security aspects specific to the Java programming language and libraries.
-8
votes
0answers
42 views
Close the virtual machine (vmware) customer [closed]
It is possible to close the virtual machine (vmware) on this machine where it is installed, and leave the remote access only certain IP ?
-5
votes
0answers
28 views
Encrypt .war file java web application? [duplicate]
Is it possible to encrypt the file .war with all its contents, and then have served understand this application? I saw something similar with JarCryp, most do not know if it's working on servers like ...
-5
votes
1answer
78 views
Protect java WEB application inside the server(against reverse engineering) [closed]
I have a web application running on Glassfish 3.1.2 servlet container and I need a way to protect the compiled java classes. I have tried to obfuscate the source code but it didn't work.
The project ...
70
votes
21answers
16k views
Lessons learned and misconceptions regarding encryption and cryptology
Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
2
votes
0answers
51 views
POC of a Java exploit using leftover JREs
Summary: I would like to show a proof of concept of a Java exploit using an old JRE on an up-to-date machine to cut short discussions on the "but we are patched so why removing older versions" ...
8
votes
2answers
1k views
Will disabling the Java add-on in IE protect you from Java exploits?
Concerning the recent Java vulnerability (Should I be disabling Java?), the most common advise seems to be to disable Java plug-ins in the browser.
However, Heise Security suggests that, when it ...
0
votes
1answer
49 views
What triggers a Firewall to block a TCP Socket?
I was wondering what would cause a Firewall to block a TCP Java Socket from connecting. What would trigger that? Thanks!
1
vote
0answers
35 views
AppEngine Sandbox
Does anyone know how the AppEngine sandbox is implemented? I heard they use a SecurityManager with Java but surely they are using another layer as well like LXC. I've looked at the whitelist and there ...
2
votes
3answers
146 views
How to identify the Java program that is maliciously accessing my web site from many client addresses?
For many years, my personal web site receives numerous pairs of hits that look like this, every day:
202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04"
...
1
vote
1answer
98 views
How safe is WSIT username authentication with symmetric key?
I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link).
How secure is this mechanism? Is this enough to ...
3
votes
2answers
69 views
security implications of Java's System.load vs System.loadLibrary
Jumping from http://stackoverflow.com/questions/7016391/difference-between-system-load-and-system-loadlibrary-in-java
What are the security implications of both approach ?
...
2
votes
2answers
83 views
Security of viewing a website containing Java applets offline
I've been wondering whether viewing a website offline increases the security risk.
The reason why I'm asking is that having been a short time java applet developer (for a small task) I've come to ...
4
votes
2answers
856 views
Does Java applets reveal the real IP address, even when using proxy or vpn?
Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
7
votes
3answers
223 views
How can I circumvent the lack of Java updates?
Just imagine you have a bunch of computers which need Java for some important software and you can't just switch to another vendor because all are using Java in this field of technology. If you start ...
0
votes
0answers
7 views
Why SecureRandomSpi or other SPI (Service Provider Interface) in java security are abstract not interface? [migrated]
SecureRandomSpi is Service Provider Interface. All the abstract methods in this class must be implemented by each service provider who wishes to supply the implementation of a cryptographically strong ...
3
votes
1answer
61 views
Is there any public information on audited Java open source projects?
I'm sure that there must have been any number of audits on common Java open source projects, many of them for governments or publicly-funded bodies.
Have any of the results been made public, so that ...
8
votes
4answers
417 views
What Checkstyle or Findbugs rules detect common vulnerabilities?
Looking for experience with both built in and custom checks.
I do not need references to commercial source code analysers.
2
votes
1answer
187 views
Are any Java Card 3.0 smart cards available?
The Java Card 3.0 specification (draft?) came out in 2008. It is now 2013. Are there any existing smart cards that actually implement the specification? How about USB tokens?
The best I've found is ...
4
votes
2answers
121 views
JInitiator is obsolete and I should reject it on grounds of security, right?
I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as ...
1
vote
1answer
171 views
Hardening JRE deployment - webjava
I am trying to set up some hardened deployment settings for Java for the end-users' machines on my network.
I have my system wide deployment config and properties files set up:
...
2
votes
5answers
198 views
Website vulnerability scanner in Java && Open Source
I am working on a Web platform that must-need-should have a good level of security.
Therefore, I am interested in a good quality tool to test my Web platform QA on security.
My main programming ...
3
votes
3answers
97 views
jasypt message integrity
I've been looking into ways to encrypt an authentication token that I need to pass from one site to another. Things i have learned so far are
use a high level library.
don't use ECB
use a HMAC to ...
1
vote
1answer
51 views
Java applet authenticity problem
I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
3
votes
2answers
127 views
Security of JVM for Server
Using type- and memory-safe languages like Java and Scala for server applications gave me the confidence of having a basic level of security (e.g. compared to C). Now with the recent wave of Oracle ...
2
votes
1answer
200 views
What is the best practice for storing a secret on the cloud?
This post on Securing Java Application Data for Cloud Computing offers a good introduction to using a Java KeyStore for securing encrypted data in the cloud. It neglects, however, to answer the ...
