Ezequiel D. Gutesman's guest appearances

Ezequiel D. Gutesman

Black Hat Briefings, USA 2007 [Video] Presentations from the security conference.

Black Hat Briefings, USA 2007 [Audio] Presentations from the security conference.

Krishna Kurapati

Chris Palmer

Keith Jones

Mark Ryan

Bruce Schneier

Tony Sager

Mark Dowd

David Byrne

Rob King

Jennifer Granick

Robert Graham

John McDonald

Mike Perry

Robert Hansen

Jamie Butler

OwlTail

Ariel Waissbein

Several protection techniques based on run-time taint analysis have been proposed within the last 3 years. Some of them provide full-automated protection for existing web applications, others require human interaction, and yet others require source code modification and/or special tunning. We briefly discuss advantages and disadvantages of these approaches. Next, we introduce a new technique which permits to efficiently identify and block several attack vectors on the fly by augmenting the web application's execution environment to include tracking information. Most web-scripting languages including PHP, ASP, Python, Perl and Java can be protected with this technique. Typical exploitation methods such as database-injection attacks, shell injection attacks, cross-site scripting attacks and directory-transversal attacks are prevented.  	More generally, this solution to the injection vulnerability problem for web applications is based on a characterization of the injection attacks family -that we implemented. The execution environment includes instrumentation information to allow identification of syntactic alteration of a sentence in cross-language boundaries. This characterization allows us, furthermore, to enforce privacy: it protects from untrusted users that try to obtain private data that stored within the web application's network. Thus, putting off the theft of sensitive data, like credit card information, as well as averting information leakage.

Several protection techniques based on run-time taint analysis have been proposed within the last 3 years. Some of them provide full-automated protection for existing web applications, others require human interaction, and yet others require source code modification and/or special tunning. We briefly discuss advantages and disadvantages of these approaches. Next, we introduce a new technique which permits to efficiently identify and block several attack vectors on the fly by augmenting the web application's execution environment to include tracking information. Most web-scripting languages including PHP, ASP, Python, Perl and Java can be protected with this technique. Typical exploitation methods such as database-injection attacks, shell injection attacks, cross-site scripting attacks and directory-transversal attacks are prevented.<br/> <br/> 	More generally, this solution to the injection vulnerability problem for web applications is based on a characterization of the injection attacks family -that we implemented. The execution environment includes instrumentation information to allow identification of syntactic alteration of a sentence in cross-language boundaries. This characterization allows us, furthermore, to enforce privacy: it protects from untrusted users that try to obtain private data that stored within the web application's network. Thus, putting off the theft of sensitive data, like credit card information, as well as averting information leakage.

Ezequiel D. Gutesman & Ariel Waissbein: A dynamic technique for enhancing the security and privacy of web applications