Security aspects specific to the Java programming language, libraries, and virtual machine.

learn more… | top users | synonyms

1
vote
1answer
129 views

Is use of HttpServletRequest.getQueryString() for a response header vulnerable to response splitting?

I've been told that using HttpServletRequest.getQueryString() in a response header makes my application susceptible to HTTP response splitting attacks, but I just don't see how. It's clear in the ...
1
vote
0answers
116 views

How to import Comodo certificates into Keystore?

I'm trying to create a Keystore. I've already generated a Private Key, generated and sent a certificate request to a CA (Comodo), and I've received a ZIP file from the CA (Comodo) containing four ...
1
vote
0answers
67 views

Secure Web app by user credential and secure REST API within app via best secure method in spring security [closed]

I have a web application which has a single page AngularJS and Spring Security.application going to login via HTTP basic and Hibernate. My application has a REST API. Now how do I secure my REST API ...
1
vote
2answers
129 views

How to rate or review one Java web Application's security

Is there a way to rate or review the security for a Java web application? Except for web scanner or code audit, does it exist a metric/procedure to evaluate the application's security? Also I have ...
1
vote
0answers
53 views

Theory behind certificate for job account

I made it work a job account protected by a certificate in a java spring application but is not that clear to me the minimal steps.(Could you believe that :) I need some theory. Here my steps: ...
1
vote
0answers
114 views

What is the point of signature file in signed JAR/ZIP files

The way JAR signatures (or ZIP for Android) are designed is that they have a manifest file, containing digest for each file in the archive. Then there is a "signature file" that contains digest of ...
1
vote
0answers
91 views

How can I use session salt for encrypting data using AES in CTR mode?

I have to implement a crypto-plugin in Java. The approach followed is conceptually similar to that used for SRTP. The algorithm used for data confidentiality is AES in CTR mode (I'm following a ...
1
vote
0answers
230 views

Problem in 'underscore.js' “new Function()” when CSP header is set.

In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line: "render = new Function(settings.variable || 'obj', '_', source);" The solution ...
1
vote
0answers
127 views

Through signing process with HSM Luna, What device perform the signing?

I'v succesfully configure and test character String signin usign Java and HSM Luna SA through PKCS11. My question is, In wich processor cryptographic operations are perform? In wich way HSM Luna ...
1
vote
1answer
381 views

Rest WebService with signed requests in Java

I'm currently implementing a rest web service with Spring+Java+Tomcat and a cmd client to access it. The most important requirement is to restrict the usage to authenticated users - encryption isn't ...
1
vote
0answers
80 views

Sign java jars for security [closed]

We have an enterprise system that utilizes many in house jars, java applications, to run on a centos 7 linux system. How do I go about achieving the following in order of importance: Only signed ...
1
vote
0answers
70 views

Setup local Certificate Authority & integrate with SCEP

I want setup local Certificate Authority and issue X.509 certificates under my CA. In order to achieve this I am exploring following options such as: OpenSSL/OpenCA BouncyCastle Cryptographic APIs ...
1
vote
1answer
381 views

Is Java javax.servlet.http.HttpServletResponse sendRedirect() auto replace the carriage return(%0d%0a) to prevent Http Header Splitting attack?

I just tried to demonstrate a simple Web app program to simulate the Http Header Splitting attack but I failed. I realise that this sendRedirect() function has filtered my carriage return and replace ...
1
vote
0answers
379 views

Best approach for storing banking information

I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables ...
1
vote
1answer
2k views

Is it safe to use localstorage to store session variables and user password? [closed]

I'm trying to make a web application in Java with a login/session system using com.sun.net.httpserver and as far I know, it does not have an inbuilt method to this. So, I had the following idea: 1 - ...
1
vote
1answer
725 views

Checklist for securing JBoss

Is there a security checklist for auditing JBoss configuration files ? CIS and DISA provides security checklist only for Tomcat and Apache server. Is there any other ressources ?
1
vote
0answers
157 views

Need help to Webservice in Axis2 with https in java

I have written my webservice with https. but as per requirement i should provide authentication. so thought of going with https ssl. could any one help me with steps like moving http to https and ssl ...
1
vote
0answers
58 views

Should we allow JSPs to change on a running application server?

Should we allow JSPs to change on a running application server on a production system? My gut feeling is no. However, I can't seem to find any information to justify it. From a performance end, ...
1
vote
0answers
31 views

Should we protect web application source code from being stolen by web hosts through obfuscation? [duplicate]

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code & probably even steal your business. If, so how to deal with this or how to obfuscate ? ...
0
votes
3answers
6k views

Can you write OS-related virus using high level languages like Python

It is a well known fact that OS-related viruses are commonly written in low level languages like C or C++ which require direct access to the kernel of the CPU , I am just wondering if its possible ...
0
votes
1answer
83 views

Protecting a jar file from being used by unauthorized parties

I have a jar file that has some business critical functionality. Keeping this logic safe and preventing unauthorized usage of this jar is very important to me. To achieve this, I have obfuscated the ...
0
votes
2answers
293 views

Any way to use Java (sun micro) without any concern of infection

My antivirus has kept removing a Java exp virus only for it to keep returning. Yesterday in frustration I decided to uninstall Java until I see some positive news about any patches regarding the ...
0
votes
1answer
2k views

What triggers a firewall to block a TCP socket?

I was wondering what would cause a firewall to block a TCP Java socket from connecting. What would trigger that?
0
votes
2answers
886 views

What is the best way to encrypt a json object in Java?

I have a Json array JsonArray people; which holds JSON objects representing people. Currently I am saving them as plaintext in a json file. try { OutputStream out = new ...
0
votes
1answer
268 views

Risks of legacy JRE versions?

