Reverse engineering a Java Card memory management algorithm. Issue 66 (May 2017)

• Record Type: Journal Article
• Authors: Mesbah, Abdelhak; Lanet, Jean-Louis; Mezghiche, Mohamed
• Is Part Of: Computers & security. Issue 66(2017)
• Page Start: 97
• Page End: 114
• Publication Date: 2017-05
• Subjects: Data reverse engineering -- Java Card -- Software attack -- Type inference -- Vulnerability discovery; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2017.01.005
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Smart cards are tamper resistant devices that manipulate assets in a secure way. Among the assets, one is of a particular interest the native layers. If some attacks have succeeded in getting access to the applicative layer very few of them have had access to the native layers. We propose here to use applicative programs to perform data reverse engineering in order to understand the hidden algorithms that manage the memory allocation. We are then able to generate our own fake references on objects that can be manipulated by the system as legal objects. Then, we propose a new attack called auto-forges that leads the system to interpret its own data or program as valid Java meta data. This attack provides access to new memory fragments where the native layers are stored. Getting access to this asset allows us to start the reverse engineering of these native layers.