Skip to main content
SpringerLink
Log in
Book cover

International Conference on Smart Card Research and Advanced Applications

CARDIS 2021: Smart Card Research and Advanced Applications pp 275–288Cite as

PhiAttack

Rewriting the Java Card Class Hierarchy

  • Conference paper
  • First Online:

  • 498 Accesses

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 13173))

Abstract

Compiling Java Card applets is based on the assumption that export files used to translate Java class item to Java Card CAP tokens are legitimate. Bouffard et al. [2] reversed the translation mechanism. Based on malicious Application Programming Interface (API) embedded in a target, they succeeded in making a man-in-the-middle attack where cryptographic keys can leak.

In this article, we disclose that, on a pool of legitimate export files, Java Card Virtual Machine (JCVM) implementations can be confused by a CAP file verified by the Java Card Bytecode Verifier (BCV). The disclosed vulnerability leads to Java Card class hierarchy rewriting. The introduced vulnerability is exploitable up to Java Card 3.0.5. Recently, Java Card 3.1.0 provides a new export file format which prevents this vulnerability.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   54.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   69.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Notes

  1. 1.

    The Java Card converter is included in the Java Card SDK available on the Oracle’s website: https://www.oracle.com/fr/java/technologies/java-card-tech.html.

References

  1. Bouffard, G., Iguchi-Cartigny, J., Lanet, J.-L.: Combined software and hardware attacks on the Java card control flow. In: Prouff, E. (ed.) CARDIS 2011. LNCS, vol. 7079, pp. 283–296. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-27257-8_18

    Chapter  Google Scholar 

  2. Bouffard, G., Khefif, T., Lanet, J., Kane, I., Salvia, S.C.: Accessing secure information using export file fraudulence. In: Crispo, B., Sandhu, R.S., Cuppens-Boulahia, N., Conti, M., Lanet, J. (eds.) 2013 International Conference on Risks and Security of Internet and Systems (CRiSIS), La Rochelle, France, 23–25 October 2013, pp. 1–5. IEEE (2013). https://doi.org/10.1109/CRiSIS.2013.6766346

  3. Bouffard, G., Lanet, J.-L.: Reversing the operating system of a Java based smart card. J. Comput. Virol. Hacking Tech. 10(4), 239–253 (2014). https://doi.org/10.1007/s11416-014-0218-7

    Article  Google Scholar 

  4. Bouffard, G., Lanet, J.: The ultimate control flow transfer in a Java based smart card. Comput. Secur. 50, 33–46 (2015). https://doi.org/10.1016/j.cose.2015.01.004

    Article  Google Scholar 

  5. Faugeron, E.: Manipulating the frame information with an underflow attack. In: Francillon, A., Rohatgi, P. (eds.) CARDIS 2013. LNCS, vol. 8419, pp. 140–151. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-08302-5_10

    Chapter  Google Scholar 

  6. Faugeron, E., Valette, S.: How to hoax an off-card verifier. e-smart (2010)

    Google Scholar 

  7. GlobalPlatform: Card Specification. GlobalPlatform Inc., 2.2.1 edn. (January 2011)

    Google Scholar 

  8. Hamadouche, S., et al.: Subverting byte code linker service to characterize Java card API. In: 7th Conference on Network and Information Systems Security (SAR-SSI), 22–25 May 2012, pp. 75–81 (2012)

    Google Scholar 

  9. Hamadouche, S., Lanet, J.: Virus in a smart card: myth or reality? J. Inf. Secur. Appl. 18(2–3), 130–137 (2013). https://doi.org/10.1016/j.jisa.2013.08.005

    Article  Google Scholar 

  10. Lancia, J.: Java card combined attacks with localization-agnostic fault injection. In: Mangard, S. (ed.) CARDIS 2012. LNCS, vol. 7771, pp. 31–45. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-37288-9_3

    Chapter  Google Scholar 

  11. Lancia, J., Bouffard, G.: Java card virtual machine compromising from a bytecode verified applet. In: Homma, N., Medwed, M. (eds.) CARDIS 2015. LNCS, vol. 9514, pp. 75–88. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-31271-2_5

    Chapter  Google Scholar 

  12. Mostowski, W., Poll, E.: Malicious code on Java card smartcards: attacks and countermeasures. In: Grimaud, G., Standaert, F.-X. (eds.) CARDIS 2008. LNCS, vol. 5189, pp. 1–16. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-85893-5_1

    Chapter  Google Scholar 

  13. Oracle: Java Card Technology - Providing a secure and ubiquitous platform for smart cards. Technical report, Oracle, Security Evaluations, Oracle Corporation, 500 Oracle Parkway, Redwood Shores, CA 94065 (2012). www.oracle.com/technetwork/java/embedded/javacard/documentation/datasheet-149940.pdf

  14. Oracle: Java Card 3 Platform, Virtual Machine Specification, Classic Edition. No. Version 3.0.5, Oracle, Oracle America Inc., 500 Oracle Parkway, Redwood City, CA 94065 (2015)

    Google Scholar 

  15. Oracle: Java card system - open configuration protection profile. Protection Profile versoin 3.0.5, Oracle, Security Evaluations, Oracle Corporation, 500 Oracle Parkway, Redwood Shores, CA 94065 (December 2017)

    Google Scholar 

  16. Oracle: Java Card 3 Platform, Virtual Machine Specification, Classic Edition. No. Version 3.1, Oracle, Oracle America Inc., 500 Oracle Parkway, Redwood City, CA 94065 (February 2021)

    Google Scholar 

  17. Razafindralambo, T., Bouffard, G., Lanet, J.-L.: A friendly framework for hidding fault enabled virus for Java based smartcard. In: Cuppens-Boulahia, N., Cuppens, F., Garcia-Alfaro, J. (eds.) DBSec 2012. LNCS, vol. 7371, pp. 122–128. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-31540-4_10

    Chapter  Google Scholar 

Download references

Acknowledgments

A very special thanks to my wife, Marie-Philomène Dubreuil, who accompanied me during all these hours of work on this research topic. This attack is named after her.

    Jean Dubreuil

Author information

Authors and Affiliations

  1. Serma Safety & Security, Pessac, France

    Jean Dubreuil

  2. National Cybersecurity Agency of France (ANSSI), Paris, France

    Guillaume Bouffard

  3. Information Security Group, DIENS École Normale Supérieure, CNRS, PSL University, Paris, France

    Guillaume Bouffard

Authors
  1. Jean Dubreuil
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Guillaume Bouffard
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Guillaume Bouffard .

Editor information

Editors and Affiliations

  1. Jean Monnet University, Saint-Etienne, France

    Vincent Grosso

  2. Infineon Technologies, Neubiberg, Germany

    Thomas Pöppelmann

Rights and permissions

Reprints and permissions

Copyright information

© 2022 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Dubreuil, J., Bouffard, G. (2022). PhiAttack. In: Grosso, V., Pöppelmann, T. (eds) Smart Card Research and Advanced Applications. CARDIS 2021. Lecture Notes in Computer Science(), vol 13173. Springer, Cham. https://doi.org/10.1007/978-3-030-97348-3_15

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-97348-3_15

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-97347-6

  • Online ISBN: 978-3-030-97348-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation