security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

2
votes
0answers
88 views

Grant permission to read java home from untrusted java code

I'm loading untrusted code at runtime and for this reason I'm also writing a custom SecurityManager. This untrusted code however lazy-loads some JRE classes that I do not want to block. Would it be ...
-2
votes
2answers
295 views

Why don't we have any popular decentralized chat systems, social networks etc.? [closed]

Let's say two computers have the same decentralized chat program. Each user has to have an ip address and port number to send the message to another person. Each message is encrypted using, let's say, ...
1
vote
0answers
45 views

Should we allow JSPs to change on a running application server?

Should we allow JSPs to change on a running application server on a production system? My gut feeling is no. However, I can't seem to find any information to justify it. From a performance end, ...
0
votes
1answer
93 views

Java is running even after it is disabled [closed]

To prevent adds and pop-up that seduce users to install or download viruses I have disabled Java. But I have noticed that even with Java disables Firefox is still running it. The pop-ups are coming ...
2
votes
1answer
141 views

Can Jasper files be used as shells to attack java web apps?

JasperReports is an open source Java reporting tool that can write to a variety of targets, such as: screen, a printer, into PDF, HTML, Microsoft Excel, RTF, ODT, Comma-separated values or XML ...
10
votes
7answers
591 views

Cheating or service disruption by altering client-side code

A reasonably white-hatted hacker has demonstrated the ability to insert text of his own choosing into the communication between a java applet and a web based server. Not a simple MITM attack, but ...
1
vote
1answer
190 views

NTRU java attack implementation

I'm researching NTRU cryptosystem and started research based on source code from sourceforge and bouncy castle(java language). Currently I'm reseacrhing attacks on NTRU, based on CVP and SVP. But I'd ...
2
votes
4answers
408 views

How to identify the Java program that is maliciously accessing my web site from many client addresses?

For many years, my personal web site receives numerous pairs of hits that look like this, every day: 202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04" ...
3
votes
3answers
297 views

Understanding JVM zero day in relationship with other runtimes

I am a .net and php developer and since java has been in the news recently thanks to the string of zero days, I decided to brush up on security. In regards to the java zero days, this question has ...
3
votes
2answers
2k views

Import Public Private key pair to a Keystore

I have created a public private key pair using the KeyPairGenerator class in Java. From this key pair I have generated the CSR request using the PKCS10 class which has been sent to a CA for ...
6
votes
1answer
10k views

PKCS7 encoding in Java without external libs like BouncyCastle etc

I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms). I have x509certificate from the keystore, rsa private key, ContentInfo. ContentType is "oidPkcs7Data". ...
1
vote
0answers
31 views

Should we protect web application source code from being stolen by web hosts through obfuscation? [duplicate]

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code & probably even steal your business. If, so how to deal with this or how to obfuscate ? ...
-2
votes
1answer
284 views

ESAPI: Input and output validation [closed]

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI. So for input validation, so far I got: Data Type Name Email ...
1
vote
4answers
294 views

Custom programming language, and translator that translate it to Java to make more difficult to get source

I want to make my game extremely hard to decompile. So I've come up with the idea of a program which will contain my game's code, coded in a custom language, and which will translate that code into ...
3
votes
2answers
170 views

How to intercept url to disallow Forced Browsing in simple Dynamic Web Project?

I found an issue related to Forced Browsing in my web-application.And I was able to verify that my static content(like text document...mainly help documents) can be accessed by simply hitting the URL ...
1
vote
1answer
235 views

Is decryption using Java+JSF safer than using JavaScript?

First off, this is in addition to using SSL! I am building a web application that receives encrypted data from a server. The data is to be decrypted client-side. I've read enough posts here to see ...
1
vote
1answer
137 views

Implementing a commitment scheme in java

Are there any implementations of cryptographic commitment schemes available as API/libraries in Java? I looked around in the security package and couldn't find much. Any help is appreciated. Thanks
2
votes
1answer
240 views

Taking root ownership

Just gonna make this clear first, this is for class! I have an assignment that requires to 1) modify a web server written in Java to accept file uploads and to use this to deface the homepage (did ...
9
votes
2answers
1k views

Why do some Java APIs bypass standard SecurityManager checks?

In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
2
votes
2answers
341 views

Where do I get started in terms of learning how to exploit Java and Flash vulnerabilities? or browser exploitation in general

Another Java 0day was discovered today which got me thinking how browser exploitation (remote execution on clients browser) works. I am unable to find any books or resources online about browser ...
5
votes
1answer
352 views

POC of a Java exploit using leftover JREs

Summary: I would like to show a proof of concept of a Java exploit using an old JRE on an up-to-date machine to cut short discussions on the "but we are patched so why removing older versions" ...
5
votes
3answers
484 views

Security of JVM for Server

Using type- and memory-safe languages like Java and Scala for server applications gave me the confidence of having a basic level of security (e.g. compared to C). Now with the recent wave of Oracle ...
1
vote
1answer
91 views

AppEngine Sandbox

Does anyone know how the AppEngine sandbox is implemented? I heard they use a SecurityManager with Java but surely they are using another layer as well like LXC. I've looked at the whitelist and there ...
-4
votes
1answer
307 views

Protect java WEB application inside the server(against reverse engineering) [closed]

I have a web application running on Glassfish 3.1.2 servlet container and I need a way to protect the compiled java classes. I have tried to obfuscate the source code but it didn't work. The project ...
8
votes
2answers
2k views

Will disabling the Java add-on in IE protect you from Java exploits?

