Hacker News Reader

Comment by cyberax | Hacker News Reader

Oh wow. A blast from the past. It was called "LiveConnect" and allowed JavaScript to call applet's methods, via reflection on the Java side.

Here you go: https://docs.oracle.com/javase/tutorial/deployment/applet/in...

I remember using it to implement hardware key security for a website. A Java Applet loaded a JNI library, after exploiting a JRE security bug to escape confinement, which interacted with the hardware key. The JavaScript then handled all the "browsery" stuff like setting cookies.

That was in 2001...

View on HN

I wrote the beginnings of a Javascript game that used LiveConnect to connect to the TCP game server.

this video shows netplay between tabs but i also tested it on a lan in a house (physically moving between computers): https://www.youtube.com/watch?v=vcwPOfVXRc0

https://github.com/fuz/jspkmne

the java applet: https://github.com/fuz/jspkmnengine/blob/master/JSPKMNe.html...

netplay code that Java applet calls: https://github.com/fuz/jspkmnengine/blob/master/netplay.js

here's the java applet calling the Javascript of the game: https://github.com/fuz/jspkmnengine/blob/master/server/Clien...

For some reason I typed the repository name wrong

https://github.com/fuz/jspkmnengine is the correct URL to the repository.

> Reflections on the Java side.

Am I reading this correctly meaning you send a "some_variable_that_i_know_about=deleteAll()" via Javascript and it will just run `deleteAll()` method on a Java applet that has god knows what access it has to things on your machine?

Yes. Applets were very slow to load, and more dangerous than flash. I think applet was the first tag removed. But at the time, you could load up excel in a tag with the right com magic.

The early web boom was wild.

> I think applet was the first tag removed.

<applet> was never removed from HTML, but it was deprecated by HTML4.01 - but only because they wanted to use <object> as a single replacement element: https://www.w3.org/TR/html401/struct/objects.html#h-13.4

Looks like <applet> was officially obsoleted sometime during the switch from HTML4.01 to the Living Specification version: https://html.spec.whatwg.org/multipage/obsolete.html#other-e... - but the spec still permits using <object> or <embed> for Java applets: https://html.spec.whatwg.org/multipage/iframe-embed-object.h...

If the applet chooses to expose such a method; reflection is about finding out what methods are exposed. And while Java had plenty of security holes applets were definitely not supposed to have a lot of access to your computer.

Signed applets had access to your computer. Even just before they were completely removed from the browser, which was just 8 years ago. You had to click "confirm" here and there, but in the end it worked.

JavaScript was originally going to be called LiveScript, associated with LiveConnect. It was renamed for marketing reasons, because Java components were seen as the future for code on web pages, and it could script the interaction between different Java components (potentially from different sources).

That fact it could be used equally for components written in other languages, if they were ever supported by object tags in common web UAs is why it had a more generic name initially.

Fun fact: LiveScript is a FP-oriented language which compiles to JavaScript. It's been around for a while now :-)

https://livescript.net/

Was it even an exploit? I seem to recall reading something about code-signed applets being allowed to load native dlls by design. Which is crazy, one single "trust signature" dialog prompt from infecting a system with malware...

> one single "trust signature" dialog prompt

Sweet summer child ;)

I mean I'm sure there were a million exploits that would bypass even the check and prompt, but that doesn't change the fact that it's pretty crazy that native code execution was part of the design with just one small incomprehensible trust dialog.

I don't think there was any dialog at all. IIRC.

At first, people weren't worried about security. It was just a bunch of us nerds on there. You interacted with real people that didn't seem like they were trying to swindle you. The world still used paper checks for anything big, and credit/debit cards were there, but not like today. It wasn't that uncommon to write a check and ask the shop owner to cash it next week, at least in my poor household.

There wasn't "online banking" or "online identities" to steal, so it didn't seem all that important. The worst thing that would happen is you would lose access to a chat handle.

> one single "trust signature" dialog prompt from infecting a system with malware

How many dialog prompts are there to launch signed downloaded exe?

At least running an .exe should be somewhat obvious to computer literate people. When I saw those signed applet dialog prompts, even as a developer it was not obvious to me that it also meant granting unsandboxed x86 code execution to a .dll/.so from the internet.

The sad truth is that executables on desktop haven’t inched much closer to security in the following decades (thankfully mobile did).

Nope, I used an actual exploit, a type confusion bug somewhere within the RMI that allowed to escape the applet's ClassLoader. It then allowed it to access COM objects and basically do everything it needed.

The result was a "zero-touch" installation, with seamless login experience. It was a really crazy time.

Wild. So any other website could then do the same thing as you, accessing the hardware key and all...? Did anyone stop to think maybe this wouldn't be the best way to expose a hardware key? I mean, if you care about security at all, which you probably do if you're even bothering with a hardware key...??!?! %-)

Reply on news.ycombinator.com