bugtraq - Re: Cracking String Encryption in Java Obfuscated Bytecode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 23 Nov 2006 13:26:11 -1000
From: Jim Manico <jim@...ico.net>
To: subere@...on.org
Cc: bugtraq@...urityfocus.com
Subject: Re: Cracking String Encryption in Java Obfuscated Bytecode

With respect, I disagree from a Java perspective.

1) If you are deploying Java on the server you are protected by so many
layers, code obfuscation is not critical
2) If you are deploying Java Applets for enterprise applications, you
are nuts. They are inherently insecure and Java applets have a long
history of critical problems.

- Jim

subere@...on.org wrote:
> Hi All,
>
> With the continuous move towards bytecode type of languages (with java and .NET being the prime examples), code obfuscation is a topic that we will be seeing more of in the future.
>
> Below is a link to a paper detailing how to crack String encryption in some of the more popular Java obfuscators.
>
> http://www.milw0rm.org/papers/117
>
> As the conclusions state, a lot more needs to be done on the subject. Naturally, your comments are more than welcome.
>
> Thank you,
>
> Subere
>
>
>