3 ms·
> Leave anything on an unprotected port taking unsanitised input and it’s vulnerable no matter what it is written in I don’t think you’re comparing apples with
by wepple 8y ago
> Leave anything on an unprotected port taking unsanitised input and it’s vulnerable no matter what it is written in
I don’t think you’re comparing apples with apples.
Even in a default configuration, the majority of services that show up on a network don’t give you instant code exec. Maybe tomcat servers with default passwords, and a few other things.
But (de)serialization isn’t securable at all. You can’t add auth, you can’t WAF it, you can’t fix the underlying vulnerabilities.
There is absolutely nothing which has that level of vulnerability and lack of security on a modern network.
- gaius 8y agoThere is absolutely nothing which has that level of vulnerability and lack of security on a modern network. OK, let's say I overwrite part of your system with something evil, knowing that your app will Class.forName() it. Is that a problem with the ClassLoader or is the problem that your perimeter is already compromised anyway?
- wepple 8y agoI don’t think it matters, at all. Java has serialization, and everyone uses it, and it’s a security nightmare. As uncomfortable as it may feel to me, I kinda agree with Oracles approach here: kill serialization, make things more secure. If they have to change core language/libraries, so be it. You were trying to say that anything left on a network socket will be compromised, and that’s simply not true. Most software is pretty solid. Anything in C will have more than it’s fair share of upcoming patches, but unlike Java serialization, you can’t fix a single lib to fix 99% of bugs.. or we would’ve surely done that.