<commit_before># serial-exploit-sample
Example shows how to use the Java Security Manager to prevent serialization exploits.

## Intro to the Problem

 * The Problem, Equifax Breach, 143 million Americans’ personal info, including names, addresses, dates of birth and SSNs compromised.
 * Only a veneer of security in place.

## The Exploit

 * The vulnerability was Apache Struts, CVE-2017.
 * http://www.zdnet.com/article/equifax-confirms-apache-struts-flaw-it-failed-to-patch-was-to-blame-for-data-breach/

## How Does It Work?

 * Input data deserialized into an executable object with privilege.
 * http://blog.diniscruz.com/2013/12/xstream

## The Solution

 * Of course you need to ensure all appropriate patches are installed to cover known defects.
 * But what about unknown defects?
 * Employ mandatory access controls like Java Security Manager to your runtime environment.

## Instructions

1. Clone the serial-exploit-sample

 ```
 git clone https://github.com/shawnmckinney/serial-exploit-sample.git
 ```

2. Edit my-java.policy file, point to project source folder:

 ```
 vi src/main/resources/my-java.policy
 ...
 grant codeBase "file:${user.home}/Development/serial-exploit-sample/-" {
 ```

3. Build and run the test program.  Make sure the -Dserial-exploit-sh points to the correct folder on your machine:

 ```
 mvn clean install
 java -cp target/serialExploitTest-1.0-SNAPSHOT.jar
      -Djava.security.manager
      -Djava.security.policy=src/main/resources/my-java.policy
      -Dserial-exploit-sh=/home/myuser/Development/serial-exploit-sample/src/main/resources/hacker-script.sh
      com.example.App
 ```

4. Examine the program output.

 ```
 Begin serial exploit test....
 Input: duke moscone center
 Serialized data is saved in myObject.ser
 BadCode will now run hacker script
 user.home=/home/myuser
 execute hacker command=/home/myuser/Development/serial-exploit-sample/src/main/resources/hacker-script.sh
 system command has been run....
 Result: foo fighters!
 ```

5. Examine the files in package:
 ```<commit_msg>cleanup<commit_after># serial-exploit-sample
Example shows how to use the Java Security Manager to prevent serialization exploits.

## Intro to the Problem

 * The Problem, Equifax Breach, 143 million Americans’ personal info, including names, addresses, dates of birth and SSNs compromised.
 * Only a veneer of security in place.

## The Exploit

 * The vulnerability was Apache Struts, CVE-2017.
 * http://www.zdnet.com/article/equifax-confirms-apache-struts-flaw-it-failed-to-patch-was-to-blame-for-data-breach/

## How Does It Work?

 * Input data deserialized into an executable object with privilege.
 * http://blog.diniscruz.com/2013/12/xstream

## The Solution

 * Of course you need to ensure all appropriate patches are installed to cover known defects.
 * But what about unknown defects?
 * Employ mandatory access controls like Java Security Manager to your runtime environment.

## Instructions

1. Clone the serial-exploit-sample

 ```
 git clone https://github.com/shawnmckinney/serial-exploit-sample.git
 ```

2. Edit my-java.policy file, point to project source folder:

 ```
 vi src/main/resources/my-java.policy
 ...
 grant codeBase "file:${user.home}/Development/serial-exploit-sample/-" {
 ```

 For example, if you cloned into '/home/myuser/projects', it would look like this:

 ```
 grant codeBase "file:${user.home}/projects/serial-exploit-sample/-" {
 ```

 Of course depends on the user's home under which the java program runs. If you're not sure, use an absolute path:
 ```
 grant codeBase "file:/home/myuser/projects/serial-exploit-sample/-" {
 ```

3. Build and run the test program.  Make sure the -Dserial-exploit-sh points to the correct folder on your machine:

 ```
 mvn clean install
 java -cp target/serialExploitTest-1.0-SNAPSHOT.jar
      -Djava.security.manager
      -Djava.security.policy=src/main/resources/my-java.policy
      -Dserial-exploit-sh=/home/myuser/Development/serial-exploit-sample/src/main/resources/hacker-script.sh
      com.example.App
 ```

4. Examine the program output.

 ```
 Begin serial exploit test....
 Input: duke moscone center
 Serialized data is saved in myObject.ser
 BadCode will now run hacker script
 user.home=/home/myuser
 execute hacker command=/home/myuser/Development/serial-exploit-sample/src/main/resources/hacker-script.sh
 system command has been run....
 Result: foo fighters!
 ```

5. Examine the files in package:
 ```
{'fraction_non_alphanumeric': 0.10707070707070707, 'fraction_numerical': 0.008978675645342313, 'mean_word_length': 3.7913978494623657, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 6, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '152441', 'n_tokens_mistral': 1413, 'n_tokens_neox': 1309, 'n_words': 429}