security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

86
votes
7answers
13k views

Why do I hear about so many Java insecurities? Are other languages more secure?

I really like the Java programming language, but I continuously hear about how insecure it is. Googling 'java insecure' or 'java vulnerabilities' brings up multiple articles talking about why you ...
35
votes
4answers
123k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
27
votes
3answers
2k views

Why did Java (JRE) vulnerabilities peak in 2012-2013?

I've taken a graph of the amount of CVE reports concerning the JRE per Year. Now as you can see this spiked in 2012-2013, which could have been guessed easily, if you look at the amount of news items ...
26
votes
6answers
480 views

How to keep an eye on upgrades, patches and security issues for used open-source libraries?

For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
23
votes
3answers
2k views

Should I be disabling Java?

First it was Apple, now it's the US government... U.S. urges users to disable Java; Apple disables some remotely New malware exploiting Java 7 in Windows and Unix systems How serious is this ...
18
votes
4answers
7k views

Deleting a Java Object securely

I know that in order to delete a Java object I should use character array instead of String, since I can safely erase (rewrite the character array with other data) its content. This seems not to be ...
17
votes
4answers
4k views

How secure is Java's hashCode()?

On our views in a Java web application, currently I am using hashCode as Id's for objects so that at server end I can get the same object back. However, I am wondering how secure Java's hashCode ...
17
votes
7answers
6k views

Any comprehensive solutions for binary code protection and anti-reverse-engineering? [closed]

Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
14
votes
6answers
4k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
13
votes
2answers
3k views

How should an application store its credentials

When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
12
votes
5answers
6k views

How can I decrypt data with Java, without hard-coding the key?

I hope this is not a chicken-egg problem or reinventing the wheel but here goes. I have a Java application that needs to access a password protected file (actually during the application startup). The ...
12
votes
3answers
3k views

Java SecureRandom doesn't block? How?

I know from experience that reading from /dev/random blocks when the Linux kernel entropy pool runs out of entropy. Also, I've seen many articles and blog entries stating that when running on Linux, ...
11
votes
3answers
2k views

Is null-byte injection possible in Java filenames?

From the Area51 proposal
11
votes
4answers
8k views

What's the standard way to encrypt a file with a public key in Java?

I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the ...
11
votes
1answer
5k views

Android Runtime Code Injection

I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
11
votes
2answers
2k views

Why do some Java APIs bypass standard SecurityManager checks?

In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
11
votes
1answer
4k views

HQL injection example

Our developers left a surprise in handling user login. Namely: // java List users = hibernate.find("from Users where username = '"+formUsername+"'"; if (users.length==0) { return BAD_USER; } if ...
10
votes
4answers
1k views

Is Java relevant to Information Security?

I'm currently studying Computer Science, where we're teached Java programming. I want to get into the IT-security field, but it seems to me that Ruby and Python are more relevant for that, so I have a ...
10
votes
7answers
1k views

Cheating or service disruption by altering client-side code

A reasonably white-hatted hacker has demonstrated the ability to insert text of his own choosing into the communication between a java applet and a web based server. Not a simple MITM attack, but ...
10
votes
2answers
701 views

How can a network observer identify computers running old versions of Java?

I received an email earlier today from my ISP (a university). The email reads (in part): Your network connection has been disabled because your version of Java is not patched for the most recent ...
9
votes
4answers
6k views

Any useful tools for Android source code review? [closed]

I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS. Fortify seems ...
9
votes
1answer
1k views

Is Java vulnerable to glibc GHOST Vulnerability in Linux?

I see on our RedHat Linux platform that "java" process has dependency over glibc library: [root@hpproliant1 ~]# ldd /usr/bin/java linux-gate.so.1 => (0xffffe000) libpthread.so.0 => ...
8
votes
4answers
2k views

Is there a real risk of exploitation in java code where a null pointer is dereferenced

I'm playing with some generally well written and parsed java code, but there are some oddities thrown up by my code scanning tool. I know a null pointer dereference can crash a program, but assuming ...
8
votes
2answers
2k views

Will disabling the Java add-on in IE protect you from Java exploits?

Concerning the recent Java vulnerability (Should I be disabling Java?), the most common advise seems to be to disable Java plug-ins in the browser. However, Heise Security suggests that, when it ...
8
votes
2answers
4k views

safe to use jBCrypt and recommend it to my organization?

I'd like to recommend to my fellow developers that we all use bcrypt to hash stored passwords. We all use java and I hesitate to recommend jBCrypt only because its latest version number (0.3) ...
8
votes
3answers
1k views

Are there any established mobile security frameworks or secure coding guidelines available?

