Enabling Java 2 Runtime Security with Eclipse Plug-ins - Ted Habeck, Advisory Software Engineer, IBM & Marco Pistoia, Ph.D., Research Staff Member, IBM
•
1 like•460 views
This document discusses enabling Java 2 runtime security with Eclipse plug-ins. It analyzes the security requirements for OSGi-enabled platforms. It provides an example of a client calling a library method that creates a socket and logs information to a file. It shows how to modify the library code to use privileges to grant the necessary permissions via doPrivileged. It outlines the steps taken to check permissions for the socket creation and file access. Finally, it describes the components of a static analysis engine for Eclipse and OSGi that can perform access rights analysis, privileged code placement analysis, tainted variable analysis, and other security checks.
Report
Share
Report
Share
Download to read offline
Recommended
Fosdem10
This document provides an overview and agenda for a presentation on OSSEC. It includes sections on log management, OSSEC features, architecture, log analysis with OSSEC, integrity checking, and management commands. The agenda covers topics like log sources, standards, decoding, analysis, and advanced rule building. It also discusses configuring OSSEC for integrity monitoring and includes example OSSEC rules and commands.
Awesome_fuzzing_for _pentester_red-pill_2017
This document provides an overview of fuzzing techniques and the Sulley fuzzing framework. It begins with definitions of fuzzing and different fuzzing techniques like static testing, randomized fuzzing, and mutation-based fuzzing. The rest of the document demonstrates how to setup and use the Sulley framework to fuzz protocols like HTTP and file formats. It includes explanations of the Sulley API and how to generate test cases, monitor for crashes, and analyze results. Examples are provided of fuzzing HTTP servers and file formats.
На страже ваших денег и данных
В последнее время все чаще происходят сложные целенаправленные атаки (APT) с использованием скрытой загрузки. Существующие системы автоанализа, как правило, не способны анализировать вредоносное ПО, используемое для APT-атак, и исследователи вредоносного ПО вынуждены анализировать его вручную. Докладчик представит новую систему автоанализа памяти в режиме реального времени (Malware Analyst). Данная система не генерирует дамп памяти при помощи LibVMI, а имеет непосредственный доступ в память для ускорения диагностики и четко распознает подозрительное поведение вредоносного ПО.
Linux Shellcode disassembling
The document provides a basic guide to reverse engineering Linux x86 shellcode. It summarizes reversing two sample shellcodes: 1) A simple program that reads the /etc/passwd file by executing the cat command. By examining registers, it is determined the shellcode executes execve to read the file. 2) An XOR encrypted shellcode that decrypts itself before launching a ksh shell with root privileges using the setreuid system call. Breakpoints are used to stop and disassemble the shellcode at key points to understand its functionality.
Внедрение безопасности в веб-приложениях в среде выполнения
В данной работе рассматриваются результаты исследования по реализации алгоритма исправления ошибок в приложении в среде выполнения. Исследование проводилось на приложении с незащищенным кодом с целью его защиты от внедрения кода и других уязвимостей веб-приложений. Также в работе будет представлена технология защиты веб-приложений нового поколения под названием Runtime Application Self-Protection (RASP) (самозащита приложения в среде выполнения), которая защищает от веб-атак, работая внутри веб-приложения. Технология RASP основана на исправлении ошибок в среде выполнения путем «внедрения» безопасности в веб-приложения в неявном виде, без внесения дополнительных изменений в код. В завершении доклада перечисляются основные проблемы при реализации этой новой технологии и обзор перспектив защиты среды выполнения.
OSSEC @ ISSA Jan 21st 2010
OSSEC is an open source host-based intrusion detection system that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response. It decodes and analyzes logs using rules to detect anomalies and security events. OSSEC includes components for log collection, rule-based analysis, alerting and active responses. It can be installed and configured in different modes and includes features for centralized management, file integrity monitoring, log source configuration, and rule management.
44CON London - Attacking VxWorks: from Stone Age to Interstellar
Attacking VxWorks: from Stone Age to Interstellar presented by Yannick Formaggio at 44CON London 2015.
The Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel by...
In this talk, we are going to disclose two unconventional Use-after-free kernel bugs on Android we found last year, and introduce the new techniques we used to make these exploits 100% reliable.
The first bug is CVE-2017-0403, which we used to gain root privilege on almost all devices shipped with 3.10 or earlier Linux kernel last year. So far more than 14 million users have successfully rooted their smartphones with this exploit. With this vulnerability, an attacker only can overwrite the freed object at a fixed offset with a pointer to object itself. How to achieve kernel code execution with this bug can be very challenging.To solve the problem, we propose a new method which is using iovec to re-fill the freed object and compromising the pipe subsystem in kernel.In this way we can covert this unusual memory corruption to arbitrary kernel memory overwriting.
The second bug is CVE-2016-6787. The bug is an UAF due to race condition, may corrupt a critical kernel structure, and lead to the kernel crash when scheduler switched context back to attacker's process. So we'll introduce a way to freeze the attacker's process soon after UAF happened ,stop kernel from crashing, and make the exploit reliable.
In summary, this presentation gives out the new techniques of exploiting use-after-free bugs we just found in Android kernel. The ideas of exploitation are fresh, detail of bugs is also never discussed before.
Recommended
Fosdem10
This document provides an overview and agenda for a presentation on OSSEC. It includes sections on log management, OSSEC features, architecture, log analysis with OSSEC, integrity checking, and management commands. The agenda covers topics like log sources, standards, decoding, analysis, and advanced rule building. It also discusses configuring OSSEC for integrity monitoring and includes example OSSEC rules and commands.
Awesome_fuzzing_for _pentester_red-pill_2017
This document provides an overview of fuzzing techniques and the Sulley fuzzing framework. It begins with definitions of fuzzing and different fuzzing techniques like static testing, randomized fuzzing, and mutation-based fuzzing. The rest of the document demonstrates how to setup and use the Sulley framework to fuzz protocols like HTTP and file formats. It includes explanations of the Sulley API and how to generate test cases, monitor for crashes, and analyze results. Examples are provided of fuzzing HTTP servers and file formats.
На страже ваших денег и данных
В последнее время все чаще происходят сложные целенаправленные атаки (APT) с использованием скрытой загрузки. Существующие системы автоанализа, как правило, не способны анализировать вредоносное ПО, используемое для APT-атак, и исследователи вредоносного ПО вынуждены анализировать его вручную. Докладчик представит новую систему автоанализа памяти в режиме реального времени (Malware Analyst). Данная система не генерирует дамп памяти при помощи LibVMI, а имеет непосредственный доступ в память для ускорения диагностики и четко распознает подозрительное поведение вредоносного ПО.
Linux Shellcode disassembling
The document provides a basic guide to reverse engineering Linux x86 shellcode. It summarizes reversing two sample shellcodes: 1) A simple program that reads the /etc/passwd file by executing the cat command. By examining registers, it is determined the shellcode executes execve to read the file. 2) An XOR encrypted shellcode that decrypts itself before launching a ksh shell with root privileges using the setreuid system call. Breakpoints are used to stop and disassemble the shellcode at key points to understand its functionality.
Внедрение безопасности в веб-приложениях в среде выполнения
В данной работе рассматриваются результаты исследования по реализации алгоритма исправления ошибок в приложении в среде выполнения. Исследование проводилось на приложении с незащищенным кодом с целью его защиты от внедрения кода и других уязвимостей веб-приложений. Также в работе будет представлена технология защиты веб-приложений нового поколения под названием Runtime Application Self-Protection (RASP) (самозащита приложения в среде выполнения), которая защищает от веб-атак, работая внутри веб-приложения. Технология RASP основана на исправлении ошибок в среде выполнения путем «внедрения» безопасности в веб-приложения в неявном виде, без внесения дополнительных изменений в код. В завершении доклада перечисляются основные проблемы при реализации этой новой технологии и обзор перспектив защиты среды выполнения.
OSSEC @ ISSA Jan 21st 2010
OSSEC is an open source host-based intrusion detection system that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response. It decodes and analyzes logs using rules to detect anomalies and security events. OSSEC includes components for log collection, rule-based analysis, alerting and active responses. It can be installed and configured in different modes and includes features for centralized management, file integrity monitoring, log source configuration, and rule management.
44CON London - Attacking VxWorks: from Stone Age to Interstellar
Attacking VxWorks: from Stone Age to Interstellar presented by Yannick Formaggio at 44CON London 2015.
The Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel by...
In this talk, we are going to disclose two unconventional Use-after-free kernel bugs on Android we found last year, and introduce the new techniques we used to make these exploits 100% reliable.
The first bug is CVE-2017-0403, which we used to gain root privilege on almost all devices shipped with 3.10 or earlier Linux kernel last year. So far more than 14 million users have successfully rooted their smartphones with this exploit. With this vulnerability, an attacker only can overwrite the freed object at a fixed offset with a pointer to object itself. How to achieve kernel code execution with this bug can be very challenging.To solve the problem, we propose a new method which is using iovec to re-fill the freed object and compromising the pipe subsystem in kernel.In this way we can covert this unusual memory corruption to arbitrary kernel memory overwriting.
The second bug is CVE-2016-6787. The bug is an UAF due to race condition, may corrupt a critical kernel structure, and lead to the kernel crash when scheduler switched context back to attacker's process. So we'll introduce a way to freeze the attacker's process soon after UAF happened ,stop kernel from crashing, and make the exploit reliable.
In summary, this presentation gives out the new techniques of exploiting use-after-free bugs we just found in Android kernel. The ideas of exploitation are fresh, detail of bugs is also never discussed before.
Possibility of arbitrary code execution by Step-Oriented Programming
Step-Oriented Programming (SOP) allows executing arbitrary code on embedded systems by repeating step execution and changing the program counter value. A debugger communicates with a target system's stub using the Remote Serial Protocol to read/write memory and registers, enabling full control via simple commands if the connection is compromised. SOP constructs code by combining pieces of existing machine code and executes it without needing to directly inject new code. Therefore attacks are possible even if execution from data areas is prevented. The presentation will demonstrate this attack principle and results from actual experimentation.
