From Bytes to Bugs - Reverse Engineering for Insecure Deserialization

Insecure Deserialization talk at HTB Mumbai.

Transcript

1. REVERSE ENGINEERING I N S E C U R E D E S E R I A L I Z A T I O N 01 From Bytes to Bugs INSECREZ
2. ABOUT ME INSECREZ 02 From Bytes to Bug DevSecOps Engineer at a Fintech Fun-Time Bug-Bounty Hunter Life-long learner of System Architecture, Networking and Security Creating meme-fied content to educate tech to common people
3. CONTENT INSECREZ 03 1.Defining Serialization and De-serialization for common people 2.Serialization Formats (JSON, XML, Java/ Kotin/Scala/Android, PHP, Python, .NET, protobufs, custom binary) 3.How De-serialization is dangerous - Object Injection, Gadget Chains, RCEs etc 4.Static Analysis - Scanning bytecode, looking for readObjects/ unmarshal/deserialization/fromBytes patterns, decompiler tips 5.Dynamic Analysis - Instrumentation, hooking, sandboxed runtime debugging, intercepting serialized streams. 6.Reverse Engineering closed-sourc clients/servers: unpacking, deobfuscation basics, extracting classes/struct layouts 7.Payloads - Samples 8.Bypassing Protections 9.Exploit Development - non-desructive verification and rollback strategies 10.Mitigations and secure patterns for developers & reviewers + Q&A 1.Serialization and Deserialization 2.What and Where to find at different places 3.Static and Dynamic Analysis 4.Reverse Engineering files for finding formats issues 5.Where to find exploits 6.Mitigations From Bytes to Bug
4. “BLINDLY TRUSTING BYTES” 04 From Bytes to Bug IDENTIFY THE AREAS OF ISSUES IN FOLLOWING CODES
5. INSECREZ SERIALIZATION Serialization is a process of conversion of Data Structures, Objects, functions into “Byte Streams” that makes it easier for transmission of data and related points. 05 From Bytes to Bug DESERIALIZATION De-serialization is the vice-versa process, to convert “Byte-Streams” data to actual Objects in the exact state as it was serialized
6. ANOTHER RIDDLE.? - FIND THE LINE OF ISSUE 07 From Bytes to Bug This is a “vulnerable” python code for testing Insecure Deserialization vulnerability. I’ve analyzed this code in Dynamic Analysis section This is a “vulnerable” Java code for Insecure Deserialization
7. WHAT TO FIND 06 From Bytes to Bug PYTHON pickle.dumps pickle.loads marshal shelve Dill/cloudpickle MessagePack/Avro/ Protobuf JAVA ObjectOutputStream ObjectInputStream procedures .ser files Converting POJOs to files/texts in JSON Hessian - Binary web service serialization protocol. FST - Fast Serialization .NET JSON BinaryFormatter System.Text.Json or Newtonsoft.Json XML Serializer SOAP DataContractSerializer/ NetDataContractSerializer BSON - Binary JSON, used in MongoDB MessagePack CBOR - Binary JSON for IoT and constrained environments. Smile - Superset of JSON by AWS with type support and annotations. Amazon Ion - Superset of JSON by AWS with type support and annotations.
8. PLACES TO FIND THE ISSUE INSECREZ 11 the very first target for finding this issue is using user input fields USER INPUT FIELDS Look for how applications handle serialized data within network requests, such as SOAP requests, which can lead to remote code execution if insecure NETWORK REQUESTS From Bytes to Bug INTERNAL COMMUNICATIONS Any internal communication channels where data is serialized and deserialized can be a potential source of vulnerability if the data is not properly validated. THIRD-PARTY LIBRARIES Insecure deserialization can be introduced through third-party libraries, as an attacker can exploit gadget chains that exist within those libraries
9. REVERSE ENGINEERING INSECREZ 08 IDENTIFY LANGUAGES AND LIBRARIES IDENTIFY SINKS - LOOK FOR EXACT FUNCTION/CLASS NAME From Bytes to Bug TAG SOURCE LOCATIONS - WHERE DATA COMES FROM BUILD TAINT/ DATAFLOW MAPS START RISK SCORING CONFIRM WITH LIGHTWEIGHT MANUAL REVIEW AUTOMATE DETECTION IN CI GENERATE A FOCUSED SEMGREP RULE PACK
