It looks like you can add another big name to the recent string of high-profile hacking attempts. Facebook announced in a blog post today that it discovered last month that it had been targeted in what's being described as a "sophisticated attack," which it says "occurred when a handful of employees visited a mobile developer website that was compromised." Facebook further pinpoints the attack to a previously unseen zero-day exploit that bypassed the Java sandbox and installed malware on the computers in question. The company goes on to note that it immediately notified Oracle of the exploit, which issued a patch on February 1st.

Facebook is also quick to point out that it has "found no evidence that Facebook user data was compromised," and adds that it was not alone in the attack, noting that it began to share information about the hack with other companies and entities as soon as it discovered it, and that it continues to work with law enforcement and others affected by the attack. You can find its full explanation of the matter at the source link.

Filed under: Facebook

Comments

Via: AllThingsD

Source: Facebook

In an effort to prevent "drive-by exploitations," upcoming versions of Firefox will have Java, Adobe Reader and Silverlight disabled by default, according to a recent Mozilla Security blog. All other third-party plugins except Flash will also be disabled, requiring users to enable them using the so-called click to play feature introduced last year. All that is to prevent "poorly designed" Firefox plugins from crashing or recent headline-grabbing exploits involving the likes of Java, with Adobe's Flash player being the one exception that works out of the box -- though versions longer of tooth than 10.3 won't see daylight without your say-so.

Filed under: Internet, Software

Comments

Source: Mozilla Security Blog

Oracle hasn't had a great start to 2013. It's barely into the new year, and Apple and Mozilla are already putting up roadblocks to some Java versions after discoveries of significant browser-based exploits. The company has been quick to respond, however, and already has a patched-up version ready to go. The Java update goes one step further to minimize repeat incidents, as well -- it makes the "high" setting the default and asks permission before it launches any applet that wasn't officially signed. If you've been skittish about running a Java plugin ever since the latest exploits became public, hit the source to (potentially) calm your nerves.

Update: Apple has released its flavor of Java built for Macs with the appropriate patch as well.

[Thanks, Trevor]

Filed under: Internet, Software, Apple

Comments

Via: Reuters

Source: Oracle

It's far from the first time that computer users have been warned to disable Java, but this latest security issue has risen to some high levels at a particularly rapid pace. After first being reported by security researchers on Thursday, the United States Computer Emergency Readiness Team (or US-CERT, a part of the Homeland Security department) stepped in with a warning of its own on Friday, which bluntly suggested that all computer users should disable Java in their web browsers (for its part, Oracle says that a fix is coming "shortly"). The flaw itself is a vulnerability in the Java Security Manager, which an attacker could exploit to run code on a user's computer.

Not content to wait for a fix, some companies have already taken steps to block possible exploits. That includes Apple, which has added recent versions of Java to its blacklist covering all OS X users, and Mozilla, which has enabled its "Click To Play" functionality in Firefox for all recent versions of Java across all platforms (it was previously only enabled by default for older versions of Java). Apple's move follows an earlier decision to remove the Java plug-in from browsers in OS X 10.7 and up last fall. You can find the full alert issued by US-CERT and additional details on the vulnerability at the links below.

Filed under: Internet, Software

Comments

Via: The Verge

Source: US-CERT, Mozilla

Apple has recently released a Mac update for OS X Lion and Mountain Lion that removes its Java plugin from all OS X browsers. If you install the update, you'll find a region labeled "Missing plug-in" in place of a Java applet; of course, Apple can't stop you from clicking on it to download a Java plug-in directly from Oracle. The Cupertino-based company had previously halted pre-installing Java in OS X partially due to the exploitable factors of the platform, so this update signifies further distancing from Larry Ellison's pride and joy.

Filed under: Internet, Apple

Comments

Via: Ars Technica

Source: Apple Support

You should know by now that it's never truly over when tech giants resort to legal warfare over their technology, and just as it said it would, Oracle has filed an appeal of the US District Court ruling in its case against Google. In case you'd forgotten, back in May Judge William Alsup found that the structure of its Java APIs were not copyrightable so Oracle had to settle for $0 in damages over its claims that Android infringed on its patents and copyrights. FOSS Patent's Florian Mueller has a full breakdown of what he sees in the case, meanwhile we'll be preparing our fallout shelters for potential Android Armageddon... again.

Update: Haven't had enough of paperwork flying back and forth? Good, because according to Bloomberg, Google has also filed an appeal in the case over the judge's decision not to set aside the jury's copyright verdict or order a new trial.

Filed under: Cellphones, Software, Mobile

Comments

Source: FOSS Patents, Bloomberg

While Sprint's iDEN network is getting the axe in favor of a new CDMA setup, AT&T will soon be sprucing up its near absent push-to-talk services. Targeting a November release with plans starting around $30, Ma Bell's enhanced PTT will be compatible with smartphones running Android 2.3+, BlackBerry 7, Windows Phone 8 and even Java-powered feature phones. In addition to playing nice with a variety of mobile platforms, this new service will also work across laptops, tablets and smart cars.

