security aspects specific to the Java programming language and libraries.
3
votes
3answers
100 views
Identifying and preventing execution of “any” function via Late-Bound commands
The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
3
votes
3answers
3k views
What password-based encryption to use with standard Java 6?
Which password-based encryption method should I use in Java 6? It should be as strong as possible, but work with the default security policy file (not the export restricted one which you have to ...
3
votes
2answers
468 views
BlackBerry client authenticating to Java Web Service
I already asked this question at StackOverflow here: http://stackoverflow.com/questions/4970681/blackberry-app-security and was directed to this site, can anyone pitch in as to how I can solve this ...
3
votes
2answers
151 views
How content-type:image can lead to infected JAR file?
Symantec published a news about a malvertising campaign targeting IE users with Java exploits (already known vulnerabilities). At some point they explain that the users are redirected on malicious ...
3
votes
1answer
483 views
Storage of 'secrets', keystores, HSMs and the rest
I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
3
votes
1answer
378 views
Securing sensitive data in a DB,is using H2 worth it?
I am designing a web application at the moment, and one of the requirements is to secure the user credentials as well as their roles. Now ofc besides the usual pwd hashing + salt +.... I was thinking ...
3
votes
2answers
88 views
Securing Java web services called by web site in DMZ using web services for communication
Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
3
votes
3answers
564 views
Java 7u11 - Safer to switch to 6?
Java update 7u11 has made some news lately for a couple reasons. Firstly, it was an out-of-band patch to resolve vulnerabilities being exploited in the wild. Then it came back up because it is now ...
3
votes
2answers
239 views
Hide web.xml file from public view
I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config.
I don't how to restrict. I tried with ...
3
votes
1answer
342 views
Best security algorith for storing passwords [duplicate]
Possible Duplicate:
Which password hashing method should I use?
I want the best cryptography algorithm for storing passwords in database, which one should I use and how can I implement ...
3
votes
1answer
364 views
Sip call Developing in android with secure data transfer
I would like to make an application similar to RedPhone on android. I took a look at SipDemo from developer.android.com and at the android.net.sip package.My question is, when you make/receive a call, ...
3
votes
1answer
60 views
Is there any public information on audited Java open source projects?
I'm sure that there must have been any number of audits on common Java open source projects, many of them for governments or publicly-funded bodies.
Have any of the results been made public, so that ...
3
votes
1answer
172 views
How to debug/reverse engineer java applets?
I need to analyze a java application (a .jar file) for a war game. I know java can be decompiled, but the coder apparently did a lot of obfuscation to prevent the reverse engineers from understanding ...
3
votes
3answers
95 views
jasypt message integrity
I've been looking into ways to encrypt an authentication token that I need to pass from one site to another. Things i have learned so far are
use a high level library.
don't use ECB
use a HMAC to ...
3
votes
1answer
444 views
Are OpenJDK and non-Windows systems vulnerable to the Sept. 25th 2012 Java vulnerability?
I have heard of this vulnerability, but although it was announced on the Full Disclosure list, it does not provide any details (other than a severity assessment). Does anyone have more info than me, ...
3
votes
1answer
184 views
Multibyte Character Exploits JSP/PostgreSQL
I am trying to secure a web application, written in Java/JSP and running on PostgreSQL, against SQL injection. I ran into this very interesting answer, which refers to PHP and MySQL. Is there any ...
3
votes
0answers
257 views
When to move from Container managed security to alternatives like Apache Shiro, Spring Security? [closed]
I am trying to secure my application which is built using JSF2.0.
I am confused about when do people choose to go with security alternatives like Shiro, Spring Security or owasp's esapi leaving ...
2
votes
3answers
2k views
What data should I validate when validating X.509 certificates using Java?
Well I began with PKI a year ago with RFID system at school. Now I'm asked to implement this in my job. I understand most part of the idea. The doubt is about the certificate validation.
I know it ...
2
votes
3answers
227 views
Microsoft password strength checker
I typed in my password in Microsoft password strength checker website. Could it now be possible for someone to recover that password from my computer?
2
votes
2answers
207 views
Where do I get started in terms of learning how to exploit Java and Flash vulnerabilities? or browser exploitation in general
Another Java 0day was discovered today which got me thinking how browser exploitation (remote execution on clients browser) works.
I am unable to find any books or resources online about browser ...
2
votes
2answers
389 views
Securing a Ubuntu system on Amazon Web Services
I'm in the process of setting up a Ubuntu server on Amazon Web Services / EC2, which will need to host the following:
A relatively simple Java-based website (using the Noir framework)
A Java-based ...
2
votes
3answers
142 views
How to identify the Java program that is maliciously accessing my web site from many client addresses?
For many years, my personal web site receives numerous pairs of hits that look like this, every day:
202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04"
...
2
votes
2answers
911 views
Storing password in Java application
What is best secure way to store passwords in Java web application?
I am not talking about password to the DB, so it must be stored in de-cryptable way. It’s cloud environment and I need to protect ...
2
votes
2answers
79 views
Security of viewing a website containing Java applets offline
I've been wondering whether viewing a website offline increases the security risk.
The reason why I'm asking is that having been a short time java applet developer (for a small task) I've come to ...
