Priyanka Aash, profile picture
Uploaded byPriyanka Aash
1,241 views

Android Serialization Vulnerabilities Revisited

The document discusses vulnerabilities in Android related to serialization, specifically focusing on the CVE-2014-7911 and CVE-2015-3825 exploits that allowed malware to execute arbitrary code through deserialization of untrusted data in system_server. It outlines the history of serialization vulnerabilities and presents a detailed overview of how these exploits operate, including examples of code and techniques used by attackers. The document also notes Google’s patches for these vulnerabilities and the need for ongoing improvements in security measures against such exploits.

Embed presentation

Downloaded 16 times
1 / 103
2 / 103
Most read
3 / 103
4 / 103
5 / 103
6 / 103
7 / 103
8 / 103
9 / 103
10 / 103
11 / 103
12 / 103
13 / 103
14 / 103
15 / 103
16 / 103
17 / 103
18 / 103
19 / 103
20 / 103
21 / 103
22 / 103
23 / 103
Most read
24 / 103
25 / 103
26 / 103
27 / 103
28 / 103
29 / 103
30 / 103
31 / 103
32 / 103
33 / 103
34 / 103
35 / 103
36 / 103
37 / 103
38 / 103
39 / 103
40 / 103
41 / 103
Most read
42 / 103
43 / 103
44 / 103
45 / 103
46 / 103
47 / 103
48 / 103
49 / 103
50 / 103
51 / 103
52 / 103
53 / 103
54 / 103
55 / 103
56 / 103
57 / 103
58 / 103
59 / 103
60 / 103
61 / 103
62 / 103
63 / 103
64 / 103
65 / 103
66 / 103
67 / 103
68 / 103
69 / 103
70 / 103
71 / 103
72 / 103
73 / 103
74 / 103
75 / 103
76 / 103
77 / 103
78 / 103
79 / 103
80 / 103
81 / 103
82 / 103
83 / 103
84 / 103
85 / 103
86 / 103
87 / 103
88 / 103
89 / 103
90 / 103
91 / 103
92 / 103
93 / 103
94 / 103
95 / 103
96 / 103
97 / 103
98 / 103
99 / 103
100 / 103
101 / 103
102 / 103
103 / 103
SESSION ID: #RSAC Roee HayAndroid Serialization Vulnerabilities Revisited MBS-F03 X-Force Application Security Team Lead IBM Security @roeehay Joint work with Or Peles
#RSAC We will see how this Android SDK class 2 public class OpenSSLX509Certificate extends X509Certificate { private final long mContext; … } MISSING MODIFIER BEFORE OUR DISCLOSURE! (NOW PATCHED)
#RSAC Led to malware capable of this… 3 REPLACEMENT OF APPS SELINUX BYPASS ACCESS TO APPS’ DATA KERNEL CODE EXEC (on select devices)
#RSAC Introduction 4
#RSAC Serialization 5 class foo { int bar; String baz; long *qux; } SENDER RECIPIENT MEDIA = 1234 = “hi” = 0x1f334233
#RSAC Serialization 6 001010…0110 SENDER Serialize MEDIA class foo { int bar; String baz; long *qux; } = 1234 = “hi” = 0x1f334233 RECIPIENT
#RSAC Serialization 7 001010…0110 SENDER Serialize Deserialize MEDIA class foo { int bar; String baz; long *qux; } = 1234 = “hi” = 0x1f334233 class foo { int bar; String baz; long *qux; } = 1234 = “hi” = 0x14d3e2c3 RECIPIENT
#RSAC Vulnerability Root Cause 8 ObjectInputStream ois = new ObjectInputStream(insecureSource); Foo t = (Foo)ois.readObject(); DESERIALIZATION OF UNTRUSTED DATA
#RSAC Vulnerability Root Cause 9 class dangerous { … } class dangerous { … } 001010…0110 ATTACKER Serialize Deserialize MEDIA VICTIM
#RSAC Example of a vulnerability 10 class dangerous { int *ptr; } class dangerous { int *ptr; } 001010…0110 ATTACKER Serialize Deserialize MEDIA VICTIM
#RSAC Example of a vulnerability 11 class dangerous { int *ptr; } class dangerous { int *ptr; } 001010…0110 ATTACKER Serialize Deserialize MEDIA = 0x66666666 = 0x66666666 VICTIM
#RSAC Vulnerability Root Cause 12 ObjectInputStream ois = new ObjectInputStream(insecureSource); dangerous t = (dangerous)ois.readObject(); callNative(t.ptr) RECIPIENT CODE
#RSAC History of Serialization Vulnerabilities 13 2009 - Shocking News in PHP Exploitation 2011 - Spring Framework Serialization-based remoting vulnerabilities 2012 - AtomicReferenceArray type confusion vulnerability 2013 - Apache Commons FileUpload Deserialization Vulnerability - Ruby on Rails YAML Deserialization Code Execution 2014 - Android <5.0 Privilege Escalation using ObjectInputStream 2015 - Android OpenSSLX509Certificate Deserialization Vulnerability - Apache Groovy Deserialization of Untrusted Data - Apache Commons Collections Unsafe Classes
#RSAC History of Serialization Vulnerabilities 14 2009 - Shocking News in PHP Exploitation 2011 - Spring Framework Serialization-based remoting vulnerabilities 2012 - AtomicReferenceArray type confusion vulnerability 2013 - Apache Commons FileUpload Deserialization Vulnerability - Ruby on Rails YAML Deserialization Code Execution 2014 - Android <5.0 Privilege Escalation using ObjectInputStream 2015 - Android OpenSSLX509Certificate Deserialization Vulnerability - Apache Groovy Deserialization of Untrusted Data - Apache Commons Collections Unsafe Classes
#RSAC Android Inter-App Communication
#RSAC Android Inter-App Communication 101 Intent { play:// …} Intent { sms:// …}
