Skip to Main content Skip to Navigation
Reports

Exploiting Java Code Interactions

François Goichon 1 Guillaume Salagnac 1 Stéphane Frénot 1
1 AMAZONES - Ambient Middleware Architectures: Service-Oriented, Networked, Efficient and Secured
Inria Grenoble - Rhône-Alpes, CITI - CITI Centre of Innovation in Telecommunications and Integration of services
Abstract : Many Java technologies allow the execution of code provided by multiple parties. Service-oriented platforms based on components such as OSGi are good examples of such a scenario. Those extensible component-based platforms are service-oriented, as components may directly interact with each other via the services they provide. However, even robust languages such as Java were not designed to handle safely code interaction between trusted and untrusted parties. In this technical report, we review how basic Java interactions can break encapsulation or execution safety. The Java security layers contribution is questionable in such environments as they induce tangible overheads without covering all threats. We also review flaws in the Java access control design that can allow untrusted code to bypass restrictions by exploiting vulnerabilities in trusted code. Our audit on real-life trusted bundles from OSGi implementations shows that real-life components do not seem prepared yet to malicious interactions.
Document type :
Reports
Complete list of metadata

Cited literature [15 references]  Display  Hide  Download

https://hal.inria.fr/hal-00652110
Contributor : François Goichon <>
Submitted on : Thursday, December 15, 2011 - 4:50:21 PM
Last modification on : Wednesday, July 8, 2020 - 12:42:43 PM
Long-term archiving on: : Friday, November 16, 2012 - 3:36:14 PM

File

RT-0419.pdf
Files produced by the author(s)

Identifiers

  • HAL Id : hal-00652110, version 1

Collections

Citation

François Goichon, Guillaume Salagnac, Stéphane Frénot. Exploiting Java Code Interactions. [Technical Report] RT-0419, INRIA. 2011. ⟨hal-00652110⟩

Share

Metrics

Record views

565

Files downloads

1868