security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

1
vote
1answer
127 views

Client vs Server security for business critical application (crossplatform)

We have the option to develop a software either based on Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
0
votes
2answers
208 views

Security concern to implement a web based remote desktop

I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class. I can configure the ...
3
votes
2answers
1k views

How secure is opening an incoming port for a java application?

If a java application is listening on UDP port xxxxx and a firewall is allowing connections to that java application through the same UDP port xxxxx, what vulnerabilities will a Windows 7 machine be ...
0
votes
1answer
107 views

Manually monitoring your PC for Java (Oracle) exploits?

Sandboxing and AV's aside, if I wanted to manually look at/monitor my system for where they usually enter it, where could I look for possible malicious Java viruses/activity, e.g., would they first ...
4
votes
1answer
3k views

Encrypting data for Android mobile app

I am creating a mobile app for Android. This is my first mobile app by the way. I have decided to store data used in my app in a SQLite database in the target Android device. The data I am storing ...
0
votes
2answers
238 views

Any way to use Java (sun micro) without any concern of infection

My antivirus has kept removing a Java exp virus only for it to keep returning. Yesterday in frustration I decided to uninstall Java until I see some positive news about any patches regarding the ...
2
votes
1answer
479 views

Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?

Question Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start") ...
1
vote
1answer
129 views

How safe is WSIT username authentication with symmetric key?

I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link). How secure is this mechanism? Is this enough to ...
1
vote
1answer
137 views

Implementing a commitment scheme in java

Are there any implementations of cryptographic commitment schemes available as API/libraries in Java? I looked around in the security package and couldn't find much. Any help is appreciated. Thanks
2
votes
3answers
381 views

Microsoft password strength checker

I typed in my password in Microsoft password strength checker website. Could it now be possible for someone to recover that password from my computer?
9
votes
1answer
2k views

HQL injection example

Our developers left a surprise in handling user login. Namely: // java List users = hibernate.find("from Users where username = '"+formUsername+"'"; if (users.length==0) { return BAD_USER; } if ...
5
votes
1answer
198 views

Security announcement mailing list for Java

I didn't find a security announcement mailing list for Java (from Oracle). How to get notified about new Java patches? I am not interested in other Oracle products. For example Apple provides such a ...
5
votes
1answer
834 views

Practices for storing username/password in Web applications

I have read the following question: Storing password in Java application but I don't find the answers useful for my case. So here is my question somehow related to that. I have a Java Web application ...
9
votes
6answers
2k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
3
votes
2answers
1k views

safe to use jBCrypt and recommend it to my organization?

I'd like to recommend to my fellow developers that we all use bcrypt to hash stored passwords. We all use java and I hesitate to recommend jBCrypt only because its latest version number (0.3) ...
3
votes
1answer
459 views

Are OpenJDK and non-Windows systems vulnerable to the Sept. 25th 2012 Java vulnerability?

I have heard of this vulnerability, but although it was announced on the Full Disclosure list, it does not provide any details (other than a severity assessment). Does anyone have more info than me, ...
3
votes
2answers
128 views

Secure Spring FrameworkUser Management

I got asked this question: "Any decent reusable / plug-able Spring user management systems (registration, change pwd, reset etc)? How do you guys do authz in Spring, including managing those roles ...
1
vote
3answers
243 views

Java class type parameter vulnerability

In a Java programming book there is a section that details the JVM and memory addresses and location as it pertains to parameters of a class type. As you can see from the console output the initial ...
-4
votes
1answer
676 views

Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]

For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html I am trying this with insecure web application of OWASP. I made ...
7
votes
2answers
1k views

How should an application store its credentials

When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
4
votes
3answers
489 views

Vulnerable java applications

I am looking for some open source/free vulnerable JAVA based applications. It can be web application, desktop application or any other. I need them to do some experiments in my research work. They ...
5
votes
2answers
2k views

Storing password in Java application

What is best secure way to store passwords in Java web application? I am not talking about password to the DB, so it must be stored in de-cryptable way. It’s cloud environment and I need to protect ...
2
votes
0answers
128 views

Need a little help with Metasploit and Java? [closed]

I'm a junior programmer and i was asked in my job to test java using metasploit... I followed this detailed environment: ...
8
votes
4answers
746 views

Are Java applets more secure than regular forms for login?

In Norway we have something called BankID which is a login solution for banks and other stuff. It consists (from a users point of view) of a Java applet where you enter your SSN (person number), a one ...
3
votes
2answers
545 views

Hide web.xml file from public view

I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config. I don't how to restrict. I tried with ...
9
votes
2answers
1k views

Why do some Java APIs bypass standard SecurityManager checks?