#RSAC An Intent can also contain Bundle Strings Primitives Arrays
#RSAC An Intent can also contain Bundle Strings Primitives Arrays Serializable Objects
#RSAC Motivation 19
#RSAC Previous work CVE-2014-7911 (Jann Horn): Non-Serializable Classes can be Deserialized on target.
#RSAC Exploiting CVE-2014-7911 21 MALWARE TARGET Step 1. Find an interesting target.
#RSAC The Target 22 SYSTEM_SERVER
#RSAC Exploiting CVE-2014-7911 23 MALWARE SYSTEM_SERVER Step 2. Send target a ‘serialized’ object in a Bundle Serialized Object of non-Serializable class
#RSAC The Serialized Object 24 final class BinderProxy implements IBinder { private long mOrgue;  POINTER … private native final destroy(); @Override protected void finalize() throws Throwable { try { destroy(); } finally { super.finalize(); } }
#RSAC Android Apps are not just Java… 25 App Java Native (C/C++)
#RSAC Android Apps are not just Java… 26 App Java Native (C/C++) JNI
#RSAC Pointers may pass back and forth 27 App Java Native (C/C++) JNI pointers
#RSAC Pointers may pass back and forth 28 App Java Native (C/C++) JNI pointers
#RSAC The Serialized Object 29 final class BinderProxy implements IBinder { private long mOrgue;  POINTER … private native final destroy(); @Override protected void finalize() throws Throwable { try { destroy(); } finally { super.finalize(); } }
#RSAC Exploiting CVE-2014-7911 30 MALWARE SYSTEM_SERVER Step 3. Make it deserialize on the target Deserialized object
#RSAC Make it deserialize automatically 31 public String getString(String key) } unparcel();  DESERIALIZES ALL final Object o = mMap.get(key); try { return (String) o; } catch (ClassCastException e) {typeWarning…} } All Bundle members are deserialized with a single ‘touch’ without type checking before deserialization e.g.
#RSAC Exploiting CVE-2014-7911 32 MALWARE SYSTEM_SERVER Step 4. Make one of its methods execute on target. Executed Method of object
#RSAC The Serialized Object 33 final class BinderProxy implements IBinder { private long mOrgue; … private native final destroy(); @Override protected void finalize() throws Throwable { try { destroy(); } finally { super.finalize(); } }  EXECUTED AUTOMATICALLY BY THE GC
#RSAC A Word about Garbage Collection 34 Object A (root) Object C Object B App’s Memory
#RSAC A Word about Garbage Collection 35 Object A (root) Object C Object B App’s Memory
#RSAC A Word about Garbage Collection 36 Object A (root) Object B App’s Memory
#RSAC The Serialized Object 37 final class BinderProxy implements IBinder { private long mOrgue; … private native final destroy(); @Override protected void finalize() throws Throwable { try { destroy(); } finally { super.finalize(); } }  EXECUTED AUTOMATICALLY BY THE GC
#RSAC The Serialized Object 38 final class BinderProxy implements IBinder { private long mOrgue; … private native final destroy(); @Override protected void finalize() throws Throwable { try { destroy(); } finally { super.finalize(); } }  NATIVE METHOD THAT USES THE PTR
#RSAC Google’s Patch for CVE-2014-7911 39 Do not Deserialize Non-Serializable Classes
#RSAC Our 1st contribution: The Android Vulnerability CVE-2015-3825/37 40
#RSAC Our Research Question 41 Class Foo implements Serializable { private long mObject; … private native final destroy(); @Override protected void finalize() throws Throwable { try { destroy(); } finally { super.finalize(); } } CONTROLLABLE POINTER POINTER USED IN NATIVE CODE. EXECUTED AUTOMATICALLY BY THE GC
#RSAC Experiment 1 42
#RSAC Experiment 1 43 boot.art
#RSAC Experiment 1 44 boot.art ~13K Loadable Java Classes
#RSAC Experiment 1 45 boot.art App: Loaded classes using Reflection ~13K Loadable Java Classes
#RSAC Experiment 1 46 boot.art App: Loaded classes using Reflection ~13K Loadable Java Classes Dumped classes: 1. Serializable 2. Finalize method 3. Controllable fields
#RSAC The Result 47 OpenSSLX509Certificate
#RSAC public class OpenSSLX509Certificate extends X509Certificate { private final long mContext; @Override protected void finalize() throws Throwable { ... NativeCrypto.X509_free(mContext); ... } } The Result 48
#RSAC public class OpenSSLX509Certificate extends X509Certificate { private final long mContext; @Override protected void finalize() throws Throwable { ... NativeCrypto.X509_free(mContext); ... } } The Result 49 (1) SERIALIZABLE
#RSAC public class OpenSSLX509Certificate extends X509Certificate { private final long mContext; @Override protected void finalize() throws Throwable { ... NativeCrypto.X509_free(mContext); ... } } The Result 50 (1) SERIALIZABLE (2) CONTROLLABLE POINTER
