Protection and Verification of Security Design Flaws
summary
Claim: about 55% design-flaw estimate of real-world security issues resist automated code scanners. Demonstration uses Spring PetClinic plus Burp Suite interception to show parameter tampering, mass-assignment and time-of-check/time-of-use exploits. Built an extension called Hdiv contract extraction that infers server-side URL/field contracts from Spring MVC/REST and enforces them, blocking many tampering and binding attacks in the demo. It works for most access-control tampering (authors claim roughly 80–90% typical cases) but cannot solve header abuse, race conditions or some workflow abuses.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:41Contents of Talk
- 7:17Finding and Fixing Vulnerabilities
- 10:58A Basic Design Bug - AT&T
- 14:18Stack Overflow
- 15:41Github
- 16:59Jboss and the JMX Consoles
- 22:50Problem Statement
- 23:51How to protect from design flaws with traditional approaches
- 27:26It does not work in practice
- 28:04The reason
- 30:06Design Flow Attack Types
- 36:57Contract based security in real use
- 39:42Limitations of this Method
- 41:10Recommendations
related talks
55mBreaking and Fixing Web Application Security
24mSecurity – only developers can make it proactive
44mShift-Left-Security with the Security Test Pyramid
27mCommon Application Security Mistakes that Enable Automated Attacks
45mSecuring LLM Applications: Overcoming Security & Privacy Challenges
50mFix The Damned Software
47mDon't Get Burned! Secure Coding Essentials to Protect Your Application
38mCan I Touch You There? Tools and Techniques for Security Testing