The Anatomy of Java Vulnerabilities
summary
Shows a real double-to-string parsing hang from 2001 that can crash servers by sending a crafted header, cites 692 Java CVEs and $450B/year cybercrime (2016), and explains how JVM classpath/URL decoding, exposed JDWP, and Apache Struts content-type parsing led to major incidents (Equifax, WannaCry touching ~250,000 machines). Covers exploitation techniques like deserialization gadget chains, risky developer shortcuts (trusting all SSL certs, permissive TrustManagers), and recommends CVE/CWE/OWASP checks plus tools LGTM, FindBugs/Find Security Bugs and frequent Java updates.
AI-written summary · about
chapters (40)
- 0:00Introduction
- 0:24Overview
- 1:53Two Character Change
- 2:08Doubles
- 3:28System Hangs
- 4:15Technical Horror Story
- 4:54What are vulnerabilities
- 5:04Bug that can be exploited
- 5:22Exploits
- 6:28Who cares
- 7:02Scale of the problem
- 7:29Lots of those
- 7:40Cybercrime
- 11:12Windows
- 14:17Social Engineering
- 18:02Features
- 18:56CVS
- 19:43Search for Java
- 20:36No Details
- 23:26Reporting
- 24:27Assess
- 25:48Dependencies
- 26:38Un untrusted code
- 27:47Plugin
- 28:49untrusted data
- 30:08JPEG buffer overflow
- 32:38No Equifax
- 33:06Heartbleed Poodle
- 34:40Local vectors
- 35:37Wannacry
- 37:24Serialisation
- 39:26Debugging
- 40:38Class loading
- 41:45Class not found
- 42:00Not in the map
- 44:32Example
- 45:35LGTM
- 45:59Findbugs
- 46:24WASP
- 46:46Updating
related talks
56mThe Anatomy of Java Vulnerabilities
46mThe Anatomy of Java Vulnerabilities
50mStranger Danger: Your Java Attack Surface Just Got Bigger
19mHow a vulnerability hack may happen and how to prevent it
49mWargames - Java vulnerabilities and why you should care
46mLive hacking: Breaking into your Java web app
48mThe Hidden Security Hazards in Your Java Stack
01h 06mLive hacking: Breaking into your Java web app