The Anatomy of Java Vulnerabilities
summary
Machine-visible examples show tiny mistakes causing huge damage: a 2001 infinite-loop double parse DoS that trivially spins CPU, a URL/URI decode mismatch enabling DLL hijack, exposed JDWP debug ports and serialization gadget chains via Commons-Collections allowing arbitrary code execution, and an Apache Struts OGNL parse that gives remote exec (Equifax). Cybercrime value hits ~$445B (2016) and WannaCry encrypts ~250k systems, so keeping runtimes current, using vulnerability scanners, avoiding naive trust-managers and custom crypto, and removing unsafe serialization materially reduces risk.
AI-written summary · about
chapters (12)
- 0:00Start
- 12:13Developers
- 15:53Common Vulnerabilities & Exposures
- 18:39Common Vulnerability Scoring System
- 19:04Example CVSS vector
- 21:20How are Java vulnerabilities addressed?
- 23:39Attack Vectors - Untrusted Code
- 24:56Attack Vectors - Untrusted Data
- 28:37Attack Vectors - Cryptographic Issues
- 29:19Attack Vectors - Local
- 31:56Deserialization Vulnerabilities
- 33:49Example vulnerability - JDWP
related talks
49mThe Anatomy of Java Vulnerabilities
56mThe Anatomy of Java Vulnerabilities
50mStranger Danger: Your Java Attack Surface Just Got Bigger
46mLive hacking: Breaking into your Java web app
19mHow a vulnerability hack may happen and how to prevent it
48mCommon vulnerabilities you wish your Java app didn't have!
41mThe Divine and Felonious Nature of Cyber Security
48mThe Hidden Security Hazards in Your Java Stack