In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
0
votes
1answer
387 views

What security concerns exist in running a glassfish app directly on port 443

I have installed Apache http server in front of glassfish based on recommendations i had in this question. I have been told that i will run into performance problems along with security issues. I was ...
4
votes
2answers
2k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
1
vote
2answers
4k views

Encrypting string in javascript and decryption in java

I would like to know if someone know any library to do encryption in javascript and decryption in java. I have already tried many API, But getting not not getting same values in java. I want ...
3
votes
2answers
1k views

Java Applet for mutual authentication with smart card

I need to develop a java applet, for a mutual authentication between Tomcat 6 (server) and a SmartCard "IDGo 300" (client). In order to do this I thought the following scheme: 1.Tomcat (server) send ...
2
votes
1answer
288 views

Security at writing in a folder

I would like to run with Runtime.exec() programs in Java (the programs' code are in C and Java ) - the users are uploading the Java/C code, and my app runs them. The code is saved in a separate folder ...
1
vote
1answer
2k views

How do I use OpenSSL with the Java Keytool?

I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring ...
1
vote
1answer
373 views

Network Sniffing Java Applet Authentication

Example, I have a java applet application, then this application is accepting userid and password as authentication. Can I sniff the userid and password on the network layer? Are the credential being ...
2
votes
1answer
253 views

Is DWR (Direct Web Remoting) Secure?

Is DWR considered secure, or what may be required to secure Direct Web Remoting? Are there better options for hardened asynchronous communication?
4
votes
2answers
514 views

Class.forName injection and constructor invocation

If a Java-based webpage takes a user-supplied parameter and instantiates an object using Class.forName(parameter) What's the worst possible consequence? The attacker does obtain stack traces. After ...
2
votes
4answers
1k views

Bouncy Castle - document signed by sender and only readable by receiver?

I am building an application that requires secure data transfer. In particular, the sender has a data file that needs to be sent to the receiver. It is required that only the receiver be able to read ...
1
vote
1answer
452 views

Preventing License protection circumvention in Java software

A software (written in Java) by a vendor uses DSA signature to verify that the license information is correct. It achieves this by embedding the public key in the same Java software. Legit license ...
3
votes
1answer
234 views

Multibyte Character Exploits JSP/PostgreSQL

I am trying to secure a web application, written in Java/JSP and running on PostgreSQL, against SQL injection. I ran into this very interesting answer, which refers to PHP and MySQL. Is there any ...
1
vote
1answer
438 views

Best Practices for Storing Digital Certificate

I'm building an application where certain sensitive files need to be digitally signed before being stored in the file system using ASN.1 encoding, so they can be verified against a digital certificate ...
1
vote
1answer
116 views

DoS and Serialization

I got the following message from Fortify static code analyser. Incorrect serialization and de-serialization can lead to unpredictable behavior and cause denial of service attacks. Can anyone ...
8
votes
1answer
2k views

How to select /dev/random or dev/urandom in the code in Android?

When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's ...
2
votes
2answers
5k views

Best Approach for removing XSS Vulnerability

I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
6
votes
1answer
10k views

PKCS7 encoding in Java without external libs like BouncyCastle etc

I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms). I have x509certificate from the keystore, rsa private key, ContentInfo. ContentType is "oidPkcs7Data". ...
3
votes
0answers
8k views

Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]

This question was originally asked on stackoverflow I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff? I have a little JavaEE ...
5
votes
3answers
343 views

How to rate Open Source Libraries?

Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries? I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
2
votes
2answers
1k views

Secure communication between C# client and Java server, using certificates

I want to secure communication between simple C# WPF client and Java server. Now i have already implemented raw sockets communication, and my security is based on: server send RSA public key to ...
3
votes
1answer
1k views

Storage of 'secrets', keystores, HSMs and the rest

I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
1
vote
1answer
496 views

PAP and CHAP implementation using Java

I want to implement PAP and CHAP based authentication in my Java project how can I implement ? is there any API available in Java for using that protocol ?
4
votes
3answers
2k views

Reverse-engineering one-time passwords for two-factor authentication systems

Given a one-time password generator that is time-based (such as Google Authenticator), how many instances of (time, PIN) pairs would one need to significantly weaken the algorithm to a point where one ...
3
votes
2answers
798 views

Securing a Ubuntu system on Amazon Web Services

I'm in the process of setting up a Ubuntu server on Amazon Web Services / EC2, which will need to host the following: A relatively simple Java-based website (using the Noir framework) A Java-based ...