Randar: A Minecraft exploit that uses LLL lattice reduction to crack server RNG
https://github.com/spawnmason/randar-explanation/blob/master/README.md [github.com]
2024-04-19 01:22
tags:
gaming
java
math
opsec
programming
random
Every time a block is broken in Minecraft versions Beta 1.8 through 1.12.2, the precise coordinates of the dropped item can reveal another player’s location. “Randar” is an exploit for Minecraft which uses LLL lattice reduction to crack the internal state of an incorrectly reused java.util.Random in the Minecraft server, then works backwards from that to locate other players currently loaded into the world.
source: HN
Bending pause times to your will with Generational ZGC
https://netflixtechblog.com/bending-pause-times-to-your-will-with-generational-zgc-256629c9386b [netflixtechblog.com]
2024-03-16 00:20
tags:
garbage-collection
java
perf
The latest long term support release of the JDK delivers generational support for the Z Garbage Collector. Netflix has switched by default from G1 to Generational ZGC on JDK 21 and later, because of the significant benefits of concurrent garbage collection.
source: HN
Breaking java.lang.String
https://wouter.coekaerts.be/2023/breaking-string [wouter.coekaerts.be]
2023-07-11 23:58
tags:
concurrency
java
programming
Let’s abuse a bug in java.lang.String to make some weird Strings. We’ll make “hello world” not start with “hello”, and show that not all empty Strings are equal to each other.
source: HN
CVE-2022-21449: Psychic Signatures in Java
https://neilmadden.blog/2022/04/19/psychic-signatures-in-java/ [neilmadden.blog]
2022-04-20 03:12
tags:
bugfix
crypto
java
security
One side of the equation is r and the other side is multiplied by r and a value derived from s. So it would obviously be a really bad thing if r and s were both 0, because then you’d be checking that 0 = 0 ⨉ [a bunch of stuff], which will be true regardless of the value of [a bunch of stuff]! And that bunch of stuff is the important bits like the message and the public key. This is why the very first check in the ECDSA verification algorithm is to ensure that r and s are both >= 1.
Guess which check Java forgot?
source: HN
Bouncy Castle crypto authentication bypass vulnerability revealed
https://www.bleepingcomputer.com/news/security/bouncy-castle-crypto-authentication-bypass-vulnerability-revealed/ [www.bleepingcomputer.com]
2020-12-20 01:19
tags:
auth
hash
java
security
That is, the Bcrypt.doCheckPassword() function responsible for performing a byte-by-byte password hash match has an erroneous logic in place.
“The code checks for an index of characters from 0 to 59 inclusive, rather than checking that characters at positions from 0 to 59 match,” reads the report published by Synopsys.
https://www.synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle/
It’s super easy to bypass Android’s hidden API restrictions
https://www.xda-developers.com/android-development-bypass-hidden-api-restrictions/ [www.xda-developers.com]
2019-11-10 02:35
tags:
android
auth
development
exploit
java
security
The API blacklist tracks who’s calling a function. If the source isn’t exempt, it crashes. In the first example, the source is the app. However, in the second example, the source is the system itself. Instead of using reflection to get what we want directly, we’re using it to tell the system to get what we want. Since the source of the call to the hidden function is the system, the blacklist doesn’t affect us anymore.
The call is coming from inside the system!
source: grugq
Jackson CVE-2019-12384: anatomy of a vulnerability class
https://blog.doyensec.com/2019/07/22/jackson-gadgets.html [blog.doyensec.com]
2019-07-28 01:56
tags:
exploit
java
library
programming
security
During one of our engagements, we analyzed an application which used the Jackson library for deserializing JSONs. In that context, we have identified a deserialization vulnerability where we could control the class to be deserialized. In this article, we want to show how an attacker may leverage this deserialization vulnerability to trigger attacks such as Server-Side Request Forgery (SSRF) and remote code execution.
source: green
How I discovered an easter egg in Android's security and didn't land a job at Google
https://habr.com/en/post/446790/ [habr.com]
2019-04-07 16:22
tags:
android
development
investigation
java
programming
valley
The same thing (except without the happy ending) happened to me. Hidden messages where there definitely couldn’t be any, reversing Java code and its native libraries, a secret VM, a Google interview — all of that is below.
In the end I got an app that emulated the entire DroidGuard process: makes a request to the anti-abuse service, downloads the .apk, unpacks it, parses the native library, extracts the required constants, picks out the mapping of VM commands and interprets the byte code. I compiled it all and sent it off to Google.
