security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

6
votes
1answer
559 views

Is java Client vulnerable by POODLE?

I have a Java based application (running on java 5 or higher) that establishes an SSL connection towards an Apache tomcat 7.0.47 on java 7. From what I understand, to exploit POODLE you need a client ...
5
votes
4answers
6k views

Writing malware in java?

To me, it seemed like malware could never be written in java. Those who taught me java said it was "secure" and did not allow "low-level access" like c,c++. But, I discovered that it can be done - ...
5
votes
3answers
9k views

What data should I validate when validating X.509 certificates using Java?

Well I began with PKI a year ago with RFID system at school. Now I'm asked to implement this in my job. I understand most part of the idea. The doubt is about the certificate validation. I know it ...
5
votes
1answer
4k views

How securely random is Oracle's java.security.SecureRandom

There was a lot of news in the past year about exploitable weaknesses in cryptography which originated from weak random number generators. In some cases it was negligence on side of the developers, in ...
5
votes
2answers
959 views

Are there any real life cases, where using final keyword in Java increases system security?

I've came across that question on StackOverflow: http://stackoverflow.com/questions/18755713/how-does-final-play-a-role-in-security The claim is made, that according to Wikipedia: A final class ...
5
votes
3answers
254 views

Did I miss any vulns here?

I recently took a beating in a Security Engineer interview and I did not get any specific feedback on how I did. I'd like to re-ask the question to the community so I can polish up on these elements. ...
5
votes
1answer
2k views

What is the best way to store password in memory (RAM) in Java?

Imagine there is a login form in Java application. We need assign usename and password to variables. Moment after we can Hash or HMAC password and keep it just for authentication step (no caching). ...
5
votes
1answer
436 views

Is it more secure to overwrite the value char[] in a String

I am talking about the Java implementation. Is it more secure to use reflection in order to access the internal Field value of type char[] inside a java.lang.String instance and overwrite the ...
5
votes
3answers
6k views

Java vulnerability: What about OpenJDK + IcedTea?

These days there is a lot of recommendations about disabling java-plugin due to a serious vulnerability. I know this topic has already been covered on this site here and here. In the reports about ...
5
votes
2answers
980 views

Class.forName injection and constructor invocation

If a Java-based webpage takes a user-supplied parameter and instantiates an object using Class.forName(parameter) What's the worst possible consequence? The attacker does obtain stack traces. After ...
5
votes
2answers
3k views

Reference implementation of C# password hashing and verification

Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java? Ideally,I'd like to see something that includes a ...
5
votes
2answers
86 views

JAVA (Web Application) Public Data Assigned to Private Array-Typed Field

Referring to this CWE-496, it mentions that because of the application assigning public data to a private array it is equivalent to giving public access to the array. This is not clear to me because ...
5
votes
2answers
889 views

How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?

I've been reading up-on DoS (denial-of-service) attacks within android and although I understand attacks like the below, which make use of regular programming functions etc. (Android Web Browser) ...
5
votes
1answer
2k views

How can I store downloaded video securely to device's sd card?

I want to save videos in my android mobile's SD card securely such no other application or user can use it, outside the application or on any other devices. So for this what can I do? I think about ...
5
votes
1answer
536 views

POC of a Java exploit using leftover JREs

Summary: I would like to show a proof of concept of a Java exploit using an old JRE on an up-to-date machine to cut short discussions on the "but we are patched so why removing older versions" ...
5
votes
0answers
13k views

Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]

This question was originally asked on stackoverflow I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff? I have a little JavaEE ...
4
votes
4answers
494 views

Is this java app harmfull?

If you visit most of the "online youtube download" pages, you will get this message: Why all these sites come up with this message? Is it a worm, or just an unharmfull app?
4
votes
3answers
2k views

Security of JVM for Server

Using type- and memory-safe languages like Java and Scala for server applications gave me the confidence of having a basic level of security (e.g. compared to C). Now with the recent wave of Oracle ...
4
votes
4answers
598 views

Is silverlight and Java running on the web browser capable of saving “state” into the user's local machines?

I am aware that even after we have cleared our cache and cookies, websites can still save files/information into our computer using Flash (Flash ever cookies), I was wondering does other plugins like ...
4
votes
4answers
464 views

Password hashing on frontend or backend? [duplicate]

I have a Java Server with Spring Boot and a JS Frontend in AngularJS. My teacher told me to use HTTPS for passwords, because I cannot hash them securely enough, that nobody can hack them. With ...
4
votes
2answers
648 views

Can one get infected through visiting a site with a PHP script on it and if yes, how?

I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP? Since it's serverside it shouldn't have access to the visitor's ...
4
votes
2answers
218 views

Questions about TLS handshaking process

I am trying to understand how TLS works. Assuming the I have a java client that uses TLSv1 to communicate to the server which supports TLSv1.2, can the client talk to the server successfully? When a ...
4
votes
3answers
1k views

Vulnerable java applications

I am looking for some open source/free vulnerable JAVA based applications. It can be web application, desktop application or any other. I need them to do some experiments in my research work. They ...
4
votes
3answers
624 views

Android and FIPS

I've recently been tasked with a research project to write a "secure messaging application" using "government approved protocols" (the government being the USA). I'm taking this to mean asymmetric ...
4
votes
3answers
3k views

Reverse-engineering one-time passwords for two-factor authentication systems

Given a one-time password generator that is time-based (such as Google Authenticator), how many instances of (time, PIN) pairs would one need to significantly weaken the algorithm to a point where one ...
4
votes
2answers
8k views

What password-based encryption to use with standard Java 6?

