security aspects specific to the Java programming language and libraries.
-2
votes
0answers
47 views
How to implement Korea's SEED algorithm in Java? [closed]
While reading about the SEED cipher in java documentations, I came to know about this Korean SEED algorithm. Can anyone help me to implement it in Java?
I have used AES for encryption and decryption ...
-2
votes
0answers
28 views
Avast keeps blocking a malicious URL but can't tell which one [closed]
I keep getting this and have no idea why
The characters and numbers at the end of the Object change but the rest is always the same.
I tried searching with grepWin to no avail.
-5
votes
0answers
47 views
how cource code to combine plaintext + key into ciphertext + key in java using aes algorithm? [closed]
how cource code to combine plaintext + key into ciphertext + key in java using aes algorithm?
I'm developing an sms application with a security system using cryptographic algorithm aes.
but I get the ...
2
votes
2answers
235 views
Where do I get started in terms of learning how to exploit Java and Flash vulnerabilities? or browser exploitation in general
Another Java 0day was discovered today which got me thinking how browser exploitation (remote execution on clients browser) works.
I am unable to find any books or resources online about browser ...
-5
votes
0answers
42 views
I need to know my keystore password [closed]
I lost my keystore password for my key .. I could find the way to copy the content of they key store into another keystore with a new password via this link now I really need to know the password of ...
5
votes
1answer
109 views
POC of a Java exploit using leftover JREs
Summary: I would like to show a proof of concept of a Java exploit using an old JRE on an up-to-date machine to cut short discussions on the "but we are patched so why removing older versions" ...
-1
votes
0answers
41 views
Can you tell me how can this website infect me? [duplicate]
Thi is the website: hxxp://host7.freehost7.com/contents/F51a424ff10912/
another website that looked exactly the same was probably taken down since I get this warning hxxp://securesignupoffers.org/g/ ...
4
votes
3answers
170 views
Security of JVM for Server
Using type- and memory-safe languages like Java and Scala for server applications gave me the confidence of having a basic level of security (e.g. compared to C). Now with the recent wave of Oracle ...
-4
votes
0answers
75 views
Is this website dangerous? It looks like one of the bitcoin wallet stealing websites people were talking about a few months ago [closed]
hxxp://procoin.mydiscussion.net/ (possible malware site)
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html ...
1
vote
1answer
49 views
AppEngine Sandbox
Does anyone know how the AppEngine sandbox is implemented? I heard they use a SecurityManager with Java but surely they are using another layer as well like LXC. I've looked at the whitelist and there ...
3
votes
1answer
236 views
Are any Java Card 3.0 smart cards available?
The Java Card 3.0 specification (draft?) came out in 2008. It is now 2013. Are there any existing smart cards that actually implement the specification? How about USB tokens?
The best I've found is ...
2
votes
1answer
55 views
Understanding JVM zero day in relationship with other runtimes
I am a .net and php developer and since java has been in the news recently thanks to the string of zero days, I decided to brush up on security.
In regards to the java zero days, this question has ...
-9
votes
0answers
59 views
Close the virtual machine (vmware) customer [closed]
It is possible to close the virtual machine (vmware) on this machine where it is installed, and leave the remote access only certain IP ?
-5
votes
0answers
31 views
Encrypt .war file java web application? [duplicate]
Is it possible to encrypt the file .war with all its contents, and then have served understand this application? I saw something similar with JarCryp, most do not know if it's working on servers like ...
-5
votes
1answer
109 views
Protect java WEB application inside the server(against reverse engineering) [closed]
I have a web application running on Glassfish 3.1.2 servlet container and I need a way to protect the compiled java classes. I have tried to obfuscate the source code but it didn't work.
The project ...
8
votes
2answers
1k views
Will disabling the Java add-on in IE protect you from Java exploits?
Concerning the recent Java vulnerability (Should I be disabling Java?), the most common advise seems to be to disable Java plug-ins in the browser.
However, Heise Security suggests that, when it ...
0
votes
1answer
66 views
What triggers a Firewall to block a TCP Socket?
I was wondering what would cause a Firewall to block a TCP Java Socket from connecting. What would trigger that? Thanks!
2
votes
3answers
164 views
How to identify the Java program that is maliciously accessing my web site from many client addresses?
For many years, my personal web site receives numerous pairs of hits that look like this, every day:
202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04"
...
1
vote
1answer
100 views
How safe is WSIT username authentication with symmetric key?
I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link).
How secure is this mechanism? Is this enough to ...
3
votes
2answers
123 views
security implications of Java's System.load vs System.loadLibrary
Jumping from http://stackoverflow.com/questions/7016391/difference-between-system-load-and-system-loadlibrary-in-java
What are the security implications of both approach ?
...
2
votes
2answers
93 views
Security of viewing a website containing Java applets offline
I've been wondering whether viewing a website offline increases the security risk.
The reason why I'm asking is that having been a short time java applet developer (for a small task) I've come to ...
4
votes
2answers
914 views
Does Java applets reveal the real IP address, even when using proxy or vpn?
Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
7
votes
3answers
226 views
How can I circumvent the lack of Java updates?
