Computerworld — Microsoft (MSFT) said Monday that an "unprecedented wave" of attacks are exploiting vulnerabilities in Oracle's (ORCL) Java software.

According to a manager with Microsoft's Malware Protection Center (MMPC), attempts to exploit Java bugs have skyrocketed in the last nine months, climbing from less than half a million in the first quarter of 2010 to more than 6 million in the third quarter.

"Some of our exploit 'malware' families were telling a scary story ... an unprecedented wave of Java exploitation," said Holly Stewart, a senior program manager with the MMPC, in a post to the team's blog Monday.

Stewart went on to call the jump in Java attacks "scary" and added, "The spike in exploitation was surprising to say the least."

Oracle is a rival of Microsoft 's, most notably in the enterprise database market, where Microsoft 's SQL Server competes with Oracle 's flagship database server software.

Stewart noted that the bulk of the attacks in the quarter that ended Sept. 30 were exploiting just three Java vulnerabilities, all of which had been patched months or even years ago.

More than 3.5 million of the 6-plus million attacks, for instance, tried to exploit a Java Runtime Environment (JRE) flaw that was patched in December 2008. More than 2.6 million additional attacks targeted a stack-based buffer overflow in Java and JRE in December 2009.

Stewart had a theory why the massive increase in attacks went unnoticed, basing it on what she claimed was "Java blindness" on the part of vendors that produce and sell intrusion detection and intrusion prevention systems (IDS and IPS, respectively), software designed to sniff out and stop exploits before they reach a company's computers.

"IDS/IPS vendors ... have challenges with parsing Java code," Stewart alleged. "Think about incorporating a Java interpreter into an IPS engine ... the performance impact on a network IPS could be crippling. [So] the people that we expect to notice increases in exploitation might have a hard time seeing this. Call it Java-blindness."

It makes sense for attackers to work up exploits against Java vulnerabilities, said Marc Fossi, the director of Symantec's (SYMC) security response team. "Since Java is both cross- browser and cross-platform, it can be appealing to attackers," he said via instant message, referring to Java's use by every major browser , and on Windows, Mac OS and Linux .

Others posed their own theories about why Java exploits have boomed.

Last month, security blogger Brian Krebs reported that "Crimepack," one of the many multi-strike attack kits hackers use to plant their malware on vulnerable computers, was extremely successful in exploiting a Java flaw patched last April.

Continue Reading