4 ms·

> We have Sun's forward-thinking and the enterprise-friendliness of the Java ecosystem to thank for that. I find it quite ironic to praise the forward-thinking

> We have Sun's forward-thinking and the enterprise-friendliness of the Java ecosystem to thank for that. I find it quite ironic to praise the forward-thinking of the company that has been instrumental to bring us into this mess via their vision of loading dependencies at runtime from an online repository. Sun imagined that the code and its configuration does not have to worry about how to fulfill its dependencies, but instead JNDI [1] could magically fetch the appropriate objects from wherever, don't worry. I'd say I would even find it ironic to praise the Java ecosystem, which, due to its excessive over-engineering, has produced best practice frameworks where fully documented behavior has the latent potential to just be catastrophically exploitable by accident, as nobody is able to reasonably understand how all of it plays together. I have a hard time to imagine how you could enable loading of external code in Rust or Go by accident using run-of-the-mill logging frameworks. [1] https://en.wikipedia.org/wiki/Java_Naming_and_Directory_Interface https://en.wikipedia.org/wiki/Java_Naming_and_Directory_Inte...

watersb 5y ago
I'm writing this from memory, with checking any sources. IIRC: Designs like JNDI were widespread in the IT software industry at the time. The academic prototype for all this was CORBA, the Common Object Request Broker Architecture. An object-oriented was to transmit data between systems running on separate processes, CPUs, remote servers. CORBA was a next-gen RPC (Remote Procedure Call) framework, the data format on the wire closely follows the format for C structs using Sun-RPC, but was way better because these CORBA things were discoverable and described at run-time, rather than compile-time libraries. That's right: RPC was initially a Sun UNIX thing. Microsoft needed a way to do this, so they had COM, the Component Object Model, for run-time discovery and linking (late binding).. Microsoft got COM to reach across network connections, "DCOM", for Distributed systems. Meanwhile, corporate IT was still pulling text out of databases and shoving it into C structs. It sucked. Microsoft's object model was better, and Java was better than better, because you didn't have to license it to use it. Well, you did; it was like an MIT License. Reason why IBM writes huge Java systems. And why Oracle owns Java. For some value of ownership. Yay objects!
- bboreham 5y ago
  In CORBA, RPC, etc., the R stands for Remote and it will execute something on the other end of the wire. In these Java attacks the code is downloaded and run locally, with all secrets and data access of the attacked program.

watersb 5y ago

I'm writing this from memory, with checking any sources. IIRC: Designs like JNDI were widespread in the IT software industry at the time. The academic prototype for all this was CORBA, the Common Object Request Broker Architecture. An object-oriented was to transmit data between systems running on separate processes, CPUs, remote servers. CORBA was a next-gen RPC (Remote Procedure Call) framework, the data format on the wire closely follows the format for C structs using Sun-RPC, but was way better because these CORBA things were discoverable and described at run-time, rather than compile-time libraries. That's right: RPC was initially a Sun UNIX thing. Microsoft needed a way to do this, so they had COM, the Component Object Model, for run-time discovery and linking (late binding).. Microsoft got COM to reach across network connections, "DCOM", for Distributed systems. Meanwhile, corporate IT was still pulling text out of databases and shoving it into C structs. It sucked. Microsoft's object model was better, and Java was better than better, because you didn't have to license it to use it. Well, you did; it was like an MIT License. Reason why IBM writes huge Java systems. And why Oracle owns Java. For some value of ownership. Yay objects!

bboreham 5y ago
In CORBA, RPC, etc., the R stands for Remote and it will execute something on the other end of the wire. In these Java attacks the code is downloaded and run locally, with all secrets and data access of the attacked program.