Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Dynamic App Patching
Search
Jon Rose
January 01, 2010
Technology
2
64
Dynamic App Patching
Jon Rose
January 01, 2010
Tweet
Share
More Decks by Jon Rose
See All by Jon Rose
Agile Security
jonrose
1
160
Decoding Bug Bounty Programs
jonrose
1
500
Builders Vs. Breakers AppSec 2012
jonrose
2
210
Rich Internet Application Security
jonrose
2
91
Cloudy with a chance of 0-day
jonrose
1
68
Deblaze - A remote method enumeration tool for flex servers
jonrose
3
190
Deblaze - A Remote Method Enumeration Tool for Flex Servers, Defcon
jonrose
2
120
CodeSearch0day
jonrose
1
51
Other Decks in Technology
See All in Technology
DynamoDB でスロットリングが発生したとき_大盛りver/when_throttling_occurs_in_dynamodb_long
emiki
1
410
New Relicを活用したSREの最初のステップ / NRUG OKINAWA VOL.3
isaoshimizu
2
610
CysharpのOSS群から見るModern C#の現在地
neuecc
2
3.4k
iOSチームとAndroidチームでブランチ運用が違ったので整理してます
sansantech
PRO
0
140
Why App Signing Matters for Your Android Apps - Android Bangkok Conference 2024
akexorcist
0
130
Platform Engineering for Software Developers and Architects
syntasso
1
520
誰も全体を知らない ~ ロールの垣根を超えて引き上げる開発生産性 / Boosting Development Productivity Across Roles
kakehashi
1
230
【令和最新版】AWS Direct Connectと愉快なGWたちのおさらい
minorun365
PRO
5
750
Lambdaと地方とコミュニティ
miu_crescent
2
370
Amplify Gen2 Deep Dive / バックエンドの型をいかにしてフロントエンドへ伝えるか #TSKaigi #TSKaigiKansai #AWSAmplifyJP
tacck
PRO
0
390
TanStack Routerに移行するのかい しないのかい、どっちなんだい! / Are you going to migrate to TanStack Router or not? Which one is it?
kaminashi
0
600
EventHub Startup CTO of the year 2024 ピッチ資料
eventhub
0
120
Featured
See All Featured
Building Your Own Lightsaber
phodgson
103
6.1k
Raft: Consensus for Rubyists
vanstee
136
6.6k
Teambox: Starting and Learning
jrom
133
8.8k
Why Our Code Smells
bkeepers
PRO
334
57k
Performance Is Good for Brains [We Love Speed 2024]
tammyeverts
6
410
Adopting Sorbet at Scale
ufuk
73
9.1k
Practical Tips for Bootstrapping Information Extraction Pipelines
honnibal
PRO
10
720
The Cost Of JavaScript in 2023
addyosmani
45
6.8k
Scaling GitHub
holman
458
140k
The MySQL Ecosystem @ GitHub 2015
samlambert
250
12k
Side Projects
sachag
452
42k
Intergalactic Javascript Robots from Outer Space
tanoku
269
27k
Transcript
Resolving*Applica/on* Vulnerabili/es* Blending(App(Scanners,(WAF’s,( and(Code(Instrumenta:on(
Agenda( • The(Problem( • Iden:fying(Risk( – Web(App(Scanning( – Code(Review( •
Mi:ga:ng(Risks( – Code(Patches( – Web(Applica:on(Firewall( • A(Blended(Solu:on(
The(Problem( • Web(apps(have(security(vulnerabili:es( ( • Feature(deadlines( • Inexperienced( developers( •
Poor(system( administra:on( • Insecure(defaults( • Vulnerable(libraries(
The(Threat(Is(Increasing( AHackers(techniques(&(toolkits(have(advanced(
CrossKEyed(( Scrip:ng( ( Click(Jacking( ( GIFAR( ( Deblaze( ( (
Recent(AHacks(
Common(Approaches( Iden:fica:on( – Web(Applica:on(Scanning( – Code(Review( ( Remedia:on( – Web(Applica:on(Firewall( – Code(Patches( (
Iden:fica:on(
