2

For me Java is just a security threat. Not many legitimate Linux apps use Java. However there is an abundance in Java malware and malicious remote administration tools like Jrat among others.

But one legitimate app I run like the "Arduino IDE" may unfortunately need Java. So, I want an option to enable or disable Java whenever I want without uninstalling it.

I was thinking of denying Java permission to execute using chmod. Would this work? Is there a better alternative? Would moving Java from a "bin" folder work?

Edit: I just realized that Java may be deeply integrated with the OS and chmod method may work for .jar files but may not actually work for all Java executables.

Important: I am not talking about Java browser plugin. I'm talking about Java on my linux system. I chose linux because it didn't have many malicious rats and botnets like Darkcomet, Poison IVy, Zeus. However there are Java rats like Jrat. Which could be autostarting once I accidentally gave them root.

3

3 options, as I see it.

1 - Disable browser plugins

I would say that the primary threat of Java is by allowing it to be invoked from the browser. So getting rid of the Java plugins to which ever browser you use would be the best option.

2 - Isolate Java - not on $PATH

Going further if you know that various applications need Java then put it in a non-standard location would likely be the next best thing to do. Not ever adding it to your PATH would be part of this solution.

3 - Isolate Java to specific applications that require it

Lastly you could opt to install Java only along side the applications that require it, there by relegating it to a very narrow focused use, for specific applications and nothing more. This will increase your HDD usage, but then only these handful of applications will be able to use their dedicated version of Java, and nothing else.

1

The major security threat WRT Java is applets, since those can be downloaded and run by a web browser without you noticing. They are supposed to be sandboxed, like flash and javascript, but Java upgrades are notorious for introducing vulnerabilities.

There's no reason to worry about normal applications you've purposefully installed, or at least, no reason to worry about the java ones in particular. These are no more or less prone to containing malware than anything written in any other language, since anything "malicious" in a normal application had to be coded intentionally, and you can do that in C or python or anything else.1 Someone on the Eclipse team could be doing bad things, but then, so could someone on the GNOME team.

How to disable Java applets in the browser depends on the browser, but it is usually as simple as turning off a plugin. On linux this may be called "Ice Tea" something or other, since this is an implementation commonly used there.

1 Likewise, bad code with vulnerabilities are possible in any language, and any language implementation.

2
  • I'm not worried about that. I know better than to enable the browser plugin. My main worry is a targetted environment. There are malware like Jrat which allows script kiddies to control my computer. This malware works on Win, Linux and Mac as long as it has Java.
    – Ufoguy
    Dec 9 '13 at 5:17
  • Lets say a script kiddie has physical access to my computer and knows my password. He could install Jrat and spy on me remotely just like on Windows. He could do that with pyhton, or native apps except that there are not many ready made malware tools that are really script-kiddie friendly. Most script kiddies try to infect Linux and Mac with Java rats. Go to hackforums.net/forumdisplay.php?fid=114 and you'll see that Jrat is among the top RATS used by these script-kiddies.
    – Ufoguy
    Dec 9 '13 at 5:23
0

To add a fourth option to what slm has said:

4 - Setup dummy with update-alternatives

update-alternatives allows the user to have several versions of java installed side by side and select which one will be active at the moment. You could setup a fictitious java, and select it as the current alternative when you do not need to have it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.