The answer didn’t take long. An email from a member of the DroidGuard team simply read: “Why are you even doing this?”
source: L
JVM Anatomy Quark #23: Compressed References
https://shipilev.net/jvm/anatomy-quarks/23-compressed-references/ [shipilev.net]
2019-03-06 05:59
tags:
garbage-collection
java
malloc
But does that mean the size of Java reference is the same as the machine pointer width? Not necessarily. Java objects are usually quite reference-heavy, and there is pressure for runtimes to employ the optimizations that make the references smaller. The most ubiquitous trick is to compress the references: make their representation smaller than the machine pointer width.
source: HN
Java's new Z Garbage Collector (ZGC) is very exciting
https://www.opsian.com/blog/javas-new-zgc-is-very-exciting/ [www.opsian.com]
2018-09-12 18:09
tags:
beta
garbage-collection
java
perf
programming
Java 11 has recently been feature frozen and contains some really great features, one in particular we’d like to highlight. The release contains a brand new Garbage Collector, ZGC, which is being developed by Oracle that promises very low pause times on multi-terabyte heaps. In this article we’ll cover the motivation for a new GC, a technical overview and some of the really exciting possibilities ZGC opens up.
source: L
The Java type system is broken
http://wouter.coekaerts.be/2018/java-type-system-broken [wouter.coekaerts.be]
2018-07-25 17:06
tags:
java
programming
type-system
The Java type system is full of loopholes. Some are deliberate, some are accidental. The difference is that some generate compiler warnings, and some do not. The kind of compiler warnings that most programmers ignore or suppress, without giving it much thought. In practice any sufficiently large Java program makes use of the deliberate loopholes in unsafe ways; because it’s the most practical thing to do. That includes the Java collections library. It’s unlikely you’ll run into the accidental loopholes of this post by accident.
Everything is broken. Everything is fine.
Don’t make it appear like you are reading your own recent writes
https://lemire.me/blog/2018/01/04/dont-make-it-appear-like-you-are-reading-your-own-recent-writes/ [lemire.me]
2018-01-05 03:51
tags:
c
cpu
java
perf
programming
On apparent false aliasing with vector instructions.
source: L
Apache Groovy Deserialization: A Cunning Exploit Chain to Bypass a Patch
https://www.zerodayinitiative.com/blog/2017/12/19/apache-groovy-deserialization-a-cunning-exploit-chain-to-bypass-a-patch [www.zerodayinitiative.com]
2017-12-22 03:02
tags:
bugfix
exploit
format
java
programming
security
In January 2017, the Zero Day Initiative (ZDI) published an advisory for Apache Groovy, ZDI-17-044/CVE-2016-6814. This vulnerability, reported to us in late 2016 by Sam Thomas of Pentest Limited, is a rather deft patch bypass for an earlier vulnerability that was also submitted via the ZDI program.
The technique the researcher used for this patch bypass highlights the treacherous nature of deserialization vulnerabilities.
source: grugq
Musings on Kotlin Ranges
http://blog.danlew.net/2017/06/05/musings-on-kotlin-ranges/ [blog.danlew.net]
2017-11-16 00:41
tags:
intro-programming
java
Here are a few interesting aspects of Kotlin ranges, some of which I’ve found to be less-than-intuitive.
source: danluu
Understanding How Graal Works - a Java JIT Compiler Written in Java
http://chrisseaton.com/rubytruffle/jokerconf17/ [chrisseaton.com]
2017-11-05 23:35
tags:
compiler
java
jit
programming
Pluggable jit for the JVM.
source: L
Open-sourcing RacerD: Fast static race detection at scale
https://code.facebook.com/posts/293371094514305/open-sourcing-racerd-fast-static-race-detection-at-scale/ [code.facebook.com]
2017-10-22 20:31
tags:
compsci
concurrency
development
java
programming
release
swtools
RacerD, our new open source race detector, searches for data races — unsynchronized memory accesses, where one is a write — in Java programs, and it does this without running the program it is analyzing. RacerD employs symbolic reasoning to cover many paths through an app, quickly.
source: L
The Folder of God
https://www.excelsiorjet.com/blog/support-stories/the-folder-of-god/ [www.excelsiorjet.com]
2017-10-12 03:30
tags:
bugfix
fs
java
programming
windows
The customer confirmed that they indeed had a God Mode folder on their desktop and that it was never a problem before, but there were no more Java application crashes after deleting it! Things were getting stranger and stranger.
source: L
Java SE 5 is the most significant release
https://www.nayuki.io/page/java-se-5-is-the-most-significant-release [www.nayuki.io]
2017-07-28 01:24
tags:
java
programming
Plus some features from newer releases.
Universal Android SSL Pinning bypass with Frida
https://techblog.mediaservice.net/2017/07/universal-android-ssl-pinning-bypass-with-frida/ [techblog.mediaservice.net]
2017-07-28 01:18
tags:
android
java
javascript
programming
security
swtools
Almost every attempt at bypassing SSL Pinning is based on manipulating the SSLContext. Can we manipulate the SSLContext with Frida? What we wanted was a generic/universal approach and we wanted to do it with a Frida JavaScript script.
source: grugq
SAW The Software Analysis Workbench
https://saw.galois.com/ [saw.galois.com]
2017-06-16 19:22
tags:
c
compiler
compsci
crypto
development
java
release
security
swtools
The Software Analysis Workbench (SAW) provides the ability to formally verify properties of code written in C, Java, and Cryptol. It leverages automated SAT and SMT solvers to make this process as automated as possible, and provides a scripting language, called SAWScript, to enable verification to scale up to more complex systems.