Should I be wary of Java and Adobe.

Bob Lang1 wrote:

Ah! Got it working now: because I don't routinely use Firefox I hadn't updated for years. A new update of Firefox and I now get localhost/127.0.0.1 returned.

I'm intrigued that this might be a security risk but I'm not sure how.

Bob

Oh, thanks Bob, I thought you were "with Java for 15 years" as a programmer or deeply assocaited with Sun/Oracle in some fashion.

etresoft wrote:

I guess technically I'm a "15 years with Java" guy too. I first used Java in 1996. I try to avoid it but I don't always succeed. If you want to read up on the security details of the Java/Javascript bridge, here is some additional information: http://download.oracle.com/javase/1.3/docs/guide/plugin/security.html#liveconnec t

Thanks.

I think you're really on a wild goose chase here. Revealing one's internal IP address is not in any way a security risk. It is an internal address. No one on the outside can ever get to it. It doesn't exist beyond your router.

Sure, anyone running a compromised website can call Java and get the internal IP, however my understanding is the security benefit of the router is to MASK the internal IP's from the outside world correct?

And since Safari doesn't allow Java to call this command, kind of begs the question why?

Very few of these security updates hold any meaningful real-world risk. They are the result of self-styled internet "security researchers" looking for potential vulnerabilities. The security threats that people worry most about are the ones that have the least likelihood of ever occuring in the real world. Nothing mentioned in this thread is ever going to hurt anyone. This sort of hacking just doesn't happen - ever. Why on earth would a hacker try to break into one person's Mac on a local network behind a router? That takes an extraordinary amount of skill. It is far easier to use a 15 year-old, hacking 101 SQL injection exploit and steal identities and credit cards of millions of people from some web site.

The "for profit" motivation is not the issue here.

For example, I might have come up with a cure for cancer which would attract the most brilliant minds to hack into my machine to gain access to this valuable knowledge and publish it as their own.

In the purposes of this example I might be a biological genius, but not a computer genius.

I do know that the less THEY know, the better.

I like to know what does what, and what reveals what, that a attacker can use to gain entry by the process of deduction and elimination.

People are clever and can fill in the blanks, but not if all the spaces are blank. Like a Soduku puzzle with no numbers filled in, they have nothing to go on.

Java giving up the internal IP of computer for really no good purpose whatsoever is just another filled in blank spot which can be eliminated.

ds store wrote:

Sure, anyone running a compromised website can call Java and get the internal IP, however my understanding is the security benefit of the router is to MASK the internal IP's from the outside world correct?

It doesn't work that way. A router doesn't just mask the internal IP addresses. The router creates a separate, internal network. Hosts on the internal network are not reachable from the outside world at all. You have to establish NAT entries on the router that will route connections to the router's port X to an internal address at port Y. Without those NAT entries, nothing will get through the router. Knowing someone's internal IP address is useless knowledge.

And since Safari doesn't allow Java to call this command, kind of begs the question why?

It is nothing that Safari does on purpose. It is just an old feature of Netscape that Firefox still has. It just never caught on with anyone else.

I do know that the less THEY know, the better.

I like to know what does what, and what reveals what, that a attacker can use to gain entry by the process of deduction and elimination.

People are clever and can fill in the blanks, but not if all the spaces are blank. Like a Soduku puzzle with no numbers filled in, they have nothing to go on.

THEY are a whole lot less clever than you give them credit for. There are many scripts floating around to hack into poorly built web sites. There are many virus and trojan templates floating arround that can hijack a Windows PC. The people controlling these scripts are called "script kiddies". They have no idea how they work, they just know what buttons to press. Even the most basic, rudimentary security practices will defeat them.

Java giving up the internal IP of computer for really no good purpose whatsoever is just another filled in blank spot which can be eliminated.

It is a non-issue. Even if you know the internal IP addresses, you can't get to them. You can only access them through the router. The hackers already have port scanners that check routers for known P2P ports.

etresoft wrote:

It doesn't work that way. A router doesn't just mask the internal IP addresses. The router creates a separate, internal network. Hosts on the internal network are not reachable from the outside world at all. You have to establish NAT entries on the router that will route connections to the router's port X to an internal address at port Y. Without those NAT entries, nothing will get through the router.

