security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

1
vote
2answers
631 views

Understanding Java Security Providers

I'm hoping to use the below issue we came across recently to better understand Java's security providers, ciphers and encryption in general. We got the following error during an SSL Handshake (using ...
1
vote
1answer
195 views

On File delete, using java File delete method what could be the security issue?

In my case, the static code analysis tool shows the issue when it founds the code like this boolean status = file.delete(); It issues the security vulnerability saying the validation is ...
1
vote
1answer
66 views

What could happen if regex metacharacters using named capturing group are not encoded?

Let's say that a web application take a specific input from the user (e.g., search form), apply a Java regex with named caputring groups on it and use the final output to do other stuff (e.g., look ...
1
vote
3answers
270 views

Capture query to MySQL in Server

I want to capture queries to MySQL from my web-application on my Linux-based Server. MySQL port is 3306 and my web-application in on port 8181. So I started using tcpdump as follow: # tcpdump -x ...
1
vote
1answer
148 views

What are the risks when processing a document with Apache POI?

Apache POI is a Java library for processing office documents. What are the risks associated with processing untrusted documents? For example, a web site that allows users to upload documents that are ...
1
vote
1answer
114 views

Storing encryption passphrases in memory in Dalvik?

Given KeePassDroid, I'm considering some of the security implications of accessing KeePass databases on an Android device. In the native applications for Windows, OSX, and Linux, whenever the ...
1
vote
1answer
81 views

Why are certain languages chosen for security application development over others?

Specifically, why are the most popular attack proxies written in java? Is there any particular security posture to the design of the java language that makes writing tools like these simpler? Easier ...
1
vote
3answers
823 views

Java AES encryption output length

I am trying to encrypt few database columns (string values) using Java AES algorithm. This is to protect certain sensitive data. For some users these data should decrypted. In Java AES encryption, if ...
1
vote
1answer
504 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...
1
vote
1answer
927 views

Convert a DER encoded Certificate to PEM encoded Certificate

I have a p7b certificate(DER encoded) which I need to convert to a PEM encoded certificate so that I can import it into my keystore. I see that the openssl command below does the job of the ...
1
vote
1answer
1k views

Uploading JSP (Any kind of java code) to Tomcat without manager

I'm new to this site. I have a question concerning the upload of dynamic java code into an application running on Tomcat 7.0.34. I'm doing a penetration testing of a java website and found it's ...
1
vote
2answers
100 views

Symmetric encryption involving load balancers - can't randomize key?

I'm working on encrypting a web application's cookie. Using symmetric AES/CBC, I encrypt the cookie data before writing it out, and then decrypt it when reading it back in - the standard stuff. The ...
1
vote
1answer
289 views

NTRU java attack implementation

I'm researching NTRU cryptosystem and started research based on source code from sourceforge and bouncy castle(java language). Currently I'm reseacrhing attacks on NTRU, based on CVP and SVP. But I'd ...
1
vote
1answer
191 views

AppEngine Sandbox

Does anyone know how the AppEngine sandbox is implemented? I heard they use a SecurityManager with Java but surely they are using another layer as well like LXC. I've looked at the whitelist and there ...
1
vote
1answer
1k views

Hardening JRE deployment - webjava

I am trying to set up some hardened deployment settings for Java for the end-users' machines on my network. I have my system wide deployment config and properties files set up: ...
1
vote
2answers
335 views

Do XBAP applications have the same vulnerabilities as Java Web Apps?

In response to the popular decision in disabling Java Web Apps, there has been very little mention of XBAP applications. XBAP applications are similar to Silverlight but it offers more options to ...
1
vote
2answers
289 views

Is a browser with disabled scripts and disabled java enough against malware

Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled java enough to be protected against dryve-by-malware from the internet. Of course this does not ...
1
vote
1answer
553 views

What security concerns exist in running a glassfish app directly on port 443

I have installed Apache http server in front of glassfish based on recommendations i had in this question. I have been told that i will run into performance problems along with security issues. I was ...
1
vote
1answer
5k views

How do I use OpenSSL with the Java Keytool?

I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring ...
1
vote
1answer
506 views

Network Sniffing Java Applet Authentication

Example, I have a java applet application, then this application is accepting userid and password as authentication. Can I sniff the userid and password on the network layer? Are the credential being ...
1
vote
1answer
771 views

PAP and CHAP implementation using Java

I want to implement PAP and CHAP based authentication in my Java project how can I implement ? is there any API available in Java for using that protocol ?
1
vote
1answer
1k views

How to best authenticate a desktop client with a scaleable backend via SOAP / REST service?

I'm trying to find a solid architecture for authenticating users against a database. I have a game client, which I plan to serve up a request with. The transport doesn't really matter, but at this ...
1
vote
0answers
48 views

How can I use session salt for encrypting data using AES in CTR mode?

I have to implement a crypto-plugin in Java. The approach followed is conceptually similar to that used for SRTP. The algorithm used for data confidentiality is AES in CTR mode (I'm following a ...
1
vote
1answer
46 views

Vulnerability test for CVE-2014-2483?

I am in penetration testing on a server with Linux RHEL6/7 os. Vulnerability databases such as http://www.cvedetails.com/ mentioned the vulnerability CVE-2014-2483 for Java in Linux RHEL systems. I ...
1
vote
0answers
91 views

OCSP stapling implementation in JAVA/ Android

I am trying to implement OCSP stapling in JAVA. How can this be implemented ? How can we set OCSPStatusRequest extension for TLS. and how we can verify the response ? Hi, How can we implement OCSP ...
1
vote
0answers
67 views

Through signing process with HSM Luna, What device perform the signing?

