The document discusses security concerns related to mobile code across various programming languages, specifically focusing on Java, Safe-Tcl, and ActiveX. It highlights specific security features and vulnerabilities associated with each language, such as sandboxing in Java and the dual-interpreter approach in Safe-Tcl. The need for robust security policies, authentication methods, and protection against attacks like denial-of-service is emphasized throughout.

1. Addressing Security Issues in
Programming Languages for
Mobile Code
S. Gritzalis, J. Iliadis
• Department of Information and Communication Systems,
University of the Aegean
DEXA’98
• Department of Informatics,
Technological Educational Institute of Athens

2. Introduction
• Mobile Code
– travels on heterogeneous networks
– crosses security domains
– is executed upon arrival to the destination
– security concerns

3. Mobile Code Languages
• Java
general-purpose, object oriented language. Portable in compiled
binary code
• Safe-Tcl
high-level interpreted scripting language
• ActiveX
visual control framework, using COM as the underlying
infrastructure. O/S dependent

4. Security Issues
Hostile Applets
– attack the Integrity of a system
– violate the user’s Privacy
– limit the Availability of a system
– achieve user’s Annoyance

5. Java Security
• Sandbox
• Classloader
• Bytecode Verifier
• Security Manager
• JDK 1.2 new security modus operandi
• security policy
• access control
• protection domains

6. Java Security - Extensions
• Digital Signatures
• Policy Enforcement
– capabilities
– extended stack
introspection
– namespace
management
• Policy Definition
• Secure Code
Distribution
• Corporate-wide
policy
• Confining the use of
Java in a network
domain

7. Safe-Tcl Security
• Padded cell approach / Dual-Interpreter
– Trusted Interpreter -> Full Tcl
– Untrusted/Restricted Interpreter -> Safe-Tcl
• Command Aliases
• Security Policy

8. Safe-Tcl Security Extensions
• Authentication of Tclets
• Authentication of Safe-Tcl security
policies
• Confronting with denial-of-service attacks

9. ActiveX Security
• Applet authentication
• code safe for initialising
• code safe for scripting
• lack of configurable security policy
• ActiveX, Digital Signatures and Firewalls

10. ActiveX Security - Extensions
• Execution safety
• Software memory protection
– attach proofs of memory protection to code

11. Conclusions
• Security Scheme
• Detailed Security Policy
• Security Integration