• Abstract and Figures
• Public Full-text

Tampering with Java Card Exceptions The Exception Proves the Rule Guillaume Barbu1,2, Philippe Hoogvorst1 and Guillaume Duc1 1Institut Mines-T´el´ecom / T´el´ecom ParisTech, CNRS LTCI, D´epartement COMELEC, 46 rue Barrault, 75634 Paris Cedex 13, France 2Oberthur Technologies, Innovation Group, Parc Scientifique Unitec 1 - Porte 2, 4 all´ee du Doyen George Brus, 33600 Pessac, France Keywords: Java Card, Java Exceptions, Software Attacks, Fault Attacks, Combined Attacks. Abstract: Many publications have studied the various issues concerning Java Cards security regarding software and/or hardware attacks. However, it is surprising to notice that the particular case of exception-related mechanisms has not been tackled yet in the literature. In this article, we fill this gap by proposing several attacks against Java Card platforms based on both exception handling and exception throwing. In addition, this study allows us to point out that a weakness known by the web-oriented Java community for more than a decade still passes the different steps of the state-of-the-art Java Card application deployment process (namely conversion and verification). This appears all the more important as the Java Card 3 Connected Edition specifications have started to bridge the gap between the two worlds that are Java Cards and Java web services. 1 INTRODUCTION that no pointer arithmetic is used in a Java Card ap- plication and that objects behave according to a given The Java Card technology is, as of today, the world’s contract defined by their Java class, superclasses and leading technology in the smart card field. This lead- interfaces. The JCRE enforces other security rules, ership comes from the outstanding cost reduction in ensuring, for instance, the isolation between the dif- terms of application deployment it allows. The fa- ferent applications running on the platform. The com- mous write once, run everywhere motto of the Java plete list of these requirement can be found in the technology is therefore a key factor for this success. specifications (Gosling et al., 2005; Lindholm and As part of the Java language, the notion of excep- Yellin, 1999; Sun Microsystems Inc., 2009b; Sun Mi- tion appears important. As per (Chen, 2000), ”an ex- crosystems Inc., 2009c). ception is an event that disrupts the normal flow of The Java Card 3 Connected Edition has brought instructions during the execution of a program”. In- the Java Card platform really close to standard ones, deed, exceptions are originally meant to handle errors introducing notions and facilities related to standard that might occur during the program execution. These Java applications and web services in particular. The errors may come from the Java Card Virtual Machine literature on the security of Java and web services is (JCVM) when internal errors occurs (a null pointer, or relatively vast and several studies, security breaches an access outof the boundsof anarrayfor instance)or and security guidelines have been published (Dean from the application itself. The latter case has lead to et al., 1996; Ladue, 1997; Princeton University, De- an evolution of the use of exceptions. Many applica- partment of Computer Science, Secure Internet Pro- tions actually use this mechanism as a programmatic gramming Group, ; Last Stage of Delirium Research trick to redirect the instruction flow to specific treat- Group, 2002; Cholakov and Milev, 2005; Hubert ments in various occasions. et al., 2010; Long et al., 2011; Oaks, 2001; The Another important factor, and especially in the Open Web Application Security Project (OWASP), smart card field, is the inherent security of the system. 2012a; The Open Web Application Security Project This security is mainly achieved by the Java Card (OWASP), 2012b; Mehta and Sollins, 1998; McGraw language and the Java Card Runtime Environment and Felten, 2000; Caromel and Vayssi`ere, 2001; Gut- (JCRE) security properties. The strongly-typed prop- terman and Malkhi, 2005; Livshits and Lam, 2005). erty of the Java Card language for instance ensures It appears then all the more interesting to reconsider Barbu G., Hoogvorst P. and Duc G.. 55 Tampering with Java Card Exceptions - The Exception Proves the Rule. DOI: 10.5220/0004018600550063 In Proceedings of the International Conference on Security and Cryptography (SECRYPT-2012), pages 55-63 ISBN: 978-989-8565-24-2 Copyright c 2012 SCITEPRESS (Science and Technology Publications, Lda.) SECRYPT2012-InternationalConferenceonSecurityandCryptography these studies in the Java Card context. In this article, dition has occurred. For instance, an exception may we focus our study on the security of the exception- be raised by a program when a given condition is sat- related mechanisms of the Java Card platform. This isfied or not, regardless of the potential consequences concern comes from the observation that attackers of- of this condition. The aim of such exception is only ten try to avoid an exception throwing, but rarely to to force a jump and execute specific lines of code that take advantage of it. are