CodeMeter protected application error "JVMTI" when using Cortex XDR

MarkusL — Tue, 23 Aug 2022 13:33:44 GMT

The Java Application i am developing is using WIBU CodeMeter Software to prevent Hacker attacks.

CodeMeter from Wibu-Systems: Secure protection & license management of software and digital content: Wibu-Systems

Currently we protect the application, so that no one can establish a Debug Connection with the JavaVM to be able to read/change values hold in memory.

CodeMeter is using the JVMTI interface for blocking these kind of attacks.

We have released an application 3 years ago and it always worked, but since 2 weeks the same application can not be started anymore, after Cortex XDR was updated.

It seems that the Cortex XDR Virus Scanner is also trying to use the JVMTI interface and because 2 application trying to "manipulate" my application the application breaks.

Do you now an option/configuration/module which i can de-activate in CortexXDR to prevent the JVMTI usage?
Is there something like an "Injection-Module" which can be de-activated for java.exe applications?

Re: CodeMeter protected application error "JVMTI" when using Cortex XDR

bbucao — Wed, 24 Aug 2022 13:32:44 GMT

Hi MarkusL,

Yes, for this you will need to navigate to your Exploit Protection Profiles and under the "Known Vulnerable Processes Protection" module you will see "Java Deserialization Protection" with a default setting of "Enabled". By disabling that specific protection for the effected hosts I believe your issue will be resolved.

topic CodeMeter protected application error "JVMTI" when using Cortex XDR in Cortex XDR Discussions

CodeMeter protected application error "JVMTI" when using Cortex XDR

Re: CodeMeter protected application error "JVMTI" when using Cortex XDR