veyepar: Preventing Deserialization attacks in Java applications

Author(s):	Jason Shepherd
Location	Plenary Hall
Date	jan Mon 16	Days Raw Files
Start	Jan. 16, 2017, 6:15 p.m.	First Raw Start	Jan. 16, 2017, 5:47 p.m.
Duration	0:30:0	Offset	0:27:47
End	Jan. 16, 2017, 6:45 p.m.	Last Raw End	Jan. 16, 2017, 6:47 p.m.
Chapters	00:00 0:03:33
Total cuts_time	22 min.

http://linux.conf.au/schedule/presentation/163/
raw-playlist raw-mp4-playlist encoded-files-playlist host archive tweet mp4 svg png

assets release.pdf Preventing_Deserialization_attacks_in_Java_applications.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:

Locked:

clear this to unlock

Locked by:

user/process that locked.

Start:

initially scheduled time from master, adjusted to match reality

Duration:

length in hh:mm:ss

Name:

Video Title (shows in video search results)

Emails:

email(s) of the presenter(s)

Released:

has someone authorised pubication

Normalise:

Channelcopy:

m=mono, 01=copy left to right, 10=right to left, 00=ignore.

Thumbnail:

filename.png

Description:

markdown

Recent research by [Chris Frohoff and Gabriel Lawrence has exposed gadget chains](https://frohoff.github.io/appseccali-marshalling-pickles/) in various libraries that allow code to be executed during object deserialization in Java. They've done some excellent research, including [publishing some code](https://github.com/frohoff/ysoserial/) that allows anyone to serialize a malicious payload that when deserialized runs the operating system command of their choice, as the user which started the Java Virtual Machine (JVM). The vulnerabilities are not with the gadget chains themselves but with the code that deserializes them.

There are couple of ways in which this type of attack on the JVM can be mitigated:

* not deserializing untrusted objects;
* not having the classes used in the 'gadget chain' in the classpath;
* running the JVM as a non-root operating system user, with reduced privileges;
* egress filtering not allowing any outbound traffic other than that matching a connection for which the firewall already has an existing state table entry.

In this talk we'll explore each of these in detail, using JBoss EAP as a example of how these mitigations can be introduced.

Comment:

production notes

2017-01-17/11_17_13.ts Apply: 18:19:55 - 18:23:28 ( 00:03:33 ) S: 18:17:13 - E: 18:47:13 D: 00:30:00 (Start: 162.0) (End: 375.0) show more...

vlc ~/Videos/veyepar/lca/lca2017/dv/plenary/2017-01-17/11_17_13.ts :start-time=0162.0 --audio-desync=0

	Raw File	Cut List
	Jan. 16, 2017, 6:17 p.m.		seconds: 162.0 Wall: 18:19:55
Duration	00:30:00
	Jan. 16, 2017, 6:47 p.m.		seconds: 375.0 Wall: 18:23:28
Comments:
mp4 mp4.m3u	dv.m3u	Split: Sequence:: delete

2017-01-17/11_17_13.ts Apply: 18:23:28 - 18:42:03 ( 00:18:35 ) S: 18:17:13 - E: 18:47:13 D: 00:30:00 (Start: 375.0) (End: 1490.0) show more...

vlc ~/Videos/veyepar/lca/lca2017/dv/plenary/2017-01-17/11_17_13.ts :start-time=0375.0 --audio-desync=0

	Raw File	Cut List
	Jan. 16, 2017, 6:17 p.m.		seconds: 375.0 Wall: 18:23:28
Duration	00:30:00
	Jan. 16, 2017, 6:47 p.m.		seconds: 1490.0 Wall: 18:42:03
Comments:
mp4 mp4.m3u	dv.m3u	Split: Sequence:: delete