Difference between revisions of "Malicious Developers and Enterprise Java Rootkits"

From OWASP
Jump to: navigation, search
(Created page with '== The presentation == rightHow much would it cost to convince a developer to insert a few special lines of Java in your application? Would you …')
 
 
(5 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 
== The presentation  ==
 
== The presentation  ==
  
[[Image:Owasp_logo_normal.jpg|right]]How much would it cost to convince a developer to insert a few special lines of Java in your application? Would you detect the attack before it went live? How much damage could it do? Malicious developers are the ultimate insiders. With a very small number of lines of Java, they can steal all your data, corrupt systems, install system level attacks, and cover their tracks. A trojaned Struts or Log4j library could affect most of the financial industry at once. This talk will examine the techniques that malicious programmers can use to insert and hide these attacks in a Java web application. What can organizations do to minimize the risk of malicious Java developers? We'll review the benefits and limitations of technical controls, such as sandboxes, configuration management, least privilege, and intrusion detection. We'll also discuss the use of detection techniques such as code review and static analysis tools. Finally, we'll talk about people and organizational issues that can help minimize this risk.
+
[[Image:JeffWilliams2.jpg|200px|thumb|right|Jeff Williams]]How much would it cost to convince a developer to insert a few special lines of Java in your application? Would you detect the attack before it went live? How much damage could it do? Malicious developers are the ultimate insiders. With a very small number of lines of Java, they can steal all your data, corrupt systems, install system level attacks, and cover their tracks. A trojaned Struts or Log4j library could affect most of the financial industry at once.
  
== The speaker  ==
+
This technical talk will examine some of the techniques that malicious programmers can use to insert and hide these attacks in a Java web application. What can organizations do to minimize the risk of malicious Java developers? We'll review the benefits and limitations of technical controls, such as sandboxes, configuration management, least privilege, and intrusion detection. We'll also discuss the use of detection techniques such as code review and static analysis tools. Finally, we'll talk about people and organizational issues that can help minimize this risk.
  
Jeff Williams has specialized in information security since 1989 and has published numerous papers focused on practical risk and assurance techniques. Jeff has been writing code for 25 years in many different environments but has focused primarily on Java and J2EE security for the past 10 years. Jeff is a primary author of the OWASP Top 10 Web Application Security Vulnerabilities and the OWASP Secure Software Development Contract Annex, and he leads several OWASP projects. He also chaired the group responsible for creating ISO 21827, the Systems Security Engineering Capability Maturity Model (SSE-CMM).
+
A long technical paper and an Eclipse project with all the code examples is [http://www.aspectsecurity.com/documents/EnterpriseJavaRootkits.zip available].
 +
 
 +
== The speaker  ==
 +
'''[[User:Jeff Williams|Jeff Williams]]''' is the founder and CEO of [http://www.aspectsecurity.com/ Aspect Security], specializing exclusively in application security professional services. Jeff also serves as the volunteer Chair of the [http://www.owasp.org/ Open Web Application Security Project (OWASP)]. He has made extensive contributions to the application security community through OWASP, including writing the [[topten|Top Ten]], [[WebGoat]], [[legal|Secure Software Contract Annex]], [[ESAPI|Enterprise Security API]], [[OWASP Risk Rating Methodology]], and starting the worldwide [[chapters|local chapters program]]. If nothing else, Jeff is probably the tallest application security expert in the world and likes nothing better than discussing new ideas for changing the way we build software.
  
 
[[Category:OWASP_AppSec_DC_09]] [[Category:OWASP_Conference_Presentations]]
 
[[Category:OWASP_AppSec_DC_09]] [[Category:OWASP_Conference_Presentations]]

Latest revision as of 10:23, 20 October 2009

The presentation

Jeff Williams
How much would it cost to convince a developer to insert a few special lines of Java in your application? Would you detect the attack before it went live? How much damage could it do? Malicious developers are the ultimate insiders. With a very small number of lines of Java, they can steal all your data, corrupt systems, install system level attacks, and cover their tracks. A trojaned Struts or Log4j library could affect most of the financial industry at once.

This technical talk will examine some of the techniques that malicious programmers can use to insert and hide these attacks in a Java web application. What can organizations do to minimize the risk of malicious Java developers? We'll review the benefits and limitations of technical controls, such as sandboxes, configuration management, least privilege, and intrusion detection. We'll also discuss the use of detection techniques such as code review and static analysis tools. Finally, we'll talk about people and organizational issues that can help minimize this risk.

A long technical paper and an Eclipse project with all the code examples is available.

The speaker

Jeff Williams is the founder and CEO of Aspect Security, specializing exclusively in application security professional services. Jeff also serves as the volunteer Chair of the Open Web Application Security Project (OWASP). He has made extensive contributions to the application security community through OWASP, including writing the Top Ten, WebGoat, Secure Software Contract Annex, Enterprise Security API, OWASP Risk Rating Methodology, and starting the worldwide local chapters program. If nothing else, Jeff is probably the tallest application security expert in the world and likes nothing better than discussing new ideas for changing the way we build software.