veyepar: Preventing Deserialization attacks in Java applications

Hi user

Admin Login:

Name: Preventing Deserialization attacks in Java applications
--client lca --show lca2017 --room plenary 12053 --force
Prev: 12 securely backing up gpg private keys.. to the cloud‽
Next: 12 U 2 can U2F

show more...

Author(s):	Jason Shepherd
Location	Plenary Hall
Date	jan Mon 16	Days Raw Files
Start	18:15	First Raw Start	17:47
Duration	0:30:0	Offset	0:27:47
End	18:45	Last Raw End	18:47
Chapters	00:00 0:03:33
Total cuts_time	22 min.

http://linux.conf.au/schedule/presentation/163/
raw-playlist raw-mp4-playlist encoded-files-playlist host archive tweet mp4 svg png

final audio

assets release.pdf Preventing_Deserialization_attacks_in_Java_applications.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:
Locked:	clear this to unlock
Locked by:	user/process that locked.
Start:	initially scheduled time from master, adjusted to match reality
Duration:	length in hh:mm:ss
Name:	Video Title (shows in video search results)
Emails:	email(s) of the presenter(s)
Released:	has someone authorised pubication
Normalise:
Channelcopy:	m=mono, 01=copy left to right, 10=right to left, 00=ignore.
Thumbnail:	filename.png
Description:	Recent research by [Chris Frohoff and Gabriel Lawrence has exposed gadget chains](https://frohoff.github.io/appseccali-marshalling-pickles/) in various libraries that allow code to be executed during object deserialization in Java. They've done some excellent research, including [publishing some code](https://github.com/frohoff/ysoserial/) that allows anyone to serialize a malicious payload that when deserialized runs the operating system command of their choice, as the user which started the Java Virtual Machine (JVM). The vulnerabilities are not with the gadget chains themselves but with the code that deserializes them. There are couple of ways in which this type of attack on the JVM can be mitigated: * not deserializing untrusted objects; * not having the classes used in the 'gadget chain' in the classpath; * running the JVM as a non-root operating system user, with reduced privileges; * egress filtering not allowing any outbound traffic other than that matching a connection for which the firewall already has an existing state table entry. In this talk we'll explore each of these in detail, using JBoss EAP as a example of how these mitigations can be introduced. markdown
Comment:	production notes

recording sheet

recording sheet

2017-01-17/10_47_13.ts Apply: 17:47:13 - 18:14:04 ( 00:26:51 ) S: 17:47:13 - E: 18:17:13 D: 00:30:00 (End: 1611.0) show more...

vlc ~/Videos/veyepar/lca/lca2017/dv/plenary/2017-01-17/10_47_13.ts :start-time=00.0 --audio-desync=0

	Raw File	Cut List
	17:47:13		seconds: 0.0 Wall: 17:47:13
Duration	00:30:00
	18:17:13		seconds: 1611.0 Wall: 18:14:04
Comments:
mp4 mp4.m3u	dv.m3u	Split: Sequence:: delete

audio viz

2017-01-17/10_47_13.ts Apply: 18:14:04 - 18:17:13 ( 00:03:09 ) S: 17:47:13 - E: 18:17:13 D: 00:30:00 (Start: 1611.0) show more...

vlc ~/Videos/veyepar/lca/lca2017/dv/plenary/2017-01-17/10_47_13.ts :start-time=01611.0 --audio-desync=0

	Raw File	Cut List
	17:47:13		seconds: 1611.0 Wall: 18:14:04
Duration	00:30:00
	18:17:13		seconds: 0.0 Wall: 17:47:13
Comments:
mp4 mp4.m3u	dv.m3u	Split: Sequence:: delete

audio viz

2017-01-17/11_17_13.ts Apply: 18:17:13 - 18:19:55 ( 00:02:42 ) S: 18:17:13 - E: 18:47:13 D: 00:30:00 (End: 162.0) show more...

vlc ~/Videos/veyepar/lca/lca2017/dv/plenary/2017-01-17/11_17_13.ts :start-time=00.0 --audio-desync=0

	Raw File	Cut List
	18:17:13		seconds: 0.0 Wall: 18:17:13
Duration	00:30:00
	18:47:13		seconds: 162.0 Wall: 18:19:55
Comments:
mp4 mp4.m3u	dv.m3u	Split: Sequence:: delete

audio viz

2017-01-17/11_17_13.ts Apply: 18:19:55 - 18:23:28 ( 00:03:33 ) S: 18:17:13 - E: 18:47:13 D: 00:30:00 (Start: 162.0) (End: 375.0) show more...

vlc ~/Videos/veyepar/lca/lca2017/dv/plenary/2017-01-17/11_17_13.ts :start-time=0162.0 --audio-desync=0

	Raw File	Cut List
	18:17:13		seconds: 162.0 Wall: 18:19:55
Duration	00:30:00
	18:47:13		seconds: 375.0 Wall: 18:23:28
Comments:
mp4 mp4.m3u	dv.m3u	Split: Sequence:: delete

audio viz

2017-01-17/11_17_13.ts Apply: 18:23:28 - 18:42:03 ( 00:18:35 ) S: 18:17:13 - E: 18:47:13 D: 00:30:00 (Start: 375.0) (End: 1490.0) show more...

vlc ~/Videos/veyepar/lca/lca2017/dv/plenary/2017-01-17/11_17_13.ts :start-time=0375.0 --audio-desync=0

	Raw File	Cut List
	18:17:13		seconds: 375.0 Wall: 18:23:28
Duration	00:30:00
	18:47:13		seconds: 1490.0 Wall: 18:42:03
Comments:
mp4 mp4.m3u	dv.m3u	Split: Sequence:: delete

audio viz

2017-01-17/11_17_13.ts Apply: 18:42:03 - 18:47:13 ( 00:05:10 ) S: 18:17:13 - E: 18:47:13 D: 00:30:00 (Start: 1490.0) show more...

vlc ~/Videos/veyepar/lca/lca2017/dv/plenary/2017-01-17/11_17_13.ts :start-time=01490.0 --audio-desync=0

	Raw File	Cut List
	18:17:13		seconds: 1490.0 Wall: 18:42:03
Duration	00:30:00
	18:47:13		seconds: 0.0 Wall: 18:17:13
Comments:
mp4 mp4.m3u	dv.m3u	Split: Sequence:: delete

audio viz

Rf filename:	root is .../show/dv/location/, example: 2013-03-13/13:13:30.dv
Sequence:
get this:	check and save to add this

2017-01-17/10_47_13.ts
audio viz

audio viz

2017-01-17/11_17_13.ts
audio viz

audio viz

Veyepar Video Eyeball Processor and Review