Forest Global Training Partners

Cyber Risks · Krebs on Security

Good Riddance to Oracle’s Java Plugin

Summary: Oracle announced on Jan. 27, 2016 that it was pulling the browser plugin from the next desktop version of Java, Java JRE 9, a step aimed at reducing drive-by download attacks that exploit outdated Java plugins. Krebs notes that roughly 97 percent of enterprise computers and 89 percent of U.S. desktop systems run some form of Java, and that exploit kits such as Angler, Blackhole, Nuclear and Rig have historically targeted outdated Java and Adobe Flash plugins.

Key Takeaway: Exploit kits lie in wait on booby-trapped sites and can silently install malware on visitors without the latest Java plugin, and the 2013 Flashback Trojan used a Java flaw to conscript more than 600,000 Mac OS X systems into a botnet. Krebs expects it will probably be years before various versions of the plugin are mostly removed from end-user systems worldwide, and some businesses still reliant on very old versions of Java will keep using them.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related