security aspects specific to the Java programming language and libraries.
68
votes
20answers
16k views
Lessons learned and misconceptions regarding encryption and cryptology
Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
22
votes
6answers
304 views
How to keep an eye on upgrades, patches and security issues for used open-source libraries?
For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
21
votes
3answers
2k views
Should I be disabling Java?
First it was Apple, now it's the US government...
U.S. urges users to disable Java; Apple disables some remotely
New malware exploiting Java 7 in Windows and Unix systems
How serious is this ...
17
votes
3answers
3k views
Deleting a Java Object securely
I know that in order to delete a Java object I should use character array instead of String, since I can safely erase (rewrite the character array with other data) its content. This seems not to be ...
13
votes
8answers
2k views
Any comprehensive solutions for binary code protection and anti-reverse-engineering?
Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
10
votes
2answers
809 views
9
votes
4answers
4k views
What's the standard way to encrypt a file with a public key in Java?
I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the ...
9
votes
1answer
436 views
Android Runtime Code Injection
I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
9
votes
1answer
605 views
HQL injection example
Our developers left a surprise in handling user login. Namely:
// java
List users = hibernate.find("from Users where username = '"+formUsername+"'";
if (users.length==0) { return BAD_USER; }
if ...
8
votes
5answers
2k views
How can I decrypt data with Java, without hard-coding the key?
I hope this is not a chicken-egg problem or reinventing the wheel but here goes.
I have a Java application that needs to access a password protected file (actually during the application startup).
The ...
8
votes
3answers
24k views
How can I export my private key from a Java Keytool keystore?
I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
8
votes
2answers
1k views
Will disabling the Java add-on in IE protect you from Java exploits?
Concerning the recent Java vulnerability (Should I be disabling Java?), the most common advise seems to be to disable Java plug-ins in the browser.
However, Heise Security suggests that, when it ...
8
votes
4answers
3k views
Any useful tools for Android source code review? [closed]
I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS.
Fortify seems ...
8
votes
4answers
408 views
What Checkstyle or Findbugs rules detect common vulnerabilities?
Looking for experience with both built in and custom checks.
I do not need references to commercial source code analysers.
8
votes
2answers
494 views
Why do some Java APIs bypass standard SecurityManager checks?
In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
7
votes
3answers
222 views
How can I circumvent the lack of Java updates?
Just imagine you have a bunch of computers which need Java for some important software and you can't just switch to another vendor because all are using Java in this field of technology. If you start ...
7
votes
4answers
487 views
Are Java applets more secure than regular forms for login?
In Norway we have something called BankID which is a login solution for banks and other stuff. It consists (from a users point of view) of a Java applet where you enter your SSN (person number), a one ...
7
votes
1answer
1k views
How to select /dev/random or dev/urandom in the code in Android?
When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's ...
6
votes
4answers
923 views
Is there a real risk of exploitation in java code where a null pointer is dereferenced
I'm playing with some generally well written and parsed java code, but there are some oddities thrown up by my code scanning tool.
I know a null pointer dereference can crash a program, but assuming ...
6
votes
6answers
681 views
Client side password hashing
Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security.
After reading through a few discussions here about client side hashing of passwords, I'm ...
6
votes
3answers
580 views
Reverse engineering and Java
Is java class file or jar file is easy to reverse engineer? Because java generates a class file after compilation and not exe files. Is jar and class files are easy to decompile compare to c# and C++? ...
6
votes
3answers
638 views
Are there any established mobile security frameworks or secure coding guidelines available?
I am looking for security frameworks and secure coding guidelines especially for mobile devices (Android and iOS). The languages I am interested in are Objective-C, JAVA and HTML5.
If there are no ...
6
votes
1answer
623 views
Is there any recommended Java library for penetration testing?
Does anyone have any recommendations for a good Java library which can be used for penetration testing?
I once read about a library which I think was called 'Attack lib' but I can't find it anymore.
...
6
votes
2answers
240 views
How to keep using Java 6 securely, despite its unpatch vulnerabilities
Given that Java 6 is now deprecated by Oracle and there recently has been notification of a 0day (that will exist forever now that Oracle is not patching JRE6), what can we do to prevent drive-by ...
5
votes
3answers
218 views
Why must all classes' data members be set to private?
In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured".
How does setting members to private makes the program ...
5
votes
1answer
318 views
Practices for storing username/password in Web applications
I have read the following question: Storing password in Java application but I don't find the answers useful for my case.