Web(App(Scanning(K(Strengths( • Easily(finds(common( vulnerabili:es( • Language(/(PlaTorm( independent( • Fast(and(Repeatable( •
CostKeffec:ve(( • Consistent(Repor:ng(
Web(App(Scanning(K(Weaknesses( • AHack(Surface(Coverage( • Detec:ng(complex(&( unique(flaws( ( • Pinpoint(vulnerable(code( loca:on(
• Providing(specific( recommenda:ons(
Code(Review(K(Strengths( • Iden:fy(logic(flaws( • Uncover(hard(to( discover(bugs( • Code(coverage( • Pinpoints(vulnerable(
code(loca:on(
Code(Review(K(Weaknesses( • Resource(Intensive( • Expensive( • Slow( • Requires(source(code( •
Requires(tuning(and( configura:on(
Mi:ga:on(Techniques(
Web(App(Firewall(K(Strengths( • Cost(Effec:ve( • Reduces(vulnerability( exposure(( • Provides(breathing( room(for(fixes( •
Dynamic(Patching(
Web(App(Firewall(K(Weaknesses( • Advanced(configura:on( requires(manual(tuning( • May(lead(to(false(sense( of(security( • Another(device/ Applica:on(to(manage(
Code(Patches(K(Strengths( • Solves(the(root(cause(of( the(issue( • Raises(developers( security(awareness( • Increases(applica:on( reliability(
Code(Patches(K(Weaknesses( • Resource(intensive( • Costly( • Slow( • Third(Party(Developers( •
Legacy(Apps(
Blended(Approach( Web(App(Scanner( App(Server( Instrumenta:on( App(Firewall(
How(It(Works(–(Instrumenta:on( • Aspect(Orientated(Programming((AOP)( – Apply(security(checks(and(controls(across(an( applica:on(without(modifying(the(source(code( Input( Output( Target(Applica:on(
How(It(Works(–(Instrumenta:on( • Aspect(Orientated(Programming((AOP)( – Apply(security(checks(and(controls(across(an( applica:on(without(modifying(the(source(code( Input( Output( Target(Applica:on( AOP(Checks(and( controls(
on(entry(and(end(points((
AOP(Advice( • Input/output(valida:on( • Logging( • Access(control( • Error(handling( •
Transac:on(management( • Session(management( Method( AOP(Advice( Method(
AOP(as(a(WAF( • Intercept(HTTP(requests(and(responses( – Input(valida:on( – Session(Management( – Output(encoding( – Filter(informa:on(leakage(
Blended(Approach( Web(App(Scanner( App(Server( Instrumenta:on( App(Firewall( Provides(input(variables( Coverage(&(data(flow(( Provides(dynamic(patch(info( Retest(verifies(fixes( Intercepts((
Requests(&(Responses(
Applica:on(Instrumenta:on( • Provide(aHack(surface(details(to(Applica:on( Scanner( • Iden:fy(Scanner(code(coverage( • Generate(dynamic(patches(based(on(scanner( results(
Similar(Solu:ons(
Next(Steps( • Further(research(on( applying(AOP( Instrumenta:on( • AOP(based(WAF( • Integrate(Scanner( technology(
Conclusion( • Blended(App(Scanner,(WAF,(and( Instrumenta:on(provides:( – Cost(effec:ve( – Efficient( – Comprehensive( – Scalable( – Repeatable( – Consistent(results(
Ques:ons((
None
Introspec:on(
Addi:onal(Checks( • Regularly(checks(config( file(for(insecure(seangs( • Monitor(files(in(the( webroot( • Determines(all( applica:on(input(by(
evalua:ng(applica:on( code( • Trace(SQL( • Intercepts(all(requests/ responses( • Basic(WAF(capability(