Utilize basic read-write functions

Sky-Tiger

Regular expressions can greatly reduce time to delivery, and can also greatly reduce code complexity; however, this comes at a cost. Regular expressions can become fragile, and without proper unit tests, maintainance can become expensive and dangerous. Like any other piece of code, tests are life; don't do unto others what you would not have them do unto you.

Don't leave complex regular expressions un-tested, and conversely, if you are confused by a regular epression you find, maybe you should spend a little time to figure out what it does, and write some tests to validate your beliefs - in the end, you'll be glad you did.

Sky-Tiger

Developers at Sun Microsystems Inc. sought to put Java security measures in place to protect the Java virtual machine (JVM), the main engine that runs Java applets, long before attacks became commonplace. Sun, which was acquired by Oracle Corp. in 2010, created Java sandboxing restrictions to protect Java applets in 1995, isolating them from accessing critical processes in the browser or the file system.

Unlike Adobe Systems and the browser makers, which are building sandboxing protections around applets that run inside the browser, Oracle promotes the use of Java for building full-fledged desktop applications, which can write to arbitrary directories, said Michael Schierl, a software developer and Java expert based in Germany. This, he said, makes the process of adding defensive mechanisms for today's attacks much more complicated.

"Adding a second sandbox around the permissions system called the Java sandbox will surely make Java safer," Schierl said, it's just that it is hard or even impossible to do so."

Java has a vast trusted code base, Schierl said, referring to the amount of code that is inherently trusted by a client machine running a Java program. This enables a program to read configuration files and the registry, store data to cache directories and other functions.  To prevent the original sandbox from terminating normal Java applets, Schierl added, these "safe" functions would have to be whitelisted in a second sandbox.

Automated toolkits are fueling most of the attacks that exploit Java flaws. BlackHole and other toolkits make the process easy and systems without the latest patches installed face the most risk, experts say. But even fully deployed systems can be targeted.

Just this week, researchers discovered two Java zero-day vulnerabilities in the latest version of the programming language. Exploit code targeting the vulnerabilities, which is rated extremely critical by Danish vulnerability clearinghouse Secunia, is publicly available. Attackers can use the flaws to bypass restrictions, install a dropper and remotely control data stealing malware using a variant of the PoisonIvy Trojan.

Software security expert Gary McGraw, CTO of Dulles, Va.-based Cigital Inc., said the impetus should be on Oracle engineers to do a better job finding and correcting flaws in the Java virtual machine.  Today the Java is maintained by Oracle; the Redwood Shores, Calif.-based vendor has not responded to an interview request. The company also has not yet acknowledged the latest zero-day flaws or the publicly available attack code.

"It would be better for everybody if the Java virtual machine sandbox was just repaired," McGraw said. "The security mechanisms designed into Java are not so terrible; they are complicated and they have to be implemented exactly right. And exactly right turns out to be real hard."

Hundreds of millions of lines of code in Oracle’s codebase are written in Java, noted Eric Maurice, director of software security assurance at Oracle in a blog entry on Java security in February.  Maurice said Oracle had added development staff dedicated to Java security, and that additional code-scanning tools were adopted to detect and address vulnerabilities.

"With these new resources available to them as a result of the Oracle acquisition, the Java development team is weeding out security bugs in Java, and is looking at ways to further improve the security posture provided by Java to its users," Maurice wrote.

Java's age, complexity and install base make it a very attractive target for attackers, said Wolfgang Kandek, CTO of Redwood City, Calif.-based vulnerability management vendor Qualys Inc.  Kandek said Oracle could restrict the resources the JVM uses or request permissions, but additional restrictions would likely not be very practical.

"Oracle acquired a huge code base; a very successful code base and they have to work through the problems that come with it," Kandek said.  

According to Kandek the most practical solution for enterprises is to control where Java is running and only run it when necessary. Enterprises IT teams can use registry zones to implement tighter restrictions, he said.

Related Topics: Software Development Methodology, Web Browser Security, Application Attacks (Buffer Overflows, Cross-Site Scripting), Web Application Security, VIEW ALL TOPICS

More News and Tutorials
ARTICLES

Apple takes novel approach to killing Flashback Trojan on Mac OS X 10.7 and 10.6
Attack code surfaces targeting Java zero-day flaw
Microsoft Patch Tuesday update excludes fix for MHTML flaw
Microsoft to release bumper holiday security update
Busy Patch Tuesday sees 16 Microsoft fixes coincide with Adobe security update release

Sky-Tiger

Background – A Unique, 3rd Party View

Though Jeff’s company historically provides services as a VAR, Jeff spends his days speaking with customers about Java applications. While discussions between his company and his customer are traditionally about infrastructure and data centers, most of his time is spent collaborating with IT teams to identify solutions based on the VMware vFabric stack – architectures made up of Spring frameworks, application servers, web servers, middleware, monitoring, in-memory, distributed databases, and more.  The operations teams he works with are typically focused on monitoring applications, keeping them running, ensuring security is in place, patching, identifying anomalies, working with performance issues, procuring hardware, etc.  The managers of these operations teams have a different focus, a different goal than application development teams.  Due to the different goals, a rift between teams exists in many IT shops today.  Jeff has seen this as a front-line worker, manager, consultant, and executive.

