A type confusion attack
Array types: Java allows a program that uses type T to use the type array of T
VM defines array types internally
- names begin with a square bracket [
- Netscape 3.0B5 allowed a byte code file to declare its own type name starting with a [
- an error was generated, but the table was updated
A redefined array type is classic type confusion and leads to complete compromise