Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Browsers store web pages in a local cache on the client's machine. How does a hostile Java applet exploit this information to gain more privileges than it is entitled to?

My understanding is that a Java applet can run either in sandbox mode or privileged mode. Only certified applets can run in privileged mode and uncertified ones CAN run in privileged mode but it has to request access from the user. However, this question implies it can use the browsers cache to escalate it's privileges.

The only thing I can think of is that the applet request access via the browser. The user can accept or decline this request and that approval is stored by the browser to determine privileges to the applet. If you could get at that cached data with the applet, you could alter the information and trick the browser into thinking it has been granted privileged access. Therefore allowing the applet to cause damage to the system.

Thoughts?

share|improve this question
3  
This is in danger of being too broad. –  Rook Nov 16 '13 at 5:42
    
Well, that sucks b/c this is a test question on my upcoming exam... –  chanpod Nov 16 '13 at 18:00
    
Hundreds of these exploits have been written using dozens of known attack patterns, anything form memory corruption exploits such as buffer overflows and use-after-free against the JVM to logic flaws and trust boundary violations. There is more than one way to skin a cat. –  Rook Nov 16 '13 at 19:34
add comment

closed as too broad by Adnan, Xander, TildalWave, scuzzy-delta, Rook Nov 16 '13 at 20:43

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

All the security measures you describe are from a perfect world. In real world, people make software, people make mistake, so software have bugs and some of them open breaches in this security scheme and can be exploited. This can be for instance exploits affecting the JRE, or the browser executing the applet.

You may google for tems like "Java applet exploit" to have some example of such threats which have been detected and solved in software updates.

To go a bit further, Java applet threat is often more sensible than, let's say, Javascript because Java is both a far more complex technology (the more complex, the more error and exploits) and a far more complete (offers more power over the host once exploited).

share|improve this answer
    
well, this is a test question on an upcoming exam. So, let's assume a perfect world. how would a malicious applet use a browsers local cache to gain privileges it shouldn't. –  chanpod Nov 16 '13 at 18:56
    
@chanpod: When I look at your question (the first paragraph), I may understand that this question less concerns the technical mean how a Java Applet could gain more privilege ("There is more than one way to skin a cat." as Rook said), but once the Java applet has gained more privileges what usage it may do of this information (for instance accessing to full browsing of the user, collecting personal or sensitive data, modifying a cached page to inject malicious content). –  GZBK Nov 18 '13 at 15:17
    
Ok, I suppose I'll modify my question. Can an applet access all aspects of a cached web page? In other words, cookies, form data, etc? –  chanpod Nov 19 '13 at 4:03
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.