Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Dynamic App Patching
Search
Jon Rose
January 01, 2010
Technology
2
69
Dynamic App Patching
Jon Rose
January 01, 2010
Tweet
Share
More Decks by Jon Rose
See All by Jon Rose
Agile Security
jonrose
1
170
Decoding Bug Bounty Programs
jonrose
1
520
Builders Vs. Breakers AppSec 2012
jonrose
2
220
Rich Internet Application Security
jonrose
2
94
Cloudy with a chance of 0-day
jonrose
1
73
Deblaze - A remote method enumeration tool for flex servers
jonrose
3
200
Deblaze - A Remote Method Enumeration Tool for Flex Servers, Defcon
jonrose
2
140
CodeSearch0day
jonrose
1
64
Other Decks in Technology
See All in Technology
大規模イベントに向けた ABEMA アーキテクチャの遍歴 ~ Platform Strategy 詳細解説 ~
nagapad
0
180
みんなのSRE 〜チーム全員でのSRE活動にするための4つの取り組み〜
kakehashi
PRO
2
120
AI人生苦節10年で会得したAIがやること_人間がやること.pdf
shibuiwilliam
1
260
TypeScript 上達の道
ysknsid25
23
5.2k
VLMサービスを用いた請求書データ化検証 / SaaSxML_Session_1
sansan_randd
0
200
クマ×共生 HACKATHON - 熊対策を『特別な行動」から「生活の一部」に -
pharaohkj
0
280
反脆弱性(アンチフラジャイル)とデータ基盤構築
cuebic9bic
2
150
【CEDEC2025】大規模言語モデルを活用したゲーム内会話パートのスクリプト作成支援への取り組み
cygames
PRO
2
720
金融サービスにおける高速な価値提供とAIの役割 #BetAIDay
layerx
PRO
1
650
【CEDEC2025】現場を理解して実現!ゲーム開発を効率化するWebサービスの開発と、利用促進のための継続的な改善
cygames
PRO
0
690
JAWS AI/ML #30 AI コーディング IDE "Kiro" を触ってみよう
inariku
2
100
AIに全任せしないコーディングとマネジメント思考
kikuchikakeru
0
400
Featured
See All Featured
Making Projects Easy
brettharned
117
6.3k
Product Roadmaps are Hard
iamctodd
PRO
54
11k
Why You Should Never Use an ORM
jnunemaker
PRO
58
9.5k
Intergalactic Javascript Robots from Outer Space
tanoku
272
27k
GraphQLの誤解/rethinking-graphql
sonatard
71
11k
Embracing the Ebb and Flow
colly
86
4.8k
How to Think Like a Performance Engineer
csswizardry
25
1.8k
jQuery: Nuts, Bolts and Bling
dougneiner
63
7.8k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
507
140k
No one is an island. Learnings from fostering a developers community.
