hours, this email is for you! We have just received an email from our ROES<\/strong> software provider that an unannounced Apple Java Security<\/strong> update is affecting certain users who are running specific Apple operating systems. We want to first apologize for any mishappenings<\/strong> that you may be experiencing from this unexpected Apple update and second we would like to alert you to our easy solutions, which we describe below.”<\/p><\/blockquote>\n

Surprise ? No. Not to any computer security professional.<\/p>\n

Further reading “Why and How to Disable Java on Your Computer<\/a><\/strong>”<\/p>\n

“Is Java the root of most internet security problems?<\/a>,” by the Examiner, February 20, 2013<\/strong><\/p>\n

Wikipedia article “Criticism of Java”<\/a><\/p>\n

 <\/p>\n

*** To test your browser to see if Java is installed or not — click here<\/a><\/strong><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

What’s with the dangerous insistence on Java ? The programming language Java has a history of serious security problems, yet several major photography printing services not only use Java – they FORCE YOU to use Java with online ordering software … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[3,15,6,13],"tags":[104,107,77,105,108,75,106,39,76,42,40,41],"class_list":["post-1964","post","type-post","status-publish","format-standard","hentry","category-computers","category-doing-evil","category-education","category-privacy","tag-apple-java-security","tag-change","tag-china","tag-deadly-rootkit","tag-ftp","tag-gregg-keizer","tag-java-demanded","tag-java-security-manager","tag-libya","tag-roes","tag-update-feb","tag-update-oct"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/daviddilworth.com\/it\/wp-json\/wp\/v2\/posts\/1964","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/daviddilworth.com\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/daviddilworth.com\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/daviddilworth.com\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/daviddilworth.com\/it\/wp-json\/wp\/v2\/comments?post=1964"}],"version-history":[{"count":81,"href":"https:\/\/daviddilworth.com\/it\/wp-json\/wp\/v2\/posts\/1964\/revisions"}],"predecessor-version":[{"id":2654,"href":"https:\/\/daviddilworth.com\/it\/wp-json\/wp\/v2\/posts\/1964\/revisions\/2654"}],"wp:attachment":[{"href":"https:\/\/daviddilworth.com\/it\/wp-json\/wp\/v2\/media?parent=1964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/daviddilworth.com\/it\/wp-json\/wp\/v2\/categories?post=1964"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/daviddilworth.com\/it\/wp-json\/wp\/v2\/tags?post=1964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}