Java for Mobile Devices: A Security Study

Java 2 Micro-Edition Connected Limited Device Configuration (J2ME CLDC) is the platform of choice when it comes to running mobile applications on resourceconstrained devices (cell phones, set-top boxes, etc.). The large deployment of this platform makes it a target for security attacks. The intent of this paper is twofold: First, we study the security architecture of J2ME CLDC. Second, we provide a vulnerability analysis of this Java platform. The analyzed components are: Virtual machine, CLDC API and MIDP (Mobile Information Device Profile) API. The analysis covers the specifications, the reference implementation (RI) as well as several other widely-deployed implementations of this platform. The aspects targeted by this security analysis encompass: Networking, record management system, virtual machine, multi-threading and digital right management. This work identifies security weaknesses in J2ME CLDC that may represent sources of security exploits. Moreover, the results reported ...

• Type: Conference
• Year: 2005
• Where: ACSAC
• Authors: Mourad Debbabi, Mohamed Saleh, Chamseddine Talhi, Sami Zhioua
• Keywords: ACSAC 2005, CLDC API, J2ME CLDC, Security, Security Privacy