Concerning the recent Java vulnerability (Should I be disabling Java?), the most common advise seems to be to disable Java plug-ins in the browser. However, Heise Security suggests that, when it ...
1
vote
1answer
129 views

How safe is WSIT username authentication with symmetric key?

I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link). How secure is this mechanism? Is this enough to ...
3
votes
2answers
991 views

security implications of Java's System.load vs System.loadLibrary

Jumping from http://stackoverflow.com/questions/7016391/difference-between-system-load-and-system-loadlibrary-in-java What are the security implications of both approach ? ...
4
votes
2answers
188 views

Security of viewing a website containing Java applets offline

I've been wondering whether viewing a website offline increases the security risk. The reason why I'm asking is that having been a short time java applet developer (for a small task) I've come to ...
4
votes
2answers
2k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
7
votes
3answers
259 views

How can I circumvent the lack of Java updates?

Just imagine you have a bunch of computers which need Java for some important software and you can't just switch to another vendor because all are using Java in this field of technology. If you start ...
3
votes
1answer
119 views

Is there any public information on audited Java open source projects?

I'm sure that there must have been any number of audits on common Java open source projects, many of them for governments or publicly-funded bodies. Have any of the results been made public, so that ...
7
votes
4answers
1k views

What Checkstyle or Findbugs rules detect common vulnerabilities?

Looking for experience with both built in and custom checks. I do not need references to commercial source code analysers.
4
votes
2answers
681 views

JInitiator is obsolete and I should reject it on grounds of security, right?

I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as ...
1
vote
1answer
783 views

Hardening JRE deployment - webjava

I am trying to set up some hardened deployment settings for Java for the end-users' machines on my network. I have my system wide deployment config and properties files set up: ...
2
votes
5answers
1k views

Website vulnerability scanner in Java && Open Source

I am working on a Web platform that must-need-should have a good level of security. Therefore, I am interested in a good quality tool to test my Web platform QA on security. My main programming ...
4
votes
3answers
182 views

jasypt message integrity

I've been looking into ways to encrypt an authentication token that I need to pass from one site to another. Things i have learned so far are use a high level library. don't use ECB use a HMAC to ...
1
vote
1answer
91 views

Java applet authenticity problem

I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
16
votes
8answers
4k views

Any comprehensive solutions for binary code protection and anti-reverse-engineering?

Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
5
votes
3answers
408 views

Why must all classes' data members be set to private?

In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured". How does setting members to private makes the program ...
3
votes
2answers
246 views

Securing Java web services called by web site in DMZ using web services for communication

Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
1
vote
4answers
169 views

Is there a need to define “language safety”?

Language safety is not clearly defined while there're warnings about for instance Java. So how can you say that language is not safe while language safety is not clearly defined? If Java is unsafe ...
7
votes
2answers
385 views

How to keep using Java 6 securely, despite its unpatch vulnerabilities

Given that Java 6 is now deprecated by Oracle and there recently has been notification of a 0day (that will exist forever now that Oracle is not patching JRE6), what can we do to prevent drive-by ...
-1
votes
1answer
151 views

What are correct steps to setup this exploit execution(jboss_invoke_deploy)?

I've found this vulnerability (http://www.metasploit.com/modules/exploit/multi/http/jboss_invoke_deploy) but can't seem to set proper values for exploit to work , payload shown on site gives me worn ...
0
votes
1answer
521 views

Java SecureRandom generate secure random number

How to generate a secure random number bit length is 256 bits using Java. What is the different between: SecureRandom random = new SecureRandom(); and SecureRandom prng = ...
1
vote
2answers
455 views

What is the safest way to store a password in a single file?

I've been reading about it. This article helped me a lot. But the more I read the more complicated it seems. For example: Is it better to use bcrypt, or PBKDF2, sha2 or something else for the salt? ...
9
votes
6answers
2k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
3
votes
1answer
377 views

How to debug/reverse engineer java applets?

I need to analyze a java application (a .jar file) for a war game. I know java can be decompiled, but the coder apparently did a lot of obfuscation to prevent the reverse engineers from understanding ...
0
votes
1answer
124 views

Did I get hit by the recent Java exploit?

Looks like the website iphonedevsdk was responsible for serving up the malware that's been causing some of the recent security exploits. According to my browser history, I visited that site back in ...
0
votes
1answer
50 views

How esignature verification process work?

I have a web application in which the users will be signing an html report. I know how the digital signature authentication works. But here the user will literally be signing the document (So, Should ...
2
votes
1answer
2k views

Where to store Java keystore password?

We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the ...