Attacks on Java Card 3.0 Combining Fault and Logical Attacks
Attacks on Java Card 3.0 Combining Fault and Logical Attacks
复制标题
Java Card 3.0故障与逻辑结合攻击
DOI：
10.1007/978-3-642-12510-2_11
复制
发表时间：
2010
期刊：
影响因子：
--
通讯作者：
Vincent Guerin
中科院分区：
文献类型：
--
作者：
G. Barbu;Hugues Thiebeauld;Vincent Guerin
迄今为止，Java 卡一直受到使用格式错误的应用程序进行攻击的威胁，这些应用程序假定应用程序字节码未经验证。只要字节码验证器通常在卡外执行并因此可以被绕过，这种假设仍然是现实的。然而，它不再适用于必须在卡上执行字节码验证的 Java Card 3 Connected Edition 上下文。因此，Java Card 3 Connected Edition 似乎可以免受此类攻击。在本文中，我们证明运行格式错误的应用程序并不一定意味着加载和安装格式错误的应用程序。为此，我们引入了一种结合了故障注入和逻辑篡改的全新攻击方式。通过这些方式，我们描述了在新的 Java Card 3 环境中进行的两个案例研究。第一个展示了尽管有卡上字节码验证器，但仍然可以引入和执行格式不正确的应用程序。第二个示例导致将卡上已安装的任何方法修改为任何恶意字节码。最后，我们成功地在最近的设备上发起了这些攻击，强调了在实现 Java Card 3 功能时考虑这些新威胁的必要性。
Java Cards have been threatened so far by attacks using ill-formed applications which assume that the application bytecode is not verified. This assumption remained realistic as long as the bytecode verifier was commonly executed off-card and could thus be bypassed. Nevertheless it can no longer be applied to the Java Card 3 Connected Edition context where the bytecode verification is necessarily performed on-card. Therefore Java Card 3 Connected Edition seems to be immune against this kind of attacks. In this paper, we demonstrate that running ill-formed application does not necessarily mean loading and installing ill-formed application. For that purpose, we introduce a brand new kind of attack which combines fault injection and logical tampering. By these means, we describe two case studies taking place in the new Java Card 3 context. The first one shows how ill-formed applications can still be introduced and executed despite the on-card bytecode verifier. The second example leads to the modification of any method already installed on the card into any malicious bytecode. Finally we successfully mount these attacks on a recent device, emphasizing the necessity of taking into account these new threats when implementing Java Card 3 features.
DOI：
--
发表时间：
2010
期刊：
--
影响因子：
--
作者：
D. Gollmann;Jean-Louis Lanet;Julien Iguchi-Cartigny
通讯作者：
D. Gollmann;Jean-Louis Lanet;Julien Iguchi-Cartigny