j2me Midlet Verification/Validation Problem
Posted on 2008-06-16
Lets examine the following scenario:
I have developed a Midlet, i have digitally Signed with a CA, and i am installing it in a Handset.
lets say that a hacker have managed to:
(1)find the src code of my midlet
(2)modify the code according to his needs but make it looks same with mine
(3)remove the signed midlet from the handset, and install his malicious "clone" Midlet.
The questions are:
(a)How the user can know that the midlet that he is launching is signed Midlet and NOT one that it is NOT signed?
(b)Is there another way that the user can check (Options perhaps?) that the Midlet is Digitally Signed?
(c)Can be done this with code on a signed Midlet? Namely to show to user that the midlet that he is using is
signed and not a malicious one OR this is NOT so secure?
(d)For Nokia6500 and for an UNSigned Midlet when i use Options->Details i can see Name,Size,Creation Time,Version,Vendor,Certificate of the Midlet.
Is there a way that a malicious user or program to make an UNSigned Midlet look secure?(namely to show that certificate is valid)
Thank you very much!