From e580772fb62514bbb7a6a0e3f27370f1809a54bc Mon Sep 17 00:00:00 2001 From: ISayarLu <61229307+ISayarLu@users.noreply.github.com> Date: Wed, 10 Apr 2024 14:17:11 +0200 Subject: [PATCH 1/2] Create Vulnerability-detection --- 2024-Conference/talks/Vulnerability-detection | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 2024-Conference/talks/Vulnerability-detection diff --git a/2024-Conference/talks/Vulnerability-detection b/2024-Conference/talks/Vulnerability-detection new file mode 100644 index 00000000..88747e8f --- /dev/null +++ b/2024-Conference/talks/Vulnerability-detection @@ -0,0 +1,26 @@ +! Vulnerability detection +Title: Detecting and preventing Pharo vulnerabilities +Name: Imen Sayar, Steven Costiou +Email: imen.sayar@inria.fr, steven.costiou@inria.fr + +""Abstract:"" +Object-oriented applications are prone to vulnerabilities in their code leading to attacks. These attacks, once detected, are declared in known databases such as +Mitre (https://cve.mitre.org/) and NVD (https://nvd.nist.gov/). Based on some criteria such as the severity and the scope, these attacks are classified according to the +Open Source Foundation for Application Security (OWASP: https://owasp.org/www-project-top-ten/) into more than 10 categories. +In the Mitre database, there are no declared attacks against Pharo code. +Recently, we have conducted an experiment to simulate attacks on Pharo using log files as a entry point for attacks. We have succeded in carring out an attack targeting code written in Pharo. +In this talk, we will present some concepts linked to the attacks of object-oriented languages. We will, then, give a PoC and explain how the simulated attack is perfromed. +We will conclude by giving some lessons learned and good practices to avoid this kind of attacks. + + +""Bio:"" +Imen is a Lecturer in Computer Science in the Evref Team and at the FST of University of Lille. +She has obtained her Ph.D from the University of Lorraine. Her research areas include the code analysis for vulnerability detection, meta-modelling, and formal development +of Cyber-Physical Systems (CPS) and Systems of Systems (SoS). +You can contact her at imen.sayar@inria.fr + +Steven is an Inria researcher and works in the EVREF team. +He builds and studies debugging tools to help developers understand their programs and fix bugs. +In this context, his research interests span reflection and meta-programming, object-centric instrumentation, dynamic software adaptation and dynamic languages. +Website: https://kloum.io/costiou + From 9921e29f00631336e28b09503b0b84d9eb59619a Mon Sep 17 00:00:00 2001 From: ISayarLu <61229307+ISayarLu@users.noreply.github.com> Date: Wed, 10 Apr 2024 14:19:07 +0200 Subject: [PATCH 2/2] Rename Vulnerability-detection to 2024-Vulnerability-detection --- .../{Vulnerability-detection => 2024-Vulnerability-detection} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename 2024-Conference/talks/{Vulnerability-detection => 2024-Vulnerability-detection} (100%) diff --git a/2024-Conference/talks/Vulnerability-detection b/2024-Conference/talks/2024-Vulnerability-detection similarity index 100% rename from 2024-Conference/talks/Vulnerability-detection rename to 2024-Conference/talks/2024-Vulnerability-detection