title: How does the Oracle Enterprise Single Sign-on Logon Manager attach itself to a VM?
body: <p>Today we noticed that a NullPointerException occurred in our software. But the origin wasn't in any package we included.</p>
  
  <pre><code>java.lang.NullPointerException
  at com.passlogix.vgo.ho.ApplicationWindow.getWindow(ApplicationWindow.java:178)
  at com.passlogix.vgo.ho.Jho.addApplicationWindow(Jho.java:453)
  at com.passlogix.vgo.ho.WindowScanner.run(WindowScanner.java:697)
  </code></pre>
  
  <p>A quick search on the internet shows that this seems to be a single sign on mechanism related to Oracle. Or more specific the Oracle Enterprise Single Sign-on Logon Manager.</p>
  
  <p>Somehow they manage to hook into our VM and scan what happens for whatever reason.
  From what i see they have an AWT event interceptor and could be keylogging and screen grabbing without us noticing. The only reason not to freak out right now is that it is an official Oracle product and "they wouldn't do that".</p>
  
  <p>This is of course a major back door to our program and i want to understand what mechanism they use to get into our VM and how to protect our programm from attacks by malware.</p>