Deep, Fast & Strong: IAST & RASP for Techies – Understanding How Runtime Analysis Actually Works!

No ratings

Presented at NYMJCSC 2016 by

Ofer Maor

IAST (& RASP) are revolutionary technologies, which are starting to get traction in the market. While this is becoming a buzz, the vast majority of security experts do not understand the details of this technology and how it works. In this talk we will do a deep dive and explain the nitty gritty details. (The talk will focus on the technology and how it is working only, and will not have any specific product references.) Brief Layout: The presentation will begin by providing (very brief!) background information on challenges in appsec security testing and existing solutions in the space (SAST/DAST). We will then present the basic concept of runtime analysis and what are the key principles behind this approach. Following the introduction, we will start by explaining the different possible techniques available for runtime analysis, including debugging, instrumentation, aspect-oriented injection, modification of runtime environment, compilation of runtime hooks, etc. We will explain the merits of each technique, and focus specifically on instrumentation which is the most widely used approach for runtime code analysis. We will show how instrumentation can be used to inject code into the memory of the process to demonstrate the level of granularity achievable with runtime analysis. After understanding how runtime analysis works, the talk will continue onto explaining its usage. In this part, we will demonstrate various common vulnerabilities (such as SQL Injection, XSS, CSRF, Parameter Tampering, etc.) - And show how runtime analysis can be used to detect these issues in the code. This will include specific code samples, showing the vulnerable piece of code, combined with the request launched against it and how it is executed in the memory, in runtime, and identified by a runtime analysis engine. Finally, we will discuss the usage of runtime code analysis, such as AppSec testing (IAST) and vulnerability detection and blocking (RASP).