15

My question is about Java exploits, for example this one: https://www.us-cert.gov/ncas/alerts/TA13-010A (exploit avaiable here http://www.securityfocus.com/bid/57246/)

The victimn should visit the site and accept to run the applet in your computer. Then if the JVM is vulnerable the cracker can execute arbitrary commands.

So my question is: How did the security researcher find this vulnerability? I mean, not specific this one, but how (what tools, method, etc) did he/she use to find these vulnerabilities? Does he/she reverse engineer javaw.exe? What's the methods?

Improve this question
1

3 Answers 3

Reset to default
12

It largely depends on what kind of vulnerability. This particular one you mentione is in SecurityManager, and you could have found it relatively easily by analyzing the Java source code.

To get some idea of how that process is done, take a look at this and this articles by Esteban Guillardoy of Immunity.

Jduck has also published some research on memory corruption vulns in JRE. You can get the better picture about how to find a vulnerability by studying the previously published ones.

I remember that LSD-PL folks have done some awesome stuff in this area long time ago, that you can find here. It's a little bit outdated, but still relevant.

Improve this answer
0
8

Well I myself am an exploit developer. The methods of attack/research are:

  • Reversing the input values. Files, network protocols etc etc.
  • Building a Fuzzer with this information
  • Fuzz till crash
  • Analyse the crash
  • Build exploit

Another method I commonly use is to reverse points of interests (eg SingleSignOne modules, other login methods, database connections (hardcoded passwords etc).

But this should be on Security Exchange not on reverse engineering.

Improve this answer
4
  • 3
    I don't think security exchange would give a better answer than RE.
    – 0xea
    Oct 5, 2013 at 21:59
  • Agree, as the Security Exchange is not really the technical Security research (exploit development, reversing malware etc) but more the ITIL based, network and common sense security. But still it is not a RCE Question but a security question. I myself still think there should be an exploit development stack exchange.
    – Stolas
    Oct 6, 2013 at 10:42
  • Ok but how do you "Reverse the input values" ? Did you reverse iexplorer.exe and then the applet?
    – jyz
    Sep 29, 2014 at 14:26
  • @jyzus windbg break these kernelbase!ReadFile kinds of Symbols and just run the tool. Reverse the flow your input variables go.
    – Stolas
    Sep 30, 2014 at 6:30
4

Lots of Java exploits revolve around bypassing the Java sandbox, the Security Manager in Java parlance. Sami Koivu published a lot of interesting work around Java security and exploits, notably his 3 parts introduction to Java security.

http://slightlyrandombrokenthoughts.blogspot.ca/2009/02/java-se-security-part-i_25.html http://slightlyrandombrokenthoughts.blogspot.ca/2009/07/java-se-security-part-ii-immutability.html http://slightlyrandombrokenthoughts.blogspot.ca/2010/02/java-se-security-part-iii-keys.html

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.