Ok thanks, I figured something like that was occuring or what's the use right? 🙂

Yet by the return the internal IP one can determine how many devices are present on the LAN correct?

The people controlling these scripts are called "script kiddies". They have no idea how they work, they just know what buttons to press. Even the most basic, rudimentary security practices will defeat them.

My interest is giving malicious hackers as little as possible, either information or exposure. Creating a hardened machine/network basically. 🙂

ds store wrote:

Yet by the return the internal IP one can determine how many devices are present on the LAN correct?

Not necessarily. IP addresses just get handed out as they are requested. A device will keep its IP address as long as its network interface stays up - or it could get auto renewed. You could be the first IP address at 10.0.1.2 or the 3rd (and last) at 10.0.1.18. A hacker wouldn't know or be physically able to access any of it until they had gotten in to your router.

My interest is giving malicious hackers as little as possible, either information or exposure. Creating a hardened machine/network basically. 🙂

The kind of hacking you are worried about could be attempted by only a few dozen people in the world. Even then, only certain routers and certain firmwares are hackable. I can assure you that they aren't interested in hacking your network.

etresoft wrote:

Not necessarily. IP addresses just get handed out as they are requested. A device will keep its IP address as long as its network interface stays up - or it could get auto renewed. You could be the first IP address at 10.0.1.2 or the 3rd (and last) at 10.0.1.18. A hacker wouldn't know or be physically able to access any of it until they had gotten in to your router.

So what do you think of the practice of some who stay behind two routers?

Kind of crazy or are they just assuming one will be hacked?

Please, send them to my tin hat store😁

Hey dwb!

You got any cans of that spray-on tin foil left?

I'm going to shave my again head. 😀

ds store wrote:

So what do you think of the practice of some who stay behind two routers?

Kind of crazy or are they just assuming one will be hacked?

When I said "a few dozen", I wasn't exaggerating. The likelihood of your router being hacked is far less than winning the lottery. How do I know this? Because people win the lottery all the time. Hacking a router is technically possible, but doesn't ever happen.

Don't make me start posting links to documented occurences of fish and other unlikely critters falling from the sky. I'll do it.

You are guilty of providing an incomplete reply, so I will do it for you:

http://www.dailymail.co.uk/news/article-1254812/Hundreds-fish-fall-sky-remote-Au stralian-town-Lajamanu.html

http://en.wikipedia.org/wiki/Raining_animals

http://www.huffingtonpost.com/2011/01/05/dead-birds-fall-from-sky-_n_804591.html

Why does it only ever rain fish, frogs, etc.

Why is there never a rain of MacBook Pros, 42" Plasma TVs, or something useful like that?

Bob

They would break and/or break arms and heads trying to catch them.

Wouldn't it be the pits to have a nice new MBP fall from the sky and miss catching it?

Respectfully I disagree. The wrote once run anywhere promise is broken and so is the security model. I put Java and Adobe Flash in the same bucket. Legacy technology that needs to be removed from every browser. I've removed all traces of Adobe Flash from my Mac and I'm looking for ways to remove Java. I'm certainly happy Apple is remove both from OS X Lion.

Chester Wisniewski from Sophos took the same line in his blog post on the issue, saying:

If you haven't already, I recommend testing out your standard OS images without the Java plug-in. Most people aren't using Java these days and it reduces the attack surface for exploits delivered over the internet.

http://www.zdnet.co.uk/blogs/jacks-blog-10017212/java-security-holes-need-fixing -immediately-10022661/

Probably because all of those beasties are fairly numerous and fairly lightweight. Whatever propels things into the sky in sufficient quantities to rain down would be unlikely to do the same to even a 13" MacBook Pro. There aren't enough of them in one spot and they are too heavy.

However, if rumors are correct, there may be a location in southern China that has up to 15 million thinner and very lightweight iPhone 5s. Chances are very good for widespread iPhone 5 showers this Fall.