Fixing the Unfixable: Solving Pervasive Vulnerabilities with RASP
summary
Claims a practical fix for Java deserialization by weaving security into running apps: a free open source RASP agent hooks the JVM, blocks ysoserial-style gadget payloads and supports blacklist/whitelist policies, demos on a Raspberry Pi running WebGoat that neuters deserialization attacks and blocks SQLi/XSS. Instrumentation uses source, binary and dynamic weaving; supports virtual patches across a portfolio; measured overhead is tiny—about 50 microseconds per request—and central control lets teams deploy protections enterprise‑wide.
AI-written summary · about
chapters (14)
- 0:00Start
- 5:17Raspberry Pi Zero
- 11:06Binary Instrumentation
- 12:02Dynamic Binary Instrumentation
- 14:14Sensors
- 17:28Cluster Bomb Effect of String Handling
- 18:37How Rasp Might Block a Attack
- 20:49Advantages To Rasp
- 21:57Impedance Mismatch Problem
- 24:13Performance
- 26:22The Java Deserialization Flaws
- 35:25Virtual Patching
- 36:57Security Logging
- 40:03Rasp Dashboard
related talks
43mJumpstarting Your DevSecOps Pipeline with IAST and RASP
49mAn overview of available opensource tools to secure your Java code
40m[In]secure Deserialization, And How [Not] To Do It
59mTrusting Software: Runtime Protection Is The Third Alternative
47mRAVAGE - Runtime Analysis of Vulnerabilities and Generation of Exploits
35mHow To Find The Next Great Deserialization CVE
24mSecurity – only developers can make it proactive
34mLow-level RASP: Protecting Applications Implemented in High-level Programming Languages