#RSAC public class OpenSSLX509Certificate extends X509Certificate { private final long mContext; @Override protected void finalize() throws Throwable { ... NativeCrypto.X509_free(mContext); ... } } The Result 51 (1) SERIALIZABLE (2) CONTROLLABLE POINTER (3) EXECUTED AUTOMATICALLY BY THE GC
#RSAC Arbitrary Decrement 52 NativeCrypto.X509_free(mContext) X509_free(x509); ASN1_item_free(x509, ...) asn1_item_combine_free(&val, ...) if (asn1_do_lock(pval, -1,...) > 0) return; // x509 = mContext // val = *pval = mContext // Decreases a reference counter (mContext+𝟎𝐱𝟏𝟎) // MUST be POSITIVE INTEGER (MSB=𝟎)
#RSAC Arbitrary Decrement 53 ref = mContext+0x10 if (*ref > 0) *ref-- else free(…)
#RSAC Proof-of-Concept Exploit Arbitrary Code Execution in system_server 54
#RSAC Exploit Outline 55 MALWARE SYSTEM_SERVER Malicious Serialized Object(s) w/ payload buffer
#RSAC Exploit Outline 56 MALWARE SYSTEM_SERVER shellcode
#RSAC First Step of the Exploit 57 Own the Program Counter (PC)
#RSAC Own the Program Counter 58 1. Override some offset / function ptr 2. Get it called.
#RSAC Creating an Arbitrary Code Exec Exploit 59 ARSENAL 1. Arbitrary Decrement 2. Controlled Buffer
#RSAC Constrained Arbitrary Memory Overwrite 60 Bundle OpenSSLX509Certificate mContext=0𝑥11111100 ∗ 0𝑥11111110 −= 1
#RSAC Constrained Arbitrary Memory Overwrite 61 Bundle OpenSSLX509Certificate mContext=0𝑥11111100 OpenSSLX509Certificate mContext=0𝑥11111100 ∗ 0𝑥11111110 −= 2
#RSAC Constrained Arbitrary Memory Overwrite 62 Bundle OpenSSLX509Certificate mContext=0𝑥11111100 OpenSSLX509Certificate mContext=0𝑥11111100 OpenSSLX509Certificate mContext=0𝑥11111100 ⋮ ∗ 0𝑥11111110 −= 𝑛
#RSAC Constrained Arbitrary Memory Overwrite 63 Bundle OpenSSLX509Certificate mContext=0𝑥11111100 OpenSSLX509Certificate mContext=0𝑥11111100 OpenSSLX509Certificate mContext=0𝑥11111100 ⋮ ∗ 0𝑥11111110 −= 𝑛 and If we knew the original value: Arbitrary Overwrite
#RSAC Creating an Arbitrary Code Exec Exploit 64 ARSENAL 1. Arbitrary Decrement 2. Controlled Buffer 3. Arbitrary Overwrite (if we knew the original value)
#RSAC Creating an Arbitrary Code Exec Exploit 65 ARSENAL DEFENSES 1. Arbitrary Decrement 2. Controlled Buffer 3. Arbitrary Overwrite (if we knew the original value) 1. ASLR 2. RELRO 3. NX pages 4. SELinux
#RSAC Finding the original value: observation system_server malware root@generic:/# cat /proc/<system_server>/maps 70e40000-72cee000 r—p ... boot.oat 72cee000-74400000 r-xp ... boot.oat 74400000-74401000 rw-p ... boot.oat … aa09f000-aa0c3000 r-xp ... libjavacrypto.so aa0c3000-aa0c4000 r--p ... libjavacrypto.so aa0c4000-aa0c5000 rw-p ... libjavacrypto.so … b6645000-b66d5000 r-xp ... libcrypto.so b66d6000-b66e1000 r--p ... libcrypto.so b66e1000-b66e2000 rw-p ... libcrypto.so root@generic:/# cat /proc/<malware>/maps 70e40000-72cee000 r—p ... boot.oat 72cee000-74400000 r-xp ... boot.oat 74400000-74401000 rw-p ... boot.oat … aa09f000-aa0c3000 r-xp ... libjavacrypto.so aa0c3000-aa0c4000 r--p ... libjavacrypto.so aa0c4000-aa0c5000 rw-p ... libjavacrypto.so … b6645000-b66d5000 r-xp ... libcrypto.so b66d6000-b66e1000 r--p ... libcrypto.so b66e1000-b66e2000 rw-p ... libcrypto.so
#RSAC Zygote app creation model fork() fork() fork() fork()fork without execve = no ASLR! Zygote system_server App_1 App_N malware
#RSAC Determining the value fork() fork() <libXYZ> value Zygote system_server malware <libXYZ> value <libXYZ> value
#RSAC Creating an Arbitrary Code Exec Exploit 69 ARSENAL DEFENSES 1. Arbitrary Decrement 2. Controlled Buffer 3. Arbitrary Overwrite (if we knew the original value) 1. ASLR 2. RELRO 3. NX pages 4. SELinux
#RSAC Using the Arbitrary Overwrite 70 Goal. Overwite some pointer Problem. .got is read only (RELRO)
#RSAC A Good Memory Overwrite Target 71 A function pointer under .data id_callback in libcrypto Called during deserialization of: OpenSSLECPrivateKey
#RSAC Triggering id_callback remotely 72 Bundle system_server OpenSSLECPrivateKey BAD DATA that leads to the right path Malware
#RSAC First Step Accomplished 73 We now own the Program Counter
#RSAC Creating an Arbitrary Code Exec Exploit 74 ARSENAL DEFENSES 1. Arbitrary Decrement 2. Controlled Buffer 3. Arbitrary Overwrite (if we knew the original value) 1. ASLR 2. RELRO 3. NX pages 4. SELinux
#RSAC Next Steps of the PoC Exploit (simplified) 75 system_server pc → r-x code rw- stack rw- ROP chain rw- shellcode sp →
#RSAC Problem 1: SP does not point at ROP chain 76 system_server pc → r-x code rw- stack rw- ROP chain rw- shellcode sp →
#RSAC Solution: Stack Pivoting 77 system_server pc → r-x code/pivot rw- stack rw- ROP chain rw- shellcode sp → Our buffer happens to be pointed by fp. The Gadget: mov sp, fp; …, pop {…} Gadget: Stack Pivot fp →
#RSAC Solution: Stack Pivoting 78 system_server pc → r-x code/pivot rw- stack rw- ROP chain rw- shellcode sp → Our buffer happens to be pointed by fp. The Gadget: mov sp, fp; …, pop {…} Gadget: Stack Pivot
