Microsoft: Java Is Responsible for Up to Half of All Exploits

The most common software exploit type in the first half of 2011 was associated with vulnerabilities in Oracle's Java Runtime Environment (JRE), according to a Microsoft Security Intelligence Report, released last month.

In the report, Microsoft found that between one-third and one-half of all exploits were due to JRE. Trendwise, the number of incidents continue to grow, quarter-over-quarter.

Tim Rains, a director at Microsoft's Trustworthy Computing Group, provided an explanation for why JRE continues to be a malware target in a Monday blog post. In it, he commented that the majority of Java vulnerabilities have already been addressed, but they persist because of a lack of diligence among users in updating their software.

"Many of the more commonly exploited Java vulnerabilities are several years old, and have had security updates available for them for years," wrote Rains. "This illustrates that once attackers develop or buy the capability to exploit a vulnerability, they continue to use the exploit for years, presumably because they continue to get a positive return on investment."

Rains pointed out that the JRE exploit with the most traction has been a vulnerability that was disclosed to Oracle and fixed in March 2010. Although the flaw was addressed, attackers increased their exploitation of it tenfold between the last quarter of 2010 and the first quarter of 2011.

Brian Krebs, a security researcher and blogger, reiterated this point in a recent blog post. Attackers rely on users putting off their software updates, he noted. They quickly create and distribute commercial exploit packs.

"Users would need only to browse to a booby-trapped site with a version of Mozilla Firefox or Internet Explorerthat is running anything older than the latest Java package, and the site could silently install malware (according to a miscreant selling access to the exploit, it does not run reliably against Google Chrome for some reason)," Krebs wrote.

The solution? Make sure your software is up to date.

Rains points out that problems can arise when multiple different versions of JRE are running on the same network. He advocated taking time to make sure that all versions of JRE are up to date as a necessary precaution.

About the Author

Chris Paoli is the site producer for and


  • Microsoft Starting To Roll Out New Excel Connected Data Types

    Microsoft on Thursday announced some Excel and Power BI enhancements that add "connected data types" on top of the standard strings and numbers options.

  • Windows 10 Users Getting New Process for Finding Optional Driver Updates

    Accessing Windows 10 drivers classified as "optional updates" will be more of a manual seek-and-install type of experience, starting on Nov. 5, 2020, Microsoft explained in a Wednesday announcement.

  • Microsoft Changes Privacy Platform Name to SmartNoise

    Microsoft Research has changed the name of its "differential privacy" platform from "WhiteNoise" to "SmartNoise," according to a Wednesday announcement.

  • Why Restarting a Failed SCVMM Job Might Be a Bad Idea

    Occasionally, restarting a failed System Center Virtual Machine Manager job can leave your virtualization infrastructure in an unknown state. Here's how to avoid that.

comments powered by Disqus