Questions tagged [java]
Security aspects specific to the Java programming language, libraries, and virtual machine.
716
questions
151
votes
5
answers
522k
views
How can I export my private key from a Java Keytool keystore?
I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
- 5,203
108
votes
8
answers
30k
views
Why do I hear about so many Java insecurities? Are other languages more secure?
I really like the Java programming language, but I continuously hear about how insecure it is. Googling 'java insecure' or 'java vulnerabilities' brings up multiple articles talking about why you ...
- 1,215
67
votes
21
answers
70k
views
Lessons learned and misconceptions regarding encryption and cryptology
Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
- 50.9k
40
votes
2
answers
39k
views
How should an application store its credentials
Context
When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, ...
- 502
38
votes
8
answers
16k
views
Client side password hashing
Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security.
After reading through a few discussions here about client side hashing of passwords, I'm ...
- 391
37
votes
8
answers
10k
views
Should I worry about remote timing attacks on string comparison? [duplicate]
Say we have a Java web application which uses a shared secret to verify the identity of the client. The secret is stored on the server, and the client transmits the secret over SSL where it is checked:...
- 1,548
33
votes
3
answers
21k
views
Am I protected from Log4j vulnerability if I run Java 8u121 or newer?
According to the notes for CVE-2021-44228 at mitre.org:
Java 8u121 (see
https://www.oracle.com/java/technologies/javase/8u121-relnotes.html)
protects against remote code execution by defaulting
"...
- 483
33
votes
4
answers
13k
views
Deleting a Java Object securely
I know that in order to delete a Java object I should use character array instead of String, since I can safely erase (rewrite the character array with other data) its content. This seems not to be ...
- 1,204
31
votes
4
answers
92k
views
What is the purpose/role of the "alias" attribute in Java keystore files?
I've heard conflicting information about the purpose of the alias attribute in Java keystore files. Can someone please clarify on what exactly this attribute is, and what it should be set to when ...
- 3,458
30
votes
7
answers
1k
views
How to keep an eye on upgrades, patches and security issues for used open-source libraries?
For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
- 401
29
votes
6
answers
12k
views
Poor error handling source code review
I received a report from the security team today. The report contains the below mentioned vulnerabilities and descriptions:
1) Poor Error Handling: Overly Broad Throws
The methods in program1....
- 449
27
votes
3
answers
3k
views
Why did Java (JRE) vulnerabilities peak in 2012-2013?
I've taken a graph of the amount of CVE reports concerning the JRE per Year.
Now as you can see this spiked in 2012-2013, which could have been guessed easily, if you look at the amount of news items ...
- 373
25
votes
5
answers
13k
views
Java SecureRandom doesn't block? How?
I know from experience that reading from /dev/random blocks when the Linux kernel entropy pool runs out of entropy. Also, I've seen many articles and blog entries stating that when running on Linux, ...
- 447
25
votes
4
answers
74k
views
Password hashing on frontend or backend? [duplicate]
I have a Java Server with Spring Boot and a JS Frontend in AngularJS.
My teacher told me to use HTTPS for passwords, because I cannot hash them securely enough, that nobody can hack them.
With HTTPS,...
- 361
25
votes
3
answers
43k
views
Difference between OpenSSL and keytool
I was wondering about differences between using OpenSSl or Keytool and generating certificates by them. I think Keytool is used by Java community but for someone who is not remotely connected to Java ...
- 353
24
votes
3
answers
2k
views
Should I be disabling Java?
First it was Apple, now it's the US government...
U.S. urges users to disable Java; Apple disables some remotely
New malware exploiting Java 7 in Windows and Unix systems
How serious is this "...
- 948
24
votes
3
answers
5k
views
Java SE 8, Update 51 Added "Native Sandbox" Protection for Windows PCs. Wait, what?
So I was doing a little research about differences (if any) between the sandboxing models for Windows 8/8.1 applications and windows 10 applications when I stumbled across something rather interesting:...
- 2,755
23
votes
3
answers
7k
views
Is Java secure for the desktop? [duplicate]
The Java plugin for web browsers is known to have many security issues, at least in the past. Google Chrome is not even supporting it any more, describing it as decrepit technology, and Firefox having ...
- 323
22
votes
4
answers
18k
views
How secure is Java's hashCode()?
On our views in a Java web application, currently I am using hashCode as Id's for objects so that at server end I can get the same object back.
However, I am wondering how secure Java's hashCode ...
- 2,108
19
votes
7
answers
13k
views
Any comprehensive solutions for binary code protection and anti-reverse-engineering? [closed]
Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
- 1,016
18
votes
2
answers
18k
views
Practices for storing username/password in Web applications
I have read the following question: Storing password in Java application but I don't find the answers useful for my case.
So here is my question somehow related to that. I have a Java Web application ...
- 183
17
votes
2
answers
3k
views
How are code-branch side channel attacks mitigated on Java?
When you are working with secret keys, if your code branches unequally it could reveal bits of the secret keys via side channels. So for some algorithms it should branch uniformly independently of the ...
- 415
17
votes
2
answers
4k
views
Why do some Java APIs bypass standard SecurityManager checks?
In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
- 99.6k
16
votes
3
answers
35k
views
SSL Newbie : Does HTTPS client also need a certificate?
I am calling an HTTPS URL through a Java program. Does my Java client need to provide a certificate to the server to establish this connection? In other words, do I need my own certificate or is the ...
- 263
16
votes
2
answers
17k
views
Why do I need to add intermediate CA certificates to JVM's cacerts file?
My company uses its own PKI. The web browser which I use to access to code repository shows a certificate chain as follows:
Company Root CA
Company Issuing CA Intranet Server
Certificate ...
