How To Find And Prevent Entire Classes Of Security Vulnerabilities

on YouTube ↗34m

" summary

A practical claim: describe a bug’s root cause, write a semantic code query that tracks data- and control-flow and run it across the codebase. Real results: Microsoft uses this on ChakraCore and finds the original exploit plus four additional variants (five total); Microsoft and others ship open-sourced checks (e g for Zip Slip) and integrate them into CI or patch rollouts. Tools combine call-graphs, dataflow, and language-aware queries rather than longer natural-language descriptions.

AI-written summary · about

" chapters (10)

1. 0:00Intro
2. 1:01A story of many bugs (CVE-2017-8046)
3. 3:18A story of many bugs 2
4. 7:42Variant Analysis?
5. 9:33Code Navigation / IDE
6. 11:32Automating Variant Analysis
7. 13:59An Example: Chakra
8. 19:39Zip Slip
9. 27:19What variant analysis is NOT
10. 30:36Recap

" related talks

• 39mSoftware Security Engineering (Learnings from the past to fix ...)D. Mohanty · OWASP 20th Anniversary 2021
• 52mSecurity as Code: A DevSecOps ApproachJoseph Katsioloudes · NDC Security 2023
• 45mEradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and InvariantsClint Gibler, Isaac Evans · OWASP Global AppSec Virtual 2020
• 23mStopping vulnerabilities at the sourcePavel Avgustinov, Grey Baker · GitHub Satellite Virtual 2020
• 45mFinding Vulnerabilities through Static Analysis and ScriptingStephen Sims · RSA Conference 2023
• 33mSecurity as Code: A DevSecOps ApproachJoseph Katsioloudes · OSMC 2022
• 49mOpen-source vulnerability management? Use the source, Luke!Henrik Plate · Conf42 DevSecOps 2022
• 27mHow to implement Security as Code?Christoph Hartmann · Conf42 Cloud Native 2023