Low-level RASP: Protecting Applications Implemented in High-level Programming Languages
No ratings
Presented at BlackHat USA 2023 by
During the emergency response process of application-level 0day vulnerabilities, RASP (Runtime Application Self Protection) usually has a better defense performance than WAF (Web Application Firewall) and HIPS (Host-based Intrusion Prevention System) because it can obtain the context (stack, method, parameter, etc.) inside the application. Take an enterprise as an example, different business teams may choose different high-level programming languages (HPL) as their main languages in software development are based on their business characteristics. However, RASP can only provide defense capabilities for a specific HPL.LL-RASP is a new runtime defense technology that we invented when we faced these problems, and it can solve these problems with lower cost and better performance. It abstracts general capabilities such as information collection, environment monitoring, rule maintenance, health check, general Hook, RPC&IPC, etc. If you want to use runtime defense capabilities to protect your applications in other HPLs such as Ruby, all you need to do is use dozens of lines of code to implement a lightweight extension.In this talk, I will take Java, NodeJS, PHP, Python and Ruby as examples to demonstrate how LL-RASP can empower security teams to be more agile and effective than ever before when protecting applications in various HPLs.