So here is my question somehow related to that. I have a Java Web application ...
5
votes
2answers
476 views
Frameworks or any Solutions for authentications/security/ login management in Java Web Applications
I am looking for a framework/solution for authentication/ user-login management/ security in java web application that can make the naive developer's job easier/faster and make the application ...
5
votes
1answer
5k views
PKCS7 encoding in Java without external libs like BouncyCastle etc
I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms).
I have x509certificate from the keystore, rsa private key,
ContentInfo. ContentType is "oidPkcs7Data".
...
4
votes
3answers
262 views
Is this java app harmfull?
If you visit most of the "online youtube download" pages, you will get this message:
Why all these sites come up with this message? Is it a worm, or just an unharmfull app?
4
votes
4answers
413 views
Is silverlight and Java running on the web browser capable of saving “state” into the user's local machines?
I am aware that even after we have cleared our cache and cookies, websites can still save files/information into our computer using Flash (Flash ever cookies),
I was wondering does other plugins like ...
4
votes
3answers
296 views
Vulnerable java applications
I am looking for some open source/free vulnerable JAVA based applications. It can be web application, desktop application or any other. I need them to do some experiments in my research work. They ...
4
votes
3answers
933 views
Reverse-engineering one-time passwords for two-factor authentication systems
Given a one-time password generator that is time-based (such as Google Authenticator), how many instances of (time, PIN) pairs would one need to significantly weaken the algorithm to a point where one ...
4
votes
2answers
848 views
Does Java applets reveal the real IP address, even when using proxy or vpn?
Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
4
votes
1answer
1k views
how to secure Android Market public key
Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
4
votes
1answer
147 views
Saved passwords (use case)
I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together.
Both the data and the password are encrypted ...
4
votes
3answers
3k views
What password-based encryption to use with standard Java 6?
Which password-based encryption method should I use in Java 6? It should be as strong as possible, but work with the default security policy file (not the export restricted one which you have to ...
4
votes
2answers
115 views
JInitiator is obsolete and I should reject it on grounds of security, right?
I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as ...
4
votes
1answer
823 views
Encrypting data for Android mobile app
I am creating a mobile app for Android. This is my first mobile app by the way.
I have decided to store data used in my app in a SQLite database in the target Android device.
The data I am storing ...
4
votes
2answers
275 views
Class.forName injection and constructor invocation
If a Java-based webpage takes a user-supplied parameter and instantiates an object using Class.forName(parameter)
What's the worst possible consequence?
The attacker does obtain stack traces. After ...
4
votes
3answers
275 views
How to rate Open Source Libraries?
Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries?
I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
4
votes
2answers
1k views
Reference implementation of C# password hashing and verification
Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java?
Ideally,I'd like to see something that includes a ...
4
votes
2answers
432 views
How should an application store its credentials
When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
4
votes
1answer
111 views
Security announcement mailing list for Java
I didn't find a security announcement mailing list for Java (from Oracle). How to get notified about new Java patches? I am not interested in other Oracle products.
For example Apple provides such a ...
4
votes
1answer
937 views
How can I store downloaded video securely to device's sd card?
I want to save videos in my android mobile's SD card securely such no other application or user can use it, outside the application or on any other devices.
So for this what can I do? I think about ...
3
votes
4answers
662 views
Writing malware in java?
To me, it seemed like malware could never be written in java. Those who taught me java said it was "secure" and did not allow "low-level access" like c,c++.
But, I discovered that it can be done - ...
3
votes
4answers
358 views
Base64 conversion for byte array in encryption
I am using ECC algorithm for security. Now the concern is I am placing the data in web page after encryption of the data in hex format and transmit to server and then it decrypts the data, but when I ...
3
votes
2answers
345 views
Can one get infected through visiting a site with a PHP script on it and if yes, how?
I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP?
Since it's serverside it shouldn't have access to the visitor's ...
3
votes
2answers
127 views
Security of JVM for Server
Using type- and memory-safe languages like Java and Scala for server applications gave me the confidence of having a basic level of security (e.g. compared to C). Now with the recent wave of Oracle ...
3
votes
2answers
917 views
Storing password in Java application
What is best secure way to store passwords in Java web application?
I am not talking about password to the DB, so it must be stored in de-cryptable way. It’s cloud environment and I need to protect ...
3
votes
2answers
284 views
Building a security framework
I know there are many security frameworks and "building" a security framework is a bad idea.
In the recent project I have worked on, I used spring security to secure the web application. In the ...
