Emergency! Emergency! Java 7 Could Kill You!

The people at www.us-cert.gov tell us there is a Java exploit that might allow some attacker to take over your computer (if you're insanely stupid about your browsing and email habits). They say, "Web browsers using the Java 7 plug-in are at high risk."

Yes, it could be serious, if the attacker steals your identity and all your money. They say, "To defend against this and future Java vulnerabilities, disable Java in web browsers". Future Java vulnerabilities? Why not disable everything? In fact, you should just stay in bed.

In another story, President Obama is poised to impose an executive order that would infringe on The Constitution (the second amendment, but it really doesn't matter which), and ... (crickets). It's too bad we can't simply disable Barack Obama in our browsers, to prevent this and future threats. This is much more serious. It isn't mere trifles such as your computer, your identity and all your money; it's your life, liberty and pursuit of happiness!

Perspective, perspective, perspective...

-----Original Message-----
From: US-CERT Alerts [mailto:technical-alerts@us-cert.gov] 
Sent: Thursday, January 10, 2013 2:53 PM
To: technical-alerts@us-cert.gov
Subject: US-CERT Alert TA13-010A - Oracle Java 7 Security Manager Bypass Vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

National Cyber Awareness System

US-CERT Alert TA13-010A
Oracle Java 7 Security Manager Bypass Vulnerability

Original release date: January 10, 2013
Last revised: --

Systems Affected

     Any system using Oracle Java 7 (1.7, 1.7.0) including

     * Java Platform Standard Edition 7 (Java SE 7)
     * Java SE Development Kit (JDK 7)
     * Java SE Runtime Environment (JRE 7)

     All versions of Java 7 through update 10 are affected.  Web
     browsers using the Java 7 plug-in are at high risk.


Overview

   A vulnerability in the way Java 7 restricts the permissions of Java
   applets could allow an attacker to execute arbitrary commands on a
   vulnerable system.


Description

   A vulnerability in the Java Security Manager allows a Java applet
   to grant itself permission to execute arbitrary code. An attacker
   could use social engineering techniques to entice a user to visit a
   link to a website hosting a malicious Java applet. An attacker
   could also compromise a legitimate web site and upload a malicious
   Java applet (a "drive-by download" attack).

   Any web browser using the Java 7 plug-in is affected. The Java
   Deployment Toolkit plug-in and Java Web Start can also be used as
   attack vectors.

   Reports indicate this vulnerability is being actively exploited,
   and exploit code is publicly available.

   Further technical details are available in Vulnerability Note
   VU#625617.


Impact

   By convincing a user to load a malicious Java applet or Java
   Network Launching Protocol (JNLP) file, an attacker could execute
   arbitrary code on a vulnerable system with the privileges of the
   Java plug-in process.


Solution

   Disable Java in web browsers

   This and previous Java vulnerabilities have been widely targeted by
   attackers, and new Java vulnerabilities are likely to be
   discovered. To defend against this and future Java vulnerabilities,
   disable Java in web browsers.

   Starting with Java 7 Update 10, it is possible to disable Java
   content in web browsers through the Java control panel applet. From
   Setting the Security Level of the Java Client:

   For installations where the highest level of security is required,
   it is possible to entirely prevent any Java apps (signed or
   unsigned) from running in a browser by de-selecting Enable Java
   content in the browser in the Java Control Panel under the Security
   tab.

   If you are unable to update to Java 7 Update 10 please see the
   solution section of Vulnerability Note VU#636312 for instructions
   on how to disable Java on a per browser basis.


References

 * Vulnerability Note VU#625617
   

 * Setting the Security Level of the Java Client
   

 * The Security Manager
   

 * How to disable the Java web plug-in in Safari
   

 * How to turn off Java applets
   

 * NoScript
   

 * Securing Your Web Browser
   

 * Vulnerability Note VU#636312
   


Revision History

  January 10, 2013: Initial release

 ____________________________________________________________________

   Feedback can be directed to US-CERT Technical Staff. Please send
   email to  with "TA13-010A Feedback VU#625617" in
   the subject.
 ____________________________________________________________________

   Produced by US-CERT, a government organization.
 ____________________________________________________________________

This product is provided subject to this Notification: 
http://www.us-cert.gov/privacy/notification.html

Privacy & Use policy: 
http://www.us-cert.gov/privacy/

This document can also be found at
http://www.us-cert.gov/cas/techalerts/TA13-010A.html

