1 / 35

Securing Java applets

Securing Java applets. Erik Poll Security of Systems (SOS) group University of Nijmegen www.cs.kun.nl/~erikpoll. Overview. Security problems of Java Card applets or any other piece of software, for that matter Work in the EU-IST project VerifiCard

wilma-chaney
Download Presentation

Securing Java applets

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Securing Java applets Erik Poll Security of Systems (SOS) group University of Nijmegen www.cs.kun.nl/~erikpoll

  2. Overview • Security problems of Java Card appletsor any other piece of software, for that matter • Work in the EU-IST project VerifiCard • Work on formal techniques for applet verification in Nijmegen Securing Java applets

  3. Java applet Java application (piece of software) that is deployed independently on some platform, with some operating system (OS), eg • Java Card smart card applet • mobile phone (eg midlet on MIDP phone) • PDA • web browser • PC • airplane Securing Java applets

  4. one program (applet) written in machine-code, specific to chip and OS burnt into ROM Applet written in high-level language (Java Card) compiled into bytecode stored in EEPROM interpreted on card Options: multi-application: several applets on one card post-issuance: adding or deleting applets on card Old vs new smart cards Securing Java applets

  5. Java Card architecture applet applet applet Java Cardplatform (JCRE) - miniature OS JC Virtual Machine JC API Global Platform smartcard hardware Securing Java applets

  6. Production of a Java Card applet bytecode verifier cap generator compiler source code byte code cap file • Options: • only pre-loaded applets • only digitally signed applets (using Global Platform) download Remaining issue: how do we certify these pre-loaded or signed applets? Securing Java applets

  7. Security questions • Is my applet correct and secure? “correct” is necessary precondition for “secure” • Is the platform correct and secure ? • Is someone else’s applet is not malicious ie. will it not • annoy users, • interfere with other applets, or • damage the platform ? Securing Java applets

  8. Java applet security • language level security • basic guarantees (no buffer overflows) • platform level security • imposes additional restrictions to protect platform & other applets (firewall/sandbox) • application level security • applet responsible for own specific correctness & security needs Securing Java applets

  9. Buffer overflows Example • Application asks for 4-digit PIN code • User supplies a 5-digit PIN code 12345 • What happens in the memory ? 0 0 1 0 2 0 3 4 0 e 5 r i k Securing Java applets

  10. Buffer overflows • Single biggest cause of bugs & security holes • 30-70% of all security alerts www.cert.org/advisories • 36% of all bugs at Microsoft • Possible - and frequent - in C, C++although there are good tools to detect them... • Impossible in modern languages: Java, C# • Conclusion: don’t use C(++), use Java or C# Securing Java applets

  11. Java applet security • language level security • basic guarantees (no buffer overflows) • platform level security • imposes additional restrictions to protect platform & other applets (firewall/sandbox) • application level security • applet responsible for own specific correctness & security needs Securing Java applets

  12. Security questions • Is my applet correct and secure? “correct” is necessary precondition for “secure” • Is the platform correct and secure ? • Is someone else’s applet is not malicious ie. will it not • annoy users, • interfere with other applets, or • damage the platform ? Security evaluations must answer these questions Securing Java applets

  13. NB Even perfectly secure applet running on perfectly secure platform may suffer from malicious applets • For example • a malicious applet on mobile phone could simply ask user to type in the PIN code • Protection against such Trojan Horses will require human source code inspection of untrusted, potentially hostile, applets ? Securing Java applets

  14. How do we certify software ? • testing but testing that applet does what it should do is easier than testing that applet does not do what it should not do • coding standards, design standards • code reviews • formal methods... Securing Java applets

  15. VerifiCard Securing Java applets

  16. VerifiCard • EU-funded project for developing and applying formal methods for the specification and verification of the Java Card • platform and • applets • Partners: universities, research institutes, smart card manufacturers • www.verificard.org Securing Java applets

