Export to

• Google Calendar
• iCalendar file
• hCalendar markup
  <div class="vevent h-event"> <h1 class="summary p-name">Portland Java User Group (PJUG) - How to Protect against Deserialization Attacks</h1> <div class='date'><time class="dtstart dt-start" title="2018-05-15T19:00:00" datetime="2018-05-15T19:00:00">Tuesday, May 15, 2018 from 7</time>–<time class="dtend dt-end" title="2018-05-15T20:00:00" datetime="2018-05-15T20:00:00">8pm</time></div> <div class="location vcard p-location h-card"> <a class="url" href='http://calagator.org/venues/202395644'><span class='fn org p-name'>Oracle Portland</span></a> <div class="adr p-adr h-adr"> <div class="street-address p-street-address">1211 SW 5th Ave #800</div> <span class="locality p-locality">Portland</span> , <span class="region p-region">OR</span> <span class="postal-code p-postal-code">97204</span> <div class="country-name p-country-name">us</div> (<a href='https://maps.google.com/maps?q=1211%20SW%205th%20Ave%20%23800,%20Portland%20OR%2097204%20us'>map</a>) </div> </div> <div class="description p-description"> <p>Insecure deserialization is one of the most critical web application security risks, yet it is by no means a new vulnerability category. Data serialization and deserialization have been used widely in applications, services and frameworks, with many programming languages supporting them natively. Deserialization got more attention recently as a potential vehicle to conduct several types of attacks: data tampering, authentication bypass, privilege escalation, various injections and, finally, remote code execution. Two recent vulnerabilities in Apache Commons and Apache Struts, both allowing remote code execution, helped raise awareness of this risk.</p> <p> </p><p>We will discuss how data serialization and deserialization are used in software, the dangers of deserializing untrusted input, and how to avoid insecure deserialization vulnerabilities.</p> <p>Speaker:</p> <p>Alexei Kojenov (<a href="https://twitter.com/kojenov" class="linkified">https://twitter.com/kojenov</a>) is a Senior Application Security Consultant with years of prior software development experience. During his career with IBM, he gradually moved from writing code to breaking code. Since late 2016, Alexei has been working as a consultant at Aspect Security, helping businesses identify and fix vulnerabilities and design secure applications. Aspect Security was recently acquired by Ernst&Young and joined EY Advisory cybersecurity practice.</p> </div> <h3>Links</h3> <ul> <li><a class="url u-url" href="https://www.meetup.com/PDXJUG/events/250603125/">Website</a></li> </ul> </div>