Hack.lu 2017 Snuffleupagus - Killing bugclasses in PHP 7, virtual-patching the rest
Channel: Cooper
Date: 2017-10-17

Snuffleupagus - Killing bugclasses in PHP 7, virtual-patching the rest

by Sébastien (blotus) Blot, Thibault (buixor) Koechlin & Julien (jvoisin) Voisin

Suhosin is a great PHP module, but unfortunately, it’s getting old, new ways have been found to compromise PHP applications, and some aren’t working anymore; and it doesn’t play well with the shiny new PHP 7. As a secure web-hosting company, we needed a reliable and future-proof solution to address the flow of new vulnerabilities that are published every day. This is why we developed Snuffleupagus, a new (and open-source!) PHP security module, that provides several features that we needed: passively killing several PHP-specific bug classes, but also implementing virtual-patching at the PHP level, allowing to patch vulnerabilities in a precise, false-positive-free, ultra-low overhead way, without even touching the applications’ code.

Bio: Sébastien (blotus) Blot, Thibault (buixor) Koechlin, Julien (jvoisin) Voisin

Sébastien (blotus) Blot is a pretty cool guy.
Thibault (bui) Koechlin used to write exploits for fun, he’s now CISO at NBS System, writing the naxsi WAF to prevent web pwning.
Julien (jvoisin) Voisin used to pwn and reverse stuff while contributing to radare2, he nowadays focus on protecting web stuff while keeping his own bug alive on websec.fr and writing stuff on dustri.org. He’s also running some high-speed Tor relay.