#RSAC Allocating RWX Memory 79 system_server pc → r-x code/mmap rw- stack rw- ROP chain rw- shellcode sp → Gadget: Stack Pivot fp → Gadget: mmap/RWX
#RSAC Problem 2: SELinux should prohibit mmap/RWX 80 system_server pc → r-x code/mmap rw- stack rw- ROP chain rw- shellcode sp → Gadget: Stack Pivot fp → Gadget: mmap/RWX
#RSAC Solution: Weak SELinux Policy for system_server 81 system_server pc → r-x code/mmap rw- stack rw- ROP chain rw- shellcode sp → Gadget: Stack Pivot fp → Gadget: mmap/RWX
#RSAC Solution: Weak SELinux Policy for system_server 82 system_server pc → r-x code/mmap rw- stack rw- ROP chain rw- shellcode sp → Gadget: Stack Pivot fp → Gadget: mmap/RWX allow system_server self:process execmem
#RSAC Allocating RWX Memory 83 system_server pc → r-x code/mmap rw- stack rw- ROP chain rw- shellcode rwx - sp → Gadget: Stack Pivot Gadget: mmap/RWX
#RSAC Copying our Shellcode 84 system_server pc → r-x code/memcpy rw- stack rw- ROP chain rw- shellcode rwx - sp → Gadget: Stack Pivot Gadget: mmap/RWX Gadget: memcpy
#RSAC Copying our Shellcode 85 system_server pc → r-x code/memcpy rw- stack rw- ROP chain rw- shellcode rwx shellcode sp → Gadget: Stack Pivot Gadget: mmap/RWX Gadget: memcpy
#RSAC Executing our Shellcode 86 system_server pc → r-x code rw- stack rw- ROP chain rw- shellcode rwx shellcode sp → Gadget: Stack Pivot Gadget: mmap/RWX Gadget: memcpy shellcode
#RSAC Creating an Arbitrary Code Exec Exploit 87 ARSENAL DEFENSES 1. Arbitrary Decrement 2. Controlled Buffer 3. Arbitrary Overwrite (if we knew the original value) 1. ASLR 2. RELRO 3. NX pages 4. SELinux
#RSAC Shellcode 88 REPLACEMENT OF APPS SELINUX BYPASS ACCESS TO APPS’ DATA KERNEL CODE EXEC (on select devices) Runs as system, still subject to the SELinux, but can:
#RSAC Demo 89
#RSAC Google’s Patch for CVE-2015-3825 90 public class OpenSSLX509Certificate extends X509Certificate { private transient final long mContext; … } MISSING MODIFIER BEFORE OUR DISCLOSURE! (NOW PATCHED)
#RSAC Hardened SELinux policy in the AOSP master branch 91 AOSP Commit #1: AOSP Commit #2:
#RSAC Are you patched? 92 Good news! Majority of the devices are updated But some aren’t…
#RSAC Our 2nd Contribution: Vulnerabilities in SDKs CVE-2015-2000/1/2/3/4/20 93
#RSAC Finding Similar Vulnerabilities in SDKs Goal. Find vulnerable Serializable classes in 3rd-party SDKs Why. Fixing the Android Platform Vulnerability is not enough. Apps can be exploited as well!
#RSAC Experiment 2 95 Analyzed over 32K of popular Android apps Main Results CVE-2015-2000 Jumio SDK Code Exec. CVE-2015-2001 MetaIO SDK Code Exec. CVE-2015-2002 Esri ArcGis SDK Code Exec. CVE-2015-2003 PJSIP PJSUA2 SDK Code Exec. CVE-2015-2004 GraceNote SDK Code Exec. CVE-2015-2020 MyScript SDK Code Exec.
#RSAC Root Cause (for most of the SDKs) 96 SWIG, a C/C++ to Java interoperability tool, can generate vulnerable classes. public class Foo implements Bar { private long swigCPtr; protected boolean swigCMemOwn; ... protected void finalize() { delete(); } public synchronized void delete() { … exampleJNI.delete_Foo(swigCPtr); … } ... } CONTROLLABLE POINTER POINTER USED IN NATIVE CODE POSSIBLY SERIALIZABLE
#RSAC SDK 1 SDK 2 SDK N DEVELOPERS END USERS Patching is problematic for SDKs
#RSAC Apps are in a bad place Vulnerable apps are still out there. SDKs need to be updated by app developers. Dozens of apps still use them! (as of Feb ‘16) New vulnerable apps can emerge Developers can introduce their own vulnerable classes.
#RSAC Apps are in a bad place Exploitation Still no type-checking by Android before deserialization. ASLR can still be defeated when malware attacks Zygote forked processes. As opposed to system_server, The SELinux policy hasn’t been hardened for the apps domain.
#RSAC Wrap-up 100
#RSAC Summary Found a high severity vulnerability in Android (Exp. 1). Wrote a reliable PoC exploit against it. Found similar vulnerabilities in 6 third-party SDKs (Exp. 2). Patches are available for all of the vulnerabilities and also for SWIG. Consumers: Update your Android. Developers: Update your SDKs. Do not create vuln. Serializable classes. Use transient when needed!
#RSAC Thank you! 102 ? ARE YOU STILL VULNERABLE?
#RSAC References Paper. https://www.usenix.org/conference/woot15/workshop-program/presentation/peles Video. https://www.youtube.com/watch?v=VekzwVdwqIY Nexus Security Bulletin. https://source.android.com/security/bulletin/2015-08-01.html AOSP Patch. https://android.googlesource.com/platform/external/conscrypt/+/edf7055461e2d7fa18de5196dca80 896a56e3540 OpenSSLX509CertificateChecker. https://play.google.com/store/apps/details?id=roeeh.conscryptchecker

