Danilo Bruschi, Davide Fabris, Vincenzo Glave, Emilia Rosti
Univeristà degli Studi di Milano
Italy

Digital signatures allow us to produce documents whose integrity and authenticity, as we generated them, is verifiable by anybody who has access to our public key. Furthermore, we cannot ``repudiate'' those documents as something we never saw, let alone signed, since nobody else but us could access our private key. In this paper we show how the previous statement can be proved wrong when carefully crafted malicious software is installed on a machine running a Java digital signature application. By using such a software, a user may unwittingly sign another document besides the one he/she intends to digitally sign or sign a different document altogether.

Our attack exploit a known vulnerability of the security architecture of the Java run time environment that allows non-Java malicious software to replace some Java system classes with malicious one, which then alter the victim application behavior.

Keywords: digital signature, malicious code, class substitution

Read Paper (in PDF)