Mobile code: invoking untrusted mobile code

Description
This attack consists on manipulation of a mobile code in order to execute malicious operations at the client side. By intercepting client traffic using the man-in-the-middle technique, a malicious user could modify the original mobile code with arbitrary operations that will be executed on client’s machine under his credentials. In other scenario, the malicious mobile code could be hosted in an untrustworthy web site or it could be permanently injected on a vulnerable web site thru an injection attack. This attack can be performed over Java or C++ applications and affects any operational system.

Risk Factors
TBD

Examples
The following code demonstrates how this attack could be performed using a Java applet.

// here declarer a object URL with the path of the malicious class URL[] urlPath= new URL[]{new URL("file:subdir/")};

// here generate a object “loader” which is responsible to load a class in the URL path URLClassLoader classLoader = new URLClassLoader(urlPath);

//here declare a object of a malicious class contained in “classLoader” Class loadedClass = Class.forName("loadMe", true, classLoader);

Related Threat Agents
Category: Logical Attacks

Related Attacks

 * Mobile code: non-final public field
 * Mobile code: object hijack

Related Vulnerabilities
Category: Unsafe Mobile Code

Related Controls
To solve this issue, it’s necessary to use some type of integrity mechanism to assure that the mobile code has not been modified.

External References

 * https://buildsecurityin.us-cert.gov/daisy/bsi/100/version/1/part/4/data/CLASP_ApplicationSecurityProcess.pdf?branch=main&language=default
 * http://cwe.mitre.org/data/definitions/494.html