New Vulnerability in Java 7!

Hackers have been able to exploit a new vulnerability to Java 7 update 6 to infect computers with malware. This exploit has been found to work in all Java 1.7.x run-time environments. The process is as follows:
1. A redirector is placed in the HTML.
2. At the redirected site, a malicious applet then installs a dropper (Dropper.MsPMs) without any notifications.

This exploit works on both Windows and Mac machines. Secunia rated the vulnerability as extremely critical because it allows the execution of arbitrary code on vulnerable systems without user interaction.

At the Black Hat security conference in July, security researchers warned that Java vulnerabilities are increasingly targetted by attackers. This is because of the widespread use of Java over various platforms and hackers can create exploits without having to worry about various security mechanism.

The largest issue with Java vulnerabilities is not the vulnerabilities themselves. The first issue is people may not install the patch. The second more unsettling situation is that Oracle is one of the most unresponsive vendors at the moment. They avoid communicating openly about security issues or confirming their existence, even to security researchers who report the vulnerabilities to them. Finally, Oracle is slow to respond with patches to prevent the vulnerability, which exposes people to the found vulnerability for longer periods of time.

Google Chrome automatically disables outdated plug-ins that are known to be vulnerable. Chrome also features a "Click to play" feature that requires the user to click on a plug-in embedded on a website in order to run it. This prevents automatic execution of enbedded plug-ins and security experts recommend enabling this. Mozilla has a plug-in blacklist for Firefox and actually used it to block vulnerable Java plug-ins in April in response to widespread attacks targeting a vulnerability in older versions.

Anti-virus programs will only stop this attack if it's recognized and a tool such as MalwareBytes will just prevent you from visiting explouted sites. That won't help if someone puts this exploit on web sites that everyone visits.

The best way to avoid this is to step back to Java 6 unless you really need Java 7. Java 6 is still being maintained. Java 6 update 34 was released August 14th.

Black Hat: Hotel Locks

This year at the Black Hat convention, Mozilla software developer Cody Brocious demonstrated a homebrewed device made for $50 that unlocks hotel rooms. The schematics for the device are open source and available on the Web. The company's locks are found on between four and five million hotel room doors worldwide. Brocious' device plugs into the DC port that is found on the bottom of the outside portion of the lock.

"[It] looks like a standard DC power port you'd see on something like a router," Brocious says. The hack simulates a device used by hotel room operators to program locks to accept certain master keys. The hacking device reads the lock's memory, obtains the cryptographic key information, and then sends that information to the door lock, allowing the hacker to gain entry to the room.

Brocious explains that the key information is easily accessible and not protected, thus allowing his device to obtain it so easily.

Testing a standard Onity lock Brocious ordered online, he was able to easily bypass the card reader and trigger the opening mechanism every time. But on three Onity locks installed on real hotel doors he and Andy Greenberg (from Forbes Magazine) tested, only one of the three opened. The third door took a second try, with Brocious taking a break to tweak his software between tests. But he believes that with more experimentation and tweaking, someone could easily access a significant fraction of hotel rooms around the country without leaving a trace.