Post by: dakota on April 02, 2012, 08:20:34 PM
Post by: Xairbusdriver on April 02, 2012, 08:46:51 PM
The last Java update for Tiger was back on <June 28, 2011>. Apple no longer maintains Java for Mac OSs, I think you need to go to Oracle/Sun for them now. Unless you installed Java on Lion, it's not even there. Apple said they were discouraging the use of Java back in 2010.Are you referring to this <malware reported a few weeks ago at TS>?
Post by: dakota on April 02, 2012, 09:08:34 PM
Post by: dakota on April 02, 2012, 09:17:26 PM
Post by: Paddy on April 02, 2012, 09:29:29 PM
This? http://www.pcworld.com/article/253036/new_...t_password.html
Anyway - this has been mentioned several times now here on TS - Gunug posted about it too, although it seems like there is a newer variant which doesn't require any installation. I'm still a little unclear on HOW it gets on your Mac (the details provided by the articles I've read have been distinctly sketchy - some say just visiting an infected/malicious site - but the mechanism itself isn't explained). Just disable Java. See: http://www.f-secure.com/weblog/archives/00002330.html for instructions. It's not needed for most websites, though some game sites use it (and there may be some online banking sites that require it, though I haven't come across it). Test to see if your browser has Java enabled here: http://www.internet-problems.com/javascript.asp Please remember that JAVA is different from JAVASCRIPT! Many, many websites use javascript, which is NOT what this is about.
If you're running Lion and never installed Java as a separate install, then don't worry about it.
More info: http://krebsonsecurity.com/2012/03/new-jav...-exploit-packs/
Post by: jchuzi on April 03, 2012, 05:43:01 AM
Post by: Jack W on April 03, 2012, 08:55:34 AM
BTW, I still dislike how Repair Permissions on 10.6.8 reports all those Java repairs, and sometimes changes them, and then changes them back again.
At least it seems that way.
Post by: Xairbusdriver on April 03, 2012, 02:05:22 PM
QUOTE
Is there any site where we Mac users can download the update?????
First, you don't need any update if you've disabled/removed Java. Very few current apps use it. I only know of one that I had and I replaced it around the middle of last year.Second, if you have an app that actually uses Java (or some website that does) seek a replacement and/or complain to the developer(s). But Apple still has updates for Tiger. Leopard, Snow Leopard and Lion at it's Support site. Just type "Java update" in the search field on their site and you'll get a list of them.
Lastly, I think I include some Terminal commands to see if you have been "awarded" any of the "prizes!"
Post by: kimmer on April 03, 2012, 06:56:28 PM
QUOTE(Xairbusdriver @ Apr 3 2012, 11:05 AM) <{POST_SNAPBACK}>
First, you don't need any update if you've disabled/removed Java.
Not sure how to remove it? But I launched the java runtime app, found lots of things checked. I unchecked and maybe I turned off stuff I shouldn't. Here's what my windows look like now:
General window: I found both clicked on, so I unclicked them. Is this the correct setting?
[attachment=2529:java_general1.png]
This looks the same:
[attachment=2532:java_security2.png]
I unclicked "keep temp files"
[attachment=2533:java_network3.png]
Shortcut was set to "always allow", I set to never allow. Is this the correct setting?
[attachment=2534:j_advanced1.png]
I deselected everything under security. Again, this the correct setting?
[attachment=2530:j_advanced2.png]
I left verify as it was. Is this the correct setting?
[attachment=2531:j_advanced3.png]
If I have anything wrong, please let me know.
And now back to my aches, pains, sniffling, sneezing, coughing, wheezing "it's going around" bug ....
Post by: Paddy on April 03, 2012, 08:38:42 PM
http://reviews.cnet.com/8301-13727_7-57408...alware-exploit/
http://support.apple.com/kb/DL1515?viewloc...mp;locale=en_US (Lion)
http://support.apple.com/kb/DL1516 (Snow Leopard)
Post by: dakota on April 03, 2012, 11:06:33 PM
Post by: Paddy on April 04, 2012, 07:19:20 AM
Me? I'd suggest downloading the updates so you do have them if you need them, but leave Java turned off in Safari if you don't need it. That way, you have the updated version should you ever need it.
See: http://hints.macworld.com/article.php?stor...110730113328796 for some of the discussion re: Java/Lion.
Post by: dakota on April 04, 2012, 08:03:57 AM
Post by: Paddy on April 04, 2012, 08:33:08 AM
QUOTE(dakota @ Apr 4 2012, 09:03 AM) <{POST_SNAPBACK}>
Thanks for the info. What is puzzling is that there is no option to turn off Java in Safari on my computer with 10.7. That's why I'm having trouble figuring out why this fix came up as an available update.
