Name: Jforum #112 - Deserialization exploits in Java: why should I care?
Start: 2023-03-07T17:30:00+01:00
End: 2023-03-07T19:30:00+01:00
Location: Microsoft Reactor @ Epicenter

We are excited to announce a meetup hosted by Microsoft Reactor @Epicenter.

**Agenda:**
**17:30** Doors open, light food and drinks

**18:00** **Deserialization exploits in Java: why should I care?**
Hackers refer to deserialization in Java as “the gift that keeps on giving”. But what is actually the problem? In most cases, it is not even your own code that creates this security vulnerability. This problem is also not restricted to Java’s custom serialization framework. When deserializing JSON, XML, or YAML, similar issues can occur as well. In this talk, I explain how deserialization vulnerabilities work natively in Java and how attack chains are created. Next, I will show that deserializing XML, JSON, and YAML can also get you into trouble. And of course, we had the recent Log4j problems with deserialization. Many different problems can occur when deserializing data and in this session, I will use several demos to illustrate various security issues. How do you avoid these issues? I will give you some pointers on how to mitigate these problems in your own applications, this also includes new features in Java 17. At the end of this session, you will have an understanding of the problem space and be able to take action in your code to prevent it.

**19:00** After the talks, those who want to mingle and have a drink can follow us to a pub nearby!

**Speakers :**
**Brian Vermeer (Snyk)**
Brian is a Java Champion, Developer Advocate for Snyk, and Software Engineer with over a decade of hands-on experience in creating and maintaining (web)applications. He is passionate about Java, (Pure) Functional Programming and Cybersecurity. Brian is a JUG leader for the Virtual JUG and the NLJUG. He also co-leads the DevSecCon community and is a community manager for Foojay. He is a regular international speaker on mostly Java-related conferences like JavaOne, Devnexus, Devoxx, Jfokus, JavaZone and many more. Besides all that, Brian is a military reserve for the Royal Netherlands Air Force and a Taekwondo Master / Teacher.

Mattias Karlsson

Jeanne

Jforum Stockholm

Technology

Java

JVM Languages

Java Virtual Machine

Web Development

Software Development

Computer Programming

Programming Languages

Open Source

JavaScript

Mobile Development

HTML5

Functional Programming

Brian is a Java Champion, Developer Advocate for Snyk, and Software Engineer with over a decade of hands-on experience in creating and maintaining (web)applications. He is passionate about Java, (Pure) Functional Programming and Cybersecurity. Brian is a JUG leader for the Virtual JUG and the NLJUG. He also co-leads the DevSecCon community and is a community manager for Foojay. He is a regular international speaker on mostly Java-related conferences like JavaOne, Devnexus, Devoxx, Jfokus, JavaZone and many more. Besides all that, Brian is a military reserve for the Royal Netherlands Air Force and a Taekwondo Master / Teacher.

Brian Vermeer (Snyk)

Jforum #112 - Deserialization exploits in Java: why should I care?

Microsoft Reactor @ Epicenter

Share

Jforum Stockholm

Jforum #112 - Deserialization exploits in Java: why should I care?

Jforum Stockholm

Details

Members are also interested in