Hi, Renoirs, how are you lately? I hope everything is well for you. This week I post again about IT section, get bored with the topic? Don’t worry this is my last post about IT, hahaha. On this week post, the theme is more specific. I will explain you about how Java applets could be security threats for client machines. Before I talk about it, the first one that I want to deliver is about general explanation about Java applets.
What is Java Applets?
Java applets are graphical computer programs written in the object oriented language of Java. Java applets, like applets written in other programming languages, require a host container, such as a browser, in which to run. A Java applet commonly is used by webmasters wanting dynamic or interactive content for their websites. When people visit these websites, their browsers automatically download and execute the Java applet for them to interact with.
A key feature of Java applets is their graphical interactivity with the user. Java applets have buttons, list boxes and other controls that users make selections with. The applet responds to these selections by displaying new content. This new content will typically be a mix of text and graphical shapes like the lines and ellipses used on appearance of a program. Contrast this type of interaction with that of a command console, where all input and output is text-based.
An essential concept in Java applets is that of events, which developers of Java applets refer to as milestones. A milestone is an event in the life cycle of an applet's execution, such as the loading of the applet into the browser, or the push of a button or other control. A mouse click on the applet's window is another type of milestone, as is the exposure of the Java applet's window, when a window from another application is moved or resized. Java applet developers are responsible for making sure the applet responds appropriately to each milestone. For example, when the user selects her time zone from the list box on a Java applet displaying the time, she expects to see the clock's hands reflect the current time for her locale.
Security and Java Applets
Since Java applets are interactive and produce dynamic content, executing them involves a greater potential security risk than executing the static content of a plain web page. To address the potential security threats, Java applets make use of security certificates. Applets with such uncertified unsigned possibly will be untrustworthy applets. An unsigned applet cannot access files on a computer, unless it given an explicit permission.
Those who use Java applets and programs face significant security threats. Information on their computers may be selectively altered, destroyed, or disclosed by those who develop Java applets and programs and those who have the ability to modify them. Damage may result from deliberately planned attacks on your system or from errors that are introduced into Java source or compiled code. Although the threat associated with inadvertent errors is far less than with malicious actions, it cannot be discounted.
The damage resulting from instances often exceeds that of the most cunning hackers. However, security threats as the result of deliberate hostile actions. The threat posed by a standalone Java program is the same as any other program that you run on your computer.
How Java Could Breach Security ?
The steps how Java applets breach the security can be simplified with an explanation like this.
When a program runs on your computer, it has access to computer files, system capabilities, and system resources, and can use this access to modify, delete, or compromise sensitive data or misuse these capabilities and resources. The program's access is limited only by the access controls enforced by your operating system or other security software. In most cases, these access controls are nonexistent or minimally effective.
The danger of running a standalone Java program is the same as running any other program that you do not develop yourself. Unless you can verify the security of the program through rigorous analysis and testing, you are forced to trust the programs not to cause deliberate or inadvertent damage.
Standalone Java programs provide no more or less security than any other programs you may encounter. They may be written to cause the same level of damage to your system as a program that is written in another programming language. Because of this unfortunate fact, the security of standalone Java programs is not explicitly considered in the remainder of this chapter.
The threat posed by Java applets expands the threat posed by standalone programs to the Web as a whole. Since Web pages may contain applets, scripts, and other types of embedded programming, clicking on a Web page is equivalent to executing a program. The increased danger associated with applets is the lack of control that you have over the programs you execute. Any Web page may bring an insidious intruder into your system. You may, of course, disable the execution of applets by your browser, but doing so eliminates all the potential benefits of Java.
Java Security Features
So, based my explanation, Java applets can be threat for your computer. But, there is a way to counter or defend your computer from this kind of harmful Java applets. To counter the threat posed by those who would bring harm to your computer and to mitigate the risk associated with running applets, the developers of Java and Java-enabled browsers have included a powerful set of security features in the Java language, compiler, runtime system, and Web browsers.
Applets cannot create or install a class loader or security manager. Applets cannot create classes in the local class name space. Applets cannot access local packages outside the standard packages of the Java API. Applets cannot access files and directories on the local system in any manner. All windows created by an applet must be clearly labeled as being entrusted. Keeping Java secure is an ongoing process. Several security flaws have been identified to date and it is reasonable to expect that new Java security flaws will continue to be found.
So, be careful when choosing or running a java program Renoirs. That’s all my post on this week, I am so happy to share about IT with you, and next week I will talk about another things, beside IT! (of course!) See you….. Take care..