For instructions on subscribing to or unsubscribing from this mailing list, visit http://www.us-cert.gov/cas/signup.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iQEVAwUBUO83IXdnhE8Qi3ZhAQLdxQf6A2LhLrArDieg41fxTuIViOXbgH6fZrDt
6bODaZIeTcvQfMMURbUb8MnTQEe7ogNbytb+XQaEzXE6A0YMdWp+93TxFy80wUI0
VpF0lBDwNyeAlwtzicLSQa5oa5Me0k5KPVUn9/mFJZh5Ff0cYjW1dt8dfXJUbH9/
OZ6ZJsnJchymJFlVax3Y87yZh9fPQC4n6dJ86CdLXqC9GaBihgBd1DUpborfWYoR
njvrtbcX+7iy+J8fS2C8/JtnQ5M+uilvqxrdU/Z9SdmebIF5HQjafLae9OmwH7Te
nxUcwwmuNqIA1Y9aN2DrStv+HnTi121DIxyaVgNOKjPnO/t5mDPKlw==
=xi3d
-----END PGP SIGNATURE-----

You Are the Merchandise

If you're not paying for something, you're not the customer; you're the product being sold. ~ blue_beetle, Metafilter discussion.

Any time you think you're getting free stuff, think again. There's no such thing as a free lunch. Free radio, free TV, free email, free health care, free education. Forget it. It isn't free. You're being sold.

Just out of college, I was the chief engineer for a radio station. The radio station had a sales department. Did the sales department go door to door, soliciting listeners? No, the sales force went business to business selling listeners, selling time to advertisers to propagandize the listeners. Sure, there is some kind of symbiosis between listeners, advertisers and the radio station. The station needs listeners in order to sell their time to the advertisers, so the radio station provides useful services and entertainment to the listeners, because more listeners means higher ratings, which translate into more advertising dollars.

Listeners don't like advertising all that much, but they tolerate it for the free music and news. But make no mistake, the listeners are the merchandise. If you watch free television, or use free services on the web (Google maps, Google mail, etc.), then you, your activity patterns, and your privacy are being sold. Someone has to pay for all that free stuff. And it's you. Oh, right -- it's the advertisers. But who pays the advertisers? You do. In response to their propaganda advertising.

What about public broadcasting? Aren't PBS and NPR supported by viewers like you? Aren't their programs made possible by grants from The Ford Foundation, or The Bill and Melinda Gates Foundation? Or Mobile? Well, maybe insofar as individual viewers do make a pledge now and then, yes. But the foundations? The commercial supporters? Those are mini-advertisements. And, PBS and NPR have to keep doing what those foundations like, or they'll stop supporting public broadcasting. It's still propaganda.

Which brings us to government grants for public broadcasting. Everything up until here has been voluntary. Listeners who don't like being sold can turn off their radio. You don't have to patronize the advertisers, or contribute to NPR, or the foundations and corporations making public broadcasting possible. You can opt out at any time. Except when it comes to your taxes. The government taxes you, and you have no recourse but to pay -- under penalty of law -- without any significant say in how your taxes are spent, even if it goes against your beliefs (no taxation without representation -- are your beliefs being represented? Anything? Hello?)

When the government buys listeners from NPR and PBS, they are buying your eyes, ears and mind, and NPR and PBS are selling propaganda time. Public broadcasting is always in need of cash, and the government has tremendous power over them, because it can withdraw its grants any time it doesn't like what the network says or does. You say it can't, or doesn't happen in America. Really?

If men were angels, no government would be necessary. If angels were to govern men, neither external nor internal controls on government would be necessary. ~ James Madison (Federalist 51)

Time for the Alternet?

The Federal Communications Commission (FCC) has now circumvented checks by congress and the courts, in their bid to regulate the Internet. Started during the first big wave of the "progressive" movement with the Communications Act of 1934, the FCC has always been the government's tool for regulating technology, commerce, and of course, information. When it was first created, the FCC was regulating the then-new technologies of interstate and foreign telegraph, telephone, cable, and radio communications. Where in the Constitution did We the People give government the authority to do that?

By establishing a few strategic choke points on business, the government has very powerful control over content. Where in the Constitution did We the People give government the authority to do that? If radio stations want to keep their FCC license (i.e., stay in business), they have to comply with reams of technical, legal, business and content regulations. Even for a small mom-and-pop station, it requires at least one full-time employee just to stay in compliance. See section 73 and section 74 of the FCC Broadcast Rules. But wait, there's more! Much more! I know. I used to be the chief engineer (First Class Radiotelephone Operator License P1-13-10705) for just such businesses. The excuse given for this overwhelming government take-over in 1934 was to ensure freedom from interference and to set up international and interstate compatibility standards. Never mind the fact that the free market could have done the same, and in fact, was already moving in that direction. Where in the Constitution did We the People give government the authority to do that?

