1

If I have a game and I want to detect if someone is reflection the fields in some classes, how would I go about doing that? I know that they MUST set the field to be accessible.

I've been told that I cannot detect if someone loaded my class and is accessing fields using reflection.

I was wondering if I could create a thread that constantly checks if someField.isAccessible() returns true.

Is this a good approach? Will it work? It works in my own classes but will it work if someone creates a class to load my jar and get the fields? They HAVE to set it accessible and that's why I am asking if this is a good method.

Any ideas or suggestions?

Improve this question
2
  • What you were told is correct. And reflection isn't the only threat, so a reflection-only solution is pointless. Commented Aug 21, 2014 at 1:05
  • But I'm not looking for a solution. I was just curious. I know for sure it is not the only solution and I know for sure it's pointless because it can be removed using ASM or BCEL or other methods. I just wanted to know IF it'd work at all. Even if only for 2 seconds. Commented Aug 21, 2014 at 1:09

2 Answers 2

Reset to default
3

You cannot prevent them from doing these things if they really want to do them.

Even if your approach worked, they could just de-compile your classes, take out the troublesome checks, and compile their own version.

The only way to prevent your software from being "hacked" is to not distribute it, but run it on your own machine ("software-as-a-service"). Might be the only option for the "security-critical" pieces.

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

Yeah but I am not trying to prevent injection or prevent reflection. I just wanted to know if it was possible to detect if "setAccessible(true)" could be detected. Ignoring injection (to remove this stuff), would I be on the right track?
1

If you control the JVM the code is executing in (hosting some user-supplied code), you can install a custom SecurityManager. As described by its documentation, Field.setAccessible will call the installed SecurityManager, which can veto the setAccessible call by throwing SecurityException (or log it or whatever). Unfortunately, the ReflectPermission object passed to the SecurityManager does not contain the Field being granted access, so you can't selectively deny access to particular fields. What you can do is check the call stack (using SecurityManager.getClassContext()) and deny access if any user-supplied code is on the stack.

There may also be a way to enforce this with the default SecurityManager implementation and policy files, but all the examples in the policy file documentation are about granting permission, not revoking it. This would imply you'd have to figure out all the permissions the non-user-supplied code requires and provide appropriate policy files. (Whitelisting is generally a superior security strategy than blacklisting, but requires more effort to set up.)

This is all predicated on the JVM security implementation to work as documented; as you may know, there have been several applet-based exploits that used flaws to escape the JVM sandbox. It's probably best to not run user-supplied code in the same JVM containing sensitive information, instead relying on OS-level process isolation for security. But taking your question strictly ("Can I detect setAccessible?") the answer is yes, if you control the JVM.

If you don't control the JVM the code is executing in (you gave your code to the user to run on their own), protection is futile. Besides modifying your code before running it to remove the protection, they could simply run on a modified JVM that doesn't enforce access checks for reflective operations originating in their code, or that directly modifies whatever fields you're trying to protect.

Improve this answer

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.