Part
1. Introduction to Java and Security 1
1.2.2 Java as an Aid to Security 8
1.2.3 Java as a Threat to Security 9
1.2.4 Java as Something to Be Secured 10
1.2.6 Staying One Jump Ahead 11
1.2.7 The Vigilant Web Site 12
2.2.1 The Development Environment 16
2.2.2 The Execution Process 22
2.2.3 Interfaces and Architectures 27
2.2.4 Cryptography to the Rescue! 31
2.3 Attacking the World of Java 35
2.3.1 Perils in the Life of an Applet 35
2.3.2 Vulnerabilities in Java Applications 42
Part
2. Under The Hood 45
3.1.2 The Class File Verifier 49
3.1.5 The Native Method Loader 50
3.1.6 The Native Method Area 51
3.1.10 The Just In Time (JIT) Compiler 52
4.3 The Java Class File Format 59
4.3.1 Decompilation Attacks 60
4.4.1 Beating the Decompilation Threat 67
5.2.1 How Class Loaders Are Implemented 81
5.2.2 The Class Loading Process 83
5.2.3 Why You Might Want to Build Your Own Class Loader 85
5.3 The Class File Verifier 86
5.3.1 The Duties of the Class File Verifier 88
5.3.2 The Four Passes of the Class File Verifier 89
7.2.1 Class Loader/Security Manager Interdependence 101
8.2 Introducing JCA: the Provider Concept 113
8.2.1 JCE and Export Considerations 114
8.3 The Security Classes in Practice 115
8.3.2 What Do We Learn from This? 117
8.3.3 IBM Packages for Cryptographic Protocols 118
9.2 JavaSoft Signed JAR Example 122
9.2.1 Creating the Certificate Authority Key Database 122
9.2.2 Creating the Server Key Database 123
9.2.3 Creating and Signing a JAR File 126
9.3 Coming Next from JavaSoft: JDK 1.2 129
9.4 Netscape Signed JAR Example 130
9.4.1 Using the netscape.security Package 131
9.4.2 Installing Keys and Certificates in Netscape 134
9.4.3 Signing JAR Files with Netscape JAR Packager 136
9.5 Microsoft and Signed Applets 140
9.5.1 Two Signed CAB Examples 142
Part
3. Beyond the Island of Java: Surfing into the Unknown 149
10.2.1 Two-Tier Architecture 152
10.2.2 Three-Tier Architecture 153
10.3 Secure Clients and Network Computers 159
10.4.1 The Cost of Server-Side Java 161
10.5 Distributed Object Architectures - RMI 164
10.5.1 The Security of RMI 166
11.2.1 Inside a TCP/IP Packet 170
11.2.2 How Can Programs Communicate through a Firewall? 173
11.3 Detailed Example of TCP/IP Protocol 174
11.3.1 DNS Flow (UDP Example) 175
11.3.2 HTTP Flow (TCP Example) 176
11.4 Proxy Servers and SOCKS 181
11.4.3 Using Proxy Servers or SOCKS Gateways 185
11.5 The Effect of Firewalls on Java 186
11.5.1 Downloading an Applet Using HTTP 186
11.5.2 Stopping Java Downloads with a Firewall 186
11.5.3 Java Network Connections through the Firewall 189
11.5.4 RMI Remote Method Invocation 191
12.2.1 Using SSL URLs with Java 197
A.1.5 Reliable Software Technologies 214
A.2.3 Georgia Institute of Technology 215
Appendix B. Signature Formats 217
Appendix C. The Bytecode Verifier in Detail 219