  17. Why formal methods ? (I) required by highest levels of certification in Common Criteria and there are increasing demands for higher levels of CC security evaluation Securing Java applets

  18. Why formal methods ? (II) Central problem in ensuring that software is correct or secure: • We have long documents in English giving functional specs, security requirements, ... • How to ensure that • these specs are consistent & complete ? • our implementations actually meet them ? • If we can express parts of these documents in formal languages, we have more options... Securing Java applets

  19. Work on platform level • At INRIA & TUM • Formalisation of Java Card Virtual Machine • Development of a provably correct byte code verifier • This relies on the use of mechanical theorem provers Securing Java applets

  20. Work on applet level • At INRIA, SICS, Kaiserslautern, Nijmegen • Formal specification and verification of Java Card applets, in particular using JML Securing Java applets

  21. Java Card applet specification and verification using JML Securing Java applets

  22. JML (Gary Leavens et al) • Formal specification language for Java • JML specs added as annotations is Java source code files • Easy to learn • small extension of Java syntax • Supported by a range of tools Securing Java applets

  23. JML Example Java compiler ignores this line but JML tools will parse it //@ requires amount >= 0; public void debit(int amount) { .... } this precondition makes an assumption explicit 19% of bugs are due to lack of input validation Securing Java applets

  24. JML Example //@ requires amount >= 0; ensures balance == \old(balance) – amount; signals (PurseException) balanace == \old(balance); @*/ public void debit(int amount) { .... } this precondition makes an assumption explicit 19% of bugs are due to lack of input validation Securing Java applets

  25. JML Example private int balance; final static int MAX_BALANCE; /*@invariant 0 <= balance && balance < MAX_BALANCE; @*/ Securing Java applets

  26. JML Example private byte[] pin; /*@ invariant pin != null && pin.length == 4 && (\forall int i; 0 <= i && i < 4 ; 0 <= pin[i] && pin[i] <= 9); @*/ Securing Java applets

  27. JML Example private byte appletState; /*@ constraint \old(appletState) == BLOCKED ==> appletState == BLOCKED; constraint \old(appletState) != PERSONALISED ==> appletState != PERSONALISED; @*/ Securing Java applets

  28. Using JML • Many “soundness/safety” properties of Java (Card) program can be easily specified in JML • Such properties help in understanding code • For such properties we can use tools to check that implementations satisfy them • There are different tools, offering different levels of assurance at different costs... Securing Java applets

  29. Tools for JML • parser & type-checker • no typos in specs • runtime assertion checker(Iowa State, Gary Leavens) • tests if any specs are violated at runtime • static checker ESC/Java(Compaq, Rustan Leino et al.) • automatic verification of simple properties • interactive program verifier LOOP(Nijmegen) • interactive verification of any property Securing Java applets

  30. Testing & verification • Testing considers a limited set of inputs • Verification covers all possible inputs • Testing is easier with a formal (JML) spec that we can test against Securing Java applets

  31. Applet verification: achievements • Verification of real industrial smart card applet (EMV applet) • Verification revealed uncaught exceptions that were not detected during normal testing • Gemplus has developed JACK tool supporting JML, integrated in IDE their developers use Securing Java applets

  32. Conclusions about applet verification • Formal specification languages and tools can help when doing a code review • Interactive program verification probably still too costly, but automated program verification seems to provide good return-on-investment • How far can we push level of automation ? • Will Moore’s law rescue us here ? Securing Java applets

  33. Conclusions Securing Java applets

  34. Old vs new generation smart cards Some points to note: • some security concerns are the same, eg • is the smart card OS correct and secure ? • is our application correct and secure ? • possible advantages of Java Card: • Java Card OS better studied than others • our knowledge of and tools for Java may allow better & cheaper security evaluations Securing Java applets

  35. Conclusions • Java Card interesting opportunity to apply state-of-the-art formal methods developed in academia for Java. • Increasing need about (security) certification of software.Central challenge:How can we express security requirements in a (semi)-formal way ? Securing Java applets

More Related