Sky-Tiger

Yet, while Jeff’s company helps with operations, Jeff focuses on applications.  And, he sees IT team dynamics change right before his eyes.  Whether the devops approach is an elephant in the room or a target strategy, the cloud concept pulls applications and operations on to the same page, with same goal, and as the same team. And, Jeff gets excited about this for two reasons:

Both infrastructure and development teams take responsibility for efficiency and the cost of operations.
Big/fast data is almost impossible without this collaboration.
Here is (a somewhat dramatic summary of the two reasons:

Sky-Tiger

Encouraging Responsibility

Virtualized, automated infrastructure creates elasticity, and elasticity creates the biggest benefit of cloud computing.  Do you need to quickly move from 20 JVMs today to 200 tomorrow?  Without a cloud infrastructure, this could take weeks.  With a cloud infrastructure, it could take minutes. This elastic capability is why the term “cloud” has become so overused by so many companies.  While it may become annoying to hear “cloud this and cloud that,” the cloud model unleashes a boatload of value and makes IT faster, more responsive, and better at keeping SLAs while reducing costs and downtime headaches.  While IT teams may reach a point of never wanting to hear the term again, IT teams are now including the related requirements and the business drivers into their plans.  You just can’t design an app or open a PO anymore with an overestimate on hardware…and you certainly don’t want to wait on environment set-up or upgrades if you don’t have to.

Sky-Tiger

Making Big Data Possible

The traditional RDBMS model cannot scale. Period.  Because of this, people speak of a death knell for the traditional RDBMS. Interestingly, fault tolerance, disaster recovery, and high availability die too.  The resurrection taking shape includes in-memory, distributed data stores and other purpose-built data management systems.  These solutions have redundancy and availability built in and enable real-time analytics, cached sessions, and more.  So, what happens when the shift in capabilities literally changes someone’s job description?  The teams creating, consuming, and managing the data must also change.  Apps and Ops work together because the sheer scale of data and processing tear down a long-time wall.

To read Jeff’s specific viewpoint and more detail on this shift in IT team dynamics, read the full article.

Sky-Tiger

Java EE is already the perfect solution for complex business/enterprise systems and provides all the tools and foundations required to deliver scalable, performant applications for a wide variety of customers and clients.

But how does the end user experience stack up? How easy is it to navigate through your Website? Is your code full of nasty navigation logic? Are your links clear, transparent, and informative? Do you find yourself adding ‘?query=parameters’ in order to serve dynamic content from your application? Can you ensure that you are not leaking information in your URLs, and that your applications are secure from URL-based attacks? Are your old links making it difficult to migrate or integrate a legacy application to a new one?

Sky-Tiger

Java EE is already the perfect solution for complex business/enterprise systems and provides all the tools and foundations required to deliver scalable, performant applications for a wide variety of customers and clients.

But how does the end user experience stack up? How easy is it to navigate through your Website? Is your code full of nasty navigation logic? Are your links clear, transparent, and informative? Do you find yourself adding ‘?query=parameters’ in order to serve dynamic content from your application? Can you ensure that you are not leaking information in your URLs, and that your applications are secure from URL-based attacks? Are your old links making it difficult to migrate or integrate a legacy application to a new one?

Sky-Tiger

Java EE is already the perfect solution for complex business/enterprise systems and provides all the tools and foundations required to deliver scalable, performant applications for a wide variety of customers and clients.

But how does the end user experience stack up? How easy is it to navigate through your Website? Is your code full of nasty navigation logic? Are your links clear, transparent, and informative? Do you find yourself adding ‘?query=parameters’ in order to serve dynamic content from your application? Can you ensure that you are not leaking information in your URLs, and that your applications are secure from URL-based attacks? Are your old links making it difficult to migrate or integrate a legacy application to a new one?

Sky-Tiger

Java EE is already the perfect solution for complex business/enterprise systems and provides all the tools and foundations required to deliver scalable, performant applications for a wide variety of customers and clients.

But how does the end user experience stack up? How easy is it to navigate through your Website? Is your code full of nasty navigation logic? Are your links clear, transparent, and informative? Do you find yourself adding ‘?query=parameters’ in order to serve dynamic content from your application? Can you ensure that you are not leaking information in your URLs, and that your applications are secure from URL-based attacks? Are your old links making it difficult to migrate or integrate a legacy application to a new one?