Hack any website
The document discusses how browser helper objects (BHOs) can be used maliciously to hack websites. It provides an overview of the attack, demonstrations modifying website content and JavaScript, an analysis of the scope and advantages, technical details on how BHOs work and access browser interfaces, and potential defenses including disabling BHOs or improving how browsers handle them. The presentation aims to teach how to hack websites using BHOs and ends with contact information and a question/answer section.
[UniteKorea2013] Protecting your Android content
The document discusses various techniques for protecting Android content in Unity games, including authentication with Google Play Licensing, application tampering detection through signature and code checking, code obfuscation, and encryption of PlayerPrefs and other sensitive game data using encryption with a user-specific key. The agenda covers licensing, tamper detection through signature and code integrity checks, obfuscation, and encryption of game data in PlayerPrefs.
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
We propose a new exploit technique that brings a whole-new attack surface to bypass SSRF (Server Side Request Forgery) protections. This is a very general attack approach, in which we used in combination with our own fuzzing tool to discover many 0days in built-in libraries of very widely-used programming languages, including Python, PHP, Perl, Ruby, Java, JavaScript, Wget and cURL. The root cause of the problem lies in the inconsistency of URL parsers and URL requesters.
Being a very fundamental problem that exists in built-in libraries, sophisticated web applications such as WordPress (27% of the Web), vBulletin, MyBB and GitHub can also suffer, and 0days have been discovered in them via this technique. This general technique can also adapt to various code contexts and lead to protocol smuggling and SSRF bypassing. Several scenarios will be demonstrated to illustrate how URL parsers can be exploited to bypass SSRF protection and achieve RCE (Remote Code Execution), which is the case in our GitHub Enterprise demo.
Understanding the basics of this technique, the audience won’t be surprised to know that more than 20 vulnerabilities have been found in famous programming languages and web applications aforementioned via this technique.
Php web app security (eng)
● PHP and the OWASP Top Ten Security
Vulnerabilities
● Secure Programming With The Zend
Framework
● Apache HTTPD
Security
● MySQL Security
● PHP Security Tools
Mobile Programming - Network Universitas Budi Luhur
This document provides code examples for implementing various networking and internet protocols in Java, including:
1. A protocol scanner that tests which protocols (HTTP, HTTPS, FTP, etc.) are supported for a given URL.
2. A port scanner that detects which ports on a given host are open or closed.
3. Code to download and parse an HTML page from a URL.
4. A knock-knock joke client-server application implementing a protocol to exchange jokes over a network.
Primer on password security
This is presentation on password security delivered at security conference at IIT Guwahti, India.
It discusses and throws light on following areas
Part I - Operating System, Cryptography & Password Recovery
Part II - Password Cracking/Recovery Techniques
Part III – Advanced Password Stealing Methods
Part IV - Why they are after you and Tips for Protection !
Csw2016 economou nissim-getting_physical
This document discusses techniques for abusing the Intel paging mechanism on Windows to achieve arbitrary write capabilities despite modern kernel protections. It describes how the HAL's heap can be accessed from user mode by modifying page table entries, allowing kernel pointers to be leaked. It also explains how spraying process memory with fake page directories can cause physical memory exhaustion and potentially lead to arbitrary writes if a sprayed page is mapped. Live demos are promised for Windows and Linux attacks.
Reversing & malware analysis training part 2 introduction to windows internals
This presentation is part of our Reverse Engineering & Malware Analysis Training program.
For more details refer our Security Training page
http://securityxploded.com/security-training.php
Waf.js: How to Protect Web Applications using JavaScript
The document discusses techniques for protecting web applications from client-side attacks using JavaScript (Waf.js). It covers the following key points in 3 sentences:
Waf.js provides defenses like CSRF prevention, DOM-based XSS prevention, and detection of unwanted applications. It utilizes parsers like Acorn and DOMPurify to parse and sanitize inputs to prevent injections. The document outlines approaches used by Waf.js to build the AST of an input and search for dangerous code like function calls to prevent attacks while minimizing false positives.
Upping the APT hunting game: learn the best YARA practices from Kaspersky
Have you ever wondered how Kaspersky discovered some of the world’s most famous APT attacks? Now, the answer is within your reach. Costin Raiu, director of Kaspersky’s Global Research and Analysis Team (GReAT), will be sharing best practices on the use of YARA, an essential tool for APT hunters that can assist with the discovery of new malware samples, exploits and zero-days, speed up incident response, and increase your defenses by deploying custom rules inside your organization.
If you ever wanted to master YARA and achieve a new level of knowledge in APT detection, mitigation and response, now is your chance.
This brief webinar is based on Kaspersky’s exclusive training on YARA rules, which has already helped improve the APT detection strategies of many cybersecurity teams from leading businesses across the world. During the webinar, you will learn how to write test and improve effective YARA rules. You will also get a glimpse of some of our internal tools and learn how to maximize your knowledge for building effective APT detection strategies with YARA.
This practical webinar is useful for security researchers and incident response personnel, malware analysts, security engineers, network security analysts, APT researchers and IT security staff. The content is suitable for both beginners and seasoned YARA users. The full webinar can be seen: https://kas.pr/92tr
Practical security In a modular world
This document discusses security aspects of Java modules and compares them to OSGi bundles. It explains that the Java module system brings improved security while fitting into the existing security architecture. Modules introduce another layer of access control and stronger encapsulation for application code. Both modules and bundles define protection domains and can be signed, but modules lack OSGi's notion of local bundle permissions. The new module system enhances security while modularizing the Java platform.
Os Vanrossum
Python 3000 (Python 3.0) is an upcoming major release that will break backwards compatibility to fix early design mistakes and issues. It introduces many changes like Unicode as the default string type, a reworked I/O library, print as a function, and removal of some old features like classic classes. The document provides details on the changes and recommends projects support both Python 2.6 and 3.0 during the transition period.
Art of Web Backdoor - Pichaya Morimoto
Topic: Art of Web Backdoor
Speaker: Pichaya Morimoto
Event: 2600 Thailand Meeting #5
Date: September 6, 2013
Video: https://www.youtube.com/watch?v=QIXTPPBfLyI
Fighting Malware Without Antivirus
When it comes to actual, real-world, active malware detection there are surprisingly few choices. Most companies invest in one anti-virus vendor and when they suspect a compromise they simply wait for them to issue signatures.
If a company thinks they may be compromised but there is no AV signature, then what?
What if we could use basic python scripting to identify malware based on signatures we produce in real time? There are plenty of python tools, scripts and frameworks for malware identification including yara, pefile, nsrl hash db, pyemu, hachoir, volatility and pyew.
What if we could integrate these together into a system for centrally issuing
indicators of compromise? What if hosts we suspect as being compromised used this system to check themselves for compromise? Lets find out...
Алексей Старов - Как проводить киберраследования?
«Cybercrime» является особым направлением в области компьютерной безопасности и приватности. Это направление объединяет научные работы, которые исследуют различные сценарии атак или мошенничества, анализируют вредоносные экосистемы, обнаруживают злоумышленников и изучает их методы с целью разработки эффективных мер противодействия. В текущем докладе будут предоставлены рекомендации о том, как проводить киберрасследования, основываясь на примерах из наших работ и статей. Например, я расскажу о нашем масштабном исследовании вредоносных веб-оболочек и как мы смогли обнаружить жертв и нападающих по всему земному шару, а так же о том, как мы использовали навыки социальной инженерии, чтобы исследовать экосистему мошеннической технической поддержки, и многое другое. Моя цель состоит в том, чтобы заинтересовать научных исследователей и других представителей области ИБ в работе по направлению “Cybercrime”, в поиске различных путей предотвращения и расследования киберпреступлений. А также, показать, что подобные полезные исследования не всегда требует огромных ресурсов и сотрудничеств. Формат доклада: разговор в виде легкого семинара с элементами коллективного мозгового штурма (ноутбук не требуется). Мы рассмотрим 3 урока, из каждого выделяя полезные методы, инструменты и навыки. Язык: русский (с элементами английского).
Socket Programming
The document discusses socket programming in Java. It covers key concepts like layers of protocols, ports, the client-server model, and socket classes. Example code is provided to demonstrate how to create simple client and server applications using sockets to connect two processes and exchange data between them. The examples show how to bind sockets, send/receive data over input/output streams, and handle multiple concurrent connections by spawning new threads.
Industroyer: biggest threat to industrial control systems since Stuxnet by An...
Industroyer is the first ever malware specifically designed to attack power grids. This unique and extremely dangerous malware framework was involved in the December 2016 blackout in Ukraine. What sets Industroyer apart from other malware targeting infrastructure, such as BlackEnergy (a.k.a. SandWorm), is its ability to control switches and circuit breakers directly via 4 different industrial communication protocols.
In addition to explaining why Industroyer can be considered the biggest threat to industrial control systems since the infamous Stuxnet worm, we will take a look at the 2016 power outage in the context of the other numerous cyberattacks against Ukrainian critical infrastructure in the recent years.
As the protocols and hardware targeted by Industroyer are employed in power supply infrastructure, transportation control systems, and other critical infrastructure systems, like water and gas, worldwide, the malware can be re-purposed to target vital services in other countries. This discovery should serve as a wake-up call for those responsible for security of these critical systems.
Anton Cherepanov
Anton Cherepanov is currently working at ESET as Senior Malware Researcher; his responsibilities include the analysis of complex threats. He has done extensive research on cyber-attacks in Ukraine. His research was presented on numerous conferences, including Virus Bulletin, CARO Workshop, PHDays, and ZeroNights. His interests focus on reverse engineering and malware analysis automation.
Róbert Lipovský
Róbert Lipovský is Senior Malware Researcher in ESET’s Security Research Laboratory, with 10 years’ experience with malware research. He is responsible for malware intelligence and analysis and leads the Malware Research team in ESET’s HQ in Bratislava. He is a regular speaker at security conferences, including Black Hat, Virus Bulletin, and CARO. He runs a reverse engineering course at the Slovak University of Technology, his alma mater and the Comenius University. When not bound to a keyboard, he enjoys sports, playing guitar and flying an airplane.
