Oracle: 'We Have to Fix Java'

eSecurity Planet ^ | 28 January 2013 | Sean Michael Kerner

[ShadowAce]

Over the course of the last two years, Oracle's Java has been exploited time and again as hackers eviscerate the technology, seemingly at will.

As each exploit emerges against Java, Oracle typically responds within a short period of time with a security update, only to have the update exploited within days. While Oracle has pledged with its successive releases that it is improving Java security, the company has not publicly spoken out about the string of exploitation that has crippled confidence in Java in recent months. That is until now.

"As many of you are keenly aware, there has been a veritable media firestorm around the recent Java vulnerability," Reza Rahman, Java EE evangelist at Oracle, blogged. " As you know, the vulnerability pertains to Java on the browser, not server-side Java, desktop Java or emdedded Java. You may also have been frustrated with Oracle's relative silence on the issue."

Oracle's most recent Java patch was issued in early January. The Java 7 update 11 (7u11) release was triggered by zero day attacks against Java. 7u11 followed the 7u10 update by less than a month. Both 7u10 and 7u11 were intended to make Java more secure through the use of a new security control. 7u10 was exploited, and now the 7u11 update has been publicly reported to be at risk as well.

Oracle Speaks

In a call made publicly available by Oracle, the leaders of the Java development group took up the issue of what's wrong with Java today.

"We have to fix Java, and we have been doing that," Oracle Java security lead Milton Smith said during the call.

Smith highlighted the new security slider that debuted in the 7u10 release as being a positive step forward. He also identified the core focus for his team's security efforts.

"A lot of the things we're looking at focus on Java in the browser," Smith said. "That's where we have seen most of the weakness with Java, and that is the concern we are targeting."

While Smith aimed to strike a positive tone about the future direction of Java security, those in the security research community are not as optimistic. HD Moore, CSO of Rapid7 and chief architect of the Metasploit framework, told eSecurity Planet that in his view Smith did not inspire any confidence that Oracle was on the right track or applying the right resources to the problem.

Smith made a number of excuses during the call, including noting that the Java security group is small, that it is difficult to get the message out and that Smith himself is still a little new to the role, Moore pointed out. "It didn't sound like Oracle was providing much support for this team, lead alone bringing in experts on SDLC or security response."

Better Communication Needed

While few actual tangible fixes were discussed during the Java security call, Smith repeatedly highlighted the Java 7u10 update which provided improved controls and a Java security slider.

"Unfortunately all of these features had little impact on the most recent zero-day exploit, which had to be fixed by 7u11," Moore said.

Moore labeled Oracle's recent Java security issues a "communications problem" and said users were not aware of the new features.

"In general, no tangible answers were provided to any of the key questions," Moore said. "The discussion around auto-updates went around for a bit and finally ended up with a discussion of whether it would fit into a Java 8 or Java 9 release."

Andrew Storms, director of security operations for nCircle, echoed Moore's lack of excitement about Oracle's Java security plans. Storms described the Java security discussion as pretty lackluster.

"It's good to finally see Oracle acknowledge that they have a seriousness of the situation," Storms said. "Unfortunately, we needed this admission a year ago before their customers started losing trust in Java security. Now Oracle has a very steep credibility hill to climb."

[ShadowAce]

[ShadowAce]

[proxy_user]

I believe that allowing the use of reflection in Java was an unwise decision. It gives programmers tremendous power, but these classes and methods are much too dangerous in the hands of malicious programmers. At the very least, I would disable the reflection classes and methods in an applet context.

[ShadowAce]

I no longer program for a living—can you explain what a reflection class is? I think I know, based on the name alone, but would appreciate an explanation.

[proxy_user]

A little cut’n’paste:

Uses of Reflection
Reflection is commonly used by programs which require the ability to examine or modify the runtime behavior of applications running in the Java virtual machine. This is a relatively advanced feature and should be used only by developers who have a strong grasp of the fundamentals of the language. With that caveat in mind, reflection is a powerful technique and can enable applications to perform operations which would otherwise be impossible.

