Improving Remote Method Invocation via Method Authorization and Elimination of Registry: An Exploration of Java and Haxe

Abstract

Service availability in Java RMI (Remote Method Invocation) implementations can easily be compromised in a number of ways. One of the ways is when an attacker controls a directory service and mounts an attack on a RMI client and data. Stubs in a registry can be de- registered or overwritten by the attacker. In addition, he could register his own stubs as proxies to a server implementation. This project focuses on the security pitfalls of using default RMI implementation, namely the lack of access control mechanism to manage server methods (and objects) and limitations of RMI registry. The RMI registry is a weak point that could be exploited. This work addresses this concern by investigating RMI implementation and customizing the behavior to support client/method authorization, authentication and elimination of the need for an RMI registry. The contribution of this work is that it removes inherent vulnerability in RMI, which is due to weak security in RMI registry implementation. In addition, an emerging toolkit, Haxe, for platform-agnostic application development was introduced and its realization of RMI was briefly demonstrated. Haxe exhibits virtually all the features in Java and could be exploited like it. It however presents more promising features for the next generation of applications and services.