RuhrSec 2016: 'Java deserialization vulnerabilities - The forgotten bug class', Matthias Kaiser

RuhrSec is the annual English speaking non-profit IT security conference with cutting-edge security talks by renowned experts. RuhrSec is organized by Hackmanit.
🔽 More information ...

Abstract. Java deserialization vulnerabilities are a bug class on its own. Although several security researchers have published details in the past, still the bug class is fairly unknown. This talk is about finding and exploiting deserialization flaws in Java. Details on a new gadget will be disclosed, allowing Remote Code Execution. And several vulnerabilities discovered by Code White will be shown as Case Studies including a 0day.

Biography. Matthias is the Head of Vulnerability Research at Code White. He enjoys bug-hunting in Java Software because it's so easy. He found vulnerabilities in products of Oracle, IBM, SAP, Symantec, Apache, Adobe, Atlassian, etc. Currently, he enjoys researching deserialization and looking into COM/OLE.

Speaker: Matthias Kaiser

———

👉 Subscribe to our channel:

👉 Read more about interesting IT Security topics on our blog:

✍️ Want a deeper dive?
Training courses in Single Sign-On (SAML, OAuth and OpenID Connect), Secure Web Development, TLS and Web Services are available here:

———

———

Thanks for your attention and support. Stay secure.

#cybersecurity #java #ruhrsec #cyber #conference #talk
#itsecurity #itsicherheit #javabug #remotecodeexecution

[peter.girnus]

Is there a place to get the slides or more info? thanks for uploading by the way.