More Related Content

PPTX
Triton and Symbolic execution on GDB@DEF CON China
byWei-Bo Chen
 
PDF
An Overview of Deserialization Vulnerabilities in the Java Virtual Machine (J...
byjoaomatosf_
 
PDF
configuring+oracle+rds+with+glasfish+server
byhunghtc83
 
PDF
Node Architecture and Getting Started with Express
byjguerrero999
 
PPTX
Pentesting ReST API
byNutan Kumar Panda
 
PDF
Exploiting Deserialization Vulnerabilities in Java
byCODE WHITE GmbH
 
PPTX
Testing an onion architecture - done right
byMichel Schudel
 
PDF
Polyglot payloads in practice by avlidienbrunn at HackPra
byMathias Karlsson
 
Triton and Symbolic execution on GDB@DEF CON China
byWei-Bo Chen
 
An Overview of Deserialization Vulnerabilities in the Java Virtual Machine (J...
byjoaomatosf_
 
configuring+oracle+rds+with+glasfish+server
byhunghtc83
 
Node Architecture and Getting Started with Express
byjguerrero999
 
Pentesting ReST API
byNutan Kumar Panda
 
Exploiting Deserialization Vulnerabilities in Java
byCODE WHITE GmbH
 
Testing an onion architecture - done right
byMichel Schudel
 
Polyglot payloads in practice by avlidienbrunn at HackPra
byMathias Karlsson
 

What's hot

PPTX
Spring Boot
byJiayun Zhou
 
PPTX
Modern JS with ES6
byKevin Langley Jr.
 
