Actu
Rahul Kashyup, chief security architect, Bromium: Java now installing adware
March 2015 by Rahul Kashyup, chief security architect, Bromium
Rich Trouton, a Mac systems administrator who runs the Der Flounder blog, discovered that a Java installer is installing adware, in the form of the Ask Toolbar. Please see below for comments from endpoint security firm, Bromium.
Rahul Kashyup, chief security architect, Bromium:
"It’ not uncommon for few large brands such as Oracle, Adobe to ‘bundle’ packages along with their software. In fact Oracle has been doing this for some time now (this is nothing new FWIW, Ref: http://www.benedelman.org/news/012213-1.html )
Just like how many large PC manufacturers bundle ‘bloatware’; popular software companies seem to be driving on the same concept [Ref: http://www.shouldiremoveit.com/]. The Ask.com add-on is known to get installed as a BHO (Browser Helper Object). Due to its dubious nature of installation and capabilities this is regarded as a ‘PUP – Potentially Unwanted Program’, a term used by the cyber security industry to navigate legal notices by the creators of such software.
Unfortunately some large brands are leveraging their credibility to package such software. People need to be vigilant to avoid installing such undesired bundled software."
Fraser Kyne, principal systems engineer, Bromium:
"This news will be music to the ears of the hard-pressed Java patching teams at many organisations who now have a nice excuse not to waste time and energy packaging up yet another Java release (after testing all their apps against it, of course..)
The sad truth is, for many organisations the concept of moving to a recent version of Java is light years away anyway. Adware concerns just add more weight on top of other security concerns, which are then balanced against the very real cost of modifying the application estate.
Microvirtualization offers a practical way to change this equation."
Simon Crosby, CTO and co-founder, Bromium:
"Given Java’s spotty record on security, we ought to expect Oracle to behave in exactly the opposite way. Rather than subject users to more unwanted, untrustworthy software installed on the sly, they should be mandating strong security and privacy in everything they do. It’s disappointing to see an industry giant so clueless in an age of rampant cyber activity”
