23 replies on
2 pages.
Most recent reply:
Jan 16, 2008 11:05 AM
by
Vesa Karvon?
final
private
strictly final
strictly private
public
package
String
java.lang.String
public final class SecureString implements String { ... }
SecureString
package trojanattack;
import java.util.*;
import static java.lang.System.*;
/* Check method would in practice grant something useful, like write permission.
* But in the example it simply return true or false. */
class Security {
/* The argument type is a mistake. Should have used String because String is
* final and therefore can't be a trojan if run with a security manager. */
static boolean check( final CharSequence pwd ) {
return (pwd != null) && (pwd.length() == 3) &&
(pwd.charAt( 0 ) == 'A') && (pwd.charAt( 1 ) == 'B') &&
(pwd.charAt( 2 ) == 'C');
}
}
/* Logs what the security check does, thus aiding cracking the password.
* Reduces search from approx. O(27^n) to O(27 * n)! 27 because 26 letters
* plus empty (password not that long). */
class Trojan implements CharSequence {
final List< Character > pwd = new ArrayList< Character >();
int charAtLog = 0;
public CharSequence subSequence( final int notUsed, final int notUsed2 ) {
throw new AssertionError();
}
public int length() { return pwd.size(); }
public char charAt( final int index ) {
charAtLog++;
return pwd.get( index );
}
}
public class Attack {
static final char[] all = { 'A', 'B', 'C', 'D', 'E' }; // etc.
public static void main( final String[] notUsed ) {
final Trojan t = new Trojan();
attack: {
while ( t.charAtLog == 0 ) { // find pwd len
t.pwd.add( '*' ); // lengthen pwd; any impossible char, it is over written!
Security.check( t ); // spy on the security
}
for ( int index = 0; ; index++ ) { // find pwd
for ( final char c : all ) {
t.pwd.set( index, c );
t.charAtLog = 0;
if ( Security.check( t ) ) { break attack; } // found pwd
if ( t.charAtLog == (index + 2) ) { break; } // found a character in pwd
}
}
}
out.println( "Cracked :), pwd = " + t.pwd );
}
}