1. David Evans http://www.cs.virginia.edu/~evans
Lecture 18:
Java™ Decaffeinated
CS551: Security and Privacy
University of Virginia
Computer Science
David Evans

2. University of Virginia CS 551
Menu
SSL Challenge Question
Java
Voting
15 November 2018
University of Virginia CS 551

3. SSL Challenge Question
Are there skeletons in VeriSign’s closet?
15 November 2018
University of Virginia CS 551

4. Secure Socket Layer (SSL)
141 Sextillion years;
Not going any where for awhile;
grab a snickers

5. SSL Background Two Kinds of SSL
Low Encryption (40-bit; 1.1x1012 possible keys)
High Encryption (128-bit; 3.8x1038 possible keys)
SSL is a transport level technology for authentication and data encryption between a web server and a Web server (example).
Applied at the socket interface from the application to the network software.
Data Link
Header
Internet
Header
Transport
Header
Application
Header
Data being sent
Plaintext
Cipher Text

6. SSL Handshake Client Server SSL Data Exchange Tell me who you are;
Here are the protocols I support.
Here is my Digital ID to prove who I am;
Here is the protocols I have decided we should use.
For your ID, I know who you are and have your public key;
Here is a secret key I created with your protocols encrypted with your key
Here is a copy of everything we’ve said encrypted with our secret key.
Here is a copy of everything we’ve said encrypted with our secret key.
SSL Data Exchange

7. Time to Break Specific Keys
Years
Key length (bits)
1995
2000
2005 40
68 hours
8.6 minutes
1.07 minutes 56
7.4 weeks
6.5 days
19 hours 64
36.7 years
4.6 years
6.9 months
128
6.7x1017 millennia
8.4x1016 millennia
1.1x1016 millennia
[Erkomaa, 1998]

8. University of Virginia CS 551
Brute Force Attacks
15 November 2018
University of Virginia CS 551

9. VeriSign’s Claim

10. Moore’s Law
18 months

12. General Timeline CS-551 Class (1.25 hours)
Not to scale
CS-551 Class
(1.25 hours)
Actual 128- bit Time to Crack
Two Universe Lifetimes
Total Human Lifetime
VeriSign’s Claim
Universe Lifetime
1010
1019
1020
1023
Quintillion years
Sextillion years

13. VeriSign’s Assumptions
Hackers or key breakers have computers that are extremely slow.
We are using the processing speed of computers that were built in the 1980’s era.
Distributed networks and special hardware are not authorized for key breaking schemes.
We are not increasing our processing power every months (based on Moore’s Law).
15 November 2018
University of Virginia CS 551

14. Java Security Real or Decaf?
15 November 2018
University of Virginia CS 551

15. University of Virginia CS 551
Java
Island in Indonesia
A Programming Language (Java)
A Portable Low-Level Language (JVML)
A Platform (JavaVM)
A successful marketing strategy
JavaScript is not related to Java or Java
So you can have more time to work on your projects
All of the above
15 November 2018
University of Virginia CS 551

16. Java : Programming Language
“A simple, object-oriented, distributed, interpreted, robust, secure, architecture neutral, portable, high-performance, multithreaded, and dynamic language.”
[Sun95]
15 November 2018
University of Virginia CS 551

17. What is a secure language?
Language is designed so it cannot express certain computations considered insecure.
Language is designed so that (accidental) program bugs are likely to be caught by the compiler or run-time environment instead of leading to security vulnerabilities.
A few attempts to do this: PLAN, packet filters
15 November 2018
University of Virginia CS 551

18. Safe Programming Languages
Type Safety
Compiler and run-time environment ensure that bits are treated as the type they represent
Memory Safety
Compiler and run-time environment ensure that program cannot access memory outside defined storage
Control Flow Safety
Can’t jump to arbitrary addresses
Which of these does C++ have?
Not a new idea: LISP had these in 1960!
15 November 2018
University of Virginia CS 551

19. University of Virginia CS 551
Java Safety
Type Safety
Most types checked statically
Coercions, array assignments type checked at run time
Memory Safety
No direct memory access (e.g., pointers)
Primitive array type with mandatory run-time bounds checking
Control Flow Safety
Structured control flow, no arbitrary jumps
15 November 2018
University of Virginia CS 551

