Vulnerabilities and Exploitation - Application Security Sci-Fi Hipster Edition

•Transferir como PPTX, PDF•

0 gostou•494 visualizações

Explaining vulnerabilities, exploits, attack vectors, attack surface reduction, aslr etc to someone who understands The Imperial Deathstar. Presented at Opkoko 2013.1. Live presentation recording in Swedish here: http://www.youtube.com/watch?v=Xi9SRFENiO4

Tecnologia

Vulnerabilities and Exploitation
APPLICATION SECURITY SCI-FI HIPSTER EDITION!
peter magnusson
twitter: @blaufish_
omegapoint.se
sakerhetspodcasten.se

DEFENDER
Imperial Death Star
(legacy application)

VULNERABILITY
Reactor core
(document.write, s
printf, eval)

ATTACK VECTOR
Exhaust port / shaft
(code paths etc.
connecting input to
vulnerability )

EXPLOIT
Torpedo fitting into
exhaust port
Reach and gain
control over
vulnerability,
?id=%27%20SQL

EXPLOIT PAYLOAD
Exploding proton warhead
(metasploit meterpreter,
connect back shells, sqli
downloading database,
etc)

ATTACK SURFACE
REDUCTION
Disable by default
Close unused port
Force-field
(firewall)

FIX
VULNERABILITY
Exploding core ->
safe non-exploding
core
(sprintf -> snprintf)

DON’T JUST FIX
ONE ATTACK
VECTOR
Often multiple
paths to same
vulnernability

EXPLOIT
MITIGATION
ASLR: Randomize
location of
vulnerability

Recomendados

Pioneer VSX АВ ресиверы 2013 ХарактеристикиPioneer Europe

BestJobs GrowAndreea Mihăescu

Case netshoesannaluizawagner

Serial Killers - or Deserialization for fun and profitblaufish

CV-subodh Final 18th Oct 2016subodh sadvilkar

In the Stables with KidsKids'n'Go Editions

BSc(Computer)Abdullah Omaid

就職活動開始時期を遅らせるべきか[1]Kohei Yasuda

Buffer overflow attacksKapil Nagrale

Positive Hack Days. Тараканов. Мастер-класс: уязвимости нулевого дняPositive Hack Days

[論文紹介] VCC-Finder: Finding Potential Vulnerabilities in Open-Source Projects ...Kenta Yamamoto

System Hacking Tutorial #1 - Introduction to Vulnerability and Type of Vulner...sanghwan ahn

zkStudyClub: Zero-Knowledge Proofs Security, in Practice [JP Aumasson, Taurus]Alex Pruden

Os Cookoscon2007

Enabling Worm and Malware Investigation Using Virtualizationamiable_indian

Exploiting buffer overflowsPaul Dutot IEng MIET MBCS CITP OSCP CSTM

Buffer overflowEvgeni Tsonev

1Buttercup On Network-based Detection of Polymorphic B.docxaryan532920

Strategies for Landing an Oracle DBA Job as a FresherRemote DBA Services

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Miguel Araújo

Why Teams call analytics are critical to your entire businesspanagenda

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...DianaGray10

Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...apidays

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobeapidays

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProduct Anonymous

Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...apidays

AXA XL - Insurer Innovation Award Americas 2024The Digital Insurer

AWS Community Day CPH - Three problems of TerraformAndrey Devyatkin

Corporate and higher education May webinar.pptxRustici Software

ICT role in 21st century education and its challengesrafiqahmad00786416

Mais conteúdo relacionado

Semelhante a Vulnerabilities and Exploitation - Application Security Sci-Fi Hipster Edition

Buffer overflow attacksKapil Nagrale

Positive Hack Days. Тараканов. Мастер-класс: уязвимости нулевого дняPositive Hack Days

[論文紹介] VCC-Finder: Finding Potential Vulnerabilities in Open-Source Projects ...Kenta Yamamoto

System Hacking Tutorial #1 - Introduction to Vulnerability and Type of Vulner...sanghwan ahn

zkStudyClub: Zero-Knowledge Proofs Security, in Practice [JP Aumasson, Taurus]Alex Pruden

Os Cookoscon2007

Enabling Worm and Malware Investigation Using Virtualizationamiable_indian

Exploiting buffer overflowsPaul Dutot IEng MIET MBCS CITP OSCP CSTM

Buffer overflowEvgeni Tsonev

1Buttercup On Network-based Detection of Polymorphic B.docxaryan532920

Semelhante a Vulnerabilities and Exploitation - Application Security Sci-Fi Hipster Edition (10)

Buffer overflow attacks

Positive Hack Days. Тараканов. Мастер-класс: уязвимости нулевого дня

[論文紹介] VCC-Finder: Finding Potential Vulnerabilities in Open-Source Projects ...

System Hacking Tutorial #1 - Introduction to Vulnerability and Type of Vulner...

zkStudyClub: Zero-Knowledge Proofs Security, in Practice [JP Aumasson, Taurus]

Os Cook

Enabling Worm and Malware Investigation Using Virtualization

Exploiting buffer overflows

Buffer overflow

1Buttercup On Network-based Detection of Polymorphic B.docx

Último