Hidden Security Features of the JVM - Everything You Didn’t Know and More
summary
JVM design relies on a tiny stack-machine model, verifier, dynamic JIT and moving GC which together make memory targeting hard; modularity, jlink and sealed classes reduce visible classes; the real recurring hole is Java serialization via ObjectInputStream enabling gadget chains and remote class loading (the Log4Shell/JNDI/ReferenceObject vector). Maven Central enforces domain ownership and scans artifacts and has found only one malware incident; telemetry shows 35% vulnerable downloads of log4j recently, so supply-chain hygiene and choosing safer dependencies matter.
AI-written summary · about
chapters (9)
- 0:00Introduction to JVM security
- 2:55Why security matters now
- 7:08JVM attack vectors overview
- 12:48JVM design and security
- 27:23Log4Shell vulnerability
- 28:28Serialization security risks
- 37:42Maven Central protections
- 41:17Developer responsibility in security
- 44:34Key takeaways and conclusion
related talks
42mHidden security features of the JVM - everything you didn’t know and more
44mSecuring the JVM
48mThe Hidden Security Hazards in Your Java Stack
43mDon't hack the JVM? ☠️💣💥
49mWargames - Java vulnerabilities and why you should care
51mJava - Integrity by Default
46mPopular Approaches to Preventing Code Injection Attacks are Dangerously Wrong
45mFive Java Features You Didnt Know About