security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

10
votes
7answers
1k views

Cheating or service disruption by altering client-side code

A reasonably white-hatted hacker has demonstrated the ability to insert text of his own choosing into the communication between a java applet and a web based server. Not a simple MITM attack, but ...
1
vote
1answer
298 views

NTRU java attack implementation

I'm researching NTRU cryptosystem and started research based on source code from sourceforge and bouncy castle(java language). Currently I'm reseacrhing attacks on NTRU, based on CVP and SVP. But I'd ...
2
votes
4answers
633 views

How to identify the Java program that is maliciously accessing my web site from many client addresses?

For many years, my personal web site receives numerous pairs of hits that look like this, every day: 202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04" ...
4
votes
3answers
445 views

Understanding JVM zero day in relationship with other runtimes

I am a .net and php developer and since java has been in the news recently thanks to the string of zero days, I decided to brush up on security. In regards to the java zero days, this question has ...
4
votes
2answers
5k views

Import Public Private key pair to a Keystore

I have created a public private key pair using the KeyPairGenerator class in Java. From this key pair I have generated the CSR request using the PKCS10 class which has been sent to a CA for ...
1
vote
0answers
31 views

Should we protect web application source code from being stolen by web hosts through obfuscation? [duplicate]

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code & probably even steal your business. If, so how to deal with this or how to obfuscate ? ...
-3
votes
1answer
913 views

ESAPI: Input and output validation [closed]

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI. So for input validation, so far I got: Data Type Name Email ...
1
vote
4answers
544 views

Custom programming language, and translator that translate it to Java to make more difficult to get source

I want to make my game extremely hard to decompile. So I've come up with the idea of a program which will contain my game's code, coded in a custom language, and which will translate that code into ...
3
votes
2answers
473 views

How to intercept url to disallow Forced Browsing in simple Dynamic Web Project?

I found an issue related to Forced Browsing in my web-application.And I was able to verify that my static content(like text document...mainly help documents) can be accessed by simply hitting the URL ...
1
vote
1answer
511 views

Is decryption using Java+JSF safer than using JavaScript?

First off, this is in addition to using SSL! I am building a web application that receives encrypted data from a server. The data is to be decrypted client-side. I've read enough posts here to see ...
1
vote
1answer
202 views

Implementing a commitment scheme in java

Are there any implementations of cryptographic commitment schemes available as API/libraries in Java? I looked around in the security package and couldn't find much. Any help is appreciated. Thanks
2
votes
1answer
253 views

Taking root ownership

Just gonna make this clear first, this is for class! I have an assignment that requires to 1) modify a web server written in Java to accept file uploads and to use this to deface the homepage (did ...
11
votes
2answers
2k views

Why do some Java APIs bypass standard SecurityManager checks?

In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
3
votes
2answers
701 views

Where do I get started in terms of learning how to exploit Java and Flash vulnerabilities? or browser exploitation in general

Another Java 0day was discovered today which got me thinking how browser exploitation (remote execution on clients browser) works. I am unable to find any books or resources online about browser ...
5
votes
1answer
494 views

POC of a Java exploit using leftover JREs

Summary: I would like to show a proof of concept of a Java exploit using an old JRE on an up-to-date machine to cut short discussions on the "but we are patched so why removing older versions" ...
4
votes
3answers
1k views

Security of JVM for Server

Using type- and memory-safe languages like Java and Scala for server applications gave me the confidence of having a basic level of security (e.g. compared to C). Now with the recent wave of Oracle ...
1
vote
1answer
195 views

AppEngine Sandbox

Does anyone know how the AppEngine sandbox is implemented? I heard they use a SecurityManager with Java but surely they are using another layer as well like LXC. I've looked at the whitelist and there ...
-5
votes
1answer
748 views

Protect java WEB application inside the server(against reverse engineering) [closed]

I have a web application running on Glassfish 3.1.2 servlet container and I need a way to protect the compiled java classes. I have tried to obfuscate the source code but it didn't work. The project ...
8
votes
2answers
2k views

Will disabling the Java add-on in IE protect you from Java exploits?

Concerning the recent Java vulnerability (Should I be disabling Java?), the most common advise seems to be to disable Java plug-ins in the browser. However, Heise Security suggests that, when it ...
1
vote
1answer
192 views

How safe is WSIT username authentication with symmetric key?

I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link). How secure is this mechanism? Is this enough to ...
3
votes
2answers
2k views

security implications of Java's System.load vs System.loadLibrary

Jumping from http://stackoverflow.com/questions/7016391/difference-between-system-load-and-system-loadlibrary-in-java What are the security implications of both approach ? ...
4
votes
2answers
304 views

Security of viewing a website containing Java applets offline

I've been wondering whether viewing a website offline increases the security risk. The reason why I'm asking is that having been a short time java applet developer (for a small task) I've come to ...
4
votes
2answers
3k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
7
votes
3answers
292 views

How can I circumvent the lack of Java updates?

Just imagine you have a bunch of computers which need Java for some important software and you can't just switch to another vendor because all are using Java in this field of technology. If you start ...
3
votes
1answer
173 views

Is there any public information on audited Java open source projects?