Indicators of compromise: From malware analysis to eradication
This document discusses detecting and analyzing indicators of compromise from a malware infection. It describes collecting data from firewalls, IDS/IPS, proxies, DNS logs, and system logs to detect suspicious activity. Once a potential malware sample is acquired, static and dynamic analysis techniques are used to analyze its behavior and identify indicators that can be used to detect infected machines, like created files, registry keys, and network traffic. These indicators are expressed using tools like Yara rules and Snort signatures to enable detection of the compromise across an environment.
Automating Malware Analysis
This document describes a malware analysis sandbox that executes suspicious files in a monitored and controlled virtual environment. It monitors the file system, registry, processes, and network activity of the sample to determine its purpose and behavior. The sandbox automates analysis using open source tools and outputs comprehensive reports, packet captures, artifacts, and screenshots for further examination. It takes samples as input, runs static and dynamic analysis, executes the sample in a clean virtual machine snapshot while monitoring for changes, analyzes memory dumps, and stores the results for later review.
The Role of the OSGi Gateway in GST Security Objectives and Architecture - An...
This document discusses the role of OSGi gateways in security for the Global System for Telematics (GST) project. The GST project aims to create an open market for telematics services in Europe. The Security (SEC) subproject of GST aims to define a security architecture and mechanisms to ensure security for telematics applications and infrastructure. OSGi gateways will play a key role in the GST security architecture by allowing secure communication between different entities like vehicles, service providers, and control centers while also enabling access to non-GST entities and services. The document outlines the GST security requirements, actors, and layered architecture that OSGi gateways would need to support to enable secure telematics
Common Security Services. Consolidation patterns for legacy components - Stef...
The concept of interface and implementation is not a new idea, but when you need to unify a number of server components that have been developed and refined for years, it might become a difficult pattern to follow. The talk is about the approach Software AG took in consolidating JAAS-based server components including dynamic loading of login modules and dynamic domain configurations. The login modules are bundles or POJO legacy implementations.
More Related Content
What's hot
Possibility of arbitrary code execution by Step-Oriented Programming
Step-Oriented Programming (SOP) allows executing arbitrary code on embedded systems by repeating step execution and changing the program counter value. A debugger communicates with a target system's stub using the Remote Serial Protocol to read/write memory and registers, enabling full control via simple commands if the connection is compromised. SOP constructs code by combining pieces of existing machine code and executes it without needing to directly inject new code. Therefore attacks are possible even if execution from data areas is prevented. The presentation will demonstrate this attack principle and results from actual experimentation.
Hack any website
The document discusses how browser helper objects (BHOs) can be used maliciously to hack websites. It provides an overview of the attack, demonstrations modifying website content and JavaScript, an analysis of the scope and advantages, technical details on how BHOs work and access browser interfaces, and potential defenses including disabling BHOs or improving how browsers handle them. The presentation aims to teach how to hack websites using BHOs and ends with contact information and a question/answer section.
[UniteKorea2013] Protecting your Android content
The document discusses various techniques for protecting Android content in Unity games, including authentication with Google Play Licensing, application tampering detection through signature and code checking, code obfuscation, and encryption of PlayerPrefs and other sensitive game data using encryption with a user-specific key. The agenda covers licensing, tamper detection through signature and code integrity checks, obfuscation, and encryption of game data in PlayerPrefs.
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
We propose a new exploit technique that brings a whole-new attack surface to bypass SSRF (Server Side Request Forgery) protections. This is a very general attack approach, in which we used in combination with our own fuzzing tool to discover many 0days in built-in libraries of very widely-used programming languages, including Python, PHP, Perl, Ruby, Java, JavaScript, Wget and cURL. The root cause of the problem lies in the inconsistency of URL parsers and URL requesters.
Being a very fundamental problem that exists in built-in libraries, sophisticated web applications such as WordPress (27% of the Web), vBulletin, MyBB and GitHub can also suffer, and 0days have been discovered in them via this technique. This general technique can also adapt to various code contexts and lead to protocol smuggling and SSRF bypassing. Several scenarios will be demonstrated to illustrate how URL parsers can be exploited to bypass SSRF protection and achieve RCE (Remote Code Execution), which is the case in our GitHub Enterprise demo.
Understanding the basics of this technique, the audience won’t be surprised to know that more than 20 vulnerabilities have been found in famous programming languages and web applications aforementioned via this technique.
Php web app security (eng)
● PHP and the OWASP Top Ten Security
Vulnerabilities
● Secure Programming With The Zend
Framework
● Apache HTTPD
Security
● MySQL Security
● PHP Security Tools
Mobile Programming - Network Universitas Budi Luhur
This document provides code examples for implementing various networking and internet protocols in Java, including:
1. A protocol scanner that tests which protocols (HTTP, HTTPS, FTP, etc.) are supported for a given URL.
2. A port scanner that detects which ports on a given host are open or closed.
3. Code to download and parse an HTML page from a URL.
4. A knock-knock joke client-server application implementing a protocol to exchange jokes over a network.
Primer on password security
This is presentation on password security delivered at security conference at IIT Guwahti, India.
It discusses and throws light on following areas
Part I - Operating System, Cryptography & Password Recovery
Part II - Password Cracking/Recovery Techniques
Part III – Advanced Password Stealing Methods
Part IV - Why they are after you and Tips for Protection !
Csw2016 economou nissim-getting_physical
This document discusses techniques for abusing the Intel paging mechanism on Windows to achieve arbitrary write capabilities despite modern kernel protections. It describes how the HAL's heap can be accessed from user mode by modifying page table entries, allowing kernel pointers to be leaked. It also explains how spraying process memory with fake page directories can cause physical memory exhaustion and potentially lead to arbitrary writes if a sprayed page is mapped. Live demos are promised for Windows and Linux attacks.
Reversing & malware analysis training part 2 introduction to windows internals
This presentation is part of our Reverse Engineering & Malware Analysis Training program.
For more details refer our Security Training page
http://securityxploded.com/security-training.php
Waf.js: How to Protect Web Applications using JavaScript
The document discusses techniques for protecting web applications from client-side attacks using JavaScript (Waf.js). It covers the following key points in 3 sentences:
Waf.js provides defenses like CSRF prevention, DOM-based XSS prevention, and detection of unwanted applications. It utilizes parsers like Acorn and DOMPurify to parse and sanitize inputs to prevent injections. The document outlines approaches used by Waf.js to build the AST of an input and search for dangerous code like function calls to prevent attacks while minimizing false positives.
Upping the APT hunting game: learn the best YARA practices from Kaspersky
Have you ever wondered how Kaspersky discovered some of the world’s most famous APT attacks? Now, the answer is within your reach. Costin Raiu, director of Kaspersky’s Global Research and Analysis Team (GReAT), will be sharing best practices on the use of YARA, an essential tool for APT hunters that can assist with the discovery of new malware samples, exploits and zero-days, speed up incident response, and increase your defenses by deploying custom rules inside your organization.
If you ever wanted to master YARA and achieve a new level of knowledge in APT detection, mitigation and response, now is your chance.
This brief webinar is based on Kaspersky’s exclusive training on YARA rules, which has already helped improve the APT detection strategies of many cybersecurity teams from leading businesses across the world. During the webinar, you will learn how to write test and improve effective YARA rules. You will also get a glimpse of some of our internal tools and learn how to maximize your knowledge for building effective APT detection strategies with YARA.
This practical webinar is useful for security researchers and incident response personnel, malware analysts, security engineers, network security analysts, APT researchers and IT security staff. The content is suitable for both beginners and seasoned YARA users. The full webinar can be seen: https://kas.pr/92tr
Practical security In a modular world
This document discusses security aspects of Java modules and compares them to OSGi bundles. It explains that the Java module system brings improved security while fitting into the existing security architecture. Modules introduce another layer of access control and stronger encapsulation for application code. Both modules and bundles define protection domains and can be signed, but modules lack OSGi's notion of local bundle permissions. The new module system enhances security while modularizing the Java platform.
Os Vanrossum
Python 3000 (Python 3.0) is an upcoming major release that will break backwards compatibility to fix early design mistakes and issues. It introduces many changes like Unicode as the default string type, a reworked I/O library, print as a function, and removal of some old features like classic classes. The document provides details on the changes and recommends projects support both Python 2.6 and 3.0 during the transition period.
Art of Web Backdoor - Pichaya Morimoto
Topic: Art of Web Backdoor
Speaker: Pichaya Morimoto
Event: 2600 Thailand Meeting #5
Date: September 6, 2013
Video: https://www.youtube.com/watch?v=QIXTPPBfLyI
Fighting Malware Without Antivirus
When it comes to actual, real-world, active malware detection there are surprisingly few choices. Most companies invest in one anti-virus vendor and when they suspect a compromise they simply wait for them to issue signatures.
If a company thinks they may be compromised but there is no AV signature, then what?
What if we could use basic python scripting to identify malware based on signatures we produce in real time? There are plenty of python tools, scripts and frameworks for malware identification including yara, pefile, nsrl hash db, pyemu, hachoir, volatility and pyew.
What if we could integrate these together into a system for centrally issuing
indicators of compromise? What if hosts we suspect as being compromised used this system to check themselves for compromise? Lets find out...
Алексей Старов - Как проводить киберраследования?
«Cybercrime» является особым направлением в области компьютерной безопасности и приватности. Это направление объединяет научные работы, которые исследуют различные сценарии атак или мошенничества, анализируют вредоносные экосистемы, обнаруживают злоумышленников и изучает их методы с целью разработки эффективных мер противодействия. В текущем докладе будут предоставлены рекомендации о том, как проводить киберрасследования, основываясь на примерах из наших работ и статей. Например, я расскажу о нашем масштабном исследовании вредоносных веб-оболочек и как мы смогли обнаружить жертв и нападающих по всему земному шару, а так же о том, как мы использовали навыки социальной инженерии, чтобы исследовать экосистему мошеннической технической поддержки, и многое другое. Моя цель состоит в том, чтобы заинтересовать научных исследователей и других представителей области ИБ в работе по направлению “Cybercrime”, в поиске различных путей предотвращения и расследования киберпреступлений. А также, показать, что подобные полезные исследования не всегда требует огромных ресурсов и сотрудничеств. Формат доклада: разговор в виде легкого семинара с элементами коллективного мозгового штурма (ноутбук не требуется). Мы рассмотрим 3 урока, из каждого выделяя полезные методы, инструменты и навыки. Язык: русский (с элементами английского).
