OT - But Important: Really Nasty Web Security Problem Found

Tim Daneliuk wrote:

> http://www.theregister.co.uk/2012/08/27/disable_java_to_block_exploit/
>
>
> If you are running Windows, check which browser you are running
> and TURN OFF JAVA. You can research how to do this for whatever
> browser (Microsoft Explorer, Google Chrome, or Firefox) you're using
> by Googling for instructions. If you do not know how to do
> this (you probably shouldn't be on the web at all), ask
> someone who does.
>
> If you're using a Mac, you still turn off Java because the same
> thing can be used to attack Macs.
>
> When you turn off Java it means that certain web sites will not
> work properly because they depend on it. If you are 100% certain
> the site is OK, then turn Java on just for that one site.
>
> This will not go away until Java itself is upgraded.


Which is one of the many reasons I run Linux.

Deb

"Tim Daneliuk" <[email protected]> wrote in message
news:[email protected]...
> http://www.theregister.co.uk/2012/08/27/disable_java_to_block_exploit/
>
>
> If you are running Windows, check which browser you are running
> and TURN OFF JAVA. You can research how to do this for whatever
> browser (Microsoft Explorer, Google Chrome, or Firefox) you're using
> by Googling for instructions. If you do not know how to do
> this (you probably shouldn't be on the web at all), ask
> someone who does.
>
> If you're using a Mac, you still turn off Java because the same
> thing can be used to attack Macs.
>
> When you turn off Java it means that certain web sites will not
> work properly because they depend on it. If you are 100% certain
> the site is OK, then turn Java on just for that one site.
>
> This will not go away until Java itself is upgraded.
> --


no-script is your friend
you'll be amazed how much sh*t runs on a page and what you can block
http://noscript.net/

"Tim Daneliuk" <[email protected]> wrote in message
news:[email protected]...
> On 08/28/2012 07:26 PM, ChairMan wrote:
>> "Tim Daneliuk" <[email protected]> wrote in message
>> news:[email protected]...
>>> http://www.theregister.co.uk/2012/08/27/disable_java_to_block_exploit/
>>>
>>>
>>> If you are running Windows, check which browser you are running
>>> and TURN OFF JAVA. You can research how to do this for whatever
>>> browser (Microsoft Explorer, Google Chrome, or Firefox) you're using
>>> by Googling for instructions. If you do not know how to do
>>> this (you probably shouldn't be on the web at all), ask
>>> someone who does.
>>>
>>> If you're using a Mac, you still turn off Java because the same
>>> thing can be used to attack Macs.
>>>
>>> When you turn off Java it means that certain web sites will not
>>> work properly because they depend on it. If you are 100% certain
>>> the site is OK, then turn Java on just for that one site.
>>>
>>> This will not go away until Java itself is upgraded.
>>> --
>>
>>
>> no-script is your friend
>> you'll be amazed how much sh*t runs on a page and what you can block
>> http://noscript.net/
>>
>>
>
> It's not clear whether noscript blocks both Java and JavaScript
> (not clear to ME - it's clear to others no doubt). This is a *Java*
> vulnerability. As a point of interest, Java has nothing whatsoever
> to do with JavaScript.
>
> --

NoScript Firefox extension provides extra protection for Firefox, Seamonkey
and other mozilla-based browsers: this free, open source add-on allows
JavaScript, *Java*, Flash and other plugins to be executed only by trusted
web sites of your choice (e.g. your online bank)

All I can tell you is that by using it I've had pages that won't load until
i start allowing 1 item at a time
YMMV

On 08/28/2012 07:26 PM, ChairMan wrote:
> "Tim Daneliuk" <[email protected]> wrote in message
> news:[email protected]...
>> http://www.theregister.co.uk/2012/08/27/disable_java_to_block_exploit/
>>
>>
>> If you are running Windows, check which browser you are running
>> and TURN OFF JAVA. You can research how to do this for whatever
>> browser (Microsoft Explorer, Google Chrome, or Firefox) you're using
>> by Googling for instructions. If you do not know how to do
>> this (you probably shouldn't be on the web at all), ask
>> someone who does.
>>
>> If you're using a Mac, you still turn off Java because the same
>> thing can be used to attack Macs.
>>
>> When you turn off Java it means that certain web sites will not
>> work properly because they depend on it. If you are 100% certain
>> the site is OK, then turn Java on just for that one site.
>>
>> This will not go away until Java itself is upgraded.
>> --
>
>
> no-script is your friend
> you'll be amazed how much sh*t runs on a page and what you can block
> http://noscript.net/
>
>

It's not clear whether noscript blocks both Java and JavaScript
(not clear to ME - it's clear to others no doubt). This is a *Java*
vulnerability. As a point of interest, Java has nothing whatsoever
to do with JavaScript.

--
----------------------------------------------------------------------------
Tim Daneliuk [email protected]
PGP Key: http://www.tundraware.com/PGP/

On 08/29/2012 08:29 AM, Dr. Deb wrote:
> Tim Daneliuk wrote:
>
>> http://www.theregister.co.uk/2012/08/27/disable_java_to_block_exploit/
>>
>>
>> If you are running Windows, check which browser you are running
>> and TURN OFF JAVA. You can research how to do this for whatever
>> browser (Microsoft Explorer, Google Chrome, or Firefox) you're using
>> by Googling for instructions. If you do not know how to do
>> this (you probably shouldn't be on the web at all), ask
>> someone who does.
>>
>> If you're using a Mac, you still turn off Java because the same
>> thing can be used to attack Macs.
>>
>> When you turn off Java it means that certain web sites will not
>> work properly because they depend on it. If you are 100% certain
>> the site is OK, then turn Java on just for that one site.
>>
>> This will not go away until Java itself is upgraded.
>
>
> Which is one of the many reasons I run Linux.
>
> Deb
>

Look more closely. The exploit applies to Linux as well. It's just
that they have not (yet) seen a Linux payload.
--
-----------------------------------------------------------------------
Tim Daneliuk