User: Password:
|
|
Subscribe / Log in / New account

Oracle patches critical Java bugs used to commandeer computers (ars technica)

Oracle patches critical Java bugs used to commandeer computers (ars technica)

Posted Sep 5, 2012 13:20 UTC (Wed) by ibukanov (subscriber, #3942)
Parent article: Oracle patches critical Java bugs used to commandeer computers (ars technica)

In Norway many banks use Java applets with elevated privileges on their netbanking pages. With browsers automatically and user manually disabling the Java due to unpatched vulnerabilities that created a support nightmare and rathger negative altitude towards Java in general.


(Log in to post comments)

Oracle patches critical Java bugs used to commandeer computers (ars technica)

Posted Sep 6, 2012 16:55 UTC (Thu) by pboddie (guest, #50784) [Link]

I tried to find out why the BankID "detector applet" wanted full access to the host system (the stock message in the security dialogue mentions access to devices including the webcam, which is surely a reminder of the days when Java was the hot new toy for Internet-based entertainment) when it is portraying itself as something that is merely checking for Java and presumably loading the appropriate payload (because, of course, Java portability on the client was such a huge success), and the only response I recall now was along the lines of "because it needs it".

In fact, the architecture seems to involve the "applet" (in fact, an "application" if one uses the dot-com era terminology) calling out to other Internet addresses and performing some kind of authentication dance. Of course, all this is in vain if the system is down, which then means you can just use the old-fashioned login mechanisms instead. Which the banks have kept around because BankID does go down every now and again.

My feeling is that a bunch of people got a budget to develop their own local solution in the hope that they could make it a more broadly adopted standard. However, every nation's banking sector probably have their eyes on the same prize, so those dreams will never play out. They were influenced enough to make it work only with a single vendor's technology - it's what the consultants know, after all - and the consequence of that is that everyone is now exposed to that vendor's fantastic track record in fixing security issues in a timely fashion.

Oracle patches critical Java bugs used to commandeer computers (ars technica)

Posted Sep 6, 2012 20:24 UTC (Thu) by ibukanov (subscriber, #3942) [Link]

> why the BankID "detector applet" wanted full access to the host system

It tries to detect presence of common malware and to fingerprint the system so in case of an infection it would be possible to black-list the customer's PC until Windows is reinstalled. In any case, running strace against browser displaying a page with BankID is rather entertaining.

> They were influenced enough to make it work only with a single vendor's technology

If banks would now about the amount of support calls they would receive about banking site not working on IPad, BankID would be dead on arrival. And banks could easily predict that state of affairs by trying to run BankId at the moment it appears on Linux and other non-mainstream systems with browser installed. That is, BankId has not even been a cross-platform solution. Indeed, those "were influenced enough"...


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds