Writing malware in java?

Question

To me, it seemed like malware could never be written in java. Those who taught me java said it was "secure" and did not allow "low-level access" like c,c++.

But, I discovered that it can be done - http://blog.trendmicro.com/trendlabs-security-intelligence/jacksbot-has-some-dirty-tricks-up-its-sleeves/

notes on the same thing - http://www.darknet.org.uk/2011/01/java-based-cross-platform-malware-trojan-maclinuxwindows/

Here is my question - Can we use java to perform ALL the "bad things/tasks needed by malware" which c, c++, can do ?
If that is the case, then can we say that java is also good for malware writing ? After all, most criminals would want their malware to be multi-platform.

Answer 1

Java code can invoke native code (e.g. code written in C or whatever, and compiled to a sequence of CPU opcodes) through a standard interface. Java can actually write a DLL file somewhere (as a bunch of bytes) and load that, so everything native code can do, so can Java.

Java also features a rich standard library which allows it to read and write files in arbitrary ways.

The hard parts for Java-based malware are:

1. A Java VM is needed. Java is not installed by default in many modern operating systems.
2. The Java VM tends to sandbox Java applets. To run native code or access arbitrary files, a Java applet must ask for permission, which entails digital signatures and certificates which may be tracked back to the perpetrator. Or a specific sandbox escape bug must be exploited; such bugs are discovered regularly, but they are also patched with commendable alacrity.
3. The existing Java VM implementations are fat. They are optimized for big applications which will use lots of RAM anyway, so any Java code has a large minimal memory footprint. Malware usually prefers inconspicuousness.
4. Java VM implementations come with extensive debugging tools which allow plugging into a running VM and inspecting what happens in it. This may help in cleansing a Java-based malware infestation.

These are reasons why Java will not look as the best language ever to malware writers. Also, even if Java is nominally portable, cross-platform malware is an elusive goal, because malware tends to do things at a quite low level -- that is, a level which is very OS-specific. Modifying the /etc/passwd file is a very naughty thing to do on a Unix-like system; but it would have no impact at all on Windows, which does not have an /etc/passwd file. Thus, there is little incentive for malware authors to use Java.

(All of this would apply almost unchanged to a question about writing malware in C#/.NET + SilverLight.)

Answer 2

Malware comes in so many shapes and sizes, this question is difficult to answer. Writing malware in Java is as easy as;

(new File("/path/to/important/file")).delete();

Could I write a java application that steals your data? Easily. Could I write a Linux rootkit in Java? Almost certainly not, but that doesn't stop me doing all the things that I can do with whatever permissions the JVM is running with.

So in that sense, yes you can write malware in Java, but you would be somewhat more limited than if you were writing in a systems language like C; a keylogger is much harder to write in Java than in C, and hiding it well is probably impossible.

Answer 3

Maybe you're misunderstanding what was meant when you heard that java was more secure. Did they mean that your application is more secure or that malware cannot be written in this language?

In the past a number of vulnerabilities in the java api have been discovered (and since patched) that allowed a java program to execute malicious code without the user's consent. This often happens via applets since many browsers enable java.

See the CVE database where you might find some previous java vulnerabilities.

However perhaps those people meant that your applications can be written to be more secure from hackers. In this sense it is partially true. For example java applications (usually)cannot be exploited via buffer overflow attacks since the stack is managed by the jvm. I think this is what was meant when you were told java is more secure.

Here is some more information about why programming in java might be secure.

Answer 4

A piece of Java malware can probably perform most, if not all, of the functionality that a piece of C malware can perform.

However, there are a few features of the Java language that probably make malware authors lean towards the likes of C.

Java Virtual Machine Required

A Java program cannot execute on a computer unless a Java Virtual Machine (JVM) is installed on that computer. Writing your malware in Java automatically limits you from any target not running a JVM.

This is different from C or other languages that may be compiled to a native executable that will run on the target system without any additional software.

This doesn't entirely discount Java as a programming language of choice for would be malware writers however, especially if they were planning on spreading via one of the many Java runtime environment vulnerabilities

Java Virtual Machine Limitations

This JVM requirement can also make it a lot more difficult for a malicious Java application to hide itself. It is relying upon the user's installed JVM; all they need to do is remove that and they will stop the malware in it's tracks.

Cross Platform Compatibility is not that simple

By now you may be thinking "Yes, but isn't it all worth it, to have your malware magically work on all platforms?"

Whilst Java is indeed cross platform compatible (as long as a JVM is available) this might not necessarily mean what you think it means.

For example, a common feature of malware is the ability for it to start when the operating system starts. Java doesn't not provide a cross platform startWhenComputerStarts method. So this would still need to be implemented separately for each platform.

Alot of malware will use platform specific bugs or features to hide itself, launch itself on startup and snarf user data. So the author would still have to do this work for each platform!

Also, let us not forget that C code can be compiled to multiple different platforms. Java's advantage over C is that it can be compiled once and run anywhere but the same C code can still ultimately run on different platforms - just with 1 extra step.

If you think about it, considering that malware is often picked up through signatures, it would make more sense for the author to write individual pieces of malware for each platform. Making detection less likely.