Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This is the second time I've had a drive-by executable installed on my machine using the following:

  • Google Chrome 6 (latest)
  • Windows 7, UAC on

This happened while I was browsing for images to add to a gaming.se post; one of the sites I visited (to get an image of a transfer cable) must have had drive-by browser exploit code running.

UAC alerted me that a weird temporary executable wanted to run, and I declined, but I still got the fake antivirus executable running on my machine. Sigh..

I do have Java installed because I upload stuff monthly to clearbits.net and their uploader is a Java plugin. So my best guess is, websites are doing drive-by installs using the massive numbers of zero-day vulnerabilities in the Java browser plugins.

For now, I have uninstalled Java, which works. But I wondered if I could disable the Java plugin in Google Chrome instead.

So, how do you disable these vulnerable plugins in Google Chrome? I can't find the UI.

share|improve this question
7  
How did you detect this drive-by executable ? –  Leonel Oct 20 '10 at 19:00
5  
You can always see if your plug-ins need to be updated here: mozilla.com/en-US/plugincheck –  travis Oct 20 '10 at 19:16
2  
@paper I used microsoft.com/security_essentials –  Jeff Atwood Nov 9 '10 at 0:03
1  
I got a similar thing from a PDF the other day... and to top things off, if I had only remembered that I hadn't meant to open one, I could have avoided it! –  SamB Dec 10 '10 at 22:07
1  
How do you know it was a vulnerability in Java and not a vulnerability in webkit? –  BlueRaja Jun 28 '11 at 4:57

6 Answers 6

up vote 125 down vote accepted

For Java specifically, Chrome now disables Java by default on all pages and prompts you to allow it to run each time a site needs it.

For more general plugin worries, Chrome allows you to block all plugins on all sites completely, and then allows you to selectively enable them on a page without reloading it. You can also configure exceptions for particular URLs.

To enable this, under the Plug-ins section of the settings url: chrome://settings/content select "Block All".

With this option enabled, when you want to run plugins on a page you have 3 options:

  • Right click on the plugin and choose "Run this plug-in" from the context menu
  • Click the plugin icon in the URL bar and choose "Run all plug-ins this time
  • Add an exception for sites you trust so that they can run plugins without your explicit permission each time

Chrome also has a "Click to play" setting which is hidden behind a flag in some versions of Chrome. As a commenter mentioned, this option is vulnerable to clickjacking attacks so I would advise against using it. You're better off with the "Block all" feature.

share|improve this answer

I found a really old bug / feature request on Google Chrome here.
It appears in Chrome 6.0 or later. Visit chrome://plugins/ or about:plugins and disable Java there.

alt text

Once I did this, to make sure Java was disabled, I visited a Java plugin demo page. And indeed it was disabled:

alt text

But my general recommendation is to uninstall Java -- you really don't want Java on your system unless you absolutely, positively have to have it .. because there are so many new exploits for it.

I would also recommend disabling any plugins you don't absolutely need. Every enabled plugin is an attack surface, and yet another thing that needs to be kept up to date..

share|improve this answer
13  
I ended up disabling like 15 plugins I didn't know I had... –  jmfsg Oct 20 '10 at 19:02
    
Couldn't you just go in and delete the "netscape" (and IE, I suppose) plugin DLLs, rather than uninstalling everything? –  SamB Dec 10 '10 at 22:04
1  
Oracle, in their wisdom, have broken those sun.com links. I googled "java applet demo" and tried the first non-sun link. Yes, it looks like modern Chrome disables Java by default. –  Jason Sep 15 '12 at 11:25

One small trick I use with Java is to hunt around and install the x64 version only, which I only use when I fire up IE x64 to use the one-off Java only apps like the one you reference.

share|improve this answer
6  
oh man that's an awesome tip; I use IE 64 bit in a similar way when I want to test in "browser I never use but still works" –  Jeff Atwood Oct 20 '10 at 19:08

To only disable Java plugins one can use the -disable-java startup switch. Example:

"C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" -disable-java

Navigating to http://java.com/en/download/help/testvm.xml after a restart of the browser gives the nice message

No working Java was detected on your system. Install Java by clicking the button below.

One can read about other switches in The Power User’s Guide to Google Chrome. There is other useful information, too.

share|improve this answer

Although it may be an easy fix, just sufficiently blocking Java, if you are in favour of a more holistic approach you may prefer to use a combination of:

  • Secunia PSI/VIM for notification of updates, vulnerabilities and automatic updates
  • Microsoft EMET for preventing stack overflows and similar
  • BufferZone for protection from drive by installers
  • iCore Virtual Accounts for times when you need to walk the dark side of the net on a production machine (it's a bit inconvenient to login/logout and uses semi-virtualisation so there is some overhead - but when you only have one machine at your disposal...)

This should protect you from more than just Java vulnerabilities.

To measure the effectiveness of these approaches (EMET alone seems to stop 90% of them) you may want to use the Social Engineering Toolkit.

share|improve this answer

Instead of disabling the plugin in Chrome, another possibility is configuring Java in order to disable it for all browsers.

To do that:

  1. Open Java Control Panel (C:\Program Files\Java\jre7\bin\javacpl.exe)
  2. Go to Security tab
  3. Uncheck "Enable Java content in the browser"
  4. Java tells you it will take effect after restarting browser(s)
share|improve this answer

protected by studiohack May 15 '11 at 1:01

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.