Download to read offline
Uploaded byNicolas Fränkel
JVM-Con - Securing the JVM
The document discusses the security aspects of JVM with a focus on permissions and the reflection API, highlighting tools like Hazelcast for distributed computing and stream processing. It details the principle of least privilege, different permission types, and how to configure policy files for secure execution of code. Additionally, it touches on steganography and the management of security within Java applications.
More Related Content
![[HES2013] Virtually secure, analysis to remote root 0day on an industry leadi...](https://cdn.slidesharecdn.com/ss_thumbnails/day1-04-140412114404-phpapp02-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to JVM-Con - Securing the JVM
More from Nicolas Fränkel
![Lect 1 Number systems and base conversions. [Autosaved].pptx](https://cdn.slidesharecdn.com/ss_thumbnails/lect1numbersystemsandbaseconversions-260111134109-67c2d865-thumbnail.jpg?width=640&height=640&fit=bounds)
JVM-Con - Securing the JVM
- 1. @nicolas_frankel Neither for funnor for profit, but do you have a choice? Securing the JVM
- 2. @nicolas_frankel • Developer, teamlead, architect, whatever it takes • Recent Developer Advocate Me, myself and I
- 3. @nicolas_frankel Hazelcast HAZELCAST IMDG isan operational, in-memory, distributed computing platform that manages data using in-memory storage, and performs parallel execution for breakthrough application speed and scale. HAZELCAST JET is the ultra fast, application embeddable, 3rd generation stream processing engine for low latency batch and stream processing.
- 4. @nicolas_frankel • Part ofthe JRE • In the java.lang.reflect package The Reflection API 5
- 5. @nicolas_frankel • Dynamically-typed languages •Groovy • JPA frameworks • Hibernate • Others • Spring • etc. Used by a lot of languages/frameworks
- 6. @nicolas_frankel • Make networkscalls • Compile code on the fly • Execute code • etc. But everything is possible 8
- 7. @nicolas_frankel • Static analyzers •Byte-code analyzers • Code reviews • Security team • etc. Safeguards?
- 8. @nicolas_frankel “Steganography is the practiceof concealing a file, message, image, or video within another file, message, image, or video” Steganography 10
- 9.
- 10. @nicolas_frankel A simple process 1.Publish a new library to central • With hidden steganographic/compile/run features 2. Add the library to your POM 3. Add an image with embedded code 4. Call the library • Pretend to read the image 5. Enjoy
- 11.
- 12. @nicolas_frankel • Meant torun on the client machine • Forbidden to do “dangerous” stuff • Run in a sandbox Applets
- 13. @nicolas_frankel • Standard mode •a.k.a. “God Mode” • Sandbox mode • Through a SecurityManager Available « modes »
- 14. @nicolas_frankel • On thecommand line • java -Djava.security.manager … • Via the API • System.setSecurityManager() Activating the Security Manager
- 15. @nicolas_frankel • Java 9 •conf/security/java.security • ➔ conf/security/java.policy • Java 8 • jre/lib/security/java.security • ➔ jre/lib/security/java.policy Permissions configuration
- 16. @nicolas_frankel • Setting thepolicy file • -Djava.security.policy==my.policy • Adding additional permissions • -Djava.security.policy=my.policy Alternative policy file
- 17. @nicolas_frankel “Requires that ina particular abstraction layer of a computing environment, every module must be able to access only the information and resources that are necessary for its legitimate purpose” Principle of least privilege
- 18. @nicolas_frankel • Listen onports • Read a few System properties Default permissions
- 19. @nicolas_frankel public class AccessibleObject implementsAnnotatedElement { public void setAccessible(boolean flag) throws SecurityException { SecurityManager sm = System.getSecurityManager(); if (sm != null) sm.checkPermission(ACCESS_PERMISSION); setAccessible0(this, flag); } } Permissions are enforced in the JDK
- 20. @nicolas_frankel Permissions Permission Details AllPermission ☺ PropertyPermission• Read • Write FilePermission • Read • Write • Execute • Delete ReflectPermission Suppress reflective access checks RuntimePermission • More granular reflective access checks • Security-related • Class-loading related • Exit Virtual Machine, shutdown hooks, etc.
- 21. @nicolas_frankel Permissions (continued) Permission Details SocketPermission• accept • connect • listen • resolve SSLPermission • Get/set SSL context • Set hostname verifier AuthPermission ServicePermission Kerberos-related AWTPermission • Clipboard • Tray • Windows • Pointer • etc.
- 22. @nicolas_frankel grant codebase "file:myjar"{ permission Foo "foo"; permission Bar "bar", "baz"; }; Structure of a policy file (simplified)
- 23.
- 24.
- 25. @nicolas_frankel • https://blog.frankel.ch/ • @nicolas_frankel •https://git.io/fx54L • https://git.io/fhZ4t • https://bit.ly/2DQBRrt Thanks a lot!