SageTV Community  

Go Back   SageTV Community > SageTV Products > SageTV Software

Notices

SageTV Software Discussion related to the SageTV application produced by SageTV. Questions, issues, problems, suggestions, etc. relating to the SageTV software application should be posted here. (Check the descriptions of the other forums; all hardware related questions go in the Hardware Support forum, etc. And, post in the customizations forum instead if any customizations are active.)

Reply
 
Thread Tools Search this Thread Display Modes
  #1  
Old 10-19-2010, 03:14 AM
korben_dallas's Avatar
korben_dallas korben_dallas is offline
Sage Icon
 
Join Date: Oct 2004
Location: USA
Posts: 1,250
Post "unprecedented wave of java exploits" - SageTV, what do we do?

Microsoft Malware Protection Center

I have seen these java exploits first-hand, and let me tell you they are no joke. They can get around UAC, and they can get around security products. Once installed, they prevent execution of task manager, registry editor, the command prompt.. pretty much anything you need to attempt to clean them. They install malware all over the place, setup listeners and browser proxies. I even saw one that corrupted Symantec Endpoint.

Running as an un-privileged user is helpful but will not stop the install if you get exploited. You'll have to logon as an Admin and clean with up-to-the-minute security product.

Blocking java applets in browser options is the only option I see, unless SageTV can give us guidance on keeping Java updated?
__________________
SageTV server & client: Win 10 Pro x64, Intel DH67CF, Core i5 2405s, 8 GB ram, Intel HD 3000, 40GB SSD system, 4TB storage, 2x HD PVR component + optical audio, USB-UIRT 2 zones + remote hack, Logitech Harmony One, HDMI output to Sony receiver with native Intel bitstreaming
Reply With Quote
  #2  
Old 10-19-2010, 05:39 AM
bcjenkins bcjenkins is offline
SageTVaholic
 
Join Date: Jan 2006
Posts: 3,764
Why is this SageTV's worry? If you don't want your machine to get infected, don't use it for anything but SageTV or switch to Linux

B
__________________
Running SageTV on unRAID via Docker
Tuning handled by HDHR3-6CC-3X2 using OpenDCT
Reply With Quote
  #3  
Old 10-19-2010, 06:23 AM
rsteele rsteele is offline
Sage User
 
Join Date: Apr 2008
Posts: 49
As far as I can tell these exploits are when using Java embedded in a browser; i.e., using applets--especially those of unknown origin. SageTV isn't based on applets, though it does use Java under the hood.

Rich
Reply With Quote
  #4  
Old 10-19-2010, 06:38 AM
CollinR CollinR is offline
Sage Icon
 
Join Date: Dec 2004
Location: Tulsa, OK
Posts: 1,305
Same stuff would happen if you browsed the web on your cable box, just keep SageTV as a single use appliance and you have much less to worry about.
Reply With Quote
  #5  
Old 10-19-2010, 06:47 AM
stuckless's Avatar
stuckless stuckless is offline
SageTVaholic
 
Join Date: Oct 2007
Location: London, Ontario, Canada
Posts: 9,711
Quote:
Originally Posted by korben_dallas View Post
Blocking java applets in browser options is the only option I see, unless SageTV can give us guidance on keeping Java updated?
This may go without saying... but given how prevalent browser attacks are...I'd recommend never running java applets, activex controls, or flash. If you must, then I'd use something like NoScript, so that you can control which sites you 'trust' to run code on your computer.
Reply With Quote
  #6  
Old 10-19-2010, 07:01 AM
stanger89's Avatar
stanger89 stanger89 is offline
SageTVaholic
 
Join Date: May 2003
Location: Marion, IA
Posts: 15,188
That's what I do.
Reply With Quote
  #7  
Old 10-19-2010, 11:13 AM
greggerm greggerm is offline
Sage Advanced User
 
Join Date: Feb 2004
Location: Rhode Island
Posts: 175
I run Java v1.6.x on my desktop station and it handles the Sage Client just fine. It remains updated.

I probably have the Sage-installed 1.4.x on my WHS box, but being literally just a server, there's zero web browsing on that machine. The homepage for the machine is Windows Update, so the likelihood of a problem there is minimal.

(All home machines are behind a physical firewall)

Although it pays to pay attention to these threats, just make sure you have mitigating controls or behaviors in play to prevent them from being a big concern.

-Greg
Reply With Quote
  #8  
Old 10-19-2010, 09:38 PM
korben_dallas's Avatar
korben_dallas korben_dallas is offline
Sage Icon
 
Join Date: Oct 2004
Location: USA
Posts: 1,250
I do not browse from my SageTV server.

However, my SageTV Client is on my main workstation, where I spend the vast majority of time in my browser. Unfortunately, my all online school schedule requires both java for programming as well as java (and flash) through the browser. Disabling either (or running something like noscript) is simply not an option.
__________________
SageTV server & client: Win 10 Pro x64, Intel DH67CF, Core i5 2405s, 8 GB ram, Intel HD 3000, 40GB SSD system, 4TB storage, 2x HD PVR component + optical audio, USB-UIRT 2 zones + remote hack, Logitech Harmony One, HDMI output to Sony receiver with native Intel bitstreaming
Reply With Quote
  #9  
Old 10-20-2010, 03:44 AM
stuckless's Avatar
stuckless stuckless is offline
SageTVaholic
 
Join Date: Oct 2007
Location: London, Ontario, Canada
Posts: 9,711
Quote:
Originally Posted by korben_dallas View Post
I do not browse from my SageTV server.

However, my SageTV Client is on my main workstation, where I spend the vast majority of time in my browser. Unfortunately, my all online school schedule requires both java for programming as well as java (and flash) through the browser. Disabling either (or running something like noscript) is simply not an option.
You may misunderstand the purpose of NoScript... basically you grant access to some sites to run java and flash, but not all sites. So your school sites would be able to execute java and flash, but other sites would not. Now if it turns out that your school sites are the source of the java expliot, then you're screwed
Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
"Backdrops" "SageTV" "Covers" folders - what's creating them mp328 Sage My Movies 4 09-20-2010 05:31 PM
JAVA "MainMsg"" error help Graygeek SageTV Software 0 09-01-2009 04:04 PM
Can anyone customize for me a Sagetv import for "movie now" "news now" .. menus thenewguy1979 SageMC Custom Interface 9 09-18-2008 02:41 PM
"Set defaults" for Series forgets "Keep"/"Auto-delete" setting maxpower SageMC Custom Interface 9 05-14-2008 09:44 PM
Java Error? "unexpected error" "exception_access_violation" gotuitdan SageTV Software 1 11-21-2006 10:49 PM


All times are GMT -6. The time now is 04:27 PM.


Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2022, vBulletin Solutions Inc.
Copyright 2003-2005 SageTV, LLC. All rights reserved.