2

I have a basic Java Server program on my iMac written entirely in Java, which works for a Java client drawing program.

The program basically enables a user to draw something on the JPanel with the drawing being copied onto the panels of all the connected clients.

The server works on a static ip address, over multiple optional ports and involves the use of databases and iMac’s filesystem.

The problem: I am receiving random connection requests from strange Ip addresses all the time and I am am really suspicious about it

Please have a look at my sample server code:

https://stackoverflow.com/questions/47307797/what-is-the-most-secure-way-to-write-a-java-server-program-which-listens-on-my-s

Questions) 1) Can hackers compromise my iMac because of my naive server program? If so, what should I modify in my code to prevent it?

2) What mechanisms in my code are the weak links?

3) Is it possible for a hacker to access my iMac just by knowing the static ip?

Thanks

closed as too broad by Anders, Steve, Xiong Chiamiov, Robert Mennell, ISMSDEV Nov 22 '17 at 22:15

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

3

Hate to be the bearer of bad news, but if you've run any program like this on your personal machine, and made it accessible to the outside world, you realistically have to assume that you've had data stolen and/or your machine has been compromised.

1) Can hackers compromise my iMac because of my naive server program? If so, what should I modify in my code to prevent it?

If you're writing anything like this, you have to assume the answer is yes. There's a reason why many, myself included, say never to roll your own security - industry standard tools, algorithms and frameworks have generally been tested and hardened in real world use over a number of years, and even they have security flaws (sometimes critical) that are revealed from time to time.

Even using such a hardened, industry standard solution though, I'd never run something like this on a personal machine unless it was behind some other layer of protection (such as a VM.)

2) What mechanisms in my code are the weak links?

This is the wrong approach - I could maybe tell you a dozen massive holes if I saw the code in its entirety, and there could still be hundreds more. That wouldn't make it secure, and you shouldn't assume that it is. You also need to consider the security of the platform that you're running on (everything from the Java VM down to the OS), so you could write a completely water tight application and still be vulnerable.

In any case, even ignoring all the above. I couldn't say. You haven't provided the code (even in the Stackoverflow question, the code clearly isn't a complete, self contained example - there's method calls / objects missing.)

However, just for the sake of playing along with what you have posted, you never actually check if you're logged in before doing:

DrawData dat=(DrawData)acceptUserData();//this reads objects 
                                      //from the socket inputstream
dat=processData(dat);
sendToAllClients(dat);

...which really smells of something not being right to me.

3) Is it possible for a hacker to access my iMac just by knowing the static ip?

If this program is running on it, and you've punched a hole in the firewall? Sure, I'd say you have to assume that people can, and have accessed your machine. If you've got passwords, sensitive data or anything else of the like on there, you'd be wise to change all of it immediately.

In the future, if you really want to experiment around with running (likely) insecure programs you've just written, then at least spin up a cheap VM and run it on that instead - that way if it gets compromised, there's not as much to lose.

  • Yes I understand, and just as you suggested I have disconnected my server and will use it only occasionally for testing. – Swapnil B Nov 22 '17 at 13:44
  • I have only two weapons against hacking- 1) I immediately close socket upon a wrong login or an exception. 2) I plan to use a very basic data encryption (the data being sent across). Will that of any help Sir? – Swapnil B Nov 22 '17 at 13:46
  • I an actually a doctor and programming is my hobby ever since high school so I dont have any formal knowledge. Can you suggest a book which comprehensively covers ethical hacking and security concepts? Thanks:) – Swapnil B Nov 22 '17 at 13:47
  • @SwapnilB 1) I immediately close socket upon a wrong login or an exception . You open the door, a crazy murderer with a rocket launcher comes in, and you politely close the door after him again. Will this help you survice? ... 2) I plan to use a very basic data encryption You even lock the door with a key. Problem is, the crazy guy is on the same side as you, and has a RPG. ... I know, sounds stupid, but this is how secure you are with this methods. Not at all. – user155462 Nov 22 '17 at 14:40
  • Can you suggest a book which comprehensively covers ethical hacking and security concepts? A single book? Sorry, no – user155462 Nov 22 '17 at 14:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.