Re:Rediscovering the Intel AMT Vulnerability
by lucb1e on Friday May 05, 2017 @03:47PM
(#14276279)
> [...] how to create equivalent bug in Java, the obvious string.equals() method [...]
Java Card, the Java version made for smart cards, does not have strings, and thus no String.equals().
Thought I remembered this from a CCC conference about EMV chips or SIM cards (don't remember which) a few years ago. Googling seems to confirm it: https://community.oracle.com/thread/1751610?db=5
Re:Rediscovering the Intel AMT Vulnerability
by paulmd on Saturday May 06, 2017 @01:33AM
(#14278858)
From what I remember in one of the deep teardowns it's possibly Java ME (which I think is one step above Java Card in terms of features). The file format is JEFF.
Java Card, the Java version made for smart cards, does not have strings, and thus no String.equals().
Thought I remembered this from a CCC conference about EMV chips or SIM cards (don't remember which) a few years ago. Googling seems to confirm it: https://community.oracle.com/thread/1751610?db=5