by A group of European researchers, led by Alexandre Bartel, a Professor of Software Engineering and Security at Umeå University, have uncovered major flaws in software written in Java, one of the most widely used programming languages in the world. These vulnerabilities pertain to the processes involved in retrieving and recreating information, such as customer accounts, transactions, or patient records. The implications of these flaws can be enormous, leading to significant costs for businesses, government entities, and public authorities.
Java is extensively utilized in various applications, including mobile games, robots, embedded systems, and business applications. Over the years, multiple security flaws have been identified in Java, prompting the researchers to investigate whether these vulnerabilities have been addressed and how. Their focus was on Java products that employ deserialization, a process that restores packaged information to its original state, such as user settings, game functions, shopping carts, or banking applications. Through a thorough analysis of existing vulnerabilities and attacks, the researchers discovered that many Java programs rely on external libraries, making it challenging to rectify the affected systems. As a solution, Alexandre Bartel suggests that developers should avoid using Java deserialization altogether to prevent the introduction of security flaws in new code.
The research findings indicate the necessity of conducting comprehensive verification throughout the entire supply chain during the application’s lifecycle. The implications of these vulnerabilities are far-reaching, with potentially detrimental consequences for companies and society as a whole. Alexandre Bartel emphasizes the importance of addressing these flaws, as the costs associated with them can be extensive.
The significance of this study has led to widespread interest and recognition. It was published in the prestigious Transactions on Software Engineering and Methodology journal, TOSEM, which is part of the Association of Computing Machinery, ACM. Additionally, the findings were presented at ICSE, the International Conference on Software Engineering, one of the most renowned conferences in the field.
Moving forward, Alexandre Bartel and his research group are working on developing more efficient methods for detecting these vulnerabilities and preventing attacks. They are focusing on processes in computer science that involve saving a data structure or object state in a format that allows for storage or transfer to another computing environment. This process entails translating data structures into a stream of bytes to facilitate storage in memory, a file, or during data transfer to another machine.
The implications of these vulnerabilities span across various industries. For example, in the pharmaceutical sector, governments require packaging to be coded in a way that enables tracking throughout the supply chain. In game development, deserialization is used to store and load game data, such as player progress, settings, and saved games. The financial sector relies on deserialization for the storage and transmission of data on financial transactions between banks and other financial systems.
Overall, the research conducted by Alexandre Bartel and his team sheds light on the significant security vulnerabilities present in Java applications. Their findings underscore the need for proactive measures to address these flaws and safeguard sensitive information and systems.
*Note:
1. Source: Coherent Market Insights, Public sources, Desk research
2. We have leveraged AI tools to mine information and compile it
