My question is about Java exploits, for example this one: https://www.us-cert.gov/ncas/alerts/TA13-010A (exploit avaiable here http://www.securityfocus.com/bid/57246/)

The victimn should visit the site and accept to run the applet in your computer. Then if the JVM is vulnerable the cracker can execute arbitrary commands.

So my question is: How did the security researcher find this vulnerability? I mean, not specific this one, but how (what tools, method, etc) did he/she use to find these vulnerabilities? Does he/she reverse engineer javaw.exe? What's the methods?

It largely depends on what kind of vulnerability. This particular one you mentione is in SecurityManager, and you could have found it relatively easily by analyzing the Java source code.

To get some idea of how that process is done, take a look at this and this articles by Esteban Guillardoy of Immunity.

Jduck has also published some research on memory corruption vulns in JRE. You can get the better picture about how to find a vulnerability by studying the previously published ones.

I remember that LSD-PL folks have done some awesome stuff in this area long time ago, that you can find here. It's a little bit outdated, but still relevant.

Well I myself am an exploit developer. The methods of attack/research are:

  • Reversing the input values. Files, network protocols etc etc.
  • Building a Fuzzer with this information
  • Fuzz till crash
  • Analyse the crash
  • Build exploit

Another method I commonly use is to reverse points of interests (eg SingleSignOne modules, other login methods, database connections (hardcoded passwords etc).

But this should be on Security Exchange not on reverse engineering.

  • 3
    I don't think security exchange would give a better answer than RE. – 0xea Oct 5 '13 at 21:59
  • Agree, as the Security Exchange is not really the technical Security research (exploit development, reversing malware etc) but more the ITIL based, network and common sense security. But still it is not a RCE Question but a security question. I myself still think there should be an exploit development stack exchange. – Stolas Oct 6 '13 at 10:42
  • Ok but how do you "Reverse the input values" ? Did you reverse iexplorer.exe and then the applet? – jyz Sep 29 '14 at 14:26
  • @jyzus windbg break these kernelbase!ReadFile kinds of Symbols and just run the tool. Reverse the flow your input variables go. – Stolas Sep 30 '14 at 6:30

Lots of Java exploits revolve around bypassing the Java sandbox, the Security Manager in Java parlance. Sami Koivu published a lot of interesting work around Java security and exploits, notably his 3 parts introduction to Java security.

http://slightlyrandombrokenthoughts.blogspot.ca/2009/02/java-se-security-part-i_25.html http://slightlyrandombrokenthoughts.blogspot.ca/2009/07/java-se-security-part-ii-immutability.html http://slightlyrandombrokenthoughts.blogspot.ca/2010/02/java-se-security-part-iii-keys.html

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.