Many computer threats can reach their malicious intents by exploiting obsolete JAVA platforms installed on users PCs.
Some users don’t understand the reasons behind the frequent releases of newer JAVA installments; others, even if aware of the risks they’re taking, decide not to update the application or even leave different JAVA versions on their own machine. Why? Here are some frequent questions:
1) JAVA is updated so often because, when a new release happens, people with a criminal intent study the application to find bugs or new characteristics they could exploit; it’s also worth knowing that fixes often help to underline the defects of the previous versions.
2) Why do users rarely update their PC with a newer JAVA version?
The answer is easy. Many programs, offered by institutions, either don’t work or are not compatible with the newer versions of the software: we could consider, as an example, ENTRATEL, made available by Agenzia delle Entrate (an Italian income venue authority); the program functions with Jre-1.7.x or previous versions, while Oracle has already released Version 8 Update 77. This situation induces most of Entratel users to never update their JAVA applications to avoid problems, and demanding Agenzia delle Entrate to adapt themselves to the fast-paced software releases of global computer security measures is just as noble as it is useless.
The “aware computer user” acts in the following ways:
– The user avoids interfacing with Agenzia delle Entrate
– The user updates his JAVA version with the latest Oracle released one and uninstalls all the previous ones
– The user visualizes all the hidden folders
– The user renames the hidden folder JAVAPATH, usually found in: C\ProgramData\Oracle\Java\JAVAPATH
In conclusion, my suggestions to improve the security of ones enterprise’s network are the following:
– Force all users to either not install JAVA on their own PC, or to install only the latest version of the software; explaining the reason why to the skeptical.
– If incompatibilities come up, immediately ask the producer to update his product.
– If the previous is impossible, either change the product or find an alternative solution to the problem.