Are you sure? I have Java installed, so can't tell you what the original preferences pre-Java looked like, but in Safari, you should see it under Security. Of course, if you don't have it installed, then perhaps that option isn't there?
If you want/need Java and don't have it installed yet, you can do so via Utilities->Java Preferences.app (see Kimmer's screenshots).
Post by: Paddy on April 04, 2012, 09:09:23 AM
QUOTE(Xairbusdriver @ Apr 3 2012, 03:05 PM) <{POST_SNAPBACK}>
QUOTE
Is there any site where we Mac users can download the update?????
First, you don't need any update if you've disabled/removed Java. Very few current apps use it. I only know of one that I had and I replaced it around the middle of last year.Second, if you have an app that actually uses Java (or some website that does) seek a replacement and/or complain to the developer(s).
Er, Jim...Java is not inherently evil, you know (of course, there are some programmers who don't like it - but there are probably just as many or more who don't like C++)
A number of Adobe applications require it for various functions and will either crash or not work properly if you don't have it. JAlbum, the superb cross-platform web album builder is written entirely in Java. ThinkFree, a free, cross-platform alternative to Microsloth Office, is written entirely in Java.
My point is - if you really want to avoid it, you could, but you'd also be avoiding the most commonly-used professional design applications in the universe (Adobe Creative Suite) as well as some of the free ones, like OpenOffice and LibreOffice, and some pretty nifty Java apps like JAlbum, along with occasional web sites which use Java-powered virtual tours etc., or online games, if you're into that sort of thing.
Yes, there have been some security holes...but you can say that of a boatload of other applications/technologies too.
Some of us DO need Java to get our work done, and don't feel that there are adequate substitutes out there and/or that the occasional security issue is enough to send us looking for alternatives.
Stay on top of software updates (DO read the explanations, though - don't blindly download and install), don't EVER install anything suggested by visiting a website, unless you really know and understand what you're doing, and don't visit dodgy websites in the first place.
Post by: Xairbusdriver on April 04, 2012, 11:46:45 AM
Here's a screen shot of the Safari Java settings.
[attachment=2535:Safari_J...settings.gif]
BTW, who said it was "evil?" Not me. But Apple has been discouraging its use for several years. That's warning enough for most developers, I would think. Those that refuse to read the "writing o the wall" just don't care about Mac users, IMHO. That's why I looked for a replacement for the financial software that was a replacement for that other Mac "stalwart," Quicken. Java is/was great for building cross-platform apps, but its obviously slower than native code and doesn't always make use of the built-in APIs, so why depend on it? That's why I suggest complaining/dropping any app that requires it; voting with the wallet.
Interweb use is another matter, it amazes me that some sites (banks?!) use Java as a "security" measure! To my mind, using a known malware vector for "security enhancement" is a sign of lazy developers/ignorant IT/"it's the way we've always done it" thinking. "Stupid is not always 'evil' but it's still stupid!"
I wasn't aware that JAlbumn used of Java, I figured the "J" was for javascript, which I avoid, also, particularly on a website. Only time I am tempted is for CSS alternatives for IE, but I figure those users can "enjoy" their problems until MS figures out their 800 pound gorilla is on a speed diet! But I don't have to support any commercial clients, fortunately. Nor do I need any support for anything in MS Office, again, fortunately.
All that said, Java is available for those who want/need it. But the user is the one responsible for keeping it up-to-date. If you want to use it, know how to keep it up-to-date and stop expecting Apple to do it for you. They have made it clear they no longer support it. Frankly, this update seems pretty fast to me, the posting I made about it is only a few weeks old.
Post by: kimmer on April 04, 2012, 02:14:02 PM
NOW ... please give me some guidance here. Since I'll need java to run OpenOffice I turned java back on (see 1st screen shot). It seemed to be an "all or nothing" type of thing so both versions are enabled, but I guess that's okay. I also turned on the temp file button. Where I'm totally confused now is what do I turn back on under security and verify? See my last 3 screen shots for more info.
This is an interesting discussion. Thanks.
Post by: Xairbusdriver on April 04, 2012, 03:16:26 PM
I haven't actually tried disabling it and turning it back on, but those prefs should stay set between times. BTW, I have practically all those items in the next to last shot checked! Further, I did the update earlier and I'm not seeing any changes in speed.
You might try tapping the side of your iMac (not too hard, mind you) to see if you have any stuck electrons. 
Post by: krissel on April 06, 2012, 09:25:12 PM
http://arstechnica.com/apple/news/2012/04/...d=related_right
Turning Java off in my browsers is one of the first things I do when I set up a new one. Haven't really run into much need to activate it.
Post by: Xairbusdriver on April 06, 2012, 10:01:52 PM
And probably the "intelligence" area, also. 