20. University of Virginia CS 551
Malicious Code
Can a safe programming language protect you from malcode?
Code your servers in it to protect from buffer overflow bugs
Only allow programs from untrustworthy origins to run if the are programmed in the safe language
15 November 2018
University of Virginia CS 551

21. University of Virginia CS 551
Safe Languages?
But how can you tell program was written in the safe language?
Get the source code and compile it (most vendors, and all malicious attackers refuse to provide source code)
Special compilation service signs object files generated from the safe language (SPIN, [Bershad96])
Verify object files preserve safety properties of source language (Java)
15 November 2018
University of Virginia CS 551

22. University of Virginia CS 551
JVML
malcode.java
Java
Source
Code
javac
Compiler
malcode.class
JVML
Object
Code
JavaVM
Joe User
Joe wants to know JVML code satisfies Java’s safety properties.
15 November 2018
University of Virginia CS 551

23. Does JVML satisfy Java’s safety properties?
iconst_2 push integer constant 2 on stack
istore_0 store top of stack in variable 0 as int
aload_ load object reference from variable 0
arraylength replace array on top of stack with its length
No! This code violates Java’s type rules.
15 November 2018
University of Virginia CS 551

24. Bytecode Verifier malcode.class JVML Object Code
Trusted Computing Base
Java Bytecode Verifier
Invalid
“Okay”
Joe User
STOP
JavaVM
15 November 2018
University of Virginia CS 551

25. University of Virginia CS 551
Bytecode Verifier
Checks JVML code satisfies Java’s safety properties
Type safe – stack and variable slots must store and load as same type
Memory safe (guaranteed by instruction set)
Control flow safe: jumps must be within function, or call/return
15 November 2018
University of Virginia CS 551

26. Are Java Bytecode Verifiers Complicated?
~700 rules to enforce, JVML specification is (not all clearly specified)
Emin Gün Sirer found > 100 bugs in commercial bytecode verifiers (using automatic test generation)
At least 15 of them were security vulnerabilities
JVML includes jsr instruction (jump to subroutine), can be called with different types in variables and on stack
15 November 2018
University of Virginia CS 551

27. Java javac malcode.class malcode.java Compiler JVML
Trusted Computing Base
Java Bytecode Verifier
Invalid
Joe User
“Okay”
STOP
JavaVM
15 November 2018
University of Virginia CS 551

28. University of Virginia CS 551
JavaVM
Virtual machine – interpreter for JVML programs
Has complete access to host machine
Bytecode verifier ensures some safety properties, JavaVM must ensure rest:
Type safety of run-time casts, array assignments
Memory safety: array bounds checking
Resource use policy
15 November 2018
University of Virginia CS 551

29. JavaVM Policy Enforcment
[JDK 1.0 – JDK 1.1]
From java.io.File:
public boolean delete() {
SecurityManager security =
System.getSecurityManager();
if (security != null) {
security.checkDelete(path); }
if (isDirectory()) return rmdir0();
else return delete0();
15 November 2018
University of Virginia CS 551

30. java.lang.SecurityManager
/**
Throws a SecurityException if the calling thread is not allowed to delete the specified file.
This method is invoked for the current security manager by the delete method of class File.
*/ (Some other comments deleted.)
public void checkDelete(String file) {
throw new SecurityException(); }
15 November 2018
University of Virginia CS 551

31. University of Virginia CS 551
Security Manager
Reference monitor
How well does it satisfy the requirements?
Complete mediation
Can stop execution/prevent action
Limited effect on execution until policy violation
User/host application creates a subclass of SecurityManager to define a policy
15 November 2018
University of Virginia CS 551

32. HotJava’s Policy (JDK 1.1.7)
public class AppletSecurity
extends SecurityManager {
...
public synchronized void checkDelete(String file) {
checkWrite(file); }
15 November 2018
University of Virginia CS 551

