Threat Level: green Handler on Duty: Guy Bruneau

SANS ISC: All I need Java for is .... - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
All I need Java for is ....

Java just can't catch a break!  A number of our readers have pointed out that Security Explorations claims they have 2 new Java zero days (no verification from Oracle on this yet).

This of course has fueled the fire of "it's time to just say no and uninstall Java" in many quarters.  And for general purpose internet browsing, maybe you can.  If you do need Java, and if you do, changing the security settings to "ask every time" is a good way to go.  Of course, if you run a business app that needs Java, you need to make it transparent to your user community somehow - this can be particular problem if your app needs a specific (aka old / vulnerable) Java version - we've talked about this in a few different stories over the last few months.

But this got me to thinking, as security folks, what tools or processes do we use daily that need Java?

My list is pretty short:
Burp Suite for Web Assessments -
ZAP - Zed Attack Proxy, also for Web Assessments -
Nessus, for straight up vulnerability assessments and security scans (Java is only needed for PDF exports in Nessus I think) -

Network appliance administration is often Java based as well - for instance, the GUI for Cisco ASA firewalls and many wirelss controllers requires Java to run.

What's in your "I only need Java for this or that infosec tool" list?  Please, let us know through our comment form.

Rob VandenBrink

Rob VandenBrink

577 Posts
ISC Handler
Feb 26th 2013
Not security-related, but Dell IT Assistant wants it.
ManageEngine OpManager
Vigiliti nLive

3 Posts
GotoMyPC (can run w/o Java, but requires extra steps)
Cisco SSL vpn client
Juniper SSL vpn client
Zyxel SSL vpn client

I use QuickJava in Firefox to enable/disable on the fly. Every chance I get, I beg vendors to develop in another language . . .

9 Posts
8 Posts
To generate Nessus reports in PDF format you must have Java installed on the Nessus server (not required on the client system). And as of 11/2012 the Nessus user interface is HTML5 (So neither Java or Flash is required on the client.

1 Posts
Cisco SSL VPN client does not require Java. It can be installed via ActiveX or downloaded and manually installed (vs. the automated methods the other two provide).

I use Java for Oracle apps (we've a dozen), Cisco ASDM Firewall configuration, HP iLO.

I was able to uninstall Java from my personal computer when my small credit union updated their banking app's menu system to not need Java.

For each environment, I have multiple browsers and use "-no-remote -ProfileManager" with Firefox to get prompted for which one to use even if there is already a Firefox session running. My personal computer only had Java enabled in my banking browser profile. My work computer only has Java enabled in my Internal-only profile.

This isn't something you call really get non-technical people to buy off on or understand. The best thing we do is block Internet Explorer access to the Internet (user-agent string blocking in Proxy) and only allow Java with it. Firefox is all that is allowed to the Internet and using GPOs we block Java with Firefox. So, Internet Explorer for intranet-only, Firefox for Internet (no Java, and most of our staff have to use an Oracle app or two or dozen).
42 Posts
STIG Viewer - Version 1.1.2 iase dot disa dot mil
1 Posts
Remote control from PC of ELK M1 perimeter security system:

Not used every day, but it sure is handy when it's needed.
1 Posts
BlueCoat Web Proxy management, Cisco asdm.

5 Posts
The webcasts provided by SANS uses Elluminate software which requires Java to be installed in order to view the webcast. *facepalm*

31 Posts
HP P4000 Management Console
HP Procurve E Series Web Interfaces (for older switches anyways)
HP ILO Remote Console (for non IE users)
Brocade SAN Switches
Blackberry Enterprise Server
ManageEngine Support Center

These are ones I can think of right off the top of my head.
3 Posts
Verizon Droid phone photo transfer app required me to re-install Java to transfer photos from my phone to my computer: Kies Air. used JAVA for one it's simple games, but has a beta test of a non-java program for their site.

That's it! Do we really need Java?
3 Posts
Sadly, Kronos Workforce Central/HR Admin.
4 Posts
Juniper's SSL VPN client does not need Java if you're using IE.

HP StorageWorks Tape Library.
HP printers.
Various vendor sites for uploading files.
Oracle E-Business Suite.

I haven't had Java installed at home for over a year. Flush is the next to go.
Ditched it company wide. Anyone needing goToMyPC can just do the extra steps. I need home and weekend time for myself, not stamping out fires caused by mixing user convenience with one well engineered social attack that succeeds.

I need to spend time working on things that provide ROI for my company.

Supporting Oracle Java SieveMaster has negative ROI.

One less Yacht and One less lawsuit would have allowed Oracle to fix their **** product instead of burdening us with Entree of the Hour makework.
We have blocked it at the firewall level, and I was surprised how many functions stop working, especially basic things like WSUS and EPO.

Internally we need it for
forewall, printer, network device administration

Externally (had to list these sites as Trusted in firewall) (for EPO) for WSUS for administering Office365 for support incidents

10 Posts
Again not specifically an infosec tool but

Oracle (formerly Sun) Secure Global Desktop
relies on Java....
Secunia OSI.

Note that Active-X (or whatever it is called these days!) is worse than Java. At least Java has sandbox capability (even if it is often overridden) whereas Active-X gives full unrestricted access to the machine.

35 Posts
I can't think of any infosec tools off the top of my head I use that require Java. The only thing I use it for is a program called Jdownloader which is used to manage file downloads from cyberlocker sites.

@Wetlandstom: Which brand of phone is the Verizon Droid? I have a Motorola Razr and it doesn't require Java for Phone-to-PC (and vice versa) xfer but uses its own proprietary software from Motorola?
@carol: Microsoft requires Java for Office365? That's laughable.
@patermann: Download the Secunia PSI tool locally instead of running the web version. It will even do the updates automatically.

17 Posts
1 Posts

Sign Up for Free or Log In to start participating in the conversation!