cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1996-01-30 - Re: Java Sniffer (Was: Re: FV Announces That The Sky Is Falling)

Header Data

From: Jon Lasser <jlasser@rwd.goucher.edu>
To: Mike McNally <m5@dev.tivoli.com>
Message Hash: d3b7febf34906fa9d555bd8e6b111186b8effd6bdaf74b9c605e80d524930ab7
Message ID: <Pine.SUN.3.91.960130101707.24113C-100000@rwd.goucher.edu>
Reply To: <9601301358.AA14772@alpha>
UTC Datetime: 1996-01-30 17:48:05 UTC
Raw Date: Wed, 31 Jan 1996 01:48:05 +0800

Raw message

From: Jon Lasser <jlasser@rwd.goucher.edu>
Date: Wed, 31 Jan 1996 01:48:05 +0800
To: Mike McNally <m5@dev.tivoli.com>
Subject: Re: Java Sniffer (Was: Re: FV Announces That The Sky Is Falling)
In-Reply-To: <9601301358.AA14772@alpha>
Message-ID: <Pine.SUN.3.91.960130101707.24113C-100000@rwd.goucher.edu>
MIME-Version: 1.0
Content-Type: text/plain


On Tue, 30 Jan 1996, Mike McNally wrote:

> Rich Graves writes:
>  > Hmm. Actually, what do Java dialog prompts look like? Is there any
>  > indication that they come from Java, or can they be made to look like any
>  > dialog from any program, or the OS itself? I suppose this is
>  > implementation-dependent. 
> 
> Yes, it's completely dependent on the AWT implementation.  (Or, of
> course, on the implementation of whatever graphical library provided
> by the particular Java runtime environment in question.)
> 
> The "standard" AWT that's used in the Netscape (and maybe HotJava)
> web browsers decorates all windows applets create such that it's
> obvious they're there.  It is designed to be impossible for the applet
> itself to corrupt the AWT such that the windows don't bear that
> decoration.  (Whether the design works as advertised is a question
> worth asking, of course.)

But the fact that Java windows are obvious doesn't seem to really speak 
to the question of can they be faked from *outside* Java.

In fact, very distinctive windows for Java are likely to increase the 
success of an attack which duplicates the window decorations perfectly, 
because people will be used to it.

Eternal vigilance, etc.
J.L.
------------------------------------------------------------------------------
Jon Lasser                <jlasser@rwd.goucher.edu>            (410)494-3072 
          Visit my home page at http://www.goucher.edu/~jlasser/
  You have a friend at the NSA: Big Brother is watching. Finger for PGP key.

Thread