EMBEDDING DEFENSE IN SERVER-SIDE APPLICATIONS

No ratings

Presented at ruxcon 2017 by

Applications often rely on secure development practices and third-party defense mechanisms for protection. Whenever an application receives malicious payloads they are either dropped or executed by the affected application. Ignoring these situations aid attackers in performing deep analysis of applications until they are able to exploit existing flaws. Standards, libraries and third-party defense systems developed to secure applications introduce opportunities for attackers. While some protections have already been implemented in applications and web firewalls, there is a whole spectrum of techniques not being analyzed. This research details how server side applications can incorporate an extensive layer of defense to detect and protect against attackers. Defense mechanisms will be released in four different languages: .NET, Java, PHP and Python. Throughout the presentation, undisclosed vulnerabilities from secure coding guidelines will be used to exemplify. By implementing the defenses laid out in this paper, attackers may unwittingly become the victims.