PPTX
SpringBoot with MyBatis, Flyway, QueryDSL
bySunghyouk Bae
 
PPTX
Sql injection
byNuruzzaman Milon
 
PPTX
Bug bounty
byn|u - The Open Security Community
 
PDF
Ch 1: Web Application (In)security & Ch 2: Core Defense Mechanisms
bySam Bowne
 
PPT
Java Security
byelliando dias
 
PPTX
Guide to an API-first Strategy
byKellton Tech Solutions Ltd
 
PDF
Introduction to Java
byProfessional Guru
 
PPTX
Oracle APEX Performance
byScott Wesley
 
PPTX
Lightweight static code analysis with semgrep
byNull Bhubaneswar
 
PDF
OSGi Presentation
byMichal Malohlava
 
PPT
Java basic
bySonam Sharma
 
PPTX
API Security Fundamentals
byJosé Haro Peralta
 
PPTX
API Management Reference Architecture
bySeong-Bok Lee
 
PDF
Java Deserialization Vulnerabilities - The Forgotten Bug Class
byCODE WHITE GmbH
 
PPTX
Jdbc
byNitesh Kumar Pandey
 
PDF
Stateless Auth using OAUTH2 & JWT
byMobiliya
 
PPTX
.Net Core
byBertrand Le Roy
 
PDF
Checkmarx meetup API Security - API Security top 10 - Erez Yalon
byAdar Weidman
 
Spring Boot
byJiayun Zhou
 
Modern JS with ES6
byKevin Langley Jr.
 
SpringBoot with MyBatis, Flyway, QueryDSL
bySunghyouk Bae
 
Sql injection
byNuruzzaman Milon
 
Bug bounty
byn|u - The Open Security Community
 
Ch 1: Web Application (In)security & Ch 2: Core Defense Mechanisms
bySam Bowne
 
Java Security
byelliando dias
 
Guide to an API-first Strategy
byKellton Tech Solutions Ltd
 
Introduction to Java
byProfessional Guru
 
Oracle APEX Performance
byScott Wesley
 
Lightweight static code analysis with semgrep
byNull Bhubaneswar
 
OSGi Presentation
byMichal Malohlava
 
Java basic
bySonam Sharma
 
API Security Fundamentals
byJosé Haro Peralta
 
API Management Reference Architecture
bySeong-Bok Lee
 
Java Deserialization Vulnerabilities - The Forgotten Bug Class
byCODE WHITE GmbH
 
Jdbc
byNitesh Kumar Pandey
 
Stateless Auth using OAUTH2 & JWT
byMobiliya
 
.Net Core
byBertrand Le Roy
 
Checkmarx meetup API Security - API Security top 10 - Erez Yalon
byAdar Weidman
 

Similar to Android Serialization Vulnerabilities Revisited

PPTX
Fixing the Java Serialization Mess
bySalesforce Engineering
 
PDF
[Wroclaw #7] Why So Serial?
byOWASP
 
PDF
Breakfast cereal for advanced beginners
byTruptiranjan Nayak
 
PDF
Unsafe Deserialization Attacks In Java and A New Approach To Protect The JVM ...
byApostolos Giannakidis
 
PPTX
Deserialization vulnerabilities
byGreenD0g
 
PDF
Persistent Session Storage
byWO Community
 
PPTX
Auscert 2022 - log4shell and history of Java deserialisation RCE
byDavid Jorm
 
PDF
Mitigating Java Deserialization attacks from within the JVM (improved version)
byApostolos Giannakidis
 
PDF
(De)serial Killers - BSides Las Vegas & AppSec IL 2018
byCheckmarx
 
PPTX
(De)serial Killers - BSides Las Vegas & AppSec IL 2018
byDor Tumarkin
 
PDF
SyScan 2016 - Remote code execution via Java native deserialization
byDavid Jorm
 
PDF
Mitigating Java Deserialization attacks from within the JVM
byApostolos Giannakidis
 
PDF
Surviving the Java Deserialization Apocalypse // OWASP AppSecEU 2016
byChristian Schneider
 
PDF
Java Deserialization Vulnerabilities - The Forgotten Bug Class (RuhrSec Edition)
byCODE WHITE GmbH
 
PDF
Defending against Java Deserialization Vulnerabilities
byLuca Carettoni
 
PPTX
BlueHat v17 || Dangerous Contents - Securing .Net Deserialization
byBlueHat Security Conference
 
PDF
Demystifying Apple 'Pie' & TouchID
bySebastián Guerrero Selma
 
PDF
OWASP SD: Deserialize My Shorts: Or How I Learned To Start Worrying and Hate ...
byChristopher Frohoff
 
PPTX
Insecure Java Deserialization
byShiv Sahni
 
PDF
.NET Deserialization Attacks
byDharmalingam Ganesan
 
Fixing the Java Serialization Mess
bySalesforce Engineering
 
[Wroclaw #7] Why So Serial?
byOWASP
 
Breakfast cereal for advanced beginners
byTruptiranjan Nayak
 
Unsafe Deserialization Attacks In Java and A New Approach To Protect The JVM ...
byApostolos Giannakidis
 
