Difference between revisions of "Mobile code: invoking untrusted mobile code"

From OWASP
Jump to: navigation, search
(Description)
 
(7 intermediate revisions by one user not shown)
Line 3: Line 3:
 
<br>
 
<br>
 
[[Category:OWASP ASDR Project]]
 
[[Category:OWASP ASDR Project]]
[[ASDR Table of Contents]]__TOC__
+
 
 +
 
 +
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
  
  
 
==Description==
 
==Description==
This attack consists on manipulation of a mobile code in order to execute malicious operations at the client side. By intercepting client traffic using the [[Man-in-the-middle_attack|man-in-the-middle]]  technique, a malicious user could modify the original mobile code with arbitrary operations that will be executed on the client’s machine under his credentials.  
+
This attack consists of a manipulation of a mobile code in order to execute malicious operations at the client side. By intercepting client traffic using the [[Man-in-the-middle_attack|man-in-the-middle]]  technique, a malicious user could modify the original mobile code with arbitrary operations that will be executed on the client’s machine under his credentials.  
 
In another scenario, the malicious mobile code could be hosted in an untrustworthy web site or it could be permanently injected on a vulnerable web site through an injection attack.
 
In another scenario, the malicious mobile code could be hosted in an untrustworthy web site or it could be permanently injected on a vulnerable web site through an injection attack.
 
This attack can be performed over Java or C++ applications and affects any operating system.
 
This attack can be performed over Java or C++ applications and affects any operating system.
Line 13: Line 15:
 
==Risk Factors==
 
==Risk Factors==
 
TBD
 
TBD
[[Category:FIXME|need content here]]
 
  
 
==Examples ==
 
==Examples ==
<br>
 
 
The following code demonstrates how this attack could be performed using a Java applet.  
 
The following code demonstrates how this attack could be performed using a Java applet.  
  
Line 29: Line 29:
 
  Class loadedClass = Class.forName("loadMe", true, classLoader);<br><br>
 
  Class loadedClass = Class.forName("loadMe", true, classLoader);<br><br>
 
</pre>
 
</pre>
 +
 +
To solve this issue, it’s necessary to use some type of integrity mechanism to assure that the mobile code has not been modified.
 +
  
 
==Related [[Threat Agents]]==
 
==Related [[Threat Agents]]==
TBD
+
* TBD
[[Category:FIXME|need links]]
+
  
 
==Related [[Attacks]]==
 
==Related [[Attacks]]==
*[[Mobile code: non-final public field]]
+
* [[Mobile code: non-final public field]]
*[[Mobile code: object hijack]]
+
* [[Mobile code: object hijack]]
  
 
==Related [[Vulnerabilities]]==
 
==Related [[Vulnerabilities]]==
[[:Category: Unsafe Mobile Code]]
+
* [[:Category: Unsafe Mobile Code]]
  
 
==Related [[Controls]]==
 
==Related [[Controls]]==
To solve this issue, it’s necessary to use some type of integrity mechanism to assure that the mobile code has not been modified.
+
* [[Hashing]]
 +
* [[Bounds Checking]]
 +
* [[Safe Libraries]]
 +
* [[Static Code Analysis]]
 +
* [[Executable space protection]]
 +
* [[Address space layout randomization (ASLR)]]
 +
* [[Stack-smashing Protection (SSP)]]
  
 
==References==
 
==References==
*https://buildsecurityin.us-cert.gov/daisy/bsi/100/version/1/part/4/data/CLASP_ApplicationSecurityProcess.pdf?branch=main&language=default   
+
* https://buildsecurityin.us-cert.gov/daisy/bsi/100/version/1/part/4/data/CLASP_ApplicationSecurityProcess.pdf?branch=main&language=default   
*http://cwe.mitre.org/data/definitions/494.html
+
* http://cwe.mitre.org/data/definitions/494.html
  
 
[[Category: Abuse of Functionality]]
 
[[Category: Abuse of Functionality]]
 
[[Category:Attack]]
 
[[Category:Attack]]

Latest revision as of 06:44, 23 April 2009

This is an Attack. To view all attacks, please see the Attack Category page.




Last revision (mm/dd/yy): 04/23/2009


Description

This attack consists of a manipulation of a mobile code in order to execute malicious operations at the client side. By intercepting client traffic using the man-in-the-middle technique, a malicious user could modify the original mobile code with arbitrary operations that will be executed on the client’s machine under his credentials. In another scenario, the malicious mobile code could be hosted in an untrustworthy web site or it could be permanently injected on a vulnerable web site through an injection attack. This attack can be performed over Java or C++ applications and affects any operating system.

Risk Factors

TBD

Examples

The following code demonstrates how this attack could be performed using a Java applet.

 // here declarer a object URL with the path of the malicious class
 URL[] urlPath= new URL[]{new URL("file:subdir/")};

 // here generate a object “loader” which is responsible to load a class in the URL path
 URLClassLoader  classLoader = new URLClassLoader(urlPath); 

 //here declare a object of a malicious class contained in “classLoader”
 Class loadedClass = Class.forName("loadMe", true, classLoader);<br><br>

To solve this issue, it’s necessary to use some type of integrity mechanism to assure that the mobile code has not been modified.


Related Threat Agents

  • TBD

Related Attacks

Related Vulnerabilities

Related Controls

References