I Think It’s About Time Oracle Steps It Up

A lot of websites have started to flat out state that Java needs to be uninstalled on most users computers. And they’re not wrong – Java is exploited a ton and sandbox escape exploits in the JRE can lead to attacks that hit users running Windows, OSX, and even Linux. And stopping these attacks as a Windows/OSX user is really difficult (Linux makes it pretty easy).

Oracle needs to be more proactive. Honestly, I don’t see why they’re lagging behind in web security – for God sake Adobe’s even doing better, significantly better.

Oracle needs to implement modern hardening techniques into their JIT and they need to redesign the JRE web plugin to work at Low Integrity (Windows sandbox). Adobe has done this and it’s paid off – Flash isn’t the security hole it used to be, I don’t worry at all about Flash exploits anymore as a Chrome user.

Most attacks against Oracle’s JRE aren’t buffer overflows, they’re simple applets that run code on the system. They break out of the JRE sandbox (all the time) and get access to a large part of the system. Due to the nature of how code runs in the JRE (JIT’d code) things like DEP and ASLR aren’t nearly as important. The key here is to contain the exploit with something built into the operating system.

Hopefully with Windows 8 we’ll see AppContainer usage for Oracle’s JRE. The details on AppContainer aren’t really clear yet but it may provide something decent.

Java just isn’t going to get used if people are afraid to have it installed, and that sucks because it’s actually a really cool language.