Oracle’s closed approach keeps Java at risk

Java security updates continue to flow like water. The most recent patch included multiple, significant design changes to counter vulnerabilities, but the preceding sequence of fixes has been just as significant. As several commentators were saying at the start of the year, the security problems uncovered in Java are hard to fix because they arise from fundamental design decisions, especially regarding the code that supports browser-based use of Java.

What worries security researchers is the cascade of interacting subsystems that are implicated. The problems seem to be less a defect in a single subsystem and more a consequence of the interplay of apparently correct subsystems. Oracle has been working very hard to address the issue, and it deserves kudos on this front. But the developers I’ve consulted note that while Oracle’s fixes have broken the exploit chain for multiple avenues of attack, building new chains of exploits remains possible — and keeps happening within the shadows of the black-hat cracker community who are fast to exploit every avenue for attack.