Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My antivirus has kept removing a Java exp virus only for it to keep returning.

Yesterday in frustration I decided to uninstall Java until I see some positive news about any patches regarding the latest security issues to install some confidence.

Today however reality has set in with regards to the fact i actually use Java a lot and would like to find a secure way to use it - if possible.

I use Java for only successful commercial sites like ADVFN and such like. If I were to reinstall Java and enable NoScript to only allow these two sites to be loaded with Java would I likely be safe from the Java exp OR can it be just as likely that using one of these two high profile sites could allow the exploit Java problem as some obscure website?

I tried NoScript yesterday, but had some issues with that as well so disabled it but maybe I'll try that again. If J simply disable the Java plugin in my browser after I've finished using the website - would that stop any Java virus?

BUT is there any other way to use this software SAFELY on these two websites that need it and no I've uninstalled it should I check for any left behind Java files to remove with a CCleaner scan (not clean) IF I reinstall.

share|improve this question
2  
Are you sure you're not getting Java and JavaScript mixed up? ADVFN doesn't seem to use a Java applet at all. –  Polynomial Dec 5 '12 at 8:43
    
Describe the issues in their own question on SuperUser. –  Ramhound Dec 5 '12 at 14:24
    
Thanks for the help. Yes its Java (Oracle) formerly Sun Micro. ADVFN requires java on its monitor function and java is used on most web based stock charting sites where each chart you click on is loaded with java i believe. Java is always up to date but my AV kept flagging it only for it to come back, but i've disabled all plugins and removed it since and seems ok now. I'll look into portable versions of browsers, sandboxie and VM's then. Seems like theres alot of negative sentiment about java at the moment. Thanks for taking the time, Great site this. –  user16792 Dec 5 '12 at 14:36
1  
Welcome to IT Security! Please use the Post answer button only for actual answers. You should modify your original question to add additional information. –  Scott Pack Dec 5 '12 at 15:54
add comment

2 Answers

I would recommend using a completely separate browser for websites that require Java to be installed. You should then disable all Java plug-ins for your other web browsers and only use one designated browser with Java plug-ins enabled for those two websites.

share|improve this answer
    
Hammo,thnx for the help. Yes i think thats what i'll do as if i do that and then get a problem it would at least narrow it down to where its entering.A special antivirus for Java - now that would be something. Come on Larry, stop looking so smug and get yer finger out !!:) My java seemed to uninstall cleanly (meaning i'm not sure...but its not there anymore in control panel). Anybody know the easiest way for me to just check (not alter) my registry to see if theres any java left in there before i reinstall? Or is that not needed unless a reinstall hits a problem? thanks again. –  joe Dec 5 '12 at 5:02
add comment

Your question doesn't make it clear, but are you sure you need Java enabled in your browser. Keep in mind that Java and JavaScript are two entirely separate technologies. Java is a cross-platform application framework and JavaScript is a scripting language designed for the web. Your mention of Sun Micro also confuses me, because Java has been an Oracle product for a long time now. If you're still running a Sun release of Java, you've got serious problems.

A lot of websites (StackExchange included) make heavy use of JavaScript, but very few these days actually require a Java applet.

In order to protect yourself from problems with JavaScript, addons like NoScript and AdBlock Plus can be extremely useful. NoScript essentially disables JavaScript on all sites until you specifically allow it, which saves you from getting hit by unexpected browser exploits. AdBlock Plus is useful since it allows pattern-based content blocking, so you can block certain scripts or even entire domains.

Java, on the other hand, is a completely different scenario. Most browsers don't come with a Java plugin by default, as the plugin usually comes when you install a Java Runtime Environment (JRE) on your system. Even then, the browser plugins are optional parts of the installation. NoScript's JavaScript blocking won't affect Java applets at all; they're completely separate things. The biggest problem with Java from a security perspective is that any sandbox escape vulnerability automatically allows the applet to modify your system with the same privilege level as your browser. If you're running as an administrator, that means it can control your whole system. Unfortunately, Java has a history of vulnerabilities that allow sandbox escape, and Oracle's patching schedule isn't particularly agile - there have been cases where Java 0days being used in the wild weren't patched for months.

If you're trying to protect yourself from malicious Java applets, I'd run through this checklist:

  • Disable the Java plugin on all of your browsers. If you're not using Java at all, uninstall the JRE completely.
  • If you need Java on a browser, get a portable copy of Firefox or Chrome and only install the plugin on that. Then use a tool such as Sandboxie to completely isolate the process from the rest of the system.
  • Keep up to date with all Java patches, as well as patches for your OS and browser.
  • Make sure your firewall is properly configured and up to date. Some of the better firewalls often have signatures that catch known malware applets, which can be a nice barrier.
  • Use an AV, even if it's Microsoft Security Essentials.
  • If you're really paranoid, only install and use Java in a dedicated virtual machine. This is pretty much the only way to make sure you have a good chance of not getting owned by Java malware.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.