Evaluating the Flexibility of the Java Sandbox

The ubiquitously-installed Java Runtime Environment (JRE) provides a complex, flexible set of mechanisms that support the execution of untrusted code inside a secure sandbox. However, many recent exploits have successfully escaped the sandbox, allowing attackers to infect numerous Java hosts. We hypothesize that the Java security model affords developers more flexibility than they need or use in practice, and thus its complexity compromises security without improving practical functionality. We describe an empirical study of the ways benign open-source Java applications use and interact with the Java security manager. We found that developers regularly misunderstand or misuse Java security mechanisms, that benign programs do not use all of the vast flexibility afforded by the Java security model, and that there are clear differences between the ways benign and exploit programs interact with the security manager. We validate these results by deriving two restrictions on applicati...

• Type: Journal
• Year: 2015
• Where: ACSAC
• Authors: Zack Coker, Michael Maass, Tianyuan Ding, Claire Le Goues, Joshua Sunshine
• Keywords: ACSAC 2015, Security Privacy