Now, the functional equivalent of radio stations -- the connection to the general public -- Internet Service Providers (ISPs) are in the cross-hairs. If they don't comply with FCC regulations, the government can fine them, or revoke their license (i.e., put them out of business). Where in the Constitution did We the People give government the authority to do that? From the government's perspective, this free-wheeling, wild and woolly internet has been free long enough. With things like conservative blogs, pornography, WikiLeaks, the threat of ISPs setting up tiered pricing in order to manage a limited resource (bandwidth) using the tried-and-true free market approach of charging more for something of higher value, the FCC wants to step in and control all of it. Especially information. But it also has its eye on "monopolistic" ISPs that might do something "greedy". Never mind the fact that I am at liberty to terminate my internet service any time I don't like my provider's terms and conditions. I really don't need the government's help with this non-essential frill. It's nice to have, but my survival does not depend on it.

I don't like the government being in control of my information sources. Radio, television and the Internet are today's free press. Or free speech. Since government has now seized the Internet, I think it is time for patriots and free thinkers everywhere to consider establishing the "Alternet", the free alternative to the Internet.

The Internet was built on research and technology from ARPANET. ARPANET packet-switching technology was intended to provide multiple routing options over an unreliable network, such as you might find on a battlefield. Today's computers and routers are built on top of protocols and modular technology that is now owned and operated by private citizens worldwide. Whenever you set up a local area network (LAN) and wireless network (WI-FI or WLAN), you are installing a miniature version of the Internet in your own home. Obviously, home routers are not up to the task of industrial-grade networking, but folks, We the People are in possession of the right technology and know-how to set up the Alternet. Certainly, there are logistical hurdles to overcome. But we shall overcome. Google is working on a self-driving car, for crying out loud. The Alternet would be child's play by comparison. We cannot let the government control our dialog, our information or our liberty.

P.S., you remember short-wave radios, and the Citizen's Band (CB) craze of the 1970s and 1980s? You might want to look in your attic, and dust off those old relics. See if they're still working. We might need them.

P.P.S., it appears that the name "Alternet" (or AlterNet) has already been taken. According to Wikipedia, "AlterNet, a project of the non-profit Independent Media Institute, is a progressive/liberal activist news service." Doesn't that just figure. Well, "Progressives" don't like copyrights and private ownership anyway, so I'm sure they won't mind if we use "Alternet"!

"Support for this government take-over of the Internet is provided in part by: the Pew Charitable Trusts, Bill Moyers's Schumann Center for Media and Democracy, the Joyce Foundation, George Soros's Open Society Institute, the Ford Foundation, and the John D. and Catherine T. MacArthur Foundation, and by contributions from other suicidal NPR supporters like yourself."

So Long, And No Thanks for the Externalities

The Rational Rejection of Security Advice by Users

This is a fascinating analysis of the true cost of computer security. Since we have well-established that I am a reactionary, anti-political correctness extremist, you have some idea where this is going.

ABSTRACT
It is often suggested that users are hopelessly lazy and unmotivated on security questions. They chose weak passwords, ignore security warnings, and are oblivious to certificates errors. We argue that users' rejection of the security advice they receive is entirely rational from an economic perspective. The advice offers to shield them from the direct costs of attacks, but burdens them with far greater indirect costs in the form of effort.

Looking at various examples of security advice we find that the advice is complex and growing, but the benefit is largely speculative or moot. For example, much of the advice concerning passwords is outdated and does little to address actual treats, and fully 100% of certificate error warnings appear to be false positives. Further, if users spent even a minute a day reading URLs to avoid phishing, the cost (in terms of user time) would be two orders of magnitude greater than all phishing losses.

Thus we find that most security advice simply offers a poor cost-benefit tradeoff to users and is rejected. Security advice is a daily burden, applied to the whole population, while an upper bound on the benefit is the harm suffered by the fraction that become victims annually. When that fraction is small, designing security advice that is beneficial is very hard. For example, it makes little sense to burden all users with a daily task to spare 0.01% of them a modest annual pain.

(Continue reading (PDF -- twelve pages)...)