I'v succesfully configure and test character String signin usign Java and HSM Luna SA through PKCS11. My question is, In wich processor cryptographic operations are perform? In wich way HSM Luna ...
1
vote
1answer
148 views

Rest WebService with signed requests in Java

I'm currently implementing a rest web service with Spring+Java+Tomcat and a cmd client to access it. The most important requirement is to restrict the usage to authenticated users - encryption isn't ...
1
vote
0answers
52 views

Sign java jars for security [closed]

We have an enterprise system that utilizes many in house jars, java applications, to run on a centos 7 linux system. How do I go about achieving the following in order of importance: Only signed ...
1
vote
0answers
43 views

Setup local Certificate Authority & integrate with SCEP

I want setup local Certificate Authority and issue X.509 certificates under my CA. In order to achieve this I am exploring following options such as: OpenSSL/OpenCA BouncyCastle Cryptographic APIs ...
1
vote
1answer
206 views

Is Java javax.servlet.http.HttpServletResponse sendRedirect() auto replace the carriage return(%0d%0a) to prevent Http Header Splitting attack?

I just tried to demonstrate a simple Web app program to simulate the Http Header Splitting attack but I failed. I realise that this sendRedirect() function has filtered my carriage return and replace ...
1
vote
0answers
32 views

PBKDF2 hashing over TLS for encrptig password [closed]

i wanna use PBKDF2 hashing over TLS for encrypting password and session and that way stop hackers from breaking into my connection. How to do it in java.
1
vote
0answers
244 views

Best approach for storing banking information

I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables ...
1
vote
1answer
1k views

Is it safe to use localstorage to store session variables and user password? [closed]

I'm trying to make a web application in Java with a login/session system using com.sun.net.httpserver and as far I know, it does not have an inbuilt method to this. So, I had the following idea: 1 - ...
1
vote
1answer
320 views

Checklist for securing JBoss

Is there a security checklist for auditing JBoss configuration files ? CIS and DISA provides security checklist only for Tomcat and Apache server. Is there any other ressources ?
1
vote
0answers
115 views

Need help to Webservice in Axis2 with https in java

I have written my webservice with https. but as per requirement i should provide authentication. so thought of going with https ssl. could any one help me with steps like moving http to https and ssl ...
1
vote
0answers
55 views

Should we allow JSPs to change on a running application server?

Should we allow JSPs to change on a running application server on a production system? My gut feeling is no. However, I can't seem to find any information to justify it. From a performance end, ...
1
vote
0answers
31 views

Should we protect web application source code from being stolen by web hosts through obfuscation? [duplicate]

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code & probably even steal your business. If, so how to deal with this or how to obfuscate ? ...
0
votes
3answers
4k views

Can you write OS-related virus using high level languages like Python

It is a well known fact that OS-related viruses are commonly written in low level languages like C or C++ which require direct access to the kernel of the CPU , I am just wondering if its possible ...
0
votes
2answers
290 views

Any way to use Java (sun micro) without any concern of infection

My antivirus has kept removing a Java exp virus only for it to keep returning. Yesterday in frustration I decided to uninstall Java until I see some positive news about any patches regarding the ...
0
votes
1answer
1k views

What triggers a firewall to block a TCP socket?

I was wondering what would cause a firewall to block a TCP Java socket from connecting. What would trigger that?
0
votes
1answer
61 views

Risks of legacy JRE versions?

Certain business applications or legacy software require running older versions of the Java Runtime Environment on client systems, e.g. JRE6 or 7 rather than or in addition to 8. Assuming that ...
0
votes
1answer
179 views

Creating secure PIN in Java

I need to create cryptographically secure PIN number in Java using secret id for each user. This simple approach comes to mind: int getPin(String secretUserIdStr) { String pepper = ...
0
votes
2answers
853 views

Doesn't the same string encrypted with the same key generate the same encrypted value?

This is my page and class to encrypt the string entered and saved in database. Each time, the Key__c is the same, as I take it from custom settings. But when I enter abc and save two times, the ...
0
votes
1answer
647 views

What are the security features of JRE 8?

I was tasked with finding the security features of JRE 1.8 and compare it to JRE 1.7 update 51. When I try to look for new security though, it only shows ">JDK< Security Enhancements" (ie. Not ...
0
votes
1answer
364 views

encrypting a file with an RSA key

I wrote a java program to encrypt and decrypt files using AES algorithm in CBC mode and a random initialization vector. but there is something fundamental I'm not understanding:first I generate a ...
0
votes
1answer
101 views

Java is running even after it is disabled [closed]

To prevent adds and pop-up that seduce users to install or download viruses I have disabled Java. But I have noticed that even with Java disables Firefox is still running it. The pop-ups are coming ...
0
votes
1answer
140 views

Did I get hit by the recent Java exploit?

Looks like the website iphonedevsdk was responsible for serving up the malware that's been causing some of the recent security exploits. According to my browser history, I visited that site back in ...
0
votes
1answer
500 views

RSA key sizes v/s public key sizes

I am new to cryptography. I have an api provided by a bank. The banks says that they are using RSA algorithm with 2048 bits. We used this api first to get the public key. Here is the sample public ...
0
votes
1answer
164 views

Java desktop app vs web service [closed]

I currently have a desktop app written in Java (Swing) which talks to a C-based backend over SSL. I am trying to understand the pros/con from a security perspective to move to a web service model. ...
0
votes
1answer
79 views

What are the consequences of not upgrading to the latest version of java?

Suppose I need to convince someone to upgrade to the latest SDK version of Java? I have heard there are many security vulnerabilities with old versions of java but can't find anything that concretely ...