Certain business applications or legacy software require running older versions of the Java Runtime Environment on client systems, e.g. JRE6 or 7 rather than or in addition to 8. Assuming that ...
0
votes
2answers
108 views

Is it possible to run an encrypted java environment?

I've seen that virtual machines in virtualbox or VMware can be encrypted so that no one on the outside can access the disk, ram or CPU cache since the entire hardware is emulated and encrypted too. ...
0
votes
1answer
338 views

Creating secure PIN in Java

I need to create cryptographically secure PIN number in Java using secret id for each user. This simple approach comes to mind: int getPin(String secretUserIdStr) { String pepper = ...
0
votes
1answer
1k views

What are the security features of JRE 8?

I was tasked with finding the security features of JRE 1.8 and compare it to JRE 1.7 update 51. When I try to look for new security though, it only shows ">JDK< Security Enhancements" (ie. Not ...
0
votes
1answer
485 views

encrypting a file with an RSA key

I wrote a java program to encrypt and decrypt files using AES algorithm in CBC mode and a random initialization vector. but there is something fundamental I'm not understanding:first I generate a ...
0
votes
1answer
101 views

Java is running even after it is disabled [closed]

To prevent adds and pop-up that seduce users to install or download viruses I have disabled Java. But I have noticed that even with Java disables Firefox is still running it. The pop-ups are coming ...
0
votes
1answer
142 views

Did I get hit by the recent Java exploit?

Looks like the website iphonedevsdk was responsible for serving up the malware that's been causing some of the recent security exploits. According to my browser history, I visited that site back in ...
0
votes
1answer
51 views

Application Security of crypto keys

Is there a way to secure a byte[], PrivateKey, PublicKey, KeyPair, and SecretKey in an application so that a malware would be unable to retrieve the key by analysing the memory? Or at least, how to ...
0
votes
1answer
2k views

RSA key sizes v/s public key sizes

I am new to cryptography. I have an api provided by a bank. The banks says that they are using RSA algorithm with 2048 bits. We used this api first to get the public key. Here is the sample public ...
0
votes
1answer
346 views

Java desktop app vs web service [closed]

I currently have a desktop app written in Java (Swing) which talks to a C-based backend over SSL. I am trying to understand the pros/con from a security perspective to move to a web service model. ...
0
votes
1answer
123 views

What are the consequences of not upgrading to the latest version of java?

Suppose I need to convince someone to upgrade to the latest SDK version of Java? I have heard there are many security vulnerabilities with old versions of java but can't find anything that concretely ...
0
votes
1answer
71 views

Why do people trust PlayFramework2 dependency management?

If you worked in a big company that was very security conscious, would you build a product based on PlayFramework2 underneath? Since it does automatic dependency resolution at load time, aren't you ...
0
votes
1answer
1k views

SQL injection is possible but selected queries not working

I'm black-box testing an application which uses java spring framework and MySQL in the back-end. When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 ...
0
votes
2answers
783 views

Anti Virus Intergration

we have found an issue with some production systems that the Anti-Virus causes the program to become slow a lot of the times and generally interferes with the activity of our software. Now as far as I ...
0
votes
1answer
204 views

How to modify a certificate using getTBSCertificate() method

I want to show that if I modify one bit or byte from a given X509 certificate the signature verification results false (because this modification results different hash value from the certificate). ...
0
votes
1answer
634 views

Can SHA-1 PRNG still create secure cipher keys?

I am concerned that a SHA-1 PRNG cannot produce an AES-256 cipher key with the expected 256 bits of security, or indeed any secure cipher key where over 165 bits of security are expected. The SHA-1 ...
0
votes
1answer
753 views

Can Veracode detect vulnerabilities in jsp files?

We have chosen Veracode to perform security assessment of our JavaEE code. We have been performing white-box security testing using Veracode. As I am quite new to Veracode, I was surprised to find no ...
0
votes
1answer
78 views

How can I ensure that only the message I sent, and nothing else reaches the receiver?

How do I make sure that the open channel I use to send a message to a specific receiver, is not used by a third party to send unwanted files and compromise the receivers system? Is there a method by ...
0
votes
1answer
66 views

ReCaptcha Placement

I wish to use google's new version 2.0 reCaptcha on my website. My website displays some users' (public) information to other registered users. Where is the best place to place the reCaptcha? 1) On ...
0
votes
1answer
102 views

Securing Java REST Api for Saas usecase

I'm building a Java RESTFul API with Jersey2. The API will be consumed by Developers. The developers should gain access to the endpoints via an access_token (preferably non-expiring). I had a look at ...
0
votes
1answer
327 views

How to implement token based api for rest api in java?

I am working on a project, and I came here in this moment, where I now need authorization. I am using Apache Shiro for my web interface, but as long as mobile web-apps are concerned, I hardly think ...
0
votes
1answer
99 views

Code signing certificate validation by Java

Despite several web search, I can’t find an accurate explanation on code signing certificate validation by Java. Indeed, I am wondering if the code signing certificate (the “final cert”) must already ...
0
votes
2answers
103 views

encryption protection against lost password

Here is a plan I am thinking about. I haven't seen this proposed, so I thought I would ask about it. Threat we are guarding against: A lost or stolen laptop leading to exposure of sensitive ...
0
votes
1answer
190 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
0
votes
1answer
957 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
0
votes
1answer
219 views

Signature Based Malware Detection

I am developing software for detecting malware based on signature, in Java. I have researched a lot for the approach to move ahead. I found that the basic idea is to store the existing malware ...