Standard Java security
The Java language and the Runtime Environment (JRE) was designed to be free from the most problematic common security vulnerabilities experienced in other languages, like C/C++. Yet, software developers and architects should not only know how to use the various security features of the Java environment (“Java for security”), but should also be aware of the numerous vulnerabilities that are still relevant for Java development (“security of Java”).
The introduction of security services is preceded with a brief overview of the foundations of cryptography, providing a common baseline for understanding the purpose and the operation of the applicable components. The use of these components is presented through several practical exercises, where participants can try out the discussed APIs for themselves.
Java developers, software architects and testers
Preparedness: Basic Java
The course also goes through and explains the most frequent and severe programming flaws of the Java language and platform. Besides the typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques.
- Java security technologies and services:
Java language security solutions, Java Virtual Machine (JVM) and Java Runtime Environment (JRE); ByteCode Verifier and Classloader; Security Manager and Access Controller, managing permissions with the PolicyTool; Java Cryptography Architecture (JCA) and Java Cryptographic Extension (JCE), Java Secure Socket Extension (JSSE), Java Authentication and Authorization Service (JAAS), Java Keystore (JKS) and the KeyTool
- Java-related vulnerabilities:
integer overflows in Java (e.g. the CRC32 bug); Calendar/ZoneInfo deserialization bug (CVE 2008-5353); unsafe reflection; injection flaws in Java (SQL Injection, Command Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF); unsafe Java Native Interface (JNI); improper error and exception handling; insecure randomness of java.util.Random; serialization of sensitive information; dangers of mobile code; Denial-of-Service (DoS) in Java (the “2.2250738585072012e-308 bug”), problem with inner classes, and many more..
; setting and using permissions; authentication and authorization through JAAS; using JCA/JCE providers for digital signing and encryption; permission for signed code; using JSSE – switching from HTTP to HTTPS; exploiting SQL injection step-by-step; crafting Cross-Site Scripting attacks; uploading and running executable code; crashing through JNI; proof-of-concept exploit of Calendar/ZoneInfo deserialization bug; using reflection to break accessibility modifiers; object hijacking; preventing serialization; exploiting mobile code vulnerabilities; crashing Java with magic double values; exploiting inner classes.
Other relevant courses