Socket Programming
The document discusses socket programming in Java. It covers key concepts like layers of protocols, ports, the client-server model, and socket classes. Example code is provided to demonstrate how to create simple client and server applications using sockets to connect two processes and exchange data between them. The examples show how to bind sockets, send/receive data over input/output streams, and handle multiple concurrent connections by spawning new threads.
Industroyer: biggest threat to industrial control systems since Stuxnet by An...
Industroyer is the first ever malware specifically designed to attack power grids. This unique and extremely dangerous malware framework was involved in the December 2016 blackout in Ukraine. What sets Industroyer apart from other malware targeting infrastructure, such as BlackEnergy (a.k.a. SandWorm), is its ability to control switches and circuit breakers directly via 4 different industrial communication protocols.
In addition to explaining why Industroyer can be considered the biggest threat to industrial control systems since the infamous Stuxnet worm, we will take a look at the 2016 power outage in the context of the other numerous cyberattacks against Ukrainian critical infrastructure in the recent years.
As the protocols and hardware targeted by Industroyer are employed in power supply infrastructure, transportation control systems, and other critical infrastructure systems, like water and gas, worldwide, the malware can be re-purposed to target vital services in other countries. This discovery should serve as a wake-up call for those responsible for security of these critical systems.
Anton Cherepanov
Anton Cherepanov is currently working at ESET as Senior Malware Researcher; his responsibilities include the analysis of complex threats. He has done extensive research on cyber-attacks in Ukraine. His research was presented on numerous conferences, including Virus Bulletin, CARO Workshop, PHDays, and ZeroNights. His interests focus on reverse engineering and malware analysis automation.
Róbert Lipovský
Róbert Lipovský is Senior Malware Researcher in ESET’s Security Research Laboratory, with 10 years’ experience with malware research. He is responsible for malware intelligence and analysis and leads the Malware Research team in ESET’s HQ in Bratislava. He is a regular speaker at security conferences, including Black Hat, Virus Bulletin, and CARO. He runs a reverse engineering course at the Slovak University of Technology, his alma mater and the Comenius University. When not bound to a keyboard, he enjoys sports, playing guitar and flying an airplane.
Indicators of compromise: From malware analysis to eradication
This document discusses detecting and analyzing indicators of compromise from a malware infection. It describes collecting data from firewalls, IDS/IPS, proxies, DNS logs, and system logs to detect suspicious activity. Once a potential malware sample is acquired, static and dynamic analysis techniques are used to analyze its behavior and identify indicators that can be used to detect infected machines, like created files, registry keys, and network traffic. These indicators are expressed using tools like Yara rules and Snort signatures to enable detection of the compromise across an environment.
Automating Malware Analysis
This document describes a malware analysis sandbox that executes suspicious files in a monitored and controlled virtual environment. It monitors the file system, registry, processes, and network activity of the sample to determine its purpose and behavior. The sandbox automates analysis using open source tools and outputs comprehensive reports, packet captures, artifacts, and screenshots for further examination. It takes samples as input, runs static and dynamic analysis, executes the sample in a clean virtual machine snapshot while monitoring for changes, analyzes memory dumps, and stores the results for later review.
What's hot (20)
Possibility of arbitrary code execution by Step-Oriented Programming
Possibility of arbitrary code execution by Step-Oriented Programming
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
Mobile Programming - Network Universitas Budi Luhur
Mobile Programming - Network Universitas Budi Luhur
Reversing & malware analysis training part 2 introduction to windows internals
Reversing & malware analysis training part 2 introduction to windows internals
Waf.js: How to Protect Web Applications using JavaScript
Waf.js: How to Protect Web Applications using JavaScript
Upping the APT hunting game: learn the best YARA practices from Kaspersky
Upping the APT hunting game: learn the best YARA practices from Kaspersky
Industroyer: biggest threat to industrial control systems since Stuxnet by An...
Industroyer: biggest threat to industrial control systems since Stuxnet by An...
Indicators of compromise: From malware analysis to eradication
Indicators of compromise: From malware analysis to eradication
Viewers also liked
The Role of the OSGi Gateway in GST Security Objectives and Architecture - An...
This document discusses the role of OSGi gateways in security for the Global System for Telematics (GST) project. The GST project aims to create an open market for telematics services in Europe. The Security (SEC) subproject of GST aims to define a security architecture and mechanisms to ensure security for telematics applications and infrastructure. OSGi gateways will play a key role in the GST security architecture by allowing secure communication between different entities like vehicles, service providers, and control centers while also enabling access to non-GST entities and services. The document outlines the GST security requirements, actors, and layered architecture that OSGi gateways would need to support to enable secure telematics
Common Security Services. Consolidation patterns for legacy components - Stef...
The concept of interface and implementation is not a new idea, but when you need to unify a number of server components that have been developed and refined for years, it might become a difficult pattern to follow. The talk is about the approach Software AG took in consolidating JAAS-based server components including dynamic loading of login modules and dynamic domain configurations. The login modules are bundles or POJO legacy implementations.
Open Services Gateway Initiative (OSGI)
OSGi is a component-based technology and was developed to provide a software platform that allows modularization and dynamic linking of application components.
OSGi components are called bundles and can be exported and imported by application bundles.
OSGi implementations like Apache Felix or Eclipse Equinox provide a runtime container which controls the lifecycle of bundles.
Even though OSGi is hardware independent, it is based on the Java Virtual Machine and as such extends the concepts of the underlying Java language.
An OSGi bundle's capabilities and properties are defined in a manifest file that is packed together with the bundle's Java class files. The manifest file allows compatibility checks by the OSGi runtime between the exporting bundle and the importing bundle.
This export and import mechanism allows highly flexible and dynamic application environments where applications and components are installed, linked and started at runtime without the need to restart the entire system.
Building Secure OSGi Applications
Modern applications and software solutions increasingly center around loosely coupled and extensible architectures. Component or Service orientation is applied in almost all areas of application development including distributed systems, ubiquitous computing, embedded systems, and client-side applications.
The Java based OSGi framework specification lends itself well as a platform for loosely coupled and extensible applications and is rapidly gaining ground as the de-facto plugin solution for Java based applications. It allows for lightweight implementations that limit themselves to the CDC profile and are ideally suited as embedded plugin frameworks.
One of the main drawbacks of dynamically extensible applications, however, are the potential security issues that arise due to executing untrusted code without appropriated safety-measures in place. Secure sandboxes and their restrictions are difficult to get right and often hard to deal with in the development of applications. The OSGi specifications have an extensive and very powerful security model that eases this difficult task.
This presentation focuses on embedding various OSGi framework implementations namely, Eclipse Equinox and Apache Felix, into applications as a means of plugin mechanism while taking advantage of the often overlooked benefits of this solution: security.
Sia door supervisor training 5
SIA door supervisor training provides security personnel with important skills through a four module, 38 hour program. The training covers security fundamentals, the responsibilities and tasks of door supervisors, conflict management, and physical intervention techniques. Completing the SIA training and obtaining an SIA license is legally required before one can work as a door supervisor. Door supervisor roles are in high demand and pay 30% more than general security guard positions due to the broader security functions they are legally allowed to perform.
Security in OSGi applications: Robust OSGi Platforms, secure Bundles
This document discusses security in OSGi applications. It describes how OSGi platforms can be made more robust through techniques like permission-based access control and how bundles can be made more secure by following recommendations around dependency management, access control, and data sharing. The document assesses the security of various OSGi platforms and how adding permissions improves their coverage of known vulnerabilities. It also provides an overview of common security threats in OSGi platforms and bundles as well as recommendations for building secure bundles.
Security Policy Enforcement for the OSGi Framework using Aspect-Oriented Pr...
This document summarizes a study on using aspect-oriented programming with AspectJ to enforce security policies in OSGi frameworks. It discusses categorizing security policies, implementing examples in AspectJ, and testing on the Knopflerfish OSGi framework. The goal is to study fine-grained security policy enforcement in vehicle systems using a language-based approach without platform modifications.
Privacy_Engineering_Privacy Assurance_Lecture-Ecole_Polytechnic_Nice_SA-20150127
This document discusses privacy engineering and assurance. It begins by defining key privacy terminology like personally identifiable information and privacy principles. It then discusses elements of an accountable privacy program, including executive oversight, policies and processes, risk assessment, and complaint handling. The document outlines privacy activities across a product life cycle, including privacy impact assessments and risk management. It also discusses assessing privacy maturity and related business processes. Finally, it provides an example use case for conducting a privacy assessment.
Raising information security awareness
A presentation by Terranova on raising information security awareness with strong training, communication and reinforcement tools.
OSGi als App-Plattform - Ein Ausflug durch den Security-Layer
The document discusses OSGi as an application platform and its security layer. It proposes using a simple container format like JAR or ZIP to package applications, including an application manifest file. Applications should be certified to check for required permissions before being deployed. The OSGi security mechanisms include bundle authentication, signatures, and conditional permission administration. Bundles can define local and global permissions. The security layer is activated by Java properties and a policy file restricts the framework's access.
Workshop OSGI PPT
The document describes the structure and dependencies of modules in a Java workshop project using J2EE and OSGi frameworks. It discusses the module structure, Maven project structure, static and dynamic dependencies between modules, source code and view deployment locations, and steps for deploying the web application.
Viewers also liked (11)
The Role of the OSGi Gateway in GST Security Objectives and Architecture - An...
The Role of the OSGi Gateway in GST Security Objectives and Architecture - An...
Common Security Services. Consolidation patterns for legacy components - Stef...
Common Security Services. Consolidation patterns for legacy components - Stef...
Security in OSGi applications: Robust OSGi Platforms, secure Bundles
Security in OSGi applications: Robust OSGi Platforms, secure Bundles
Security Policy Enforcement for the OSGi Framework using Aspect-Oriented Pr...
