Fuzzing and Overflows in Java Card Smart Cards — Guillaume Bouffard, Julien Lancia
Date : 03 June 2016 à 10:15 — 30 min.
The Byte Code Verifier (BCV) is one of the most important security element in the Java Card environment. Indeed, embedded applets must be verified prior installation to prevent ill-formed applet loading. At the CARDIS 2015 conference, we disclosed a flaw in the Oracle BCV which affects the applet linking process and can be exploited on real world Java Card smart cards. In this article, we present how this vulnerability had been found and our exploitation of this flaw on a Java Card implementation that enables injecting and executing arbitrary native malicious code in the communication buffer from a verified applet. This attack was evaluated on several Java Card implementations with black box approach. In this case, as we cannot evaluate the effect of the control flow redirection caused by the attack, we develop a generic function which can be executed from any point.