Deserialization vulnerabilities
byGreenD0g
 
Persistent Session Storage
byWO Community
 
Auscert 2022 - log4shell and history of Java deserialisation RCE
byDavid Jorm
 
Mitigating Java Deserialization attacks from within the JVM (improved version)
byApostolos Giannakidis
 
(De)serial Killers - BSides Las Vegas & AppSec IL 2018
byCheckmarx
 
(De)serial Killers - BSides Las Vegas & AppSec IL 2018
byDor Tumarkin
 
SyScan 2016 - Remote code execution via Java native deserialization
byDavid Jorm
 
Mitigating Java Deserialization attacks from within the JVM
byApostolos Giannakidis
 
Surviving the Java Deserialization Apocalypse // OWASP AppSecEU 2016
byChristian Schneider
 
Java Deserialization Vulnerabilities - The Forgotten Bug Class (RuhrSec Edition)
byCODE WHITE GmbH
 
Defending against Java Deserialization Vulnerabilities
byLuca Carettoni
 
BlueHat v17 || Dangerous Contents - Securing .Net Deserialization
byBlueHat Security Conference
 
Demystifying Apple 'Pie' & TouchID
bySebastián Guerrero Selma
 
OWASP SD: Deserialize My Shorts: Or How I Learned To Start Worrying and Hate ...
byChristopher Frohoff
 
Insecure Java Deserialization
byShiv Sahni
 
.NET Deserialization Attacks
byDharmalingam Ganesan
 

More from Priyanka Aash

PPTX
AI Code Generation Risks (Ramkumar Dilli, CIO, Myridius)
byPriyanka Aash
 
PDF
From Chatbot to Destroyer of Endpoints - Can ChatGPT Automate EDR Bypasses (1...
byPriyanka Aash
 
PDF
Cracking the Code - Unveiling Synergies Between Open Source Security and AI.pdf
byPriyanka Aash
 
PDF
Oh, the Possibilities - Balancing Innovation and Risk with Generative AI.pdf
byPriyanka Aash
 
PDF
Lessons Learned from Developing Secure AI Workflows.pdf
byPriyanka Aash
 
PDF
Cyber Defense Matrix Workshop - RSA Conference
byPriyanka Aash
 
PDF
A Constitutional Quagmire - Ethical Minefields of AI, Cyber, and Privacy.pdf
byPriyanka Aash
 
PDF
Securing AI - There Is No Try, Only Do!.pdf
byPriyanka Aash
 
PDF
GenAI Opportunities and Challenges - Where 370 Enterprises Are Focusing Now.pdf
byPriyanka Aash
 
PDF
Coordinated Disclosure for ML - What's Different and What's the Same.pdf
byPriyanka Aash
 
PDF
10 Key Challenges for AI within the EU Data Protection Framework.pdf
byPriyanka Aash
 
PDF
Techniques for Automatic Device Identification and Network Assignment.pdf
byPriyanka Aash
 
PDF
Keynote : Presentation on SASE Technology
byPriyanka Aash
 
PDF
Keynote : AI & Future Of Offensive Security
byPriyanka Aash
 
PDF
Redefining Cybersecurity with AI Capabilities
byPriyanka Aash
 
PDF
Demystifying Neural Networks And Building Cybersecurity Applications
byPriyanka Aash
 
PDF
Finetuning GenAI For Hacking and Defending
byPriyanka Aash
 
PDF
(CISOPlatform Summit & SACON 2024) Kids Cyber Security .pdf
byPriyanka Aash
 
PDF
(CISOPlatform Summit & SACON 2024) Regulation & Response In Banks.pdf
byPriyanka Aash
 
PDF
(CISOPlatform Summit & SACON 2024) Cyber Insurance & Risk Quantification.pdf
byPriyanka Aash
 
AI Code Generation Risks (Ramkumar Dilli, CIO, Myridius)
byPriyanka Aash
 
From Chatbot to Destroyer of Endpoints - Can ChatGPT Automate EDR Bypasses (1...
byPriyanka Aash
 
Cracking the Code - Unveiling Synergies Between Open Source Security and AI.pdf
byPriyanka Aash
 
Oh, the Possibilities - Balancing Innovation and Risk with Generative AI.pdf
byPriyanka Aash
 
Lessons Learned from Developing Secure AI Workflows.pdf
byPriyanka Aash
 
Cyber Defense Matrix Workshop - RSA Conference
byPriyanka Aash
 
A Constitutional Quagmire - Ethical Minefields of AI, Cyber, and Privacy.pdf
byPriyanka Aash
 
Securing AI - There Is No Try, Only Do!.pdf
byPriyanka Aash
 
GenAI Opportunities and Challenges - Where 370 Enterprises Are Focusing Now.pdf
byPriyanka Aash
 
Coordinated Disclosure for ML - What's Different and What's the Same.pdf
byPriyanka Aash
 
10 Key Challenges for AI within the EU Data Protection Framework.pdf
byPriyanka Aash
 
Techniques for Automatic Device Identification and Network Assignment.pdf
byPriyanka Aash
 