2
votes
5answers
185 views
Website vulnerability scanner in Java && Open Source
I am working on a Web platform that must-need-should have a good level of security.
Therefore, I am interested in a good quality tool to test my Web platform QA on security.
My main programming ...
2
votes
1answer
111 views
Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads?
As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
2
votes
1answer
176 views
Are any Java Card 3.0 smart cards available?
The Java Card 3.0 specification (draft?) came out in 2008. It is now 2013. Are there any existing smart cards that actually implement the specification? How about USB tokens?
The best I've found is ...
2
votes
3answers
3k views
Java vulnerability: What about OpenJDK + IcedTea?
These days there is a lot of recommendations about disabling java-plugin due to a serious vulnerability. I know this topic has already been covered on this site here and here.
In the reports about ...
2
votes
1answer
176 views
Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?
Question
Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start")
...
2
votes
2answers
414 views
safe to use jBCrypt and recommend it to my organization?
I'd like to recommend to my fellow developers that we all use bcrypt to hash stored passwords. We all use java and I hesitate to recommend jBCrypt only because its latest version number (0.3) ...
2
votes
4answers
747 views
Bouncy Castle - document signed by sender and only readable by receiver?
I am building an application that requires secure data transfer. In particular, the sender has a data file that needs to be sent to the receiver. It is required that only the receiver be able to read ...
2
votes
2answers
625 views
Secure communication between C# client and Java server, using certificates
I want to secure communication between simple C# WPF client and Java server. Now i have already implemented raw sockets communication, and my security is based on:
server send RSA public key to ...
2
votes
2answers
296 views
What is the correct way to assess and compare Certicom's products to the alternatives?
I'm investigating Certicom's API because they are "free" with the Blackberry implementations, and have come to realize that I have several alternatives for implementing crypto such as BouncyCastle, ...
2
votes
1answer
195 views
What is the best practice for storing a secret on the cloud?
This post on Securing Java Application Data for Cloud Computing offers a good introduction to using a Java KeyStore for securing encrypted data in the cloud. It neglects, however, to answer the ...
2
votes
1answer
290 views
Where to store Java keystore password?
We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the ...
2
votes
1answer
401 views
How disable Java in Chrome 23?
Well in case someone doesn't know yet... there is a new Java zero day.
I'm trying to disable it on Chrome but I can't find any option. Google searches says that the option for deactivate it is on ...
2
votes
2answers
631 views
Java Applet for mutual authentication with smart card
I need to develop a java applet, for a mutual authentication between Tomcat 6 (server) and a SmartCard "IDGo 300" (client).
In order to do this I thought the following scheme:
1.Tomcat (server) send ...
2
votes
1answer
150 views
Is DWR (Direct Web Remoting) Secure?
Is DWR considered secure, or what may be required to secure Direct Web Remoting?
Are there better options for hardened asynchronous communication?
2
votes
2answers
90 views
Secure Spring FrameworkUser Management
I got asked this question:
"Any decent reusable / plug-able Spring user management systems (registration, change pwd, reset etc)?
How do you guys do authz in Spring, including managing those roles ...
2
votes
0answers
113 views
Need a little help with Metasploit and Java? [closed]
I'm a junior programmer and i was asked in my job to test java using metasploit... I followed this detailed environment: ...
2
votes
1answer
115 views
Security at writing in a folder
I would like to run with Runtime.exec() programs in Java (the programs' code are in C and Java ) - the users are uploading the Java/C code, and my app runs them. The code is saved in a separate folder ...
1
vote
2answers
269 views
What is the safest way to store a password in a single file?
I've been reading about it. This article helped me a lot. But the more I read the more complicated it seems. For example:
Is it better to use bcrypt, or PBKDF2, sha2 or something else for the salt?
...
1
vote
3answers
478 views
Java vulnerability applicability
On a server running Java, can a JRE vulnerability be exploited even in cases where the named subcomponent is not used by the application?
See CVE-2011-3545, for which the vulnerable subcomponent is ...
1
vote
1answer
73 views
Client vs Server security for business critical application (crossplatform)
We have the option to develop a software either based on
Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
1
vote
3answers
148 views
Java class type parameter vulnerability
In a Java programming book there is a section that details the JVM and memory addresses and location as it pertains to parameters of a class type. As you can see from the console output the initial ...
1
vote
2answers
2k views
How does Java 7 update 11 fix the security vulnerability?
There is a new Java released a couple days ago to resolve a hole that was recently discovered.
(Oracle, US-CERT, NVD/NIST)
In my initial reading about this update 11, I saw clearly where it by ...
1
vote
1answer
242 views
Preventing License protection circumvention in Java software
A software (written in Java) by a vendor uses DSA signature to verify that the license information is correct.
It achieves this by embedding the public key in the same Java software.
Legit license ...
1
vote
1answer
317 views
Best Practices for Storing Digital Certificate
I'm building an application where certain sensitive files need to be digitally signed before being stored in the file system using ASN.1 encoding, so they can be verified against a digital certificate ...
1
vote
1answer
102 views
DoS and Serialization
I got the following message from Fortify static code analyser.
Incorrect serialization and de-serialization can lead to unpredictable behavior and cause denial of service attacks.
Can anyone ...
1
vote
1answer
51 views
Java applet authenticity problem
I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
