Arshan Dabirsiaghi - How To Find The Next Great Deserialization CVE - AppSecUSA 2016
Channel: OWASP Foundation
Date: 2016-11-13

Recorded at AppSecUSA 2016 in Washington, DC
https://2016.appsecusa.org/

The talk will generalize the recent spate of deserialization attacks, including a brief discussion of an originally authored exploit for a recently discovered CVE. 

The commonalities between deserialization attacks will then be discussed, laying the framework for a "how to" guide on finding and exploiting deserialization vulnerabilities.

The talk will also explain the incredible difficulty faced when using traditional appsec defenses (input validation, signaturing) to stop these vulnerabilities, and explain free and open source options for builders to protect themselves from such attacks.

Arshan Dabirsiaghi
Chief Scientist, Contrast Security
Arshan is an accomplished security researcher with over 10 years of experience advising large organizations on application security. Prior to Contrast Security, Arshan spent 8 years at Aspect Security in a research role where he used static and dynamic technology to perform security assurance work, including code reviews, architecture reviews and penetration testing. 

-

Managed by the official OWASP Media Project https://www.owasp.org/index.php/OWASP_Media_Project