Which password-based encryption method should I use in Java 6? It should be as strong as possible, but work with the default security policy file (not the export restricted one which you have to ...
4
votes
4answers
626 views

Vulnerability exploitation in Java

I am not intimately familiar with Java, so this could be a stupid question. In a C program I can find buffer overflows or may be a ROP based exploit to run custom code. How is it done in the context ...
4
votes
2answers
3k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
4
votes
1answer
2k views

how to secure Android Market public key

Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
4
votes
3answers
2k views

Protecting the Java keystore with a weak password, what's the risk?

From my understanding, the Java keystore contains certificate information, but this information is public (i.e. other machine certificates which you want the local machine to trust). Is there ...
4
votes
1answer
2k views

Salt usage for Spring security?

I use the Spring security for Java web applications and I have written an authentication provider which is working without salt and now I want to either add salt or alternatively use the built-in ...
4
votes
2answers
850 views

How secure is MongoDB wire protocol?

I'm building a JavaFX 2.0 standalone application (it'll be distributed as an .exe) and it opens a connection to a MongoDB instance. The connection is just a standard Mongo connection using the Mongo ...
4
votes
2answers
3k views

security implications of Java's System.load vs System.loadLibrary

Jumping from http://stackoverflow.com/questions/7016391/difference-between-system-load-and-system-loadlibrary-in-java What are the security implications of both approach ? ...
4
votes
3answers
1k views

JInitiator is obsolete and I should reject it on grounds of security, right?

I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as ...
4
votes
1answer
359 views

Saved passwords (use case)

I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together. Both the data and the password are encrypted ...
4
votes
1answer
4k views

Storage of 'secrets', keystores, HSMs and the rest

I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
4
votes
2answers
68 views

Can you ever get partially decrypted data from a decryption algorithm?

I'm decrypting some data using Java and Apache's most recent WSS4J library with 128-bit AES decryption. I setup the the cipher which appears to be correct with the right padding, decryption ...
4
votes
1answer
175 views

Vulnerability of Java software

The JAVA software provided by Oracle is a security mess. But what exactly, in that software package is the most vulnerable. If someone install it and disables the Java plugin in the browser, will he ...
4
votes
2answers
345 views

Security of viewing a website containing Java applets offline

I've been wondering whether viewing a website offline increases the security risk. The reason why I'm asking is that having been a short time java applet developer (for a small task) I've come to ...
4
votes
3answers
469 views

Understanding JVM zero day in relationship with other runtimes

I am a .net and php developer and since java has been in the news recently thanks to the string of zero days, I decided to brush up on security. In regards to the java zero days, this question has ...
4
votes
1answer
2k views

What is the best practice for storing a secret on the cloud?

This post on Securing Java Application Data for Cloud Computing offers a good introduction to using a Java KeyStore for securing encrypted data in the cloud. It neglects, however, to answer the ...
4
votes
1answer
302 views

What are the major vulns that affect the Dalvik VM of Android?

I frequently hear about the security risks of using Android. But few people who write articles on this subject ever identify what parts of Android are at fault, nor do they identify design flaws. Can ...
4
votes
2answers
404 views

Secure way to store application settings

What is a proper or, if possible to tell, the best way to store configuration in matters of security? So far I can tell that a database with very restricted access is a good way, but please let's ...
4
votes
2answers
5k views

Import Public Private key pair to a Keystore

I have created a public private key pair using the KeyPairGenerator class in Java. From this key pair I have generated the CSR request using the PKCS10 class which has been sent to a CA for ...
4
votes
1answer
1k views

Is it safe to enable SSLv2 ClientHello support?

In the wake of the POODLE attack, many web sites have dropped support for SSLv3. But some clients still in relatively common use as of May 2015 still initiate the handshake with an SSLv2 ClientHello ...
4
votes
3answers
337 views

jasypt message integrity

I've been looking into ways to encrypt an authentication token that I need to pass from one site to another. Things i have learned so far are use a high level library. don't use ECB use a HMAC to ...
4
votes
0answers
61 views

Why java.sql.ResultSet.getString is an Information Leakage vulnerability

Recently I started using LAPSE+ for static code analysis and it kept on pointing java.sql.ResultSet.getString as an Information Leakage. The ResultSet is properly closed after its usage. LAPSE+ does ...
4
votes
0answers
225 views

Why does Java allow AES-256 bit encryption on systems without JCE unlimited strength policies if using PBE?

It's fairly standard knowledge that due to the cryptography export controls, Oracle JRE ships with "limited" cryptographic strength enabled as listed in the JCA Documentation. For AES, the default max ...
4
votes
1answer
810 views

Session fixation in Java

In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability. Referring to the documentation I came up with the following ...
3
votes
2answers
854 views

Where do I get started in terms of learning how to exploit Java and Flash vulnerabilities? or browser exploitation in general

Another Java 0day was discovered today which got me thinking how browser exploitation (remote execution on clients browser) works. I am unable to find any books or resources online about browser ...