Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
A history on security and how to win the battle
Search
Joshua Thijssen
August 19, 2012
Technology
2
82
A history on security and how to win the battle
Joshua Thijssen
August 19, 2012
Tweet
Share
More Decks by Joshua Thijssen
See All by Joshua Thijssen
RAFT: A story on how clusters of computers keep your data in sync
jaytaph
0
30
The first few milliseconds of HTTPS
jaytaph
0
170
Paradoxes and theorems every developer should know
jaytaph
0
220
Paradoxes and theorems every developer should know
jaytaph
0
530
The first few milliseconds of HTTPS - PHPNW16
jaytaph
1
170
compiler_-_php010.pdf
jaytaph
0
80
Paradoxes and theorems every developer should know
jaytaph
0
190
Introduction into interpreters, compilers and JIT
jaytaph
1
220
Paradoxes and theorems every developer should know
jaytaph
1
830
Other Decks in Technology
See All in Technology
インフラとバックエンドとフロントエンドをくまなく調べて遅いアプリを早くした件
tubone24
1
430
iOSチームとAndroidチームでブランチ運用が違ったので整理してます
sansantech
PRO
0
150
OCI Vault 概要
oracle4engineer
PRO
0
9.7k
Python(PYNQ)がテーマのAMD主催のFPGAコンテストに参加してきた
iotengineer22
0
540
Exadata Database Service on Dedicated Infrastructure(ExaDB-D) UI スクリーン・キャプチャ集
oracle4engineer
PRO
2
3.2k
TypeScriptの次なる大進化なるか!? 条件型を返り値とする関数の型推論
uhyo
2
1.7k
あなたの知らない Function.prototype.toString() の世界
mizdra
PRO
1
270
オープンソースAIとは何か? --「オープンソースAIの定義 v1.0」詳細解説
shujisado
10
1.3k
SRE×AIOpsを始めよう!GuardDutyによるお手軽脅威検出
amixedcolor
0
200
テストコード品質を高めるためにMutation Testingライブラリ・Strykerを実戦導入してみた話
ysknsid25
7
2.7k
エンジニア人生の拡張性を高める 「探索型キャリア設計」の提案
tenshoku_draft
1
130
OCI Security サービス 概要
oracle4engineer
PRO
0
6.5k
Featured
See All Featured
Embracing the Ebb and Flow
colly
84
4.5k
The Web Performance Landscape in 2024 [PerfNow 2024]
tammyeverts
0
110
Become a Pro
speakerdeck
PRO
25
5k
How to train your dragon (web standard)
notwaldorf
88
5.7k
StorybookのUI Testing Handbookを読んだ
zakiyama
27
5.3k
The Psychology of Web Performance [Beyond Tellerrand 2023]
tammyeverts
44
2.2k
個人開発の失敗を避けるイケてる考え方 / tips for indie hackers
panda_program
93
16k
How STYLIGHT went responsive
nonsquared
95
5.2k
Designing the Hi-DPI Web
ddemaree
280
34k
Fantastic passwords and where to find them - at NoRuKo
philnash
50
2.9k
Documentation Writing (for coders)
carmenintech
65
4.4k
XXLCSS - How to scale CSS and keep your sanity
sugarenia
246
1.3M
Transcript
A history on security and how to win the battle...
Joshua Thijssen
Channeling and restricting flow
Sometimes channels don’t listen
Failure is always an option
Security is a business value
Security is a business value
Security is a business value
Let others take care of security
Let others take care of security
History of (computer) security
Security in the “old days”
I wasn’t kidding when I said: “old days”
5.25” high density disks
5.25” high density disks
Copying was a breeze
Copy protection
Copy protection
Let’s try dongles
NOPE!
8086 segmented memory layout
8086 segmented memory layout segment reg. 16-bit
8086 segmented memory layout segment reg. offset reg. 16-bit 16-bit
8086 segmented memory layout segment reg. offset reg. physical address
16-bit 16-bit 20-bit
8086 segmented memory layout segment reg. offset reg. << 4
physical address 16-bit 16-bit 20-bit
8086 segmented memory layout segment reg. offset reg. << 4
+ physical address 16-bit 16-bit 20-bit
07C0:0050 07C00 0050+ 07C50 8086 segmented memory layout segment reg.
offset reg. << 4 + physical address 16-bit 16-bit 20-bit
07C0:0050 07C00 0050+ 07C50 0000:7C50 00000 07C50+ 07C50 8086 segmented
memory layout segment reg. offset reg. << 4 + physical address 16-bit 16-bit 20-bit
07C0:0050 07C00 0050+ 07C50 0000:7C50 00000 07C50+ 07C50 007C:7490 007C0
07490+ 07C50 8086 segmented memory layout segment reg. offset reg. << 4 + physical address 16-bit 16-bit 20-bit
8086 segmented memory layout segment reg. offset reg. << 4
+ physical address 16-bit 16-bit 20-bit
386 protected memory layout + descriptor directory entry page table
entry physical address directory page offset cr3 gdt / ldt page directory page table page frame linear address descriptor table selector offset 32-bit 16-bit
None
None
Ring 0 Kernel
Ring 0 Kernel Ring 1 Device drivers
Ring 0 Kernel Ring 1 Device drivers Ring 2 Device
Drivers
Ring 0 Kernel Ring 1 Device drivers Ring 2 Device
Drivers Ring 3 Applications
Security today
The weakest link
Humans
it is much easier to trick someone into giving a
password for a system than to spend the effort to crack into the system -- K. Mitnick
Raising awareness on browsers
It’s a trap!
We’re curious
People are resourceful
Weird hobby’s
Weird hobby’s
00710022211101015511130102359000000000
00710033308171115011231111700000000000
00710033308171115011231111700000000000 00710022211101015511130102359000000000
00710033308171115011231111700000000000 00710022211101015511130102359000000000
00710022211101015511130102359000000000 00710033308171115011231111700000000000
00710044401011200001231122359000000000
None
Magnetic card reader/writer: $ 250
Magnetic card reader/writer: $ 250 Parking costs per night: $40
Magnetic card reader/writer: $ 250 Parking costs per night: $40
Free parking: priceless
How can we cure this problem?
We need to implement REAL security, not fake.
How do we win the war? How do we win
the war?
If we as developers have to keep thinking about security,
we will lose...
We need to deflect *EVERY* attack, They only need *ONE*
to win...
99.999% of all programmers are NOT trained or have the
capability to identify security threats. The other 0.001% will not be able to identify them ALL OF THEM ALL THE TIME.
A day in the life of a PHP programmer...
$result = mysql_query('SELECT * FROM users WHERE username="'.$_GET['username'].'"');
You should use mysql_real_escape_string!
No, you shouldn’t!
You just put a developer who wasn’t aware of security
issues, in charge of security...
Let others handle security (PDO)
There is no (quick) solution.
There is no (quick) solution. but we have to change
the way we deal with security radically,
There is no (quick) solution. but we have to change
the way we deal with security radically, by not dealing with security...
Let others take care of security
Any questions (maximum 5)?
Find me on twitter: @jaytaph Find me for development and
training: www.noxlogic.nl Find me on email:
[email protected]
Find me for blogs: www.adayinthelifeof.nl Thank you! http://joind.in/6853