Update Your Java to Patch 20 Vulnerabilities Or Just Disable it

Today, Oracle has released its quarterly Critical Patch Update (CPU) for the month of July, as part of its monthly security bulletin, in which it fixes a total of 113 new security vulnerabilities for hundreds of the company’s products.

The security update for Oracle’s popular browser plug-in Java addresses 20 vulnerabilities in the software, all of which are remotely exploitable without authentication, that means an attacker wouldn't need a username and password to exploit them over a network.

MOST CRITICAL ONE TO PATCH FIRST

Oracle uses the Common Vulnerability Scoring System (CVSS) to provide an open and standardized rating of the security holes it finds in its products. One or more of the Java vulnerabilities received the most “critical” rating according to Oracle’s Common Vulnerability Scoring System (CVSS), i.e. base score of 10 or near.

Although, numerous other Oracle products and software components addressed in the latest security updates, which address around 29 vulnerabilities in Oracle Fusion Middleware out of which 27 enable remote code execution, seven vulnerabilities in Hyperion products and five apiece for Oracle database and E-Business Suite. But, Java was the only impacted with security issues scoring the highest critical rating.

So, Java patches are the most urgent and should be at the top of your list, as one of the Java SE vulnerabilities (CVE-2014-4227) in this patch update, scores ten out of ten in the common vulnerability rating system, and seven of the other Java SE client vulnerabilities received a CVSS score of 9.3.

Oracle Database Server will also be updated for five vulnerabilities, one of which is remotely exploitable, while there will be 10 patches released for MySQL Server, but none of them are remotely exploitable.

JAVA WILL CONTINUE TO SUPPORT WINDOWS XP

The company recently announced that it would no longer support Java on Windows XP, though it expect Java 7 to continue to work on Windows XP platform and Oracle security updates for Java on XP machines will continue.

“This end of support announcement has been misread as ‘Java no longer works on Windows XP’ or ‘Oracle will stop Java updates from being applied on Windows XP.’ These statements are not correct,” said Oracle vice-president of product management in the Java Platform Group Henrik Stahl.

“We expect all versions of Java that were supported prior to the Microsoft de-support announcement to continue to work on Windows XP for the foreseeable future. In particular, we expect that JDK 7 will continue to work on Windows XP.”

However, Java 8 is not designed even to install on Windows XP operating system. So, the installer for the developer releases of Java 8 will not run on it without manual intervention.

PATCH OR SIMPLY DISABLE JAVA?

Java runs on more than 850 million personal computers and on billions of devices worldwide, therefore protecting against Java zero-day exploits is a rising concern among millions of Windows, Mac OS, and Linux users.

  Security experts recommend not installing Java if you don't already have it, and perhaps even disable it if you have it if you do not regularly use an application or visit any Web site that requires Java.

UPDATE YOUR SYSTEMS NOW

The company is urging its customers to update their systems as soon as possible. "Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible," the firm warned.

Oracle has published the full details about the list of patches here.

Read More

Project Zero - A Team of Star-Hackers Hired by Google to Protect the Internet

Google has publicly revealed its new initiative called “Project Zero,” a team of Star Hackers and Bug Hunters with the sole mission to improve security and protect the Internet.

A team of superheroes in sci-fi movies protect the world from Alien attack or bad actors, likewise Project Zero is a dedicated team of top security researchers, who have been hired by Google to finding the most severe security flaws in software around the world and fixing them.

PROTECT ZERO vs ZERO-DAY

Project Zero gets its name from the term "zero-day," and team will make sure that zero-day vulnerabilities don't let fall into the wrong hands of Criminals, State-sponsored hackers and Intelligence Agencies.

"Yet in sophisticated attacks, we see the use of "zero-day" vulnerabilities to target, for example, human rights activists or to conduct industrial espionage." Chris Evans said, who was leading Google’s Chrome security team and now will lead Project Zero.

Zero-day vulnerabilities could give bad actors the power to completely control target users’ computers, and in such scenario - no encryption can protect them.

 

RECRUITMENT OF STAR HACKERS

Google has already recruited some hackers at Project Zero:

• Ben Hawkes - an independent researcher from New Zealand, and well known for discovering dozens of bugs in software like Adobe Flash and Microsoft Office.
• George Hotz - best known for hacking Sony PlayStation 3, cracking iPhone and Google's Chrome browser.
• Tavis Ormandy - working as an Information Security Engineer at Google and known for discovering lots of critical zero-day vulnerabilities in various softwares.
• and many more..

Main objective of the Project Zero is to significantly reduce the number of people harmed by targeted attacks.

"We're hiring the best practically-minded security researchers and contributing 100% of their time toward improving security across the Internet." Chris added.

TEAM WORK

However, they are not restricted to finding bugs in Google's products only, rather they can choose targets by themselves strategically, but possibly team would majorly focus on the softwares that relied upon by a significant number of people. Flaw hunting and reporting process will be as mentioned below:

1. The Project Zero team will hunt for zero-day vulnerabilities in Popular Softwares.
2. Google will report flaws to vendors.
3. Google will release full vulnerability disclosure only when the vendor issues a patch for it.
4. Every bug will be filed transparently in an external database.

