JRE pwnage
So this is a great write-up by Symantec on the rise in not only vulnerabilities but active exploitation of vulnerabilities in the Sun Java Runtime Environment.
This all just makes sense to me . . . people bemoan the Microsoft 'monoculture' as dangerous due to its ubiquity but they often overlook the *other* equally if not more dangerous monocultures that exist out there. Think about every OEM PC ever made in the last 5 years . . . what is pre-installed on that bad boy for you? Why I bet you get a copy of the Sun JRE and / or Adobe Acrobat and Flash.
We've already seen the MPack exploit framework attempting Winzip and Quicktime AX control vulnerabilities - it makes sense that they'd try to increase their success rates with software that's harder to get patched (does the Sun JRE even have an automatic update ability? Is your mom going to know how to patch Java on her machine?).
IMHO - this article is just more evidence that the bad guys are increasingly turning their focus to other vendors who make ubiquitous software because at the end of the day it's all about the data and the money for them - they don't really care who makes the software. I'm just glad we have products developed under several years worth of the SDL coming on-line (Vista, Office 2007 etc.) . . . too bad the other vendors can't say the same. :)