As many of you will have heard by now there is a currently unpatched security flaw in Java which leaves every computer with Java 7 installed vulnerable to malware attacks. The most prominent example involves the official Samsung website – this website is currently serving malware this is NOT a false positive detection! (Status as per Aug. 30, 11:50 a.m. EST). We therefore strongly recommend disabling Java in all browsers to prevent any infections. You will find some instructions on how to do this enclosed.
What is the issue?
A so called Zero-Day security flaw has been found in Java 7. According to media reports this flaw so far was only exploited in targeted attacks and not widely used. Now that the exploit code was been disclosed, it is to be expected that an increasing number of malware attacks based on this exploit will take place in the next few days. Updates for the Blackhole crime pack and for Metasploit which contain the details of this flaw are already available and put to use.
Who is affected?
At this point Java 7 Update 0 up to Java 7 Update 6 have to be considered potential targets. The issue does not affect Java Version 6 and older; we strongly discourage a downgrade, though, as this will make computers susceptible to other security issues that are not present anymore in Java7!
What do I need to do?
Until Oracle releases a security update for Java the only way of avoiding a malware attacks based on this exploit is to disable Java in all installed browsers. Proceed as follows:
Step 1: Disable Java for all installed browsers
- Close all browser
- windows Access the following path in Windows explorer: C:\Program Files (x86)\Java\jre7\bin
- Locate the file javacpl.exe and run it as Administrator (right-click > Run as administrator).
- When asked to confirm running the application, click ‘yes’
- Select the ‘Advanced’ tab and look for the option ‘Default Java for browsers’.
- Remove the check marks for all browsers displayed there. In case one browser is greyed out, select it with the left mouse button and hit ‘SPACE’. This will remove the check mark.
- Select ‘Apply’ and confirm all changes. Then click ‘OK’
- If Java is installed in a 64-Bit version repeat the above set of instructions in the folder C:\Program Files\Java\jre7\bin.
Step 2: Disable Java separately in each browser
- Turn off Java in every browser you have, regardless of whether you are using it actively or not. This will leverage a maximum level of security.
- Firefox (current release: 15.0)
Extras > Add-Ons > Plugins > disable all plugins associated with Java - Internet Explorer (current release: 9.0.9) Tools > Manage Add-ons >
Set Show to All add-ons > disable all plugins associated with Oracle America Inc. - Google Chrome (current release: 21.0.1180.83)
Enter chrome://settings/content in your address bar > Plug-Ins > Disable individual plug-ins > disable all plugins associated with Java - Safari for Windows (current release 5.1.5) Select the cogwheel > Settings > Security > Remove check mark next to Enable Java
Check if all settings have been applied correctly
Visit the following website with each installed browser: http://java.com/en/download/testjava.jsp. If you see a message stating that “No working version of Java was detected on your system” the settings are all correct. If you still get a working Java display message, then review your settings again.
Can I also uninstall Java 7 completely?
This is of course an option, but bear in mind that some legitimate programs on your computer may be using Java, too. Removing Java may also have an impact on the function of those programs.
General guidelines about using Oracle Java
Generally it is recommended to keep Java constantly updated. To find out whether you have the latest version, go to http://www.java.com/en/download/installed.jsp.
Note: This online check will not work as long as Java is disabled. In that case, you can review your Java version via the Control Panel under Programs > Java. Click the ‘About’ button to learn your version number. If you are not running the latest version of Java, make sure to uninstall all currently installed versions of Java prior to installing the latest version. Keeping old and unsupported versions of Java on your system presents a serious security risk., states Java vendor Oracle on their website. Follow Oracle’s official instructions to remove older Java versions and download the latest one from their official website http://www.java.com/en/download/.
