I've just read about the Mal/JavaJar-B malware that is apparently capable of attacking OS X computers via a security hole in Java. I've also heard a few people mention that it can also affect Linux computers, but only from perfunctory sources (the comments in the article, and a few passing references from Googling).

Is such malware a concern for Linux users, and should we be running anti-virus software?

(I know the second question has been addressed here before, but it seems to me that the route of infection of Mal/JavaJar-B is possible even for the paranoid user. If I understand correctly, a popular website was compromised, and anyone that merely visited this website was infected. Imagine if askubuntu.com was compromised!)

  • A truely paranoid user wouldn't run java outside a secure, disposable VM, isolated from the main system. I'd also note these were suprisingly targetted attacks, possibly done by well equipped state sponsored sources. – Journeyman Geek Feb 20 '13 at 1:07
  • Haha… there's paranoid and there's paranoid. – Sparhawk Feb 20 '13 at 1:09
  • Then there's running everything off a livecd, and committing everything to memory ;p – Journeyman Geek Feb 20 '13 at 1:09

In theory, yes. In this case, the malware is 'just another program' running in java to steal data I believe. Malware goes cross platform!

In practice there's already a certain degree of hardening in browsers that's likely to mitigate the risk of this.

First and formost, unless you're clicking everything you see (and apparently its plausible that the developers in question explicitly trusted this site), firefox is adding click to play for plugins, so its slightly less likely that you'll have something just running willy nilly on your computer.

You can also mitigate the risks of this by not installing java (or installing it on a VM). Obviously this is slightly paranoid - you can instead disable the java plugin in your browser as twitter has suggested

These are often 0 day attacks so the ability of AV to catch them before they happen is limited. They're also more interested in user data, so, the system itself is safe. The best defense here is common sense. They're also targetted attacks so unless you're an obvious target, well, there's less to fear. If you are, well, a good, sensible security policy will help as much as, or even more than AV - for example isolating sensitive stuff off the internet where possible, and/or having network monitoring in place to catch unusual things.

| improve this answer | |
  • Just to clarify, do Java exploits have to be specifically tailored to Linux, or are they cross-platform "out of the box"? FWIW, I do use noscript, but I'm somewhat lazy; if a page doesn't work, I just allow scripts immediately. If it's a blank page, then I'd allow scripts to see what it is! Finally, could you please expand on "isolating sensitive stuff off the internet" and "network monitoring"? Thanks. – Sparhawk Feb 20 '13 at 23:09
  • I do believe that java exploits are cross platform by nature - though they are often used to get OS specific payloads into a system. As for "isolating stuff off the internet" - basically, the simplest way to keep something you are paranoid about getting stolen is to put it on a system thats not connected to the internet - the military, for example runs systems on an internal network. Network monitoring involves something like an IDS that keeps track of network traffic, and alerts you to anything odd. – Journeyman Geek Feb 21 '13 at 0:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.