Filed under: Cellphones, Wireless, Mobile

Comments

Via: Fierce Wireless

Source: AT&T

Developers have their work cut out. Even if we (impolitely) sidestep the likes of Windows Phone, BlackBerry and the rest, those coders often have to pitch their work across web, iOS and Android. Google's trying to make that job a little easier, introducing a new tool that automatically converts Java source code into Objective-C, which is used in iPad and iPhone apps. While the J2ObjC tool can't tackle the UI for these, it does allow developers to craft other parts (including data access and nuts-and-bolts programming) into an easily shareable code without editing. Some existing Google projects already utilize the new translator, but its results remains a little temperamental -- the tool hasn't translated all possible paths just yet, and many Java devs have, according to the project page, "a slightly different way of using Java."

Comments

Via: ZDNET

Source: Google Open Source Blog

After watching Judge Alsup strike down its patent and Java API infringement claims, Oracle seems to be cutting its losses, agreeing to accept $0 in damages from Google. Confused? So was the Judge, who reportedly responded to the proposal by asking, "is there a catch I need to be aware of?" No catch, but Oracle isn't giving up, stating that it's taking its case to the Court of Appeals for the Federal Circuit. If successful, the appeal could put the two firms back in Alsup's courtroom, perhaps asking for somewhere between the previously proposed $32.3 million and today's sum total of zilch. We'll let you know when the drama comes around again.

Comments

Thought the Oracle v. Google litigation fireworks were over? Well, if you weren't aware, during the copyright phase of the trial, the jury found that Google had infringed the structure, sequence and organization of Oracle's Java APIs. However, at the time, Judge Alsup had yet to evaluate the validity of Oracle's API copyright claims upon which that verdict was based. Today, Alsup found that Oracle's argument didn't hold water because it would expand the breadth of copyright holder's rights too far -- in essence, it would allow owners of software code to prevent others from writing different versions to perform the same functions. This ruling renders the jury's earlier infringement verdict moot, and gives Mountain View yet another courtroom victory. Despite this latest defeat, Oracle's sure to run the case up one more rung on the legal ladder, so let the countdown to the appeal begin.

Comments

It appears that the jury has come to a conclusion in the Oracle v. Google trial, determining that Android does not infringe Oracle patents. Judge William Alsup of the US District Court for Northern California exonerated the search giant following a trial that lasted three weeks, ruling that Google did not infringe on six claims in US Patent RE38,104, along two claims in US Patent 6,061,520. Jurors were dismissed following today's ruling, with the trial's damages phase reportedly set to begin on Tuesday. According to The Verge, the jury did determine that Google was responsible for two counts of minor copyright infringement, relating to the order of Java APIs and several lines of rangeCheck code, which could be matched with a maximum penalty of $150,000 for each count. Regardless, it appears that the lawsuit, which dates back to 2010, when Oracle filed against Google for copyright and patent infringement related to Sun's Java code, could finally be coming to a close.

Filed under: Mobile

Comments

Folks still rocking Apple's Leopard may have been feeling left out after Lion and Snow Leopard both got an update for addressing that Flashback malware. If you're one of them, you'll be glad to know that Apple has finally issued a Leopard fix that comes with a removal tool for the vulnerability afflicting its big cats. In addition to a 1.23MB Flashback update, Apple also released a second 1.11MB fix for Leopard that disables versions of Adobe Flash Player that don't have the requisite security updates. Both should further whittle down the number of Apple computers affected by the Flashback trojan. For the actual updates, feel free to pounce on the source links below.

Comments

Would it be ironic if Android developers did an end-run around Microsoft patents by using Microsoft's own C#? Or if Google kiboshed its Oracle brouhaha with the aid of none other than Redmond? We're asking because Xamarin, the wacky open source implementer of .NET, has ported Android to Microsoft's C# with its XobotOS project. Although just an experiment and unlikely to solve Google's issues, the team showed that running the robot on C# instead of Java gave fewer coding limitations, better battery life and direct graphics access. Additionally, Xamarin reports "massive" speed gains on its HTC Flyer and Acer Iconia when running the side-project port -- no surprise given C#'s machine heritage. Sure, it's pure speculation that Mountain View and its developers would ever change their Java MO, but a little patent relief and faster Android devices in one kill shot? That's a sweet idea.

Comments

By now, we're all quite familiar with the Java-driven trojan that's affected thousands of Apple's rigs, and while the numbers seem to have drastically dropped since the first Cupertino fix, there's still a plethora of machines carrying the bug. According to Symantec, the number of infected computers is now at around 140,000, seeing a decline of over 460,000 since April 9th. Still, the security outfit remains puzzled by the fact, as it expected the digits to be somewhere near the 99,000 mark by now. Perhaps this is due to some folks not even being aware of Flashback's existence, or maybe not checking for software updates as often as most of us. Either way, we hope you've already used one of the tools Apple handed you.

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Filed under: Mobile

Comments

Filed under: Mobile

Comments