I am looking for security frameworks and secure coding guidelines especially for mobile devices (Android and iOS). The languages I am interested in are Objective-C, JAVA and HTML5. If there are no ...
8
votes
2answers
492 views

How to keep using Java 6 securely, despite its unpatch vulnerabilities

Given that Java 6 is now deprecated by Oracle and there recently has been notification of a 0day (that will exist forever now that Oracle is not patching JRE6), what can we do to prevent drive-by ...
8
votes
4answers
1k views

Are Java applets more secure than regular forms for login?

In Norway we have something called BankID which is a login solution for banks and other stuff. It consists (from a users point of view) of a Java applet where you enter your SSN (person number), a one ...
8
votes
1answer
3k views

How to select /dev/random or dev/urandom in the code in Android?

When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's ...
8
votes
1answer
19k views

PKCS7 encoding in Java without external libs like BouncyCastle etc

I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms). I have x509certificate from the keystore, rsa private key, ContentInfo. ContentType is "oidPkcs7Data". ...
8
votes
1answer
301 views

Security Risks of BD+

I have recently been reading about the DRM measures on commercial bluray disks, in particular BD+. It seems that this technology involves Java software running in a virtual machine, with full access ...
7
votes
3answers
5k views

Reverse engineering and Java

Is java class file or jar file is easy to reverse engineer? Because java generates a class file after compilation and not exe files. Is jar and class files are easy to decompile compare to c# and C++? ...
7
votes
2answers
2k views

Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 a safe cipher suite to use?

Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 a safe cipher suite to use for a TLS 1.2 connection to a Tomcat server? What are potential weaknesses or better alternatives? I am looking for a cipher ...
7
votes
3answers
951 views

Why must all classes' data members be set to private?

In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured". How does setting members to private makes the program ...
7
votes
1answer
8k views

Encrypting data for Android mobile app

I am creating a mobile app for Android. This is my first mobile app by the way. I have decided to store data used in my app in a SQLite database in the target Android device. The data I am storing ...
7
votes
4answers
2k views

What Checkstyle or Findbugs rules detect common vulnerabilities?

Looking for experience with both built in and custom checks. I do not need references to commercial source code analysers.
7
votes
3answers
292 views

How can I circumvent the lack of Java updates?

Just imagine you have a bunch of computers which need Java for some important software and you can't just switch to another vendor because all are using Java in this field of technology. If you start ...
7
votes
2answers
3k views

Practices for storing username/password in Web applications

I have read the following question: Storing password in Java application but I don't find the answers useful for my case. So here is my question somehow related to that. I have a Java Web application ...
6
votes
2answers
4k views

Storing password in Java application

What is best secure way to store passwords in Java web application? I am not talking about password to the DB, so it must be stored in de-cryptable way. It’s cloud environment and I need to protect ...
6
votes
3answers
440 views

How to rate Open Source Libraries?

Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries? I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
6
votes
1answer
1k views

Is there any recommended Java library for penetration testing?

Does anyone have any recommendations for a good Java library which can be used for penetration testing? I once read about a library which I think was called 'Attack lib' but I can't find it anymore. ...
6
votes
1answer
207 views

How many bits of entropy does an identifier contain?

According to https://www.owasp.org/index.php/Insufficient_Session-ID_Length: Assuming that the session identifiers are being generated using a good source of random numbers, we will estimate the ...
6
votes
5answers
710 views

Is sending plain passwords over SSL as part of a password update process bad?

The Web application I'm working on is 100% SSL secured (or rather TLS as it is called today...). The application recently has been audited by a security company. I mostly agree with their results but ...
6
votes
1answer
468 views

Security announcement mailing list for Java

I didn't find a security announcement mailing list for Java (from Oracle). How to get notified about new Java patches? I am not interested in other Oracle products. For example Apple provides such a ...
6
votes
1answer
521 views

Is java Client vulnerable by POODLE?

I have a Java based application (running on java 5 or higher) that establishes an SSL connection towards an Apache tomcat 7.0.47 on java 7. From what I understand, to exploit POODLE you need a client ...
5
votes
3answers
8k views

What data should I validate when validating X.509 certificates using Java?

Well I began with PKI a year ago with RFID system at school. Now I'm asked to implement this in my job. I understand most part of the idea. The doubt is about the certificate validation. I know it ...
5
votes
2answers
791 views

Are there any real life cases, where using final keyword in Java increases system security?

I've came across that question on StackOverflow: http://stackoverflow.com/questions/18755713/how-does-final-play-a-role-in-security The claim is made, that according to Wikipedia: A final class ...
5
votes
2answers
874 views

Class.forName injection and constructor invocation

If a Java-based webpage takes a user-supplied parameter and instantiates an object using Class.forName(parameter) What's the worst possible consequence? The attacker does obtain stack traces. After ...
5
votes
2answers
3k views

Reference implementation of C# password hashing and verification

Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java? Ideally,I'd like to see something that includes a ...
5
votes
2answers
516 views

How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?

I've been reading up-on DoS (denial-of-service) attacks within android and although I understand attacks like the below, which make use of regular programming functions etc. (Android Web Browser) ...