14
votes
8answers
2k views
Any comprehensive solutions for binary code protection and anti-reverse-engineering?
Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
5
votes
3answers
218 views
Why must all classes' data members be set to private?
In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured".
How does setting members to private makes the program ...
3
votes
2answers
88 views
Securing Java web services called by web site in DMZ using web services for communication
Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
0
votes
4answers
134 views
Is there a need to define “language safety”?
Language safety is not clearly defined while there're warnings about for instance Java. So how can you say that language is not safe while language safety is not clearly defined? If Java is unsafe ...
6
votes
2answers
242 views
How to keep using Java 6 securely, despite its unpatch vulnerabilities
Given that Java 6 is now deprecated by Oracle and there recently has been notification of a 0day (that will exist forever now that Oracle is not patching JRE6), what can we do to prevent drive-by ...
-1
votes
1answer
82 views
What are correct steps to setup this exploit execution(jboss_invoke_deploy)?
I've found this vulnerability (http://www.metasploit.com/modules/exploit/multi/http/jboss_invoke_deploy) but can't seem to set proper values for exploit to work , payload shown on site gives me worn ...
0
votes
1answer
233 views
Java SecureRandom generate secure random number
How to generate a secure random number bit length is 256 bits using Java. What is the different between:
SecureRandom random = new SecureRandom();
and
SecureRandom prng = ...
1
vote
2answers
274 views
What is the safest way to store a password in a single file?
I've been reading about it. This article helped me a lot. But the more I read the more complicated it seems. For example:
Is it better to use bcrypt, or PBKDF2, sha2 or something else for the salt?
...
5
votes
1answer
5k views
PKCS7 encoding in Java without external libs like BouncyCastle etc
I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms).
I have x509certificate from the keystore, rsa private key,
ContentInfo. ContentType is "oidPkcs7Data".
...
6
votes
6answers
683 views
Client side password hashing
Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security.
After reading through a few discussions here about client side hashing of passwords, I'm ...
3
votes
1answer
177 views
How to debug/reverse engineer java applets?
I need to analyze a java application (a .jar file) for a war game. I know java can be decompiled, but the coder apparently did a lot of obfuscation to prevent the reverse engineers from understanding ...
1
vote
1answer
110 views
Did I get hit by the recent Java exploit?
Looks like the website iphonedevsdk was responsible for serving up the malware that's been causing some of the recent security exploits. According to my browser history, I visited that site back in ...
0
votes
1answer
39 views
How esignature verification process work?
I have a web application in which the users will be signing an html report. I know how the digital signature authentication works. But here the user will literally be signing the document (So, Should ...
0
votes
0answers
48 views
Can Jasper files be used as shells to attack java web apps?
JasperReports is an open source Java reporting tool that can write to a variety of targets, such as: screen, a printer, into PDF, HTML, Microsoft Excel, RTF, ODT, Comma-separated values or XML ...
2
votes
1answer
317 views
Where to store Java keystore password?
We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the ...
3
votes
2answers
155 views
How content-type:image can lead to infected JAR file?
Symantec published a news about a malvertising campaign targeting IE users with Java exploits (already known vulnerabilities). At some point they explain that the users are redirected on malicious ...
9
votes
1answer
446 views
Android Runtime Code Injection
I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
4
votes
1answer
151 views
Saved passwords (use case)
I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together.
Both the data and the password are encrypted ...
2
votes
3answers
3k views
Java vulnerability: What about OpenJDK + IcedTea?
These days there is a lot of recommendations about disabling java-plugin due to a serious vulnerability. I know this topic has already been covered on this site here and here.
In the reports about ...
0
votes
1answer
113 views
Can Veracode detect vulnerabilities in jsp files?
We have chosen Veracode to perform security assessment of our JavaEE code. We have been performing white-box security testing using Veracode. As I am quite new to Veracode, I was surprised to find no ...
6
votes
3answers
606 views
Reverse engineering and Java
Is java class file or jar file is easy to reverse engineer? Because java generates a class file after compilation and not exe files. Is jar and class files are easy to decompile compare to c# and C++? ...
1
vote
2answers
86 views
Do XBAP applications have the same vulnerabilities as Java Web Apps?
In response to the popular decision in disabling Java Web Apps, there has been very little mention of XBAP applications.
XBAP applications are similar to Silverlight but it offers more options to ...
21
votes
3answers
2k views
Should I be disabling Java?
First it was Apple, now it's the US government...
U.S. urges users to disable Java; Apple disables some remotely
New malware exploiting Java 7 in Windows and Unix systems
How serious is this ...
1
vote
2answers
2k views
How does Java 7 update 11 fix the security vulnerability?
There is a new Java released a couple days ago to resolve a hole that was recently discovered.
(Oracle, US-CERT, NVD/NIST)
In my initial reading about this update 11, I saw clearly where it by ...
3
votes
3answers
565 views
Java 7u11 - Safer to switch to 6?
Java update 7u11 has made some news lately for a couple reasons. Firstly, it was an out-of-band patch to resolve vulnerabilities being exploited in the wild. Then it came back up because it is now ...