defined as the exception handler. This article is organized as follows. Section 2 in- troduces more precisely the notion of exception and Good Practices. Several references (Long et al., the related mechanisms. In Section 3, we present sev- 2011; Oaks, 2001; The Open Web Application Secu- eral new attacks against Java Card platforms taking rity Project (OWASP), 2012a; The Open Web Appli- advantage of the exception-related mechanisms. Sec- cation Security Project (OWASP), 2012b) detail the tion 4 analyses those attacks and outlines their conse- importance of properly handling any exception that quences. Finally Section 5 concludes this article. might occur during the execution of a program. Con- cerning the Java language, it is particularly important to segregate the different exception types (classes) in 2 EXCEPTIONS IN JAVA CARD different catch-blocks in order to handle each and ev- PLATFORMS ery exception type in an appropriate way. Further- more, it is also generally advised not to transmit too much information within the exception, as it could be This section aims at introducing the notion of excep- useful to an attacker1. tion, the evolution of its use in a program and the re- lated mechanisms on Java Card platforms, namely ex- ception throwing and exception handling. Although 2.2 The Syntax of Exception Handling we get relatively specific concerning certain proper- ties, we do not intend to give an exhaustive descrip- Java, as several programming languages, defines a tion of the ins and outs of exceptions. Readers wish- syntax associated to exception handling. For that pur- ing to learn more should definitely refer to (Chen, pose, the Java language allows the definition of try- 2000, §6), (Gosling et al., 2005, §11) and (Lindholm catch-blocks. and Yellin, 1999, §2.16). Listing 1: Exception syntax in Java and Java Card. 2.1 The Role of Exceptions t r y { // Code operating a sensitive As previously stated, exceptions are initially meant // process that will raise an to handle errors during the execution of a program. // exception if deemed unsuccessful . ... In the following, we show that if this original pur- } catch (ExceptionType1 et1) { pose is still in use today, exceptions have been totally // The operation has failed in a integrated in application’s programming and are now // specific way, handle it widely used for more than ”just” handling errors. // accordingly . ... } catch (ExceptionType2 et2) { Handling Abnormal Conditions. On one hand,we // The operation has failed in find the traditional usage of exceptions, that is to say // another specific way, handle it error handling. In this scope, an exception is created // accordingly . when an abnormal behaviour is detected, when the ... execution of a program is deemed unsuccessful, or } finally { // Code executed whether an when the system detects that pursuing the execution // exception has been thrown or not, will lead it to halt abruptly for instance. The excep- // caught or not. tion handler is then in charge of handling the abnor- ... mal conditions that have led to the exception raising, } and in the worst case to properly halt the system. As described in Listing 1, the programmer has to Handling Particular Conditions. On the other 1The typical example of such a situation is that of an at- hand, in certain modern programs, exceptions are tacker sending SQL requests to a database server and gain- used as a way to break the control flow of an appli- ing information on the structure of tables thanks to the mes- cation and not necessarily because an abnormal con- sage contained in the returned exceptions. 56 TamperingwithJavaCardExceptions-TheExceptionProvestheRule write the code that is likely to raise an exception in- Algorithm 1: Exception Handler Searching. side a try-block and the code that will be executed when a certain type of exception is raised in different input : E the exception being handled input : H the exception handler table catch-blocks. In addition, the finally-block allows to output:- define a code portion that will be executed whether an 1 while more handler left in H do exception was raised or not, caught or not. 2 handler ← next handler; 3 if jpc is covered by handler offsets then 2.3 The Exception Handler Table in 4 if handler match E’s type then Java Card Binaries 5 jump to handler; 6 end loop; 7 end In the binary format, either .CLASS files for standard 8 end Java binaries or .CAP files for Java Card binaries, ex- 9 end ception handlers are represented for each method into 10 forward exception to previous frame; a so-called handler table.Ina.CAP file, for instance, this table is represented in the method component as specified in (Sun Microsystems, 2006) and described below: 3 SOFTWARE, FAULT AND method_component { COMBINED ATTACKS: ON THE u1 tag SECURITY OF EXCEPTIONS u2 size u1 handler_count AND EXCEPTION HANDLING exception_handler_info exception_handlers[handler_count] Most of time, attackers only care about exceptions method_info methods[] because they wish to avoid the particular conditions } leading to an exception throwing.

Load more

  9

Copy Link