Microsoft: Java Is Responsible for Up to Half of All Exploits

The most common software exploit type in the first half of 2011 was associated with vulnerabilities in Oracle's Java Runtime Environment (JRE), according to a Microsoft Security Intelligence Report, released last month.

In the report, Microsoft found that between one-third and one-half of all exploits were due to JRE. Trendwise, the number of incidents continue to grow, quarter-over-quarter.

Tim Rains, a director at Microsoft's Trustworthy Computing Group, provided an explanation for why JRE continues to be a malware target in a Monday blog post. In it, he commented that the majority of Java vulnerabilities have already been addressed, but they persist because of a lack of diligence among users in updating their software.

"Many of the more commonly exploited Java vulnerabilities are several years old, and have had security updates available for them for years," wrote Rains. "This illustrates that once attackers develop or buy the capability to exploit a vulnerability, they continue to use the exploit for years, presumably because they continue to get a positive return on investment."

Rains pointed out that the JRE exploit with the most traction has been a vulnerability that was disclosed to Oracle and fixed in March 2010. Although the flaw was addressed, attackers increased their exploitation of it tenfold between the last quarter of 2010 and the first quarter of 2011.

Brian Krebs, a security researcher and blogger, reiterated this point in a recent blog post. Attackers rely on users putting off their software updates, he noted. They quickly create and distribute commercial exploit packs.

"Users would need only to browse to a booby-trapped site with a version of Mozilla Firefox or Internet Explorerthat is running anything older than the latest Java package, and the site could silently install malware (according to a miscreant selling access to the exploit, it does not run reliably against Google Chrome for some reason)," Krebs wrote.

The solution? Make sure your software is up to date.

Rains points out that problems can arise when multiple different versions of JRE are running on the same network. He advocated taking time to make sure that all versions of JRE are up to date as a necessary precaution.

About the Author

Chris Paoli is the site producer for and

comments powered by Disqus

Reader Comments:

Thu, Dec 1, 2011 Blue'N Gold

If it were true that winOS problems are rooted in java, then why have the winOS use/recognize Java at all? With FF, one can block all scripts from running on every web page... Never missed anything important using FF. Surfing with IE is like trying to make a 90 degree turn in the Titanic... treacherous at best. Many real users despise the ever-increasing code bloat winOS's are renown for. The endless security patches of (pick your winOS) have no stellar reputation either. Bad OS is still bad OS. You'd be surprised how fast pages load without Adobe Flash installed--who wants those ads anyway? Adobe Flash has its endless up-dates too. When going online, users are not there to fix code sold by lazy corporate programmers. With OS, less is more. There you have it.

Add Your Comment Now:

Your Name:(optional)
Your Email:(optional)
Your Location:(optional)
Please type the letters/numbers you see above

Redmond Tech Watch

Sign up for our newsletter.

I agree to this site's Privacy Policy.