thoeni
21
3.4k
Performance Is Good for Brains [We Love Speed 2024]
tammyeverts
10
1k
The Invisible Side of Design
smashingmag
301
51k
Transcript
Resolving*Applica/on* Vulnerabili/es* Blending(App(Scanners,(WAF’s,( and(Code(Instrumenta:on(
Agenda( • The(Problem( • Iden:fying(Risk( – Web(App(Scanning( – Code(Review( •
Mi:ga:ng(Risks( – Code(Patches( – Web(Applica:on(Firewall( • A(Blended(Solu:on(
The(Problem( • Web(apps(have(security(vulnerabili:es( ( • Feature(deadlines( • Inexperienced( developers( •
Poor(system( administra:on( • Insecure(defaults( • Vulnerable(libraries(
The(Threat(Is(Increasing( AHackers(techniques(&(toolkits(have(advanced(
CrossKEyed(( Scrip:ng( ( Click(Jacking( ( GIFAR( ( Deblaze( ( (
Recent(AHacks(
Common(Approaches( Iden:fica:on( – Web(Applica:on(Scanning( – Code(Review( ( Remedia:on( – Web(Applica:on(Firewall( – Code(Patches( (
Iden:fica:on(
Web(App(Scanning(K(Strengths( • Easily(finds(common( vulnerabili:es( • Language(/(PlaTorm( independent( • Fast(and(Repeatable( •
CostKeffec:ve(( • Consistent(Repor:ng(
Web(App(Scanning(K(Weaknesses( • AHack(Surface(Coverage( • Detec:ng(complex(&( unique(flaws( ( • Pinpoint(vulnerable(code( loca:on(
• Providing(specific( recommenda:ons(
Code(Review(K(Strengths( • Iden:fy(logic(flaws( • Uncover(hard(to( discover(bugs( • Code(coverage( • Pinpoints(vulnerable(
code(loca:on(
Code(Review(K(Weaknesses( • Resource(Intensive( • Expensive( • Slow( • Requires(source(code( •
Requires(tuning(and( configura:on(
Mi:ga:on(Techniques(
Web(App(Firewall(K(Strengths( • Cost(Effec:ve( • Reduces(vulnerability( exposure(( • Provides(breathing( room(for(fixes( •
Dynamic(Patching(
Web(App(Firewall(K(Weaknesses( • Advanced(configura:on( requires(manual(tuning( • May(lead(to(false(sense( of(security( • Another(device/ Applica:on(to(manage(
Code(Patches(K(Strengths( • Solves(the(root(cause(of( the(issue( • Raises(developers( security(awareness( • Increases(applica:on( reliability(
Code(Patches(K(Weaknesses( • Resource(intensive( • Costly( • Slow( • Third(Party(Developers( •
Legacy(Apps(
Blended(Approach( Web(App(Scanner( App(Server( Instrumenta:on( App(Firewall(
How(It(Works(–(Instrumenta:on( • Aspect(Orientated(Programming((AOP)( – Apply(security(checks(and(controls(across(an( applica:on(without(modifying(the(source(code( Input( Output( Target(Applica:on(
How(It(Works(–(Instrumenta:on( • Aspect(Orientated(Programming((AOP)( – Apply(security(checks(and(controls(across(an( applica:on(without(modifying(the(source(code( Input( Output( Target(Applica:on( AOP(Checks(and( controls(
on(entry(and(end(points((
AOP(Advice( • Input/output(valida:on( • Logging( • Access(control( • Error(handling( •
Transac:on(management( • Session(management( Method( AOP(Advice( Method(
AOP(as(a(WAF( • Intercept(HTTP(requests(and(responses( – Input(valida:on( – Session(Management( – Output(encoding( – Filter(informa:on(leakage(
Blended(Approach( Web(App(Scanner( App(Server( Instrumenta:on( App(Firewall( Provides(input(variables( Coverage(&(data(flow(( Provides(dynamic(patch(info( Retest(verifies(fixes( Intercepts((
Requests(&(Responses(
Applica:on(Instrumenta:on( • Provide(aHack(surface(details(to(Applica:on( Scanner( • Iden:fy(Scanner(code(coverage( • Generate(dynamic(patches(based(on(scanner( results(
Similar(Solu:ons(
Next(Steps( • Further(research(on( applying(AOP( Instrumenta:on( • AOP(based(WAF( • Integrate(Scanner( technology(
Conclusion( • Blended(App(Scanner,(WAF,(and( Instrumenta:on(provides:( – Cost(effec:ve( – Efficient( – Comprehensive( – Scalable( – Repeatable( – Consistent(results(
Ques:ons((
None
Introspec:on(
Addi:onal(Checks( • Regularly(checks(config( file(for(insecure(seangs( • Monitor(files(in(the( webroot( • Determines(all( applica:on(input(by(
evalua:ng(applica:on( code( • Trace(SQL( • Intercepts(all(requests/ responses( • Basic(WAF(capability(