This is the kind of economic analysis that congress and regulators rarely do with government programs. Instead, they look at the feel-good factor, and ignore the cost entirely. One line in particular caught my eye: "... economists have long studied how misaligned incentives often produce
undesired outcomes ...". This practically defines government programs. I know many liberals would read this document, and their heads would explode. "How can you say this? Do you know the risk you are exposing users to?" Well, yes, as a matter of fact, I do. But just try having a rational discussion about bicycle helmets or seat belts with a liberal. They feel that no risk of any kind, in any amount, is acceptable. Hence, the disclaimer at the end:

Note: this paper is not to be read as an encouragement to end-users to ignore security policies or advice. The opinions expressed are those of the author.

They cannot seem to get their heads around calculated risk assessment. Since they can't, they feel that no one else can either, and regulators must force everyone to "be safe" -- whatever that means in real terms (while simultaneously ignoring the unintended and often very undesirable consequences of their nanny statism).

Or, maybe it's because most legislators are lawyers, and everything is a "slip-and-fall" situation. The possibility of getting sued and having someone be awarded an astronomically out-of-proportion-to-the-injury settlement makes no risk acceptable these days.

Patriots, Man Your Battlestations!

I said it during the campain, and I'll say it now: Barack Obama is a radical statist. Privacy and free speech on the Internet is about to change dramatically. And it won't be the criminals digging into your stored files and network traffic, it will be Uncle Sam. The Obama Administration is claiming legal authority to perform warrantless searches and network monitoring, or to shut down the Internet if they consider it a threat to national security. That's bogus! Where's the ACLU when we actually need them?

This article has the details. The thing that stuns me is that they're acting all surprised that Obama's campaign rhetoric doesn't match his actions. Barack Obama's ideology was as plain as the nose on your face all during the campaign. It didn't matter what he said. His past record and his past associations said it all. He didn't fool anybody who was paying the slightest attention.

The Conficker Worm

Hello, I'm taking a break from politics to talk about computer malware. Specifically, Conficker. Conficker is one nasty worm. It has security professionals very concerned, because it is a general purpose program that can install other malware on command from "home" -- wherever "home" is -- some clues point to somewhere in the Ukraine. Conficker uses many strategies and tactics to hide itself, and to prevent detection and removal. There is no doubt that other bad guys are emulating Conficker, and soon a whole new generation of very sophisticated attacks will crop up that emulate Conficker in some or all ways. It is nearly impossible to completely harden systems against it, but you can certainly lower your risk by doing some specific things.

1. Use a virus scanner and keep it up to date. Virus scanners aren't infallible, but they're better than nothing. Conficker is good at hiding from virus scanners, though, and it’s always a race between the virus scanner providers and the bad guys.
2. Keep your operating system up to date. For many Windows users, the easiest thing is to enable automatic updates. Not using Windows might give you some temporary security through obscurity, but I would not expect the top two or three operating systems, especially MacOS, Linux and all of its variants, to be immune to Conficker for very long. It's authors are very knowledgeable and devious.
3. Run with the lowest authority possible. I know it is annoying, but if you don't really need to be an administrator, don't be. Running as administrator gives you and every program you run -- accidentally or not (including worms) -- full control of your computer.
4. Connect to the Internet through a NAT router* and/or at least make sure you use a personal firewall, such as Windows Firewall that ships with all currently supported Windows versions. Keep in mind, though, that personal firewalls can be defeated by malware, and certainly Conficker knows how to do this, and will if it has administrative access. It is much harder for malware to affect your router. But...
5. If you use a NAT router, turn off Universal Plug'n'Play (UPnP). Conficker uses UPnP to open up your router to the internet, so that it can phone home and get instructions, and then run spambots and other nefarious applications.
6. Use strong passwords for all of your accounts (especially administrative) on your computer and on your router. DO NOT leave the default passwords. Conficker contains a dictionary (frequently updated by its perpetrators) of all the default passwords for all of the popular routers, as well as all the passwords commonly used by humans everywhere. If it has your admin password, it owns your system, and by extension, it owns your identity.

Here's a link to a Reuters story with more information.

*NAT router, also called "broadband router" means any of a number of hardware routers from providers such as DLink, Linksys, Belkin, etc. They are designed for general networking, wireless networking, and sharing a single internet connection among several computers. While networking and sharing an internet connection might be the reason you bought it, security is one of the primary benefits. Just make sure you set it up for optimal security, and change the default administration passwords.