- 746
16
votes
4
answers
13k
views
What's the standard way to encrypt a file with a public key in Java?
I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the server?...
16
votes
1
answer
17k
views
Preventing Server-Side Request Forgeries in Java
The application lets users specify a URL for their profile picture. It fetches the data from the URL and saves it on the server. However, the app is vulnerable to server-side request forgery (SSRF) - ...
- 33.4k
15
votes
1
answer
10k
views
HQL injection example
Our developers left a surprise in handling user login. Namely:
// java
List users = hibernate.find("from Users where username = '"+formUsername+"'";
if (users.length==0) { return BAD_USER; }
if (!...
- 561
14
votes
7
answers
5k
views
Timing attacks in password hash comparisons
I had a discussion with a friend today about his password hash comparison. I argued that you can't return false on the first hash mismatch you have and I sent him a link to an article about a Java ...
- 141
14
votes
3
answers
29k
views
Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 a safe cipher suite to use?
Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 a safe cipher suite to use for a TLS 1.2 connection to a Tomcat server? What are potential weaknesses or better alternatives? I am looking for a cipher ...
- 243
14
votes
5
answers
13k
views
How can I decrypt data with Java, without hard-coding the key?
I hope this is not a chicken-egg problem or reinventing the wheel but here goes.
I have a Java application that needs to access a password protected file (actually during the application startup).
The ...
- 1,415
14
votes
2
answers
20k
views
What is the difference of TrustManager PKIX and SunX509?
Java's JSSE provides two different TrustManagers:
PKIX and
SunX509
I tried to find out what the differences between both are, but couldn't find any in the documentation. Can you tell me the ...
- 1,646
14
votes
3
answers
11k
views
Reverse-engineering one-time passwords for two-factor authentication systems
Given a one-time password generator that is time-based (such as Google Authenticator), how many instances of (time, PIN) pairs would one need to significantly weaken the algorithm to a point where one ...
- 243
14
votes
1
answer
4k
views
How many bits of entropy does an identifier contain?
According to https://www.owasp.org/index.php/Insufficient_Session-ID_Length:
Assuming that the session identifiers are being generated using a good source of random numbers, we will estimate the ...
- 2,169
13
votes
2
answers
22k
views
What is the best way to store password in memory (RAM) in Java?
Imagine there is a login form in Java application. We need assign usename and password to variables. Moment after we can Hash or HMAC password and keep it just for authentication step (no caching). ...
- 784
13
votes
1
answer
11k
views
Android Runtime Code Injection
I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
- 505
12
votes
3
answers
9k
views
12
votes
5
answers
9k
views
Generating and securing gift card codes
I'm working for a company that is generating gift card codes which can be used to pay for goods on online stores.
I'm wondering what the most secure way of generating these gift card codes are. The ...
- 181
12
votes
2
answers
18k
views
Where should a keystore (.jks) be stored in a repository
I've got a question about the best practice in storing a Keystore file (.jks) in source control. This Keystore is called by a stand-alone Java component that retrieves a private key for the purpose of ...
- 181
11
votes
4
answers
4k
views
What are the differences of checking a self-signed certificate vs ignore it?
I'm doing an integration with a system that has a self-signed certificate. For initial development, we choose to ignore the certificate checking to bypass some errors:
Exception in thread "main" ...
- 213
11
votes
4
answers
8k
views
Is there a real risk of exploitation in java code where a null pointer is dereferenced
I'm playing with some generally well written and parsed java code, but there are some oddities thrown up by my code scanning tool.
I know a null pointer dereference can crash a program, but assuming ...
- 61.5k
11
votes
4
answers
6k
views
Is Java relevant to Information Security?
I'm currently studying Computer Science, where we're teached Java programming. I want to get into the IT-security field, but it seems to me that Ruby and Python are more relevant for that, so I have a ...
- 113
11
votes
3
answers
13k
views
Reverse engineering and Java
Is java class file or jar file is easy to reverse engineer? Because java generates a class file after compilation and not exe files. Is jar and class files are easy to decompile compare to c# and C++? ...
- 464
11
votes
2
answers
10k
views
safe to use jBCrypt and recommend it to my organization?
I'd like to recommend to my fellow developers that we all use bcrypt to hash stored passwords. We all use java and I hesitate to recommend jBCrypt only because its latest version number (0.3) ...
- 6,864
11
votes
2
answers
8k
views
security implications of Java's System.load vs System.loadLibrary
Jumping from https://stackoverflow.com/questions/7016391/difference-between-system-load-and-system-loadlibrary-in-java
What are the security implications of both approach ?
System.loadLibrary("...
- 215
11
votes
1
answer
10k
views
Storage of 'secrets', keystores, HSMs and the rest
I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
- 147
11
votes
2
answers
3k
views
Is it possible to exploit this Zookeeper instance?
I was performing a security test for a client when I came across a Zookeeper installation on xx.x.x.xx:2181. Trying NetCat revealed that I'm able to all the following commands:
dump: Lists the ...
- 397
11
votes
2
answers
1k
views
How can a network observer identify computers running old versions of Java?
I received an email earlier today from my ISP (a university). The email reads (in part):
Your network connection has been disabled because your version of Java is not patched for the most recent ...
- 3,332
11
votes
1
answer
47k
views
PKCS7 encoding in Java without external libs like BouncyCastle etc
I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms).
I have x509certificate from the keystore, rsa private key,
ContentInfo. ContentType is "oidPkcs7Data".
...
- 213
10
votes
7
answers
2k
views
Cheating or service disruption by altering client-side code
A reasonably white-hatted hacker has demonstrated the ability to insert text of his own choosing into the communication between a java applet and a web based server. Not a simple MITM attack, but ...
- 2,006