33. AppletSecurity.checkWrite (some exception handling code removed)
public synchronized void checkWrite(String file) {
if (inApplet()) {
if (!initACL) initializeACLs();
String realPath =
(new File(file)).getCanonicalPath();
for (int i = writeACL.length ; i-- > 0 ;) {
if (realPath.startsWith(writeACL[i])) return; }
throw new AppletSecurityException
("checkwrite", file, realPath);
Note: no checking if not inApplet!
Very important this does the right thing.
15 November 2018
University of Virginia CS 551

34. University of Virginia CS 551
inApplet
boolean inApplet() {
return inClassLoader(); }
Inherited from java.lang.SecurityManager:
protected boolean inClassLoader() {
return
currentClassLoader() != null;
15 November 2018
University of Virginia CS 551

35. University of Virginia CS 551
currentClassLoader
/**
Returns an object describing the most recent class loader executing on the stack.
Returns the class loader of the most recent occurrence on the stack of a method from a class defined using a class loader; returns null if there is no occurrence on the stack of a method from a class defined using a class loader. */
protected native ClassLoader currentClassLoader();
15 November 2018
University of Virginia CS 551

36. University of Virginia CS 551
Recap
java.io.File.delete calls SecurityManager.checkDelete before deleting
HotJava overrides SecurityManager with AppletSecurity to set policy
AppletSecurity.checkDelete calls AppletSecurity.checkWrite
AppletSecurity.checkWrite checks if any method on stack has a ClassLoader
If not no checks; if it does, checks ACL list
15 November 2018
University of Virginia CS 551

37. University of Virginia CS 551
JDK 1.0 Trust Model
When JavaVM loads a class from the CLASSPATH, it has no associated ClassLoader (can do anything)
When JavaVM loads a class from elsewhere (e.g., the web), it has an associated ClassLoader
15 November 2018
University of Virginia CS 551

38. University of Virginia CS 551
JDK Evolution
JDK 1.1: Signed classes from elsewhere and have no associated ClassLoader
JDK 1.2:
Different classes can have different policies based on ClassLoader
Explict enable/disable/check privileges
SecurityManager is now AccessController
15 November 2018
University of Virginia CS 551

39. University of Virginia CS 551
What can go wrong?
Java API doesn’t call right SecurityManager checks (63 calls in java.*)
Font loading bug, synchronization
ClassLoader is tricked into loading external class as internal
Bug in Bytecode Verifier can be exploited to circumvent SecurityManager
Policy is too weak and allows damaging behavior
15 November 2018
University of Virginia CS 551

40. University of Virginia CS 551
Hostile Applets
See (about 1 new vulnerability/month)
Easy to write “annoying” applets (policy is too imprecise; no way to constrain many resource operations)
15 November 2018
University of Virginia CS 551

41. University of Virginia CS 551
Voting
15 November 2018
University of Virginia CS 551

42. VA Absentee Voting: Ballot
Print out form from state web site
Fill in name and address, sign by voter and a witness
Mail to local election official
Local election official mails ballot to voter’s address (presumably: checks voter is registered, verifies address, marks on election rolls)
15 November 2018
University of Virginia CS 551

43. University of Virginia CS 551
VA Absentee Voting
Open Envelope A in presence of witness (do not open without witness present)
Borrow No. 2 pencil and mark ballot.
Place ballot in Envelope B and seal. Do not put anything else in that envelope.
Fill in identification and sign Envelope B. Witness signs Envelope B.
Place Envelope B in return envelope pre-addressed to Secretary of the Electoral Board. Mail or hand deliver in person.
15 November 2018
University of Virginia CS 551

44. University of Virginia CS 551
Voting Challenges
(50 points) Explain why VA absentee ballot protocol uses Envelope A and requires voter to open it in presence of a witness
(50 points) Devise a good absentee voting protocol (better than my baseline)
(200 points) Exploit vulnerabilities in electoral protocols so Harry Browne or Ralph Nader wins election
Remember getting me arrested is points!
15 November 2018
University of Virginia CS 551

45. University of Virginia CS 551
Charge
Tomorrow: Vote
Pay attention to security protocols: who are you trusting?
Don’t get arrested, but think about how a malicious person might defeat the system
Next time
Guest Lecture: Chenxi Wang
15 November 2018
University of Virginia CS 551