CIO Today

CIO Today Network Sites:   Top Tech News  |   CIO Today   |   Mobile Tech Today   |   Data Storage Today
Daily Briefing for Technology's Top Decision-Makers
Eliminate costly downtime!
Find out how with Free White Paper
& enter to win a Samsung Galaxy Note

www.apc.com
Saturday, April 19th 
24/7/365 Network Uptime!
Trending Topics:   Security Heartbleed Big Data Cloud Computing Windows XP Data Centers OS X Mavericks
Home
Enterprise Software
Enterprise Hardware
Big Data
Network Security
Cloud Computing
CRM Systems
Data Storage
Operating Systems
Communications
CIO Issues
Mobile Tech
Chips & Processors
World Wide Web
Business Briefing
After Hours
Press Releases
 
Free Newsletters
Top CIO News
 
Mobile Tech Today
 

Network Security

New Java Security Warning System Criticized as Confusing

New Java Security Warning System Criticized as Confusing
April 18, 2013 1:24PM

Bookmark and Share
Security analyst Paul Ducklin is not thrilled with the numerous combinations of alerts and warnings that now pop up with Oracle's Java security update. "Logo and shield. Triangle and shield. Shield alone. Triangle alone. Confused yet? You're forgiven if you are, because these dialogs end up asking the very questions that you might reasonably expect Java to answer."

BMC is redefining the relationship between I.T. and business. Now I.T. can provide easy access to business services, support and applications -- anywhere, anytime, and from any device. Meaning a more efficient business and an even more innovative I.T. Learn more here.

Oracle on Wednesday issued a critical patch update for Java SE. The bulletin offers 42 new security vulnerability fixes. A whopping 39 of them may be remotely exploitable without user authentication. But this month, it's launch of a new malicious-app warning system that's drawing the most criticism.

Let's review the Java drama, or at least part of it. In just 30 days, Oracle has pushed out three updates to fix critical vulnerabilities in Java -- and the last update was an emergency fix. The company is still working to manage the latest crisis with Java 6.

"This update addresses the vulnerabilities found during the PWN2OWN competition at CanSecWest in Vancouver in March, where Java was exploited by three different security researchers," Wolfgang Kandek, CTO of Qualys, told us. "Oracle also changed the alerts that come up when one runs a Java applet, introducing distinct states giving overall more information on the nature of the applet. The new versions are update 21 for Java version 7 and update 45 for Java version 6."

Warnings About Java Applets

But the update is mostly the same old, same old. What's new is the way the Java browser plug-in behaves. The Java 7 Update 21 changes the plug-in behavior that is supposed to help you make more informed choices before running the Java applet in the browser.

Here's how it works: a security prompt asks for a confirmation before allowing Java content to run in the browser. Oracle said the messages presented depends upon different risk factors, such as using old versions of Java or running applet code that is not signed from a trusted Certificate Authority.

"Apps that present a lower risk display a simple informational message," Oracle said in its Java blog. "This includes an option to prevent showing similar messages for apps from the same publisher in the future."

Java ran through several scenarios of the types of messages -- which include various icons and color coding to explain the risks -- that users may receive and what they mean in practice. Oracle offers screen shots of each scenario, and there are many different possibilities that could appear.

A Confusing Update

Paul Ducklin, a senior security analyst at Sophos, isn't thrilled with the update. He pointed to the numerous combinations of alerts and warnings and said that although Oracle has offered careful explanations of each one, the security ball remains very much in the users' court.

"Logo and shield. Triangle and shield. Shield alone. Triangle alone. Confused yet? You're forgiven if you are, because these dialogs end up asking the very questions that you might reasonably expect Java to answer," Ducklin wrote in a blog post.

"Many users will therefore understandably be tempted to rely on the "Do not show this again" option to deal with these alerts. A better solution, unless you need Java in your browser, and know you need it, is simply to turn it off."

Tell Us What You Think
Comment:

Name:



 Network Security
1. Heartbleed Exploit Could Cost Millions
2. Michaels: Nearly 3M Cards Breached
3. Google Street View Unravels CAPTCHAs
4. Teen Arrested for Heartbleed Hack
5. IBM Adds Disaster Recovery to SoftLayer




 Most Popular Articles
1. BlackBerry Drops T-Mobile After Nasty Spat
2. Cisco, IBM Launch Internet of Things Consortium
3. Salesforce CRM Gets Industry Specific for Internet of Customers
4. IBM Applies Big Data Analytics To Fight Against Fraud
5. Intel Bets on Cloudera for Big Data Analytics

Have an informed opinion on this story?
Send a Letter to the Editor.
We want to know what you think.
Send us your Feedback.

