Legacy Java Vulnerabilities
Talkat AppSec California 2015 · on Wednesday, 2015-01-28· at 10:30· Annenberg Community Beach House: Track 2, 415 Pacific Coast Hwy·
summary
Shows a modified JVM that containerizes legacy Java apps so multiple old JREs run on one modern host JVM, with run multiple legacy JVMs on one host and no app changes. Demonstrates a rules engine and taint‑tracking SQL detector that a one‑line rule enables and throws a Java exception the app can catch, stopping injection without crashing. Describes profiling → alert → block deployment, examples using Tomcat 6/7 on a Java 7 host, and orchestration via config management for scale.
AI-written summary · about
chapters (12)
- 0:00Start
- 0:23Agenda
- 0:56Let's Set the Stage - Reality Check
- 5:06The Typical Java Stack is Insecure
- 6:39Advanced Security Technology in Java Containers
- 7:57Security Rules Provide Broad Coverage of Application Activity
- 8:40Simple Security Rules can be Modified Without Service Interruption
- 11:14Waratek Containers for Legacy Java Security and Compliance No changes to the application
- 18:11SQL Injection can be Mitigated with a Single Rule that Invokes the TDE
- 26:35Under the Covers: An SQL Abstract Syntax Tree (AST)
- 29:53The Metadata Identifies the Potentially Compromised Portions of the Query
- 30:19Syntax Verification Reliably Identifies Alterations of Syntax Structure
related talks
52mSecuring Your Java Containers by Breaking In
48mHidden Security Features of the JVM - Everything You Didn’t Know and More
56mThe Anatomy of Java Vulnerabilities
44mSecuring the JVM
46mStranger Danger: Securing Your Java Containers by Breaking In
48mThe Hidden Security Hazards in Your Java Stack
49mThe Anatomy of Java Vulnerabilities
48mCommon vulnerabilities you wish your Java app didn't have!