Security Policy Enforcement for the OSGi Framework using Aspect-Oriented Pr...
Privacy_Engineering_Privacy Assurance_Lecture-Ecole_Polytechnic_Nice_SA-20150127
Privacy_Engineering_Privacy Assurance_Lecture-Ecole_Polytechnic_Nice_SA-20150127
OSGi als App-Plattform - Ein Ausflug durch den Security-Layer
OSGi als App-Plattform - Ein Ausflug durch den Security-Layer
Similar to Enabling Java 2 Runtime Security with Eclipse Plug-ins - Ted Habeck, Advisory Software Engineer, IBM & Marco Pistoia, Ph.D., Research Staff Member, IBM
Hibernate Import.Sql I18n
The document discusses three methods for importing SQL scripts using Hibernate:
1. Specify the import file in hibernate.cfg.xml using the classpath location
2. Directly specify the file path to import.sql
3. Implement a listener to convert the SQL file to the proper encoding on application startup
Internet Technology (Practical Questions Paper) [CBSGS - 75:25 Pattern] {Mast...
Internet Technology (Practical Questions Paper) [CBSGS - 75:25 Pattern] {Mast...Mumbai B.Sc.IT Study
Internet Technology (Practical Questions Paper) [CBSGS - 75:25 Pattern] {Master Code}
.
,internet technology ,practical questions paper ,cbsgs - 75:25 pattern ,2017 - manual ,master code ,bscit ,bscit question paper ,bscit question papers 2018 ,bscit semester vi ,bscit smester 6 2018 ,cbsgs ,cbsgs 75-25 pattern ,december - 2018 ,idol ,idol - revised course ,idol question paper ,internet technologies ,may – 2018 ,mumbai university bscit ,mumbai university question papers ,project management cbsgs 2018 ,project management may - 2018 ,project management question paper ,question paper ,tybscitJava sockets
The document discusses keyboard and file access in Java using input streams, readers, and buffers. It then covers socket programming in Java to connect to other computers over a network. A client-server model is described where the client connects to the server, which listens for connections on a port. The server accepts the connection and a separate socket is used to communicate with that client.
Code red SUM
The document contains code for a client-server chat application written in Java. It defines classes for the client, server, and thread handling client connections. The client and server classes establish sockets to communicate. The server accepts new connections in a loop, passing each to a ServerThread class that handles the communication with that client using input/output streams. The client also uses input/output streams to continuously send user input to the server and receive responses, allowing for a back-and-forth chat.
Bhaloo
The document contains code for a client-server chat application written in Java. It defines classes for the client, server, and thread handling communication between the server and clients. The client and server classes set up socket connections and input/output streams for sending and receiving messages. The server accepts new connections in a loop and spawns a new thread for each client. Threads read incoming messages from clients and print them, and take input from the server console to send back to clients.
Laporan multiclient chatting client server
This document describes a multi-client chat client-server application created using Java socket programming. It includes the code for the ChatServer.java and ChatClient.java classes. The ChatServer class handles multiple client connections and broadcasts messages to all connected clients. The ChatClient class represents the graphical client interface that connects to the server and allows users to send and receive chat messages. The application allows for multiple clients to simultaneously chat by connecting to a central chat server.
Embedded Recipes 2019 - Testing firmware the devops way
ITRenew is selling recertified OCP servers under the Sesame brand, those servers come either with their original UEFI BIOS or with LinuxBoot. The LinuxBoot project is pushing the Linux kernel inside bios flash and using userland programs as bootloader.
To achieve quality on our software stack, as any project, we need to test it. Traditional BIOS are tested by hand, this is 2019 we need to do it automatically! We already presented the hardware setup behind the LinuxBoot CI, this talk will focus on the software.
We use u-root for our userland bootloader; this software is written in Go so we naturally choose to use Go for our testing too. We will present how we are using and extending the Go native test framework `go test` for testing embedded systems (serial console) and improving the report format for integration to a CI.
Julien Viard de Galbert
Monitoring OSGi Applications with the Web Console
A presentation by senior developer Carsten Ziegeler at the OSGi Community Event / EclipseCon Europe 2013. This session introduces the latest version of the famous Apache Felix web console which allows to monitor and inspect OSGi web applications through the browser. The web console is based on a flexible plugin mechanism to add custom information and functionality. Learn how to write your own extensions and how to leverage the available functionality for monitoring and troubleshooting OSGi installations. For more on this, check out the slides available from Carsten: http://www.slideshare.net/cziegeler.
Monitoring OSGi Applications with the Web Console
Presentation from the OSGi Community Event / EclipseCon Europe 2013
This session introduces the latest version of the famous Apache Felix web console which allows to monitor and inspect OSGi web applications through the browser. The web console is based on a flexible plugin mechanism to add custom information and functionality. Learn how to write your own extensions and how to leverage the available functionality for monitoring and troubleshooting OSGi installations.
Monitoring OSGi Applications with the Web Console - Carsten Ziegeler
OSGi Community Event 2013 (http://www.osgi.org/CommunityEvent2013/Schedule)
ABSTRACT
This session introduces the latest version of the famous Apache Felix web console which allows to monitor and inspect OSGi web applications through the browser. The web console is based on a flexible plugin mechanism to add custom information and functionality. Learn how to write your own extensions and how to leverage the available functionality for monitoring and troubleshooting OSGi installations.
SPEAKER BIO
Carsten Ziegeler is senior developer at Adobe Research Switzerland and spends most of his time on architectural and infrastructure topics. Working for over 25 years in open source projects, Carsten is a member of the Apache Software Foundation and heavily participates in several Apache communities including Sling, Felix and ACE. He is a frequent speaker on technology and open source conferences and participates in the OSGi Core Platform and Enterprise expert groups.
JavaExamples
This doc files covers all the important java programs of BSC. CSIT
TU Examination.Focused for 6th sem CSIT NEPAL sylllabus
Java Socket Programming
This is all about socket programming in java using TCP and UDP socket and an example of simple Echo Server.
Also includes concepts of the socket, Socket class and methods and use of those.
Secure erasure code based cloud storage system with secure data forwarding
The document describes a presentation on implementing threshold proxy re-encryption and decentralized erasure code for distributed storage systems. The proposed system uses threshold proxy re-encryption and decentralized erasure coding to improve security and reliability compared to traditional general encryption schemes. Key components include storage servers, key servers, and flexible adjustment of parameters between servers. Diagrams are included showing the system architecture, workflow, use cases and sequences.
Testing in android
The document discusses testing in Android applications. It recommends moving as much logic as possible to the Java Virtual Machine (JVM) to allow for easier unit testing. This includes business logic, models, and network code using Retrofit. It also suggests using Espresso for UI testing on Android and monkeyrunner for basic OS interaction testing. The document acknowledges testing on Android can be painful due to speed and fragmentation issues, and proposes compromises like helping quality assurance engineers with tools like the Bee library.
Node worshop Realtime - Socket.io
The document discusses using Socket.io to add real-time capabilities to web applications. It provides an overview of Socket.io and how to install and use it with Node.js. Examples are given of emitting and receiving events, broadcasting to all connections, and setting up Socket.io with Express.
멀티플랫폼 앱 개발과 테스팅
- The document discusses developing and testing multi-platform apps. It provides information on SDKs, tools, and downloads for platforms like iOS, Android, Unity, and Node.js.
- It demonstrates building a simple app that multiples an input number by 2 on different platforms, including sample code and project files.
- It also describes testing the logic of the app using different languages and frameworks like Objective-C, Java, C#, and JavaScript.
Secure your Web Application With The New Python Audit Hooks
The audit hooks were added to Python 3.8 with the PEP 578. This security mechanism gives you more visibility and control over what your application does at runtime. After a short introduction of the new feature, we will explore ideas on how web developers, library maintainers and security engineers can leverage it to detect and block security vulnerabilities, illustrated with concrete examples.
Docker meetup
The document discusses SpilGames' use of Docker containers and Puppet for infrastructure configuration management and testing. Key points:
1) SpilGames uses Docker containers to run functional tests for Puppet modules in parallel, providing isolation and speed compared to virtual machines. A baseline Docker image is tested and snapshots are used to spawn containers for testing other modules.
2) Puppet is used to configure all of SpilGames' servers through roles and classes. Code is verified using Gerrit and functional tests are run inside Docker containers using an orchestration script.
3) SpilGames is evaluating using Docker and the open source PaaS Stackato to further migrate production systems to their private OpenStack cloud for an
file-transfer-using-tcp.pdf
The document describes a Java program for file transfer using TCP sockets. It includes algorithms for both a server and client. The server accepts connections, reads a file, and sends it to the client in byte chunks. The client receives the file contents and writes them to a new file. The program code shows how to create sockets, get input/output streams, read/write files and bytes, and close connections. It was tested by running the server and client programs which successfully transferred a file.
Introduction to Vert.x
Vert.x is a tool for building reactive applications on the JVM. It is polyglot, allowing applications to be written in Java, Groovy, JavaScript and other languages. It uses an asynchronous and non-blocking model with shared-nothing communication between components. Modules communicate through publish/subscribe messaging on an event bus or directly through request-response patterns. Vert.x provides horizontal scaling and allows efficient use of server resources. It can also integrate with SockJS to provide WebSocket-like capabilities in browsers that do not support WebSockets.
Similar to Enabling Java 2 Runtime Security with Eclipse Plug-ins - Ted Habeck, Advisory Software Engineer, IBM & Marco Pistoia, Ph.D., Research Staff Member, IBM (20)
Internet Technology (Practical Questions Paper) [CBSGS - 75:25 Pattern] {Mast...
Internet Technology (Practical Questions Paper) [CBSGS - 75:25 Pattern] {Mast...
Embedded Recipes 2019 - Testing firmware the devops way
Embedded Recipes 2019 - Testing firmware the devops way
Monitoring OSGi Applications with the Web Console - Carsten Ziegeler
Monitoring OSGi Applications with the Web Console - Carsten Ziegeler
Secure erasure code based cloud storage system with secure data forwarding
Secure erasure code based cloud storage system with secure data forwarding
Secure your Web Application With The New Python Audit Hooks
Secure your Web Application With The New Python Audit Hooks
More from mfrancis
Eclipse Modeling Framework and plain OSGi the easy way - Mark Hoffman (Data I...
