Turn off your Java plug-ins RIGHT FUGGIN NOW!!!!! [View all]

[Earth Bound Misfit]

Critical Java zero-day bug is being “massively exploited in the wild”
http://arstechnica.com/security/2013/01/critical-java-zero-day-bug-is-being-massively-exploited-in-the-wild/

Attack code that exploits vulnerability in Java's browser plugin has been added to the Blackhole, Cool, Nuclear Pack, and Redkit exploit kits, according to the Malware Don't Need Coffee blog, prompting its author to say that the bug is being "massively exploited in the wild." Miscreants use these products to turn compromised websites into platforms for silently installing keyloggers and other types of malicious software on the computers of unsuspecting visitors. KrebsOnSecurity reporter Brian Krebs said the curators of both Blackhole and Nuclear Pack have taken to the underweb to boast of the addition to their wares. It's not yet clear how many websites have been outfitted with the exploits.

snip

"There appears to be multiple ad networks redirecting to Blackhole sites, amplifying the mass exploitation problem," Kaspersky Lab expert Kurt Baumgartner wrote. "We have seen ads from legitimate sites, especially in the UK, Brazil, and Russia, redirecting to domains hosting the current Blackhole implementation delivering the Java 0day. These sites include weather sites, news sites, and of course, adult sites."

Java 7 Update 10 ships with a feature that makes it far simpler to unplug Java from the browser than in previous versions. Oracle’s instructions for using that feature are here: http://www.java.com/en/download/help/disable_browser.xml

Setting the Security Level of the Java Client: http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/client-security.html