"We'll use standard approaches such as locating and reporting large numbers of vulnerabilities. In addition, we'll be conducting new research into mitigations, exploitation, program analysis—and anything else that our researchers decide is a worthwhile investment." Chris said.

Google is looking forward to grow their team of security experts and is making every effort to dedicatedly contribute to the Infosec Community.

 

Read More

Motorola Moto E Outshines all the phone under 10000Rs

1. Motorola Moto E:

Again a magical phone from Motorola. The Moto E has got everything you can expect at this price range, it even has additional features you can’t imagine at just Rs. 7,000. This is the best phone under 10,000 Rs. and yet it is cheaper by about 3,000 Rs. than other phones in this list. The Moto E runs on the latest Android 4.4.2 Kitkat and most important is that, Motorola has promised at least one update of the Android when a new version is released. It has a Dual Core Qualcomm Snapdragon 200 A7 processor clocked at at 1.2 GHz and is supported by 1 GB of RAM, the combination of which can handle most everyday needs, multitasking and gaming. The phone has a very good design which is similar to the Moto G. It has a 1980 mAh Li-Ion battery which can last all day. Its camera is not so great but come on…., you are not buying a phone at 7,000 Rs to click high resolution images. Additionally it has water resistance and smudge coating with Corning Gorilla Glass 3. Sometimes, I wonder how Motorola manages to put so many things at such a low price. Overall, it is a perfect all round phone one should buy at this price range and yes, it is better than Micromax Unite 2.

PRICE	6,999 Rs.
OS	Android OS, v4.4.2 (KitKat)
CPU	Dual-core 1.2 GHz, Qualcomm Snapdragon 200 Processor
RAM	1 GB RAM
SCREEN	4.3 inches capacitive touchscreen with Corning Gorilla Glass
DISPLAY	540 x 960 pixels, 256 ppi pixel density
SIM	Optional Dual SIM (Micro-SIM, dual stand-by)
CAMERA	5 MP Primary Camera, No Secondary Camera
MEMORY	Internal Storage 4. microsd expandable upto 32 GB
BATTERY	Non-removable Li-Ion 1980 mAh battery
OTHERS	3G, Bluetooth, WiFi, GPS

 

2. Micromax Canvas 2 A120 Colours:

PRICE	8623 Rs.
OS	Android v4.2 (Jelly Bean)
CPU	1.3 GHz, Quad Core, MT6582 Processor
RAM	1 GB RAM
SCREEN	5.0 inches, Color IPS capacitive touchscreen
DISPLAY	1280 x 720 pixels, 294 ppi pixel density
SIM	Dual SIM (GSM+GSM)
CAMERA	8 MP Primary Camera, Secondary Camera: 2 MP
MEMORY	Internal Storage 4 GB, microsd expandable upto 32 GB
BATTERY	2000 mAH, Li-ion Battery
OTHERS	3G, Bluetooth, WiFi, GPS

 

3. Sony Xperia M:

PRICE	10,799 Rs.
OS	Android OS, v4.1 (Jelly Bean)/ v4.2.2 - C2004/C2005 models, upgradable to v4.3 (Jelly Bean)
CPU	Dual-core 1 GHz Krait, Qualcomm Snapdragon S4 Plus MSM8227 Processor
RAM	1 GB RAM
SCREEN	4.0 inches, TFT capacitive touchscreen
DISPLAY	480 x 854 pixels, 245 ppi pixel density
SIM	Optional Dual SIM (Micro-SIM)
CAMERA	5 MP Primary Camera, 0.3 MP Front Camera
MEMORY	Internal Storage 4 GB, microsd expandable upto 32 GB
BATTERY	Li-Ion 1750 mAh battery
OTHERS	3G, NFC, Bluetooth, WiFi, GPS

 

4. Nokia XL:

PRICE	10,320 Rs.
OS	Android OS, v4.1.2 (Jelly Bean)
CPU	Dual-core 1 GHz Cortex-A5, Qualcomm MSM8225 Snapdragon S4 Play Processor
RAM	768 MB RAM
SCREEN	5.0 inches, IPS LCD capacitive touchscreen
DISPLAY	480 x 800 pixels, 187 ppi pixel density
SIM	Dual SIM (GSM + GSM)
CAMERA	5 MP Primary Camera, 2 MP Secondary Camera
MEMORY	Internal Storage 4 GB, microsd expandable upto 32 GB
BATTERY	Li-Ion 2000 mAh battery (BN-02)
OTHERS	3G, Bluetooth, WiFi, GPS

 

5. HTC Desire 310:

PRICE	9,833 Rs.
OS	Android OS, v4.2.2 (Jelly Bean)
CPU	Quad-core 1.3 GHz Cortex-A7 Mediatek MT6582M Processor
RAM	512 MB RAM
SCREEN	4.5 inches, 218 ppi pixel density
DISPLAY	480 x 854 pixels TFT capacitive touchscreen
SIM	Dual SIM, (Micro-SIM, dual stand-by)
CAMERA	5 MP, 2592х1944 pixels, autofocus, Geo-tagging, touch focus, face detection & Front Camera: 0.3 MP
MEMORY	Internal Storage 4 GB, upto 32 GB microSD expandable
BATTERY	Li-Ion 2000 mAh battery
OTHERS	3G,Bluetooth, WiFi, GPS

 

Read More