Keynote : Presentation on SASE Technology
byPriyanka Aash
 
Keynote : AI & Future Of Offensive Security
byPriyanka Aash
 
Redefining Cybersecurity with AI Capabilities
byPriyanka Aash
 
Demystifying Neural Networks And Building Cybersecurity Applications
byPriyanka Aash
 
Finetuning GenAI For Hacking and Defending
byPriyanka Aash
 
(CISOPlatform Summit & SACON 2024) Kids Cyber Security .pdf
byPriyanka Aash
 
(CISOPlatform Summit & SACON 2024) Regulation & Response In Banks.pdf
byPriyanka Aash
 
(CISOPlatform Summit & SACON 2024) Cyber Insurance & Risk Quantification.pdf
byPriyanka Aash
 

Recently uploaded

PDF
Track Phone Location by Number (2026)_ What’s Actually Possible for Free (and...
byEmily Woods
 
PDF
How to build hackthon projects from ZERO!
byishantyadav1111
 
PDF
What Is the Azure AI Foundry and Why Does It Matter for Enterprises?
byjohncarterjn
 
PPTX
TechSprint Inauguration at SJB Institute of Technology held on 18 December 2025
bysuhasspgdg
 
PPTX
NTG - Data Center Management System Software
byMustafa Kuğu
 
PDF
Supercharge Your Copilot-Driven Collaboration with Microsoft 365 Agents SDK
byAntti Koskela
 
PPTX
Computer architecture, Computer architecture ,Computer architecture
bywaheedqazi123
 
PPTX
WEEK 1-introduction of industrial arts grade 7.pptx
byrosierufinomaliongan
 
PDF
Post Quantum Cryptography for Dummies.pdf
byAde Ismail Isnan
 
PPTX
How Does an ICO Launchpad Work Step-by-Step Breakdown.pptx
byTom Hardy S
 
PDF
Getting Started with Apache Spark: Big Data Made Simple [Free Meetup]
byHaim Michael
 
PDF
The Manifesto for AI-enabled Governance !
byYannis Charalabidis
 
PDF
Track Phone Location via Number (2026)_ What Actually Works, What’s a Scam, a...
byEmily Woods
 
PDF
BEP-20 Token on BNB Chain: From Concept to Deployment.pdf
byimoliviabennett
 
PDF
Startup Formation Collapses While Acquisition Activity Hits New High!
byMemoori
 
PDF
CI CD Observability, Metrics and DORA - Shifting Left and Cleaning Up! - Febr...
byPeter Souter
 
PDF
Why Many Smart Device Platforms Fail to Scale?
byPromeraki Developments
 
PPTX
Retrieval Augmented Generation- The Synergistic Power of Prompt Engineering
bySemantic SEO BD
 
PPTX
Automation Without Apprentices: How AI Challenges the Open Source Way
byIcinga
 
PDF
GenerationAI Paris 2025 | How Agentic AI is Reinventing Organizations
byapidays
 
Track Phone Location by Number (2026)_ What’s Actually Possible for Free (and...
byEmily Woods
 
How to build hackthon projects from ZERO!
byishantyadav1111
 
What Is the Azure AI Foundry and Why Does It Matter for Enterprises?
byjohncarterjn
 
TechSprint Inauguration at SJB Institute of Technology held on 18 December 2025
bysuhasspgdg
 
NTG - Data Center Management System Software
byMustafa Kuğu
 
Supercharge Your Copilot-Driven Collaboration with Microsoft 365 Agents SDK
byAntti Koskela
 
Computer architecture, Computer architecture ,Computer architecture
bywaheedqazi123
 
WEEK 1-introduction of industrial arts grade 7.pptx
byrosierufinomaliongan
 
Post Quantum Cryptography for Dummies.pdf
byAde Ismail Isnan
 
How Does an ICO Launchpad Work Step-by-Step Breakdown.pptx
byTom Hardy S
 
Getting Started with Apache Spark: Big Data Made Simple [Free Meetup]
byHaim Michael
 
The Manifesto for AI-enabled Governance !
byYannis Charalabidis
 
Track Phone Location via Number (2026)_ What Actually Works, What’s a Scam, a...
byEmily Woods
 
BEP-20 Token on BNB Chain: From Concept to Deployment.pdf
byimoliviabennett
 
Startup Formation Collapses While Acquisition Activity Hits New High!
byMemoori
 
CI CD Observability, Metrics and DORA - Shifting Left and Cleaning Up! - Febr...
byPeter Souter
 
Why Many Smart Device Platforms Fail to Scale?
byPromeraki Developments
 
Retrieval Augmented Generation- The Synergistic Power of Prompt Engineering
bySemantic SEO BD
 
Automation Without Apprentices: How AI Challenges the Open Source Way
byIcinga
 
GenerationAI Paris 2025 | How Agentic AI is Reinventing Organizations
byapidays
 

Android Serialization Vulnerabilities Revisited