Just imagine you have a bunch of computers which need Java for some important software and you can't just switch to another vendor because all are using Java in this field of technology. If you start ...
3
votes
1answer
66 views
Is there any public information on audited Java open source projects?
I'm sure that there must have been any number of audits on common Java open source projects, many of them for governments or publicly-funded bodies.
Have any of the results been made public, so that ...
8
votes
4answers
476 views
What Checkstyle or Findbugs rules detect common vulnerabilities?
Looking for experience with both built in and custom checks.
I do not need references to commercial source code analysers.
4
votes
2answers
168 views
JInitiator is obsolete and I should reject it on grounds of security, right?
I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as ...
1
vote
1answer
214 views
Hardening JRE deployment - webjava
I am trying to set up some hardened deployment settings for Java for the end-users' machines on my network.
I have my system wide deployment config and properties files set up:
...
2
votes
5answers
247 views
Website vulnerability scanner in Java && Open Source
I am working on a Web platform that must-need-should have a good level of security.
Therefore, I am interested in a good quality tool to test my Web platform QA on security.
My main programming ...
3
votes
3answers
100 views
jasypt message integrity
I've been looking into ways to encrypt an authentication token that I need to pass from one site to another. Things i have learned so far are
use a high level library.
don't use ECB
use a HMAC to ...
1
vote
1answer
56 views
Java applet authenticity problem
I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
2
votes
1answer
224 views
What is the best practice for storing a secret on the cloud?
This post on Securing Java Application Data for Cloud Computing offers a good introduction to using a Java KeyStore for securing encrypted data in the cloud. It neglects, however, to answer the ...
15
votes
8answers
2k views
Any comprehensive solutions for binary code protection and anti-reverse-engineering?
Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
5
votes
3answers
226 views
Why must all classes' data members be set to private?
In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured".
How does setting members to private makes the program ...
3
votes
2answers
101 views
Securing Java web services called by web site in DMZ using web services for communication
Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
0
votes
4answers
138 views
Is there a need to define “language safety”?
Language safety is not clearly defined while there're warnings about for instance Java. So how can you say that language is not safe while language safety is not clearly defined? If Java is unsafe ...
6
votes
2answers
254 views
How to keep using Java 6 securely, despite its unpatch vulnerabilities
Given that Java 6 is now deprecated by Oracle and there recently has been notification of a 0day (that will exist forever now that Oracle is not patching JRE6), what can we do to prevent drive-by ...
-1
votes
1answer
87 views
What are correct steps to setup this exploit execution(jboss_invoke_deploy)?
I've found this vulnerability (http://www.metasploit.com/modules/exploit/multi/http/jboss_invoke_deploy) but can't seem to set proper values for exploit to work , payload shown on site gives me worn ...
0
votes
1answer
266 views
Java SecureRandom generate secure random number
How to generate a secure random number bit length is 256 bits using Java. What is the different between:
SecureRandom random = new SecureRandom();
and
SecureRandom prng = ...
1
vote
2answers
291 views
What is the safest way to store a password in a single file?
I've been reading about it. This article helped me a lot. But the more I read the more complicated it seems. For example:
Is it better to use bcrypt, or PBKDF2, sha2 or something else for the salt?
...
5
votes
1answer
6k views
PKCS7 encoding in Java without external libs like BouncyCastle etc
I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms).
I have x509certificate from the keystore, rsa private key,
ContentInfo. ContentType is "oidPkcs7Data".
...
6
votes
6answers
754 views
Client side password hashing
Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security.
After reading through a few discussions here about client side hashing of passwords, I'm ...
3
votes
1answer
192 views
How to debug/reverse engineer java applets?
I need to analyze a java application (a .jar file) for a war game. I know java can be decompiled, but the coder apparently did a lot of obfuscation to prevent the reverse engineers from understanding ...
1
vote
1answer
113 views
Did I get hit by the recent Java exploit?
Looks like the website iphonedevsdk was responsible for serving up the malware that's been causing some of the recent security exploits. According to my browser history, I visited that site back in ...
0
votes
1answer
42 views
How esignature verification process work?
I have a web application in which the users will be signing an html report. I know how the digital signature authentication works. But here the user will literally be signing the document (So, Should ...
0
votes
0answers
53 views
Can Jasper files be used as shells to attack java web apps?
JasperReports is an open source Java reporting tool that can write to a variety of targets, such as: screen, a printer, into PDF, HTML, Microsoft Excel, RTF, ODT, Comma-separated values or XML ...
2
votes
1answer
411 views
Where to store Java keystore password?
We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the ...
3
votes
2answers
173 views
How content-type:image can lead to infected JAR file?
Symantec published a news about a malvertising campaign targeting IE users with Java exploits (already known vulnerabilities). At some point they explain that the users are redirected on malicious ...
9
votes
1answer
585 views
Android Runtime Code Injection
I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
4
votes
1answer
158 views
Saved passwords (use case)
I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together.
Both the data and the password are encrypted ...
2
votes
3answers
3k views
Java vulnerability: What about OpenJDK + IcedTea?
These days there is a lot of recommendations about disabling java-plugin due to a serious vulnerability. I know this topic has already been covered on this site here and here.
In the reports about ...