OSGi Community Event 2018 Presentation by Mark Hoffmann (Data In Motion)
Abstract: This talk will show you how the EMF framework can be used in pure OSGi environments other than Equinox. We will introduce you into free configurable ResourceSets and the principle of a ResourceSetFactory. This enables your application to have multiple tenants with different model visibillity. The profit of OSGi services provides a behavior where even models can come and go all the time.
We will also give you look inside, how easy it is to extend the default code generation process of EMF to generate OSGi service component that handle the model registration in an OSGi way.
OSGi and Java 9+ - BJ Hargrave (IBM)
OSGi Community Event 2018 Presentation by BJ Hargrave (IBM)
Abstract: Java 9 introduced the Java Platform Module System (JPMS) as a way to modularize the Java platform and it can be also be used by developers to modularize their own applications, although JPMS lack a number of important features for software running on the Java platform.
As people look to support the latest versions of the Java platform, changes introduced in Java 9 related to JPMS led to the needs for some features in the OSGi Core specification. OSGi framework implementations like Eclipse Equinox and Apache Felix and tools like Bnd were updated to support these new features.
This session will explore the Java 9+ support added to OSGi Core R7 and Bnd and help you learn how to navigate the world of Java 9+ and OSGi.
Simplify Web UX Coding using OSGi Modularity Magic - Paul Fraser (A2Z Living)
This document discusses simplifying web UX using OSGi modularity. It mentions coding tasks becoming quicker and easier using OSGi and controlling OSGi DS component instances. It provides links to GitHub pages for the Open Security Controller project and a blog post about controlling OSGi components. It concludes by thanking the audience and reminding them they are being watched.
OSGi for the data centre - Connecting OSGi to Kubernetes - Frank Lyaruu
This document discusses connecting the OSGi framework to Kubernetes for managing applications in container-based environments. It raises questions about building systems that can update while running and whether years spent on this have been wasted. It also briefly mentions a demo of OSGi and Kubernetes integration and asks why a load balancer wouldn't work instead. The document calls for feedback on sessions and ideas about OSGi, Kubernetes, immutable vs mutable systems, and J2EE versus OSGi.
Remote Management and Monitoring of Distributed OSGi Applications - Tim Verbe...
OSGi Community Event 2018 Presentation by Tim Verbelen (imec) & Jan S. Rellermeyer (TU Delft)
Abstract: With the proliferation of cloud computing and more recently mobile and edge computing, there is a increasing demand to build flexible and robust distributed applications. The OSGi service and module technology is a key enabler for such deployment. Recent additions to the OSGi standards provide a set of services that provide interfaces for managing distributed instances of OSGi frameworks. The REST Service (added in R6 compendium) offers an easy and language-independent way to manage bundes and introspect services from outside the network. The Cluster Information specifications (added in R7 compendium) provide means for applications to manage and monitor the deployment intrinsically, building on top of the Remote Service specifications. In the Eclipse Concierge project, we have provided the reference implementations of both specifications. In this talk, we will show how the services can be used to build distributed applications that benefit from the OSGi modularity.
OSGi with Docker - a powerful way to develop Java systems - Udo Hafermann (So...
OSGi Community Event 2018 Presentation by Udo Hafermann (Software AG)
Abstract: In this talk we will share our experiences in developing a tool chain from classes, to bundles, to containers, to systems.
OSGi and Docker come together in a compelling way where the former provides modularity "in the small" and the latter "modularity in the large". We discover how the unique characteristics of OSGi enable a smooth transition from small to large.
The resulting environment enables developers to grow distributed systems on their local machine and test them with plain JUnit at all levels of granularity - classes to systems. During development OSGi enables the tool chain to update the system without container rebuilds.
While an increase in productivity is one benefit of such an environment, an arguably more important benefit is the way it empowers developers to gain new insights.
A real world use case with OSGi R7 - Jurgen Albert (Data In Motion Consulting...
OSGi Community Event 2018 Presentation by Jurgen Albert (Data In Motion Consulting GmbH)
Abstract: OSGi is often conceived as a tool to write efficient Java Applications for resource limited Devices or If resources are a real issue in complex applications. On the other hand Microservices became the buzzword of the cloud and is often implemented using Spring or other Programming languages. OSGi carries the concept of microservices in its core and is therefore much better suited to the task then most other approaches. This talk will show you how a service can be built with a real-worldish use case, leveraging the power of OSGi R7. It will show the combined usage of PushsStreams, the JaxRS Whiteboard, the configurator, remote deployment and a lot of the other cool things OSGi has to offer.
OSGi Feature Model - Where Art Thou - David Bosschaert (Adobe)
OSGi Community Event 2018 Presentation by David Bosschaert (Adobe)
Abstract: OSGi lends itself well to develop extensible applications assembled from reusable modules, where a set of bundles together with a set of configurations deployed to a provisioned OSGi framework is the application.
While this works very well for the originally intended use-cases, maintaining and building large applications developed by multiple teams often requires to assemble multiple larger components for which there is limited support in OSGi as of today. This is especially true in cases where multiple groups of bundles, configuration, metadata, and other artifacts need to be combined.
In this talk we will introduce you to OSGi RFP-188, named OSGi Features, which defines the requirements on providing a solution. We'll establish a shared understanding of the problem space and how it relates to already available mechanisms in OSGi (like e.g. subsystems, deploymentadmin, startlevels, etc.) and will subsequently, review it in the context of some of the current (open source) solutions like Apache Karaf Features and Apache Sling Features and Bnd.
Migrating from PDE to Bndtools in Practice - Amit Kumar Mondal (Deutsche Tele...
OSGi Community Event 2018 Presentation by Amit Kumar Mondal (Deutsche Telekom AG) & Jochen Hiller (Deutsche Telekom AG)
Abstract: QIVICON is an Eclipse SmartHome based solution from Deutsche Telekom AG. It utilises OSGi to provide a modular Java runtime.
Since the beginning, QIVICON leveraged Eclipse PDE with Maven & Eclipse Tycho as its build technology but over the time, the complexity increased. It became hard to get an overview and manage the runtime and build dependencies. Especially maintaining target configurations for IDE and CI/CD build, having different embedded gateways for installation increased complexity significantly.
Bndtools is the 'swiss army knife' in the context of OSGi development since it takes the nitty-gritty pains and loads off the developer's chest. And that's why we decided to avail the benefits of Bndtools.
But, many other OSGi-based projects still cannot avail the benefits as they are very tightly coupled with Eclipse PDE. Want to make a switch from your existing PDE source base to Bndtools? This talk would give you an overview to proceed towards this.
We would like to further demonstrate in this talk how to set up a Bndtools workspace from an existing PDE workspace, convert all current projects to Bnd projects and embrace the OSGi-way of developing bundles.
Since QIVICON containing more than 350 projects utilised this solution to move to a higher modularity maturity level, this talk would, therefore, outline the pros, cons and the learnings using Bndtools in such a big OSGi project for embedded development.
OSGi CDI Integration Specification - Ray Augé (Liferay)
OSGi Community Event 2018 Presentation by Ray Augé (Liferay)
Abstract: This talk discusses the upcoming OSGi CDI Integration Specification and demonstrates common usage patterns and its component model that brings OSGi dynamics; like services and configuration, to CDI and provides for an ecosystem of CDI portable extentions.
How OSGi drives cross-sector energy management - Jörn Tümmler (SMA Solar Tech...
SMA is an energy equipment supplier that was seeking a solution for cross-sector energy management. They evaluated OSGi and decided to develop their own framework based on OSGi. They encountered several problems initially but overcame them by improving API design, avoiding dependencies, and using helper classes. They have now successfully applied OSGi in their products and find that it defines clean module deployment and versioning while supporting dynamic updates.
Improved developer productivity thanks to Maven and OSGi - Lukasz Dywicki (Co...
OSGi Community Event 2018 Presentation by Lukasz Dywicki (Code-House)
Abstract: During this short presentation I will revisit existing mechanisms and approach towards OSGi and JEE development. I will show how many manual steps can be avoided and how to maintain project in effective manner. I will try to find a balance between execution environment requirements and programmer happines at same time.
I believe that OSGi and Eclipse ecosystem experience troubles gaining people from outside for few reasons. Beside overall impression of OSGi complexity there is equally old and invalid complain about quaility of developer tooling. Since invention of BND development experience can be really pleasant and independent of text editor/IDE preferences. Sadly lots of people still rely on former experiences spreading black/bad PR. I would like to clarify their point.
After this presentation attendees will learn:
How to use Maven to build OSGi projects (without Tycho).
How to automate manual tasks.
How to build custom software distributions with Maven artifacts and run it with Apache Karaf.
That OSGi development doesn't differ much from regular day-to-day usage of application servers or microservice runtimes.
This talk is intended for people who know basics of OSGi as it will show few basic technics towards better developer productivity.
It Was Twenty Years Ago Today - Building an OSGi based Smart Home System - Ch...
OSGi Community Event 2018 Presentation by Christer Larsson (Makewave)
Abstract: OSGi was originally designed for Smart Homes and Residential Gateways almost 20 years ago.
This talk will present how the OSGi specifications have evolved over the years, and how you today, in 2018, design an OSGi based Smart Home System.
A real world use case of a Swedish Smart Home start-up company will be used to illustrate different design principles and how OSGi remains as relevant today as it was when it started.
Popular patterns revisited on OSGi - Christian Schneider (Adobe)
This document discusses how various software design patterns can be applied within the OSGi runtime environment. It describes patterns like Observer/Listener, OSGi Whiteboard, Dependency Injection, Circuit Breaker, and Domain-Driven Design and how they differ or are adapted when used with OSGi. For example, the OSGi Whiteboard pattern allows services and listeners to be loosely coupled without direct dependencies, and OSGi's declarative services specification provides a way to perform dependency injection and manage component lifecycles. The document argues that applying patterns like having microservices per bounded context can help match the original ideas of microservices while minimizing remote communication when using OSGi.
