Mobile code: invoking untrusted mobile code - Revision history

KirstenS at 11:44, 23 April 2009

2009-04-23T11:44:43Z

2009-04-07T22:05:46Z

2009-02-16T13:19:43Z

2009-02-16T13:18:18Z

2008-09-16T11:48:44Z

‎Related Controls

2008-09-14T16:18:04Z

‎Examples

2008-09-14T16:17:49Z

‎Description

2008-09-14T01:30:42Z

2008-09-12T22:56:58Z

‎Description

2008-09-12T22:52:05Z

@@ Line 3: / Line 3: @@
 <br>
 [[Category:OWASP ASDR Project]]
 ==Description==

@@ Line 3: / Line 3: @@
 <br>
 [[Category:OWASP ASDR Project]]
 ==Description==

@@ Line 12: / Line 12: @@
 ==Risk Factors==
 TBD
 ==Examples ==
@@ Line 27: / Line 26: @@
   Class loadedClass = Class.forName("loadMe", true, classLoader);<br><br>
 </pre>
 ==Related [[Threat Agents]]==
 * TBD
 ==Related [[Attacks]]==
@@ Line 47: / Line 48: @@
 * [[Address space layout randomization (ASLR)]]
 * [[Stack-smashing Protection (SSP)]]
 ==References==

@@ Line 3: / Line 3: @@
 <br>
 [[Category:OWASP ASDR Project]]
-[[ASDR Table of Contents]]__TOC__
+[[ASDR Table of Contents]]
 ==Description==

@@ Line 41: / Line 41: @@
 ==Related [[Controls]]==
-* To solve this issue, it’s necessary to use some type of integrity mechanism to assure that the mobile code has not been modified.
+* [[Hashing]]
 ==References==

← Older revision		Revision as of 16:18, 14 September 2008
Line 16:		Line 16:

	==Examples ==		==Examples ==
−	~~<br>~~
	The following code demonstrates how this attack could be performed using a Java applet.		The following code demonstrates how this attack could be performed using a Java applet.

@@ Line 7: / Line 7: @@
 ==Description==
-This attack consists on manipulation of a mobile code in order to execute malicious operations at the client side. By intercepting client traffic using the [[Man-in-the-middle_attack|man-in-the-middle]]  technique, a malicious user could modify the original mobile code with arbitrary operations that will be executed on the client’s machine under his credentials.
+This attack consists of a manipulation of a mobile code in order to execute malicious operations at the client side. By intercepting client traffic using the [[Man-in-the-middle_attack|man-in-the-middle]]  technique, a malicious user could modify the original mobile code with arbitrary operations that will be executed on the client’s machine under his credentials.
 In another scenario, the malicious mobile code could be hosted in an untrustworthy web site or it could be permanently injected on a vulnerable web site through an injection attack.
 This attack can be performed over Java or C++ applications and affects any operating system.

@@ Line 31: / Line 31: @@
 ==Related [[Threat Agents]]==
-TBD
+* TBD
 [[Category:FIXME|need links]]
 ==Related [[Attacks]]==
-*[[Mobile code: non-final public field]]
+* [[Mobile code: non-final public field]]
-*[[Mobile code: object hijack]]
+* [[Mobile code: object hijack]]
 ==Related [[Vulnerabilities]]==
-[[:Category: Unsafe Mobile Code]]
+* [[:Category: Unsafe Mobile Code]]
 ==Related [[Controls]]==
-To solve this issue, it’s necessary to use some type of integrity mechanism to assure that the mobile code has not been modified.
+* To solve this issue, it’s necessary to use some type of integrity mechanism to assure that the mobile code has not been modified.
 ==References==
-*https://buildsecurityin.us-cert.gov/daisy/bsi/100/version/1/part/4/data/CLASP_ApplicationSecurityProcess.pdf?branch=main&language=default
+* https://buildsecurityin.us-cert.gov/daisy/bsi/100/version/1/part/4/data/CLASP_ApplicationSecurityProcess.pdf?branch=main&language=default
-*http://cwe.mitre.org/data/definitions/494.html
+* http://cwe.mitre.org/data/definitions/494.html
 [[Category: Abuse of Functionality]]
 [[Category:Attack]]