Securing Java applets Erik Poll Security of Systems (SOS) group University of Nijmegen

Erik PollSecuring Java applets2 Overview Security problems of Java Card applets or any other piece of software, for that matter Work in the EU-IST project VerifiCard Work on formal techniques for applet verification in Nijmegen

Erik PollSecuring Java applets3 Java applet Java application (piece of software) that is deployed independently on some platform, with some operating system (OS), eg –Java Card smart card applet –mobile phone (eg midlet on MIDP phone) –PDA –web browser –PC –airplane

Erik PollSecuring Java applets4 Old vs new smart cards one program (applet) written in machine-code, specific to chip and OS burnt into ROM Applet written in high-level language (Java Card) compiled into bytecode stored in EEPROM interpreted on card Options: multi-application: several applets on one card post-issuance: adding or deleting applets on card

Erik PollSecuring Java applets5 Java Card platform (JCRE) - miniature OS Java Card platform (JCRE) - miniature OS Java Card architecture smart card hardware applet JC Virtual Machine JC API Global Platform

Erik PollSecuring Java applets6 Production of a Java Card applet byte code source code cap file compiler cap generator download Options: only pre-loaded applets only digitally signed applets (using Global Platform) Remaining issue: how do we certify these pre-loaded or signed applets? bytecode verifier

Erik PollSecuring Java applets7 Security questions 1.Is my applet correct and secure? “correct” is necessary precondition for “secure” 2.Is the platform correct and secure ? 3.Is someone else’s applet is not malicious ie. will it not –annoy users, –interfere with other applets, or –damage the platform ?

Erik PollSecuring Java applets8 Java applet security 1.language level security –basic guarantees (no buffer overflows) 2.platform level security –imposes additional restrictions to protect platform & other applets (firewall/sandbox) 3.application level security –applet responsible for own specific correctness & security needs

Erik PollSecuring Java applets9 Buffer overflows Example Application asks for 4-digit PIN code User supplies a 5-digit PIN code What happens in the memory ? 00 kire

Erik PollSecuring Java applets10 Buffer overflows Single biggest cause of bugs & security holes –30-70% of all security alerts –36% of all bugs at Microsoft Possible - and frequent - in C, C++ although there are good tools to detect them... Impossible in modern languages: Java, C# Conclusion: don’t use C(++), use Java or C#

Erik PollSecuring Java applets11 Java applet security 1.language level security –basic guarantees (no buffer overflows) 2.platform level security –imposes additional restrictions to protect platform & other applets (firewall/sandbox) 3.application level security –applet responsible for own specific correctness & security needs

Erik PollSecuring Java applets12 Security questions 1.Is my applet correct and secure? “correct” is necessary precondition for “secure” 2.Is the platform correct and secure ? 3.Is someone else’s applet is not malicious ie. will it not –annoy users, –interfere with other applets, or –damage the platform ? Security evaluations must answer these questions

Erik PollSecuring Java applets13 NB Even perfectly secure applet running on perfectly secure platform may suffer from malicious applets For example –a malicious applet on mobile phone could simply ask user to type in the PIN code Protection against such Trojan Horses will require human source code inspection of untrusted, potentially hostile, applets ?

Erik PollSecuring Java applets14 How do we certify software ? 1.testing but testing that applet does what it should do is easier than testing that applet does not do what it should not do 2.coding standards, design standards 3.code reviews 4.formal methods...

Erik PollSecuring Java applets15 VerifiCard

Erik PollSecuring Java applets16 VerifiCard EU-funded project for developing and applying formal methods for the specification and verification of the Java Card –platform and –applets Partners: universities, research institutes, smart card manufacturers

Erik PollSecuring Java applets17 Why formal methods ? (I) required by highest levels of certification in Common Criteria and there are increasing demands for higher levels of CC security evaluation

Erik PollSecuring Java applets18 Why formal methods ? (II) Central problem in ensuring that software is correct or secure: –We have long documents in English giving functional specs, security requirements,... –How to ensure that these specs are consistent & complete ? our implementations actually meet them ? –If we can express parts of these documents in formal languages, we have more options...

Erik PollSecuring Java applets19 Work on platform level At INRIA & TUM Formalisation of Java Card Virtual Machine Development of a provably correct byte code verifier This relies on the use of mechanical theorem provers

Erik PollSecuring Java applets20 Work on applet level At INRIA, SICS, Kaiserslautern, Nijmegen Formal specification and verification of Java Card applets, in particular using JML

Erik PollSecuring Java applets21 Java Card applet specification and verification using JML

Erik PollSecuring Java applets22 JML (Gary Leavens et al) Formal specification language for Java –JML specs added as annotations is Java source code files Easy to learn –small extension of Java syntax Supported by a range of tools

Erik PollSecuring Java applets23 JML Example requires amount >= 0; public void debit(int amount) {.... } Java compiler ignores this line but JML tools will parse it 19% of bugs are due to lack of input validation this precondition makes an assumption explicit

Erik PollSecuring Java applets24 JML Example requires amount >= 0; ensures balance == \old(balance) – amount; signals (PurseException) balanace == public void debit(int amount) {.... } 19% of bugs are due to lack of input validation this precondition makes an assumption explicit

Erik PollSecuring Java applets25 JML Example private int balance; final static int MAX_BALANCE; invariant 0 <= balance && balance <

Erik PollSecuring Java applets26 JML Example private byte[] pin; invariant pin != null && pin.length == 4 && (\forall int i; 0 <= i && i < 4 ; 0 <= pin[i] && pin[i] <=

Erik PollSecuring Java applets27 JML Example private byte appletState; constraint \old(appletState) == BLOCKED ==> appletState == BLOCKED; constraint \old(appletState) != PERSONALISED ==> appletState !=

Erik PollSecuring Java applets28 Using JML Many “soundness/safety” properties of Java (Card) program can be easily specified in JML Such properties help in understanding code For such properties we can use tools to check that implementations satisfy them There are different tools, offering different levels of assurance at different costs...

Erik PollSecuring Java applets29 Tools for JML parser & type-checker –no typos in specs runtime assertion checker (Iowa State, Gary Leavens) –tests if any specs are violated at runtime static checker ESC/Java (Compaq, Rustan Leino et al.) –automatic verification of simple properties interactive program verifier LOOP (Nijmegen) –interactive verification of any property

Erik PollSecuring Java applets30 Testing & verification Testing considers a limited set of inputs Verification covers all possible inputs Testing is easier with a formal (JML) spec that we can test against

Erik PollSecuring Java applets31 Applet verification: achievements Verification of real industrial smart card applet (EMV applet) Verification revealed uncaught exceptions that were not detected during normal testing Gemplus has developed JACK tool supporting JML, integrated in IDE their developers use

Erik PollSecuring Java applets32 Conclusions about applet verification Formal specification languages and tools can help when doing a code review Interactive program verification probably still too costly, but automated program verification seems to provide good return-on-investment How far can we push level of automation ? –Will Moore’s law rescue us here ?

Erik PollSecuring Java applets33 Conclusions

Erik PollSecuring Java applets34 Old vs new generation smart cards Some points to note: some security concerns are the same, eg –is the smart card OS correct and secure ? –is our application correct and secure ? possible advantages of Java Card: –Java Card OS better studied than others –our knowledge of and tools for Java may allow better & cheaper security evaluations

Erik PollSecuring Java applets35 Conclusions Java Card interesting opportunity to apply state-of-the-art formal methods developed in academia for Java. Increasing need about (security) certification of software. Central challenge: How can we express security requirements in a (semi)-formal way ?