Dangerous Serialization
summary
Examines insecure serialization across several programming languages and serialization formats, showing how modern libraries and frameworks hide internal behaviors that can lead to security failures. Uses concrete examples of language-specific serialization pitfalls to demonstrate how misuse or ignorance of serialization details can enable full system compromise.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:12What is serialization
- 6:48Serialization vulnerabilities
- 12:54Serialization attack examples
- 19:00Exploiting nested classes
- 24:54Libraries and remote code
- 26:45PHP and Memcached flaws
- 28:30Finding code flaws
- 30:17Protection methods
- 33:47Security rules
related talks
41mJava Serialisation: A Modern Fairytale
47mA Modern Fairy Tale: Java Serialization
44mSecond Breakfast: Implicit and Mutation-Based Serialization Vulnerabilities in .NET
24mSecond Breakfast: Implicit and Mutation-Based Serialization Vulnerabilities in .NET
41mHigh-Secure Java Serialization
37mDeserialization in Java - is there still anything to fear?
45mSerialization & Object Graph Communication
53mWhy We Hate Java Serialization And What We're Doing About It