Integrating SLF4J and the new OSGi LogService 1.4 - BJ Hargrave (IBM)
OSGi Community Event 2018 Presentation by BJ Hargrave (IBM)
Abstract: OSGi Compendium R7 provides a major update to the OSGi LogService specification. A new logging API is added which supports logging levels and dynamic logging administration. A new Push Stream-based means of receiving log entries is also added. But it is quite often the case you need to use other code such as open source projects which are using slf4j for their logging API. This session will explore the new OSGi LogService changes and how you can integrate code using both slf4j logging and OSGi LogService logging.
OSG(a)i: because AI needs a runtime - Tim Verbelen (imec)
OSGi Community Event 2018 Presentation by Tim Verbelen (imec)
Abstract: Nowadays AI is reaching new heights on the hype cycle, especially due to recent advances in deep learning techniques. A lot of deep learning frameworks exist for creating and training deep neural networks, the most popular ones being PyTorch and TensorFlow. However, how to integrate, deploy and manage these neural networks in complex software systems is often overlooked. In this talk we show how OSGi can be used as a modular runtime for deep learning models. We embed those models inside OSGi bundles, and use the extender pattern to make these available as OSGi services. You can then use your favorite OSGi specs such as DS and PushStreams to integrate these into your application.
Flying to Jupiter with OSGi - Tony Walsh (ESA) & Hristo Indzhov (Telespazio V...
OSGi Community Event 2018 Presentation by Tony Walsh (ESA) & Hristo Indzhov (Telespazio Vega)
Abstract: The European Space Operations Centre (ESOC) is the main operations center for the European Space Agency (ESA), operating a number of earth observation and scientific missions. Monitoring and control functions needed by spacecraft operators are provided by software systems which are reused across missions, but tailored and extended for mission specific needs. The current generation of monitoring and control systems are becoming obsolete and a European wide initiative called the European Ground Systems Common Core (EGS-CC) (http://www.egscc.esa.int) has been started to develop the next generation.
This talk will explain why OSGi was chosen and how it is used in the development of next generation of monitoring and control software. It will describe how OSGi provides the necessary framework that enables the software to be extended for the different space systems it is expected to support. The overall software architecture will be discussed, some of the challenges faced and the benefits gained by using OSGi. The first target mission for the system is JUICE (http://sci.esa.int/juice) which will explore the moons of Jupiter and which is scheduled for launch in 2022.
MicroProfile, OSGi was meant for this - Ray Auge (Liferay)
OSGi Community Event 2018 Presentation by Ray Augé (Liferay)
Abstract: The craze is fully on. The past couple of years have seem micro services grow from next _flava_ to fully consuming of the software industry. The Eclipse micorprofile.io project is tackling the issue putting common usage patterns together over a foundation of CDI. What better assembly driver is there than OSGi to put it all together. This talk will demonstrate building your own MicroProfile using OSGi and the OSGi enRoute packaging model.
Prototyping IoT systems with a hybrid OSGi & Node-RED platform - Bruce Jackso...
OSGi Community Event 2018 Presentation by Bruce Jackson (Myriad)
Abstract: Node-RED is often used as a protyping tool for IoT systems. However, there are also a large number of OSGi components that have already been built to interface to devices, sensors and systems. In this talk I will show how two completely different runtime environments (OSGi and Node-RED) can be combined into a single platform for prototyping (and more) combining the strengths of both languages and systems.
Being able to quickly and simply prototype IoT application is extremely useful, and to this end many people have adopted Node-Red, a Node.js based runtime with extensive support for plugins to interface to various IoT hardware and protocols. However, this requires these services/protocols to be developed in Javascript, and there is already a significant body of code developed in Java/OSGi that it would be desirable to re-use.
The talk will explain how it is possible to:
Create and manage a Node-Red runtime from within an OSGi bundle
Share OSGi components and object into the Node-Red runtime
Interact and build Node-Red flows that exchange data and call methods between Node.js and OSGi
This is obviously useful for the original purpose: prototyping IoT systems, but also demonstrates some interesting techniques for bridging between different languages and runtimes.
How to connect your OSGi application - Dirk Fauth (Bosch)
OSGi Community Event 2018 Presentation by Dirk Fauth (Bosch)
Abstract: In todays connected world the requirement to connect applications across network boundaries has become a common requirement. With OSGi there are several ways to accomplish this, as there are different specifications to achieve this. In this talk we will look at some of these specifications to show what options there are and which might fit your requirements. Starting from an architecture that makes use of the HTTP Whiteboard pattern, over Remote Services to finally showing the usage of the JAX-RS Whiteboard specification introduced with R7. We will show the general usage of these specifications and explaining the advantages and disadvantages of each solution.
More from mfrancis (20)
Eclipse Modeling Framework and plain OSGi the easy way - Mark Hoffman (Data I...
Eclipse Modeling Framework and plain OSGi the easy way - Mark Hoffman (Data I...
Simplify Web UX Coding using OSGi Modularity Magic - Paul Fraser (A2Z Living)
Simplify Web UX Coding using OSGi Modularity Magic - Paul Fraser (A2Z Living)
OSGi for the data centre - Connecting OSGi to Kubernetes - Frank Lyaruu
OSGi for the data centre - Connecting OSGi to Kubernetes - Frank Lyaruu
Remote Management and Monitoring of Distributed OSGi Applications - Tim Verbe...
Remote Management and Monitoring of Distributed OSGi Applications - Tim Verbe...
OSGi with Docker - a powerful way to develop Java systems - Udo Hafermann (So...
OSGi with Docker - a powerful way to develop Java systems - Udo Hafermann (So...
A real world use case with OSGi R7 - Jurgen Albert (Data In Motion Consulting...
A real world use case with OSGi R7 - Jurgen Albert (Data In Motion Consulting...
OSGi Feature Model - Where Art Thou - David Bosschaert (Adobe)
OSGi Feature Model - Where Art Thou - David Bosschaert (Adobe)
Migrating from PDE to Bndtools in Practice - Amit Kumar Mondal (Deutsche Tele...
Migrating from PDE to Bndtools in Practice - Amit Kumar Mondal (Deutsche Tele...
OSGi CDI Integration Specification - Ray Augé (Liferay)
OSGi CDI Integration Specification - Ray Augé (Liferay)
How OSGi drives cross-sector energy management - Jörn Tümmler (SMA Solar Tech...
How OSGi drives cross-sector energy management - Jörn Tümmler (SMA Solar Tech...
Improved developer productivity thanks to Maven and OSGi - Lukasz Dywicki (Co...
Improved developer productivity thanks to Maven and OSGi - Lukasz Dywicki (Co...
It Was Twenty Years Ago Today - Building an OSGi based Smart Home System - Ch...
It Was Twenty Years Ago Today - Building an OSGi based Smart Home System - Ch...
Popular patterns revisited on OSGi - Christian Schneider (Adobe)
Popular patterns revisited on OSGi - Christian Schneider (Adobe)
Integrating SLF4J and the new OSGi LogService 1.4 - BJ Hargrave (IBM)
Integrating SLF4J and the new OSGi LogService 1.4 - BJ Hargrave (IBM)
OSG(a)i: because AI needs a runtime - Tim Verbelen (imec)
OSG(a)i: because AI needs a runtime - Tim Verbelen (imec)
Flying to Jupiter with OSGi - Tony Walsh (ESA) & Hristo Indzhov (Telespazio V...
Flying to Jupiter with OSGi - Tony Walsh (ESA) & Hristo Indzhov (Telespazio V...
MicroProfile, OSGi was meant for this - Ray Auge (Liferay)
MicroProfile, OSGi was meant for this - Ray Auge (Liferay)
Prototyping IoT systems with a hybrid OSGi & Node-RED platform - Bruce Jackso...
Prototyping IoT systems with a hybrid OSGi & Node-RED platform - Bruce Jackso...
How to connect your OSGi application - Dirk Fauth (Bosch)
How to connect your OSGi application - Dirk Fauth (Bosch)
Recently uploaded
Presentation of the OECD Artificial Intelligence Review of Germany
Consult the full report at https://www.oecd.org/digital/oecd-artificial-intelligence-review-of-germany-609808d6-en.htm
OpenID AuthZEN Interop Read Out - Authorization
During Identiverse 2024 and EIC 2024, members of the OpenID AuthZEN WG got together and demoed their authorization endpoints conforming to the AuthZEN API
みなさんこんにちはこれ何文字まで入るの？40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの？えこ...
ここ3000字までしか入らないけどタイトルの方がたくさん文字入ると思います。
20240609 QFM020 Irresponsible AI Reading List May 2024
Everything I found interesting about the irresponsible use of machine intelligence in May 2024
Ocean lotus Threat actors project by John Sitima 2024 (1).pptx
Ocean Lotus cyber threat actors represent a sophisticated, persistent, and politically motivated group that poses a significant risk to organizations and individuals in the Southeast Asian region. Their continuous evolution and adaptability underscore the need for robust cybersecurity measures and international cooperation to identify and mitigate the threats posed by such advanced persistent threat groups.
Skybuffer SAM4U tool for SAP license adoption
Manage and optimize your license adoption and consumption with SAM4U, an SAP free customer software asset management tool.
SAM4U, an SAP complimentary software asset management tool for customers, delivers a detailed and well-structured overview of license inventory and usage with a user-friendly interface. We offer a hosted, cost-effective, and performance-optimized SAM4U setup in the Skybuffer Cloud environment. You retain ownership of the system and data, while we manage the ABAP 7.58 infrastructure, ensuring fixed Total Cost of Ownership (TCO) and exceptional services through the SAP Fiori interface.
Choosing The Best AWS Service For Your Website + API.pptx
Have you ever been confused by the myriad of choices offered by AWS for hosting a website or an API?
Lambda, Elastic Beanstalk, Lightsail, Amplify, S3 (and more!) can each host websites + APIs. But which one should we choose?
Which one is cheapest? Which one is fastest? Which one will scale to meet our needs?
Join me in this session as we dive into each AWS hosting service to determine which one is best for your scenario and explain why!