I'm sure much of the paranoia about AV developers creating malware just to prove you need their software is just that: paranoia. But I find it incredible that anyone would suggest visiting a site in a location known for delivering more malware than anywhere else in the galaxy in order to determine ones computer 'health!'. Updates the old saying a little: "The 'bear' is guarding the hen house!?" Has anyone seen even a link to a site that purports to know of someone who has seen a computer that is actually infected?
Post by: Paddy on April 07, 2012, 06:09:34 PM
And in another discussion, the claim that 600,000 Macs are infected is discussed:
http://www.ehmac.ca/mac-ipod-help-troubles...an-alert-9.html
Post by: Xairbusdriver on April 07, 2012, 08:41:23 PM
And I'm not about to visit his webb site! I think his(?) site has cross-hairs!
Post by: Paddy on April 08, 2012, 11:15:36 AM
https://www.securelist.com/en/blog/20819344...otnet_confirmed
Post by: kimmer on April 08, 2012, 02:31:51 PM
Now, if I'm correct, a user can figure out easily if their Mac is infected by running 3 simple terminal commands.
QUOTE(Xairbusdriver @ Apr 2 2012, 05:46 PM) <{POST_SNAPBACK}>
Are you referring to this <malware reported a few weeks ago at TS>?
I've run those commands (as has Sneakers), and our iMac's are clean, but how do we keep them clean?
I'd really appreciate someone who understands all this to do a nice, clean, short summary.
Post by: Xairbusdriver on April 08, 2012, 04:08:32 PM
This is a security problem that was found in Java. I try to always capitalize it and often add a parenthetical comment that it is not "javascript." Perhaps this except from Wikipedia will help:
QUOTE
Java is a programming language originally developed by James Gosling at Sun Microsystems (which has since merged into Oracle Corporation) and released in 1995 as a core component of Sun Microsystems' Java platform...Java applications are typically compiled to bytecode (class file) that can run on any Java Virtual Machine (JVM) regardless of computer architecture...It is intended to let application developers "write once, run anywhere" (WORA), meaning that code that runs on one platform does not need to be recompiled to run on another. Java is currently one of the most popular programming languages in use, particularly for client-server web applications, with a reported 10 million users.
Note that "client-server" applications are not what most people use on their personal computers.I also try to always use lower-case for javascript, often emphasizing the "script" part. Again, from Wikipedia:
QUOTE
JavaScript was formalized in the ECMAScript language standard and is primarily used in the form of client-side JavaScript, implemented as part of a Web browser in order to provide enhanced user interfaces and dynamic websites. This enables programmatic access to computational objects within a host environment.
Basically, javascript is not a compiled language. It is merely a text file that your browser uses and interprets to do certain things. It's most widely seen use my regular computer users is in a browser to create actions/behaviors on a web site.Finally, there is Flash®. I usually add the "®" or "™" symbol to make it plain that it is a product of some company, namely Adobe, Inc.
They are all three separate "animals" all with their own set of problems and best uses. The basic, generalized, key differences:
Java is maintained by Oracle, make it "easy" to write something that will run on any computer that has a virtual machine designed for it.Read the Wikipedia for more detailed explanations...if you really want to know! :wall bash:
javascript is simply a text file, just like 99% of what any web site uses. It usually needs your browser to interpret it in order to do anything.
Flash™ is well named as it mainly adds "fluff" to a site and seldom useful decoration/animation to something. That's my opinion, of course! :get sick: It became more and more difficult to make it work on the evolving OSs for computers/tablets/phone/etc.
I suspect we all aren't reading new threads as they appear and it may be because we come to TS via different methods. This sometimes leads to duplicate topics in multiple threads. Keeping things organized is why we pay the Administrators the big bucks!
Post by: Xairbusdriver on April 08, 2012, 04:14:32 PM
QUOTE
how do we keep them clean?
Generally, the same way you avoid all other web-transmitted malware: Avoid untrusted sites, never click an email link, never but pirated software, etc. Of course, you can turn most of these off or simply avoid using them. javascript has several Add-Ons/Plugins available for most browsers that will block it or allow you to let it run, same for Java and Flash. But some sites simply won't be usable without one or all three. Hopefully, HTML5 and CSS3 will help put an end to most javascript. Flash is finally showing its age and lack of wide support and may disappear even before javascript. Java will probably last much longer, if only because it is running on servers.
Post by: Paddy on April 08, 2012, 06:50:45 PM
QUOTE
This malware was initially found in September 2011 while being distributed as a fake Flash Player installer (hence its "Flashback" name). In in the past few months it has evolved to exploiting Java vulnerabilities to target Mac systems.