10. STATIC ANALYSIS INSECREZ 09 From Bytes to Bug Explaining Static Analysis :- Take the file and create a working folder Open the file and check for: direct calls to pickle.loads, pickle.load, pickle.loads(...) etc. calls that construct objects from external input methods that look like deserialization hooks: __setstate__, __reduce__, __getstate__, readObject (Java), ISerializable constructors (C# — not applicable here) any yaml.load, marshal.loads run Bandit (Python Scanner) run Ruff (linting) / Pyflakes / MyPy run Semgrep with a focused rule (yaml) AST-based scanner for obfuscated codes
11. DYNAMIC ANALYSIS INSECREZ 10 Imports the demo module (must be colocated). Creates the "victim" pickle using demo.make_victim_pickle() Disassembles the pickle with pickletools.dis() so you can inspect GLOBAL opcodes. Uses a LoggingUnpickler (subclass of pickle.Unpickler) that logs every class name requested via find_class during unpickling. Temporarily monkeypatches pickle.loads to log caller stack trace when called (detects where unpickling occurs in code). Runs the vulnerable_deserialize() to observe logging + the harmless side-effect. Demonstrates a safe_unpickle_with_allowlist() wrapper which rejects unknown classes
12. DYNAMIC ANALYSIS (FURTHER ANALYSIS) INSECREZ 10 This is a local script that works when ysoserial fails. Ysoserial generally fails to comply directly for finding insecure deserializations, for the parameter of Collections. Plus, ysosrial directly helps .exe formats more than .jar formats.
13. MITIGATIONS INSECREZ 12 Stop deserializing untrusted input - reject any serialized blob from clients/networks; only accept structured data (JSON/protobuf) from untrusted sources. Use safe formats & DTOs - replace pickle/Java native serialization/ BinaryFormatter with JSON, protobuf, or explicit DTO objects and parse into validated types. Allowlist types — never blacklist - meaning, enforce an explicit allowlist in your deserializer (ObjectInputFilter for Java, custom Unpickler for Python, KnownTypes/binder for .NET) and reject everything else. Disable polymorphic type loading - turn off Jackson default typing / Newtonsoft $type handling / TypeNameHandling; if polymorphism is needed, register explicit subtypes only. From Bytes to Bug
14. MITIGATIONS INSECREZ 12 Authenticate + integrity-check serialized blobs - HMAC or sign (RSA/ECDSA) all serialized payloads; verify signature BEFORE deserializing. Sandbox deserialization- run any unavoidable deserialization in a minimal- privilege process/container with no network, restricted filesystem, and resource limits (CPU/memory/pids). Remove/replace dangerous libs & APIs - eliminate pickle, yaml.load (use yaml.safe_load), BinaryFormatter, ObjectInputStream on network input — update to safe libs and latest versions. Log + monitor deserialization events - instrument deserializers to log caller stack, source IP, payload hash, and requested types; alert when unknown/ critical classes are requested. Build CI gates & tests - add Semgrep/Bandit rules and unit tests that fail builds on pickle.loads, yaml.load, ObjectInputStream reads from sockets, or new __setstate__/readObject hooks. From Bytes to Bug
15. BUG-HUNTERS TIPS FOR INSECURE DESERIALIZAATION 13 1.Map Serialization Points 2.Idenitify Untrusted Sources 3.fingerprint Serialization formats 4.Inspect Libraries and Dependencies 5.Look for “Dynamic” Deserialization From Bytes to Bug 6. Try to Safe-Unsafe transformation 7. analyze Type and Property Handling 8. Test Edge Cases and Serialization limits 9. Monitor Error Messages and Responses 10. Automate and Fuzz Globally Python: pickle.loads, pickle.load, yaml.load, marshal.loads Java: ObjectInputStream, XMLDecoder, enableDefaultTyping() (Jackson) .NET: BinaryFormatter.Deserialize, NetDataContractSerializer Generic: dynamic factory lookups using class names in input (globals()[name], Class.forName, $type in JSON)
16. BOOKS / BLOGS INSECREZ 14 From Bytes to Bug
17. THANK YOU 15 INSECREZ.MEDIUM.COM HTTPS://WWW.LINKEDIN.COM/IN/INSECREZ/ G E T I N T O U C H W I T H M E : INSECREZ @INSECREZ @INSECREZ