Hidden security features of the JVM - everything you didn’t know and more
summary
Java 17 deprecates the Security Manager but the JVM still defends via its simple stack‑based VM, bytecode verification, JIT diversification, classloader isolation and read‑only metadata. Real breakins come from serialized data and gadget chains via ObjectInputStream and JNDI/log4j style loaders; serialization is the biggest weakness. Practical mitigations are modules and jlink (smaller, verified runtimes), class filters/jar sealing, using records to avoid gadget code, and supply‑chain hygiene — Maven Central scans show ~33% of downloads include vulnerable versions.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker background
- 3:36Cybercrime and open source threats
- 7:47JVM design and security fundamentals
- 15:37JVM defenses and abstractions
- 22:00Class loaders and remote code risks
- 25:39Serialization vulnerabilities explained
- 30:12Security features in Java 17 and modules
- 33:40GraalVM and native compilation trade-offs
- 35:04Maven Central security measures
- 37:32Dependency management and fixes
- 41:04Q&A and resources
related talks
48mHidden Security Features of the JVM - Everything You Didn’t Know and More
43mDon't hack the JVM? ☠️💣💥
51mJava - Integrity by Default
36mSecurity in the Java World
48mThe Hidden Security Hazards in Your Java Stack
46mStrengthening Java Apps: Best Practices in Secure Coding for Java Developers
49mWargames - Java vulnerabilities and why you should care
44mJava Code Security