Persistent fault injection attack from white-box to black-box

Among the protection mechanisms that ensure the Java Card security, the Byte Code Verifier (BCV) is one of the most important security elements. In fact, embedded applets must be verified prior installation. This prevents ill-formed applet to be loaded. In this article, the behavior of the Oracle BCV towards some unchecked piece of codes is analyzed, and the way to bypass the BCV is highlighted. Then, we demonstrate how one can use this breach to access to the system data of a frame, and persistently activate any code. Using both a white-box approach and fault injection that can transform a well-formed code to an ill-formed one during runtime execution.