I'm sure that there must have been any number of audits on common Java open source projects, many of them for governments or publicly-funded bodies. Have any of the results been made public, so that ...
7
votes
4answers
2k views

What Checkstyle or Findbugs rules detect common vulnerabilities?

Looking for experience with both built in and custom checks. I do not need references to commercial source code analysers.
1
vote
1answer
1k views

Hardening JRE deployment - webjava

I am trying to set up some hardened deployment settings for Java for the end-users' machines on my network. I have my system wide deployment config and properties files set up: ...
2
votes
5answers
3k views

Website vulnerability scanner in Java && Open Source [closed]

I am working on a Web platform that must-need-should have a good level of security. Therefore, I am interested in a good quality tool to test my Web platform QA on security. My main programming ...
4
votes
3answers
297 views

jasypt message integrity

I've been looking into ways to encrypt an authentication token that I need to pass from one site to another. Things i have learned so far are use a high level library. don't use ECB use a HMAC to ...
1
vote
1answer
118 views

Java applet authenticity problem

I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
7
votes
3answers
958 views

Why must all classes' data members be set to private?

In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured". How does setting members to private makes the program ...
3
votes
2answers
402 views

Securing Java web services called by web site in DMZ using web services for communication

Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
1
vote
4answers
191 views

Is there a need to define “language safety”?

Language safety is not clearly defined while there're warnings about for instance Java. So how can you say that language is not safe while language safety is not clearly defined? If Java is unsafe ...
8
votes
2answers
492 views

How to keep using Java 6 securely, despite its unpatch vulnerabilities

Given that Java 6 is now deprecated by Oracle and there recently has been notification of a 0day (that will exist forever now that Oracle is not patching JRE6), what can we do to prevent drive-by ...
-1
votes
1answer
278 views

What are correct steps to setup this exploit execution(jboss_invoke_deploy)?

I've found this vulnerability (http://www.metasploit.com/modules/exploit/multi/http/jboss_invoke_deploy) but can't seem to set proper values for exploit to work , payload shown on site gives me worn ...
1
vote
2answers
603 views

What is the safest way to store a password in a single file?

I've been reading about it. This article helped me a lot. But the more I read the more complicated it seems. For example: Is it better to use bcrypt, or PBKDF2, sha2 or something else for the salt? ...
3
votes
1answer
594 views

How to debug/reverse engineer java applets?

I need to analyze a java application (a .jar file) for a war game. I know java can be decompiled, but the coder apparently did a lot of obfuscation to prevent the reverse engineers from understanding ...
0
votes
1answer
140 views

Did I get hit by the recent Java exploit?

Looks like the website iphonedevsdk was responsible for serving up the malware that's been causing some of the recent security exploits. According to my browser history, I visited that site back in ...
0
votes
1answer
77 views

How esignature verification process work?

I have a web application in which the users will be signing an html report. I know how the digital signature authentication works. But here the user will literally be signing the document (So, Should ...
2
votes
1answer
4k views

Where to store Java keystore password?

We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the ...
3
votes
2answers
398 views

How content-type:image can lead to infected JAR file?

Symantec published a news about a malvertising campaign targeting IE users with Java exploits (already known vulnerabilities). At some point they explain that the users are redirected on malicious ...
11
votes
1answer
5k views

Android Runtime Code Injection

I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
4
votes
1answer
335 views

Saved passwords (use case)

I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together. Both the data and the password are encrypted ...
4
votes
3answers
6k views

Java vulnerability: What about OpenJDK + IcedTea?

These days there is a lot of recommendations about disabling java-plugin due to a serious vulnerability. I know this topic has already been covered on this site here and here. In the reports about ...
0
votes
1answer
591 views

Can Veracode detect vulnerabilities in jsp files?

We have chosen Veracode to perform security assessment of our JavaEE code. We have been performing white-box security testing using Veracode. As I am quite new to Veracode, I was surprised to find no ...
1
vote
2answers
337 views

Do XBAP applications have the same vulnerabilities as Java Web Apps?

In response to the popular decision in disabling Java Web Apps, there has been very little mention of XBAP applications. XBAP applications are similar to Silverlight but it offers more options to ...
23
votes
3answers
2k views

Should I be disabling Java?

First it was Apple, now it's the US government... U.S. urges users to disable Java; Apple disables some remotely New malware exploiting Java 7 in Windows and Unix systems How serious is this ...
3
votes
2answers
3k views

How does Java 7 update 11 fix the security vulnerability?

There is a new Java released a couple days ago to resolve a hole that was recently discovered. (Oracle, US-CERT, NVD/NIST) In my initial reading about this update 11, I saw clearly where it by ...
3
votes
3answers
663 views

Java 7u11 - Safer to switch to 6?

Java update 7u11 has made some news lately for a couple reasons. Firstly, it was an out-of-band patch to resolve vulnerabilities being exploited in the wild. Then it came back up because it is now ...
1
vote
2answers
295 views

Is a browser with disabled scripts and disabled java enough against malware

Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled java enough to be protected against dryve-by-malware from the internet. Of course this does not ...