Full Memory Read Attack on a Java Card

We present a simple attack on a Java Card smart card to perform arbitrary memory reads. The attack utilises a known technique of type confusion of the card’s Java Virtual Machine by exploiting the faulty transaction mechanism implementation. The type confusion attack lets us access the application’s private meta-data, reverse engineer it, and in turn get full read and write access to arbitrary memory locations on the card. The attack gives us good insights into overall memory organisation of the card. We discuss the exploit in detail, including the exploit applet source code, to provide a reproducible attack. We shortly discuss the usefulness of an on-card Bytecode Verifier, that the exploited card is equipped with, and also the Java Card firewall mechanism deficiencies.