Extensibility Features
An application may make use of external, user-defined classes by creating instances of extensibility objects using their fully-qualified names.
Class Browsers and Visual Development Environments
A class browser needs to be able to enumerate the members of classes. Visual development environments can benefit from making use of type information available in reflection to aid the developer in writing correct code.
Debuggers and Test Tools
Debuggers need to be able to examine private members on classes. Test harnesses can make use of reflection to systematically call a discoverable set APIs defined on a class, to insure a high level of code coverage in a test suite.
Drawbacks of Reflection
Reflection is powerful, but should not be used indiscriminately. If it is possible to perform an operation without using reflection, then it is preferable to avoid using it. The following concerns should be kept in mind when accessing code via reflection.

Performance Overhead
Because reflection involves types that are dynamically resolved, certain Java virtual machine optimizations can not be performed. Consequently, reflective operations have slower performance than their non-reflective counterparts, and should be avoided in sections of code which are called frequently in performance-sensitive applications.
Security Restrictions
Reflection requires a runtime permission which may not be present when running under a security manager. This is in an important consideration for code which has to run in a restricted security context, such as in an Applet.
Exposure of Internals
Since reflection allows code to perform operations that would be illegal in non-reflective code, such as accessing private fields and methods, the use of reflection can result in unexpected side-effects, which may render code dysfunctional and may destroy portability. Reflective code breaks abstractions and therefore may change behavior with upgrades of the platform.

[knarf]

Someone once explained RAM to me thusly;

Take a desk you want to work on and clear what you need to do that work
If you learn you need more space after doing what you've done so far, you take that phase of the projecrt off the desk (clearing the space again), go to the shelf you need to get the materiels you need to perform phase two and sit down to work on a clear desk.

THAT works for me (if it's correct)

Can you simplify what you just said for us non techies ?

[proxy_user]

Basically, reflection allows self-modifying code.

All these security exploits have used reflection in sneaky ways to get access to classes and data they’re not supposed to have access to.

[dfwgator]

I work a lot with server-side Java, but there is NO WAY I would advocate using Java in the browser.

[bmwcyle]

Yes, and I hope they do it soon. I am tired of Retina crapping all over it.

[ShadowAce]

...but there is NO WAY I would advocate using Java in the browser.

We use it internally here. We use HP servers with ILO licensed, and we access the ILO with JVM or .NET.

[knarf]

But ... what is reflection ?

[ShorelineMike]

Perhaps an analogy will help.

***
Scenario: Pointy-Headed Boss (PHB) says to Dilbert: “I need an employee to do ImpossibleTask. And no, you may not hire a new employee from outside.” Dilbert frantically searches the list of employees that he manages for one with the capability of handling ImpossibleTask, and tells that employee to perform ImpossibleTask on PHB’s behalf.
***

Dilbert is the “reflection class” for PHB in this scenario. He can “see into” the capabilities of the employees that he manages and “reflect” those capabilities back to PHB.

PHB doesn’t (have to) know (or care) which employee actually performs ImpossibleTask, as long as Dilbert finds one that does.

In sum, a “reflection” class has the capability of inspecting the attributes (data) and behaviors (actions) of another class and providing that information to another class that requests it.

[AFPhys]

This is such a “Duh” headline. If Java is not locked down somehow for internet transmission and use, it will be relegated to the dustbin of history. People are now associating it with big trouble under all circumstances, despite it really having problems only when being downloaded by websites. It is too technical for most people to realize that Java programs that they have been using for years and are resident on their computers are not affected by the malware exploits.

[central_va]

"Java Reflection makes it possible to inspect classes, interfaces, fields and methods at runtime, without knowing the names of the classes, methods etc. at compile time. It is also possible to instantiate new objects, invoke methods and get/set field values using reflection."

Java Reflection Tutorial

[dfwgator]

Here is the problem with reflection:

field.setAccessible(true);

[I want the USA back]

Top management never wants to admit it’s wrong.

Besides, I don’t like Larry Ellison.

[dfwgator]

C# also uses Reflection.

[knarf]

So .. an outsider (hacker) can be called by dilbert or the hacker IS dilbert?

[JoeProBono]