Snuffleupagus: killing bug classes and virtual patching the rest

Display subtitles automatically

None
In the preferred language only when the video is using another
Always in the preferred language
Always in the original language of the video

Preferred language:

Qualities

UbiCast player x

Keyboard shortcuts

Key

Action

K or space

Play / Pause

Mute / Unmute

Select next subtitles

Select next audio track

Show slide in full page or toggle automatic source change

left arrow

Seek 5s backward

right arrow

Seek 5s forward

shift + left arrow or J

Seek 10s backward

shift + right arrow or L

Seek 10s forward

control + left arrow

Seek 60s backward

control + right arrow

Seek 60s forward

shift + down arrow

Decrease volume

shift + up arrow

Increase volume

shift + comma

Decrease playback rate

shift + dot or shift + semicolon

Increase playback rate

end

Seek to end

beginning

Seek to beginning

Loading Click here to add:

Information on this media

Number of views:

85 (this month: 1)

Creation date:

July 3, 2018

License:

CC BY-SA v4

Description

Suhosin is a great php module, but unfortunately, it’s getting old, new ways have been found to compromise php applications, and some aren’t working anymore; and it doesn’t play well with the shiny new php7.

As a secure web-hosting company, we needed a reliable and future-proof solution to address the flow of new vulnerabilities that are published every day. This is why we developed Snuffleupagus, a new (and open-source!) php security model, that provides several features that we needed, like passively killing several php-specific bug classes, but also implementing virtual-patching at the PHP level, allowing to patch vulnerabilities in a precise, false-positive-free, ultra-low overhead way, without even touching the applications’ code.

https://github.com/nbs-system/snuffleupagus

Julien ‘jvoisin’ Voisin
Julien used to pwn and reverse things while contributing to radare2, he nowadays focus on protecting web applications while keeping his own bugs alive on websec.fr and writing stuff on dustri.org.

Thibault ‘bui’ Koechlin
Thibault used to write exploits for fun, he’s now CISO at NBS System, writing the naxsiWAF to prevent web pwning.

Simon ‘piké’ Magnin-Feysot
Simon is a pretty cool guy.

Snuffleupagus: killing bug classes and virtual patching the rest

Information on this media

Links:

Number of views:

Creation date:

License:

Description

Other media in the channel "2018"