Popular Approaches to Preventing Code Injection Attacks are Dangerously Wrong
summary
Claims a JVM runtime hardening called Name Space Layout Randomization that renames JRE packages on each boot so injected class files cannot reference java.lang.System etc, logs attempts and throws ClassNotFoundException, and uses 96–1,024 bit entropy to block brute force. Shows low‑overhead tracing plus tainted lexical analysis that deterministically catches SQLi/XSS/path traversal with ~1–2% cost and zero false positives, and demonstrates live virtual patching via the JIT to fix a CVE without redeploying.
AI-written summary · about
chapters (7)
- 0:00Introduction to code injection
- 3:54Rethinking security
- 10:43Limitations of current tools
- 15:13Runtime tracing and analysis
- 22:36Addressing bytecode injection
- 30:29Compartmentalization techniques
- 37:13Compiler-based virtual patching
related talks
48mHidden Security Features of the JVM - Everything You Didn’t Know and More
44mSecuring the JVM
43mDon't hack the JVM? ☠️💣💥
48mThe Hidden Security Hazards in Your Java Stack
46mThe Anatomy of Java Vulnerabilities
56mThe Anatomy of Java Vulnerabilities
44mSinking Your Hooks in Applications
50mStranger Danger: Your Java Attack Surface Just Got Bigger