TrustArc Webinar - 2024 Global Privacy Survey
How does your privacy program stack up against your peers? What challenges are privacy teams tackling and prioritizing in 2024?
In the fifth annual Global Privacy Benchmarks Survey, we asked over 1,800 global privacy professionals and business executives to share their perspectives on the current state of privacy inside and outside of their organizations. This year’s report focused on emerging areas of importance for privacy and compliance professionals, including considerations and implications of Artificial Intelligence (AI) technologies, building brand trust, and different approaches for achieving higher privacy competence scores.
See how organizational priorities and strategic approaches to data security and privacy are evolving around the globe.
This webinar will review:
- The top 10 privacy insights from the fifth annual Global Privacy Benchmarks Survey
- The top challenges for privacy leaders, practitioners, and organizations in 2024
- Key themes to consider in developing and maintaining your privacy program
Artificial Intelligence for XMLDevelopment
In the rapidly evolving landscape of technologies, XML continues to play a vital role in structuring, storing, and transporting data across diverse systems. The recent advancements in artificial intelligence (AI) present new methodologies for enhancing XML development workflows, introducing efficiency, automation, and intelligent capabilities. This presentation will outline the scope and perspective of utilizing AI in XML development. The potential benefits and the possible pitfalls will be highlighted, providing a balanced view of the subject.
We will explore the capabilities of AI in understanding XML markup languages and autonomously creating structured XML content. Additionally, we will examine the capacity of AI to enrich plain text with appropriate XML markup. Practical examples and methodological guidelines will be provided to elucidate how AI can be effectively prompted to interpret and generate accurate XML markup.
Further emphasis will be placed on the role of AI in developing XSLT, or schemas such as XSD and Schematron. We will address the techniques and strategies adopted to create prompts for generating code, explaining code, or refactoring the code, and the results achieved.
The discussion will extend to how AI can be used to transform XML content. In particular, the focus will be on the use of AI XPath extension functions in XSLT, Schematron, Schematron Quick Fixes, or for XML content refactoring.
The presentation aims to deliver a comprehensive overview of AI usage in XML development, providing attendees with the necessary knowledge to make informed decisions. Whether you’re at the early stages of adopting AI or considering integrating it in advanced XML development, this presentation will cover all levels of expertise.
By highlighting the potential advantages and challenges of integrating AI with XML development tools and languages, the presentation seeks to inspire thoughtful conversation around the future of XML development. We’ll not only delve into the technical aspects of AI-powered XML development but also discuss practical implications and possible future directions.
Columbus Data & Analytics Wednesdays - June 2024
Columbus Data & Analytics Wednesdays, June 2024 with Maria Copot 20
Building Production Ready Search Pipelines with Spark and Milvus
Spark is the widely used ETL tool for processing, indexing and ingesting data to serving stack for search. Milvus is the production-ready open-source vector database. In this talk we will show how to use Spark to process unstructured data to extract vector representations, and push the vectors to Milvus vector database for search serving.
Fueling AI with Great Data with Airbyte Webinar
This talk will focus on how to collect data from a variety of sources, leveraging this data for RAG and other GenAI use cases, and finally charting your course to productionalization.
AI 101: An Introduction to the Basics and Impact of Artificial Intelligence
Imagine a world where machines not only perform tasks but also learn, adapt, and make decisions. This is the promise of Artificial Intelligence (AI), a technology that's not just enhancing our lives but revolutionizing entire industries.
Introduction of Cybersecurity with OSS at Code Europe 2024
I develop the Ruby programming language, RubyGems, and Bundler, which are package managers for Ruby. Today, I will introduce how to enhance the security of your application using open-source software (OSS) examples from Ruby and RubyGems.
The first topic is CVE (Common Vulnerabilities and Exposures). I have published CVEs many times. But what exactly is a CVE? I'll provide a basic understanding of CVEs and explain how to detect and handle vulnerabilities in OSS.
Next, let's discuss package managers. Package managers play a critical role in the OSS ecosystem. I'll explain how to manage library dependencies in your application.
I'll share insights into how the Ruby and RubyGems core team works to keep our ecosystem safe. By the end of this talk, you'll have a better understanding of how to safeguard your code.
Digital Marketing Trends in 2024 | Guide for Staying Ahead
https://www.wask.co/ebooks/digital-marketing-trends-in-2024
Feeling lost in the digital marketing whirlwind of 2024? Technology is changing, consumer habits are evolving, and staying ahead of the curve feels like a never-ending pursuit. This e-book is your compass. Dive into actionable insights to handle the complexities of modern marketing. From hyper-personalization to the power of user-generated content, learn how to build long-term relationships with your audience and unlock the secrets to success in the ever-shifting digital landscape.
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Taking AI to the Next Level in Manufacturing.pdf
Read Taking AI to the Next Level in Manufacturing to gain insights on AI adoption in the manufacturing industry, such as:
1. How quickly AI is being implemented in manufacturing.
2. Which barriers stand in the way of AI adoption.
3. How data quality and governance form the backbone of AI.
4. Organizational processes and structures that may inhibit effective AI adoption.
6. Ideas and approaches to help build your organization's AI strategy.
National Security Agency - NSA mobile device best practices
Threats to mobile devices are more prevalent and increasing in scope and complexity. Users of mobile devices desire to take full advantage of the features
available on those devices, but many of the features provide convenience and capability but sacrifice security. This best practices guide outlines steps the users can take to better protect personal devices and information.
GraphRAG for Life Science to increase LLM accuracy
GraphRAG for life science domain, where you retriever information from biomedical knowledge graphs using LLMs to increase the accuracy and performance of generated answers
Recently uploaded (20)
Presentation of the OECD Artificial Intelligence Review of Germany
Presentation of the OECD Artificial Intelligence Review of Germany
みなさんこんにちはこれ何文字まで入るの？40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの？えこ...
みなさんこんにちはこれ何文字まで入るの？40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの？えこ...
20240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 2024
Ocean lotus Threat actors project by John Sitima 2024 (1).pptx
Ocean lotus Threat actors project by John Sitima 2024 (1).pptx
Choosing The Best AWS Service For Your Website + API.pptx
Choosing The Best AWS Service For Your Website + API.pptx
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
AI 101: An Introduction to the Basics and Impact of Artificial Intelligence
AI 101: An Introduction to the Basics and Impact of Artificial Intelligence
Introduction of Cybersecurity with OSS at Code Europe 2024
Introduction of Cybersecurity with OSS at Code Europe 2024
Digital Marketing Trends in 2024 | Guide for Staying Ahead
Digital Marketing Trends in 2024 | Guide for Staying Ahead
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
National Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practices
GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
Enabling Java 2 Runtime Security with Eclipse Plug-ins - Ted Habeck, Advisory Software Engineer, IBM & Marco Pistoia, Ph.D., Research Staff Member, IBM
- 2. Enabling Java 2 Runtime Security with Eclipse Plug-ins ___ Analyzing Security Requirements for OSGi-Enabled Platforms
- 8. Main.main() Socket.<init>("www.ibm.com", 80) sm.checkConnect("www.ibm.com", 80) sm.checkPermission(p) AccessController.checkPermission(p) p p p p p ? ? ? ? ?If all the code source was granted Permission p… SecurityException Otherwise… Problem: What Permissions are required? • Not too many permissions • Not too few permissions
- 9. import java.io.*; import java.net.*; public class LibraryCode { private static String logFileName = "audit.txt"; public static Socket createSocket(String host, int port) throws UnknownHostException, IOException { Socket socket = new Socket(host, port); FileOutputStream fos = new FileOutputStream(logFileName); BufferedOutputStream bos = new BufferedOutputStream(fos); PrintStream ps = new PrintStream(bos, true); ps.print("Socket " + host + ":" + port); return socket; } } Client Library createSocket Socket Permission File Permission
- 10. Client.main() LibraryCode.createSocket() q q p p Socket.<init>(host,port) sm.checkConnect(host,port) sm.checkPermission(q) AccessController.checkPermission(q) q q q q FileOutputStream.<init>(logFileName) sm.checkWrite(logFileName) sm.checkPermission(p) AccessController.checkPermission(p) p p p p p = new FilePermission("audit.txt","write");q = new SocketPermission("ibm.com","80");
- 11. import java.io.*; import java.net.*; import java.security.*; public class LibraryCode2 { private static final String logFileName = "audit.txt"; public static Socket createSocket(String host, int port) throws UnknownHostException, IOException, PrivilegedActionException { Socket socket = new Socket(host, port); File f = new File(logFileName); PrivWriteOp op = new PrivWriteOp(host, port, f); FileOutputStream fos = (FileOutputStream) AccessController.doPrivileged(op); BufferedOutputStream bos = new BufferedOutputStream(fos); PrintStream ps = new PrintStream(bos, true); ps.print("Socket " + host + ":" + port); return socket; } } class PrivWriteOp implements PrivilegedExceptionAction { private File f; PrivWriteOp (File f) { this.f = f; } public Object run() throws IOException { return new FileOutputStream(f); } } Client Library createSocket Socket Permission File Permission
- 12. Client.main() Library.createSocket() q q p AccessController.doPrivileged(op) op.run() p p FileOutputStream.<init>(logFileName) sm.checkWrite(logFileName) sm.checkPermission(p) AccessController.checkPermission(p) p p p p p = new FilePermission("audit.txt","write"); Socket.<init>(host,port) sm.checkConnect(host,port) sm.checkPermission(q) AccessController.checkPermission(q) q q q q q = new SocketPermission("ibm.com","80");
- 16. SecurityManager. checkPermission(p) p p p p AccessController. checkPermission(p) FileOutputStream. <init>() pClient Library p Core p AccessController. doPrivileged(pa) p PrivilegedAction. run()
- 20. Static Analysis Engine (Eclipse and OSGi Aware) JAR Inspection Java Bytecode Analysis (JaBA) Call Graph Access-Rights Analysis Privileged-Code Placement Analysis Tainted-Variable Analysis Object CodeSecurity Policy Code Architecture Inspection Certificate Inspection Permission Inspection KeyStore Editor JAR Signer Call Path Analysis