0 Replies Latest reply on Jan 3, 2009 6:05 PM by 843810

    JVMTI and instrumented unsigned code opens security hole?

    843810
      I wonder if someone has tested this before ... I use a framework like e.g. bouncycastle (or anything other security relevant) which is signed and no one should ever manipulate the contained *.class files (hence this is signed?). So it is possible (I think) to write an agent which hooks the classload event and injects some "evil" bytecode in lets say ... a encryption implementation (which could break security mechanisms).

      On *.class level (in the jar file) the security is given, manipulations can be detected by verifying signed jars. But what about raw bytecode injection at runtime? Does the VM distinguish between signed and unsigned bytecode? Or does the user probably not even know that the "private data" he enteres at a java program is not encrypted by the "original" bouncycaste *.class?

      Thank you for ideas ;-)

      (assume that placing an "-agent" commandline and *.dll is not impossible on desktop applications)