Reducing Third-Party Security Risk in .NET Core Applications

on YouTube ↗59m

" summary

Shows a demo MVC app where an included PDF component allows path traversal and server‑side request forgery (loads remote images). Uses .NET Core 3.1 AssemblyLoadContext plus a self‑contained deployment to load the PDF library in an isolated context, replaces System.Net.Http with a stub to block external fetches while still permitting local files, and proves the sandbox works. Ships a CLI called fennec (Mono.Cecil) to dump API calls for review. Cites Veracode stats: ~85% → ~70% vulnerable apps.

AI-written summary · about

" chapters (14)

1. 0:00Start
2. 1:46Reducing Third-Party Security Risk in .NET Core Applications
3. 5:20Third-Party Security Risks
4. 7:30State of Software Security
5. 11:50Octopus Scanner
6. 13:33Supply Chain Attacks
7. 14:40ASUS Live Update
8. 29:03Compartmentalization of functionality
9. 29:50System.AppDomain
10. 31:56System.Runtime.Loader.Assembly LoadContext
11. 49:29Changes in Software Architecture
12. 50:27Review Third-Party Libraries
13. 56:39Microsoft Application Inspector
14. 57:27Conclusion

" related talks

• 49mReducing Third-Party Security Risk in .NET Core ApplicationsNiels Tanis · Update Conference Prague 2019
• 58mReducing Third-Party Security Risk in .NET Core ApplicationsNiels Tanis · NDC London 2020
• 01h 03mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Brock Allen · NDC Minnesota 2019
• 58mASP.NET Core meets OWASP Top 10 2025Anders Abel · NDC Security 2026
• 52mBuilding Community-Driven Security Analysis for Your .NET Software Supply ChainNiels Tanis · NDC Manchester 2025
• 52mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0Dominick Baier · NDC Copenhagen 2019
• 54mASP.NET Core Meets Owasp Top 10Anders Abel · NDC Security 2022
• 32mBuilding Secure ASP.NET Core MVC ApplicationsNiels Tanis · AppSec USA 2017