While the exploits used by recent variants of the Flashback malware have been for older, patched vulnerabilities, over the weekend another variant surfaced that appears to be taking advantage of Java vulnerability (CVE-2012-0507) that currently is unpatched in OS X.
For OS X systems with Java installed, simply visiting a malicious Web site containing the malware will result in one of two installation routes, both of which have been characteristic of prior variants of the malware. First it will ask for an administrator password, and if supplied it will install its payload into target programs within the /Applications folder. However, if no password is supplied, then the malware will still install to the user accounts where it will run in a more global manner.
While the exploits used by recent variants of the Flashback malware have been for older, patched vulnerabilities, over the weekend another variant surfaced that appears to be taking advantage of Java vulnerability (CVE-2012-0507) that currently is unpatched in OS X.
For OS X systems with Java installed, simply visiting a malicious Web site containing the malware will result in one of two installation routes, both of which have been characteristic of prior variants of the malware. First it will ask for an administrator password, and if supplied it will install its payload into target programs within the /Applications folder. However, if no password is supplied, then the malware will still install to the user accounts where it will run in a more global manner.
So, it would appear that it doesn't just install with no warning whatsoever - there is that initial request. However, it will install itself with no password if none is supplied. I would suggest that if you happen upon a web site that wants to install something (just about anything) just because you've visited the site, that you leave the site immediately.
As for how to disable Java on Chrome, see:
http://www.podfeet.com/wordpress/tutorials...java-in-chrome/
In Firefox:
http://support.mozilla.org/en-US/kb/How%20...0Java%20applets
Hope that helps.
I have Java enabled, but turned off in my browsers. I do need Java for various things (some Adobe apps require it, as does JAlbum) but don't generally need it for browsing the web. Do note that some online banking sites require Java and I know that one exception I have in my Java preferences is for a government of Canada web site. Obviously, on trusted sites such as these, you shouldn't have to worry.
Post by: kimmer on April 08, 2012, 08:37:18 PM
QUOTE(Paddy @ Apr 8 2012, 03:50 PM) <{POST_SNAPBACK}>
Kimmer, your confusion may have something to do with the original way this trojan spread - it was part of a fake Flash installer.
Yes, thanks! I might have figured this out in a few days, but I'm rummy from the cough syrup. At least that's my excuse.
QUOTE
I would suggest that if you happen upon a web site that wants to install something (just about anything) just because you've visited the site, that you leave the site immediately.
times 10!Thanks for the info on Chrome and FF. My prefs were a bit different in Chrome, but I figured it out from the info presented.
QUOTE
I have Java enabled, but turned off in my browsers. I do need Java for various things (some Adobe apps require it, as does JAlbum) but don't generally need it for browsing the web. Do note that some online banking sites require Java and I know that one exception I have in my Java preferences is for a government of Canada web site. Obviously, on trusted sites such as these, you shouldn't have to worry.
I also have it enabled for a few apps, but now it's off in all my browsers (and I can easily turn it on in Safari if my bank site requires me - and I believe they do).
Thanks muchly!
Post by: krissel on April 10, 2012, 11:24:42 PM
http://arstechnica.com/apple/news/2012/04/...ontent=My+Yahoo
Post by: Xairbusdriver on April 11, 2012, 08:25:30 AM
QUOTE
Apple supposedly is coming up with software to detect and remove said Trojan.
But, but, all they need to do is put a toolbar link to Dr. Webb's site! He has so kindly brought us the alert and created a web-based procedure to do all the work for us poor souls who unwisely visited (and downloaded stuff) other Russian sites.
Post by: Xairbusdriver on April 13, 2012, 05:53:43 PM
QUOTE("Update page")
Please quit any web browsers and Java applications before installing this update.
The Apple built detection/removal tool is now available.
<For Lion (10.7)>
<For Snow Leopard (10.6.8)>
Note that your Java plugin settings will be changed to NOT automatically run Java. But you can easily change them back in Java Preferences (Lion). I don't remember how in SL.
I'll go check.BYW, I'd not be in any rush to apply this update. If you've already used the previously posted methods to check for the infection, you already have cleaned up your System. I never recommend applying any update immediately, let someone else find out there's a small bug in it that toasts the OS!
Post by: jchuzi on April 13, 2012, 08:12:14 PM
Post by: Xairbusdriver on April 14, 2012, 05:55:16 PM
Post by: jchuzi on April 14, 2012, 07:09:54 PM
QUOTE(Xairbusdriver @ Apr 14 2012, 06:55 PM) <{POST_SNAPBACK}>
I was hoping there was a more System-wide setting, somewhere. I suppose one could always just delete the Java files...
In /Applications/Utilities/Java Preferences.app, you can uncheck the boxes for Java versions. AFAIK, that effectively disables Java without having to delete Java files.