Java Card Virtual Machine Compromising from a Bytecode Verified Applet

Julien Lancia (1) , Guillaume Bouffard (2)

1 THALES COMMUNICATIONS & SECURITY
2 Agence nationale de la sécurité des systèmes d'information (ANSSI)

The Byte Code Verifier (BCV) is one of the most important security element in the Java Card environment. Indeed, embedded applets must be verified prior installation to prevent ill-formed applet loading. In this article, we disclose a flaw in the Oracle BCV which affects the applet linking process and can be exploited on real world Java Card smartcards. We describe our exploitation of this flaw on a Java Card implementation that enables injecting and executing arbitrary native malicious code in the communication buffer from a verified applet. This native execution allows snapshotting the smart card memory with OS rights.

Mots clés: Java Card; Software Attack; BCV vulnerabilities

Domaines: Cryptographie et sécurité [cs.CR]

Julien Lancia, Guillaume Bouffard. Java Card Virtual Machine Compromising from a Bytecode Verified Applet. Smart Card Research and Advanced Applications - 14th International Conference, CARDIS 2015, Nov 2015, Bochum, Germany. pp.75-88, ⟨10.1007/978-3-319-31271-2_5⟩. ⟨hal-03138832⟩