 Related Topics  Latest News & Special Reports

  Galaxy S5 Phone: Less Can Be More
  Heartbleed Exploit Could Cost Millions
  Poll: A Mix of Feelings on Future Tech
  Google, Rockstar Suit Stays in Calif.
  Michaels: Nearly 3M Cards Breached

 Technology Marketplace

Business Intelligence
Get real-time, cloud-based information services with Neustar.
 
Cloud Computing
BMC's I.T. solutions unleash the power of your business
Next Generation Data Center Is Here! Vblock™ Systems from VCE
 
Contact Centers
HP delivers the future of the contact center with HP Qfiniti 10.
 
Data Storage
Next Generation Data Center Is Here! Vblock™ Systems from VCE
Barium Ferrite (BaFe) is the future of tape.
2.5" Enterprise-class SATA & SAS SSDs for server & storage applications
 
Enterprise Hardware
Barium Ferrite (BaFe) is the future of tape.
2.5" Enterprise-class SATA & SAS SSDs for server & storage applications
 
Enterprise I.T.
BMC's I.T. solutions unleash the power of your business
 
Hardware
Protect your network with APC Smart-UPS battery backup
 
Network Security
Protect your network with APC Smart-UPS battery backup
 

Network Security Spotlight
Heartbleed Could Cost Millions, Could Have Been Prevented
Early estimates of Heartbleed’s cost to enterprises are running in the millions. The reason: revoking all the SSL certificates the bug exposed will come at a very hefty price. Some say it all could have been avoided.
 
Michaels Says Nearly 3M Credit, Debit Cards Breached
Arts and crafts retail giant Michaels Stores has confirmed that a data breach at its POS terminals from May 2013 to Jan. 2014 may have exposed nearly 3 million customer credit and debit cards.
 
Google's Street View Software Unravels CAPTCHAs
The latest software Google uses for its Street View cars to read street numbers in images for Google Maps works so well that it also solves CAPTCHAs, those puzzles designed to defeat bots.
 

Enterprise Hardware Spotlight
Vaio Fit 11A Battery Danger Forces Recall by Sony
Using a Sony Vaio Fit 11A laptop? It's time to send it back to Sony. In fact, Sony is encouraging people to stop using the laptop after several reports of its Panasonic battery overheating.
 
Continued Drop in Global PC Shipments Slows
Worldwide shipments of PCs fell during the first three months of the year, but the global slump in PC demand may be easing, with a considerable slowdown from last year's drops.
 
Google Glass Finds a Home in Medical Education, Practice
The innovative headpiece may find its niche in markets where hands-free access to data can be a big advantage. Glass experiments for doctors are already under way, with some promising results.
 

Mobile Technology Spotlight
Review: Siri-Like Cortana Fills Windows Phone Gap
With the new Cortana virtual assistant, Windows catches up with Apple's iOS and Google's Android in a major way, taking some of the best parts of Apple's and Google's virtual assistants, with new tools too.
 
With Galaxy S5, Samsung Proves Less Can Be More
Samsung has produced the most formidable rival yet to the iPhone 5s: the Galaxy S5. The device is the fifth edition of the company's successful line of Galaxy S smartphones, and shows less can be more.
 
Facebook Rolls Out Potentially Intrusive Location-Sharing
Looking for friends? Facebook users in the U.S. will soon be able to see which of their friends are nearby, using a smartphone's GPS. Could be a cool feature in some cases, or way too much information.
 

Navigation
CIO Today
Home/Top News | Enterprise Software | Enterprise Hardware | Big Data | Network Security | Cloud Computing | CRM Systems
Data Storage | Operating Systems | Communications | CIO Issues | Mobile Tech | Chips & Processors | World Wide Web
Business Briefing | After Hours | Press Releases
Also visit these Enterprise Technology Sites
Top Tech News | CIO Today | Mobile Tech Today | Data Storage Today

Services:
FreeNewsFeed | Free Newsletters | XML/RSS Feed

About CIO Today Network | How To Contact Us | Article Reprints | Services for PR Pros (In partnership with NewsFactor) | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 CIO Today. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.