2

A web application uses a Java applet that stores a password, submitted by the user, in a private property and uses this property in several public methods.

I wonder if it is possible for another Java applet loaded from the same or different web site to call the methods of this applet or possibly access the private property containing the password?

Do different applets run in a same or different JVMs? If they run in the same JVM, can one applet somehow get a reference to another running applet?

The password-storing applet is signed. I work from assumption that the snooping applet that wants to get the password can also be signed.

Improve this question
1
  • I have reconsidered my question. Actually, if the attacker has managed to run a signed applet on the victim's computer, it's game over for the victim. It does not matter, if the passwords are stored or not stored. The attacker can install a keylogger and get the password anyway. Commented Dec 18, 2009 at 8:07

2 Answers 2

Reset to default
1

You can use AppletContext to get a reference from one applet to another. The current applet will have to know what to typecast the result into if you want to call any public methods other than those defined by the Applet class itself.

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

Thanks, Dan. AppletContext allows to access other applets in the same page. That's already something. Is there any way to find applets loaded by other pages?
You'll have to go through Javascript in that case. Make sure the calling applet has mayscript enabled, and use JSObject to make the call to a Javascript function that can in turn use the DOM to query elements in other windows. Note that both windows will have to have come from the same server.
0

I think your answer is here. A signed applet can have, with the client's permission, access to outside the sandbox so in theory you might be able to.

Which makes me think -- what if I were to have my (malicious) applet signed? Would I be able to acquire some user data, by concocting the poor user into clicking 'yes'? The question is left as an exercise to the reader (ok, I'm joking here).

Improve this answer

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.