This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Java applet code review"

From OWASP
Jump to: navigation, search
Line 23: Line 23:
  
 
#[[Mutual authentication over SSL]]
 
#[[Mutual authentication over SSL]]
−
#[[Access control]]
+
#[[Access control - Not possible on client?]]
−
#[[Not possible on client?]]
 
 
#[[Input validation]]
 
#[[Input validation]]
 
#[[Interpreter use]]
 
#[[Interpreter use]]

Revision as of 21:12, 21 January 2007

Attackers Reverse Engineer Client

  1. All clients can be reverse engineered, monitored, and modified
  2. All encryption keys and mechanisms are not secrets
  3. All intellectual property (algorithms, data) is disclosed

Attackers Create Malicious Client, Server, or Proxy

  1. Tamper with requests and responses
  2. Spoof a legitimate client or server application

Attackers Target Rich Client Application Itself

  1. Clients can be abused - especially if they are "listening"
  2. All forms of input corruption (injection, overflow, etc.) can be used
  3. Spoofed server can be set up

Attackers Target Server Application Vulnerabilities

  1. All typical server application issues are possible

Client Security Considerations

  1. Mutual authentication over SSL
  2. Access control - Not possible on client?
  3. Input validation
  4. Interpreter use
  5. Error handling and logging
  6. Intrusion detection
  7. Encryption
  8. For protecting information - Not possible on client?
  9. For secure communications
  10. For secure storage
  11. Jar Signing
Retrieved from "https://wiki.owasp.org/index.php?title=Java_applet_code_review&oldid=15626"