The Java ME vulnerability sounds pretty nasty: with just a phone number, an attacker can send a series of messages to a Nokia Series 40 phone that would essentially take over the device, allowing the attacker to record conversations, make phone calls, and install various unsavory programs. The particularly nasty turn that the story has taken is that Adam Gowdiak, the security researcher who found the vulnerability, is essentially extorting money from Sun and Nokia for his proof of concept. 20,000 euros is chump change for a couple of multinational corporations like Sun and Nokia, but it sets an unpleasant precedent — plus, there’s no guarantee that the information he has will be useful, or that the vulnerability he describes exists. Gowdiak actually claims to be a former Sun employee, which adds another layer of distaste and drama to the sordid affair. (This story caused a bit of panic in me personally as I couldn’t remember just what kind of phone I owned — turned out it’s a Series 60. Whew. Do your worse, hackers!) Other Java security news was a bit more upbeat. Hey, remember that anti-Java professor who got everyone so darn riled up? Remember how he said that one sign of Java’s basic lameness was the aerospace industry’s failure to adopt it? Well, it looks like Java is beginning to battle Ada (Ada?) for defense contracts in the US for embedded programming. This is due to the advance of real-time Java, which is more secure now than ever — secure both in the sense of “has good encryption and is safe from hackers” and in the sense of “will not crash and shut your system down at Mach 2”. On a final security note, Symantec released its 2008 Cybercrime trends, suggesting that Java could cause problems on the PC. “Java-based Web applications—small programs, such as video players or interactive maps, that launch themselves from a Web page—are proliferating, which will provide a growing opportunity for cyberthieves to spread bots, keyloggers, and other malicious software.” Wait, are we talking about Java Web Start here? Doesn’t that run in some kind of security sandbox? I suppose Symantec would tell us the details if we, um, paid for their reports. Security