UPDATE:

This article over on ZDNet explains in detail how Oracle tricks users into installing third-party software malware, specifically when updating Java. You need to be aware and defend your systems against these aggressive and deceptive practices. Bottom line: Avoid using Java if you can. If you must use Java, disable the plugins in your browsers and be on the defensive every time you do an update.

The Computer Security community is abuzz with last week’s news that the Java software that resides on many computers is highly vulnerable and may be beyond fixing.

Soft Target

The ubiquitous Java software from Oracle has been a long time favorite target for hackers. Last week, two specific vulnerabilities (referred to as zero-day vulnerabilites) were identified by Oracle and patches released. Specific threats from the vulnerabilities include malware and identity theft. But many critics claim that additional vulnerabilities exist and it may be years before all the holes can be patched (if ever).

Be CERTain

As a result, the United States Computer Emergency Readiness Team (US-CERT) (part of the US Department of Homeland Security) advised all computer users to immediately disable Java within their browsers on any platform, including Windows, Mac, Linux, and Solaris. That seems like good advice, but how do you actually do that?

A Simple How-To

Well, depending on the version of Java you have installed, it may be possible to disable it in your browser or you may need to turn it off at the system level. Details are here on the Java website.

What We Recommend

Communications Diversified recommends uninstalling Java where it is not needed. We also recommend if you do need to use Java, only enable it in the browser and for the time period you need it. Keep it disabled at all other times. Visit only trusted sites while Java is enabled. As with any software, be sure to keep your Java software updated to the latest release so you have the latest security patches.