Towards a General Framework for Formal Reasoning about Java Bytecode Transformation

Program transformation has gained a wide interest since it is used for several purposes: altering semantics of a program, adding features to a program or performing optimizations. In this paper we focus on program transformations at the bytecode level. Because these transformations may introduce errors, our goal is to provide a formal way to verify the update and establish its correctness. The formal framework presented includes a definition of a formal semantics of updates which is the base of a static verification and a scheme based on Hoare triples and weakest precondition calculus to reason about behavioral aspects in bytecode transformationComment: In Proceedings SCSS 2012, arXiv:1307.802

The Effects of Social Support on At-Risk Youth

Social support is conceptualized as a protective factor that buffers against distress and dysfunction. Social support can be beneficial to all individuals and is usually available through a support system consisting of family and friends. Unfortunately, there are populations that lack effective support systems and consequently do not receive social support. One such population is at-risk youth. In this project, I examined the effects of social support, within the context of participation in youth programs, on the academic, emotional, and behavioral functioning of at-risk youth. Twenty-three adolescents participating in three youth programs were assessed at three time points: the beginning of the youth program (Time 1), four months into the program (Time 2), and at the end of the program (Time 3). Results showed that overall social support increased across the program year. Social support was also found to have a significant relationship with reported self esteem, academic performance, and behavioral dysfunction. These findings can have important implications for mentoring program development

Combined Software and Hardware Attacks on the Java Card Control Flow

Part 7: Java Card SecurityInternational audienceThe Java Card uses two components to ensure the security of its model. On the one hand, the byte code verifier (BCV) checks, during an applet installation, if the Java Card security model is ensured. This mechanism may not be present in the card. On the other hand, the firewall dynamically checks if there is no illegal access. This paper describes two attacks to modify the Java Card control flow and to execute our own malicious byte code. In the first attack, we use a card without embedded security verifier and we show how it is simple to change the return address of a current function. In the second attack, we consider the hypothesis that the card embeds a partial implementation of a BCV. With the help of a laser beam, we are able to change the execution flow

Heap . . . Hop! Heap Is Also Vulnerable

International audienceSeveral logical attacks against Java based smart card have been published recently. Most of them are based on the hypothesis that the type verification was not performed, thus allowing to obtain dynamically a type confusion. To mitigate such attacks, typed stack have been introduced on recent smart card. We propose here a new attack path for performing a type confusion even in presence of a typed stack. Then we propose using a Fault Tree Analysis a way to design efficiently counter measure in a top down approach. These counter measures are then evaluated on a Java Card virtual machin

Les objets communicants au Japon : aspects logiciels

Cette mission s'est déroulée du 27 au 31 Octobre 2003. Elle faisait suite à une précédente mission "objets communicants, aspects matériels" qui s'était déroulée en Juin 2003. Elle visait à en compléter les conclusions sous les aspects réseaux et plates-formes.Des laboratoires différents ont été visités par les deux missions, pour offrir un panorama de la recherche sur le thème objets communicants (smart devices) et intelligence ambiante, ubiquitous networking selon le terme en vogue au Japon

Les objets communicants au Japon : aspects logiciels

Cette mission s'est déroulée du 27 au 31 Octobre 2003. Elle faisait suite à une précédente mission "objets communicants, aspects matériels" qui s'était déroulée en Juin 2003. Elle visait à en compléter les conclusions sous les aspects réseaux et plates-formes.Des laboratoires différents ont été visités par les deux missions, pour offrir un panorama de la recherche sur le thème objets communicants (smart devices) et intelligence ambiante, ubiquitous networking selon le terme en vogue au Japon

Model-Based Robustness Testing in Event-B Using Mutation

International audienceRobustness testing aims at finding errors in a system under invalid conditions, such as unexpected inputs. We propose a robust-ness testing approach for Event-B based on specification mutation and model-based testing. We assume that a specification describes the valid inputs of a system. By applying negation rules, we mutate the precondition of events to explore invalid behaviour. Tests are generated from the mutated specification using ProB. ProB has been adapted to efficiently process mutated events. Mutated events are statically checked for satisfiability and enability using constraint satisfaction, to prune the transition search space. This has dramatically improve the performance of test generation. The approach is applied to the Java Card bytecode verifier. Large mutated specifications (containing 921 mutated events) can be easily tackled to ensure a good coverage of the robustness test space

A Template Attack Against VERIFY PIN Algorithms

International audienceThis paper presents the first side channel analysis from electromagnetic emissions on VERIFY PIN algorithms. To enter a PIN code, a user has a limited number of trials. Therefore the main difficulty of the attack is to succeed with very few traces. More precisely, this work implements a template attack and experimentally verifies its success rate. It becomes a new real threat, and it is feasible on a low cost and portable platform. Moreover, this paper shows that some protections for VERIFY PIN algorithms against fault attacks introduce new vulnerabilities with respect to side channel analysis