Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: All I need Java for is .... - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
All I need Java for is ....

Java just can't catch a break!  A number of our readers have pointed out that Security Explorations claims they have 2 new Java zero days (no verification from Oracle on this yet).

This of course has fueled the fire of "it's time to just say no and uninstall Java" in many quarters.  And for general purpose internet browsing, maybe you can.  If you do need Java, and if you do, changing the security settings to "ask every time" is a good way to go.  Of course, if you run a business app that needs Java, you need to make it transparent to your user community somehow - this can be particular problem if your app needs a specific (aka old / vulnerable) Java version - we've talked about this in a few different stories over the last few months.

But this got me to thinking, as security folks, what tools or processes do we use daily that need Java?

My list is pretty short:
Burp Suite for Web Assessments - www.portswigger.net
ZAP - Zed Attack Proxy, also for Web Assessments - https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
Nessus, for straight up vulnerability assessments and security scans (Java is only needed for PDF exports in Nessus I think) - http://www.tenable.com

Network appliance administration is often Java based as well - for instance, the GUI for Cisco ASA firewalls and many wirelss controllers requires Java to run.

What's in your "I only need Java for this or that infosec tool" list?  Please, let us know through our comment form.
 

===============
Rob VandenBrink
Metafore

Rob VandenBrink

489 Posts
ISC Handler
Not security-related, but Dell IT Assistant wants it.
Anonymous
ManageEngine OpManager
Eclipse
Vigiliti nLive
Freemind
jrivett

2 Posts
GotoMyPC (can run w/o Java, but requires extra steps)
Cisco SSL vpn client
Juniper SSL vpn client
Zyxel SSL vpn client

I use QuickJava in Firefox to enable/disable on the fly. Every chance I get, I beg vendors to develop in another language . . .
RichH

9 Posts
Libreoffice

http://www.libreoffice.org/download/system-requirements/
RichH
8 Posts
To generate Nessus reports in PDF format you must have Java installed on the Nessus server (not required on the client system). And as of 11/2012 the Nessus user interface is HTML5 (So neither Java or Flash is required on the client.

Ref: http://static.tenable.com/documentation/nessus_5.0_installation_guide.pdf
RichH
1 Posts
Cisco SSL VPN client does not require Java. It can be installed via ActiveX or downloaded and manually installed (vs. the automated methods the other two provide).

I use Java for Oracle apps (we've a dozen), Cisco ASDM Firewall configuration, HP iLO.

I was able to uninstall Java from my personal computer when my small credit union updated their banking app's menu system to not need Java.

For each environment, I have multiple browsers and use "-no-remote -ProfileManager" with Firefox to get prompted for which one to use even if there is already a Firefox session running. My personal computer only had Java enabled in my banking browser profile. My work computer only has Java enabled in my Internal-only profile.

This isn't something you call really get non-technical people to buy off on or understand. The best thing we do is block Internet Explorer access to the Internet (user-agent string blocking in Proxy) and only allow Java with it. Firefox is all that is allowed to the Internet and using GPOs we block Java with Firefox. So, Internet Explorer for intranet-only, Firefox for Internet (no Java, and most of our staff have to use an Oracle app or two or dozen).
RichH
42 Posts
STIG Viewer - Version 1.1.2 iase dot disa dot mil
RichH
1 Posts
Remote control from PC of ELK M1 perimeter security system:
http://www.elkproducts.com/product-catalog/elk-m1xep-m1-ethernet-interface

Not used every day, but it sure is handy when it's needed.
RichH
1 Posts
BlueCoat Web Proxy management, Cisco asdm.
Erik

5 Posts
The webcasts provided by SANS uses Elluminate software which requires Java to be installed in order to view the webcast. *facepalm*
T

31 Posts
HP P4000 Management Console
HP Procurve E Series Web Interfaces (for older switches anyways)
HP ILO Remote Console (for non IE users)
Brocade SAN Switches
Blackberry Enterprise Server
ManageEngine Support Center

These are ones I can think of right off the top of my head.
T
3 Posts
Verizon Droid phone photo transfer app required me to re-install Java to transfer photos from my phone to my computer: Kies Air.
AllStarPuzzles.com used JAVA for one it's simple games, but has a beta test of a non-java program for their site.

That's it! Do we really need Java?
T
3 Posts
Sadly, Kronos Workforce Central/HR Admin.
T
4 Posts
Juniper's SSL VPN client does not need Java if you're using IE.

HP StorageWorks Tape Library.
HP printers.
Various vendor sites for uploading files.
Oracle E-Business Suite.

I haven't had Java installed at home for over a year. Flush is the next to go.
Anonymous
Ditched it company wide. Anyone needing goToMyPC can just do the extra steps. I need home and weekend time for myself, not stamping out fires caused by mixing user convenience with one well engineered social attack that succeeds.

I need to spend time working on things that provide ROI for my company.

Supporting Oracle Java SieveMaster has negative ROI.

One less Yacht and One less lawsuit would have allowed Oracle to fix their **** product instead of burdening us with Entree of the Hour makework.
Anonymous
We have blocked it at the firewall level, and I was surprised how many functions stop working, especially basic things like WSUS and EPO.

Internally we need it for
forewall, printer, network device administration

Externally (had to list these sites as Trusted in firewall)
currenex.net
adobe.com
Akamaitechnologies.com
hp.com
inforextreme.com
konicaminolta.com
mcafee.com (for EPO)
mathworks.com
Microsoft.com for WSUS
Microsoftonline.com for administering Office365
nai.com for support incidents
oracle.com
symantecliveupdate.com
idera.com
guichetuinique.ch
carol

10 Posts
Again not specifically an infosec tool but

Oracle (formerly Sun) Secure Global Desktop
relies on Java....
Anonymous
Secunia OSI.

Note that Active-X (or whatever it is called these days!) is worse than Java. At least Java has sandbox capability (even if it is often overridden) whereas Active-X gives full unrestricted access to the machine.
patermann

35 Posts
I can't think of any infosec tools off the top of my head I use that require Java. The only thing I use it for is a program called Jdownloader which is used to manage file downloads from cyberlocker sites.

@Wetlandstom: Which brand of phone is the Verizon Droid? I have a Motorola Razr and it doesn't require Java for Phone-to-PC (and vice versa) xfer but uses its own proprietary software from Motorola?
@carol: Microsoft requires Java for Office365? That's laughable.
@patermann: Download the Secunia PSI tool locally instead of running the web version. It will even do the updates automatically.
pogue

17 Posts
OpenNMS, NetMRI
pogue
1 Posts

Sign Up for Free or Log In to start participating in the conversation!