10:00 - 11:00 - Plate Henrik (Endor Labs)
What you never wanted to know about vulnerability databases
Vulnerability databases play a crucial role in modern software security, serving as the backbone for Application Security (AppSec) and Software Composition Analysis (SCA) tools. However, the accuracy and reliability of these databases vary significantly, often leading to misinformed security decisions. This talk explores the challenges associated with vulnerability databases, including incomplete data, inconsistent reporting, and the rapid evolution of software ecosystems.
While tools like SBOM (Software Bill of Materials) and VEX (Vulnerability Exploitability eXchange) aim to improve vulnerability management, their effectiveness is heavily dependent on the quality of the underlying vulnerability data. Real-world examples from the Java/Maven ecosystem will illustrate how flaws in vulnerability databases can propagate through AppSec and SCA solutions, leading to false positives, missed vulnerabilities, and inefficient remediation efforts.
This presentation will provide insights into the limitations of current vulnerability databases and offer guidance on how consumers of AppSec and SCA tools can better evaluate and mitigate these risks.
11:00 - 12:00 - Lefeuvre Hugo (The University of British Columbia)
CHERIoT RTOS: An OS for Fine-Grained Memory-Safe Compartments on Low-Cost Embedded Devices
Embedded systems do not benefit from strong memory protection, because they are designed to minimize cost. At the same time, there is increasing pressure to connect embedded devices to the internet, where their vulnerable nature makes them routinely subject to compromise. This fundamental tension leads to the current status-quo where exploitable devices put individuals and critical infrastructure at risk.
We present the design of a dependable embedded OS where compartmentalization and memory safety are first-class citizens. We co-design the OS with an embedded hardware platform that implements CHERI capabilities at a similar cost profile to existing chips with minimal security. We demonstrate key design benefits: fine-grained fault-tolerant compartments, OS-level support for compartment-interface hardening, and auditing facilities to thwart supply-chain attacks, among others, and show that they come at a memory usage and performance cost that allows their widespread deployment in cheap, resource-constrained devices.
----------------------------------------------------------------------
Seminar taking place in person with mandatory registration at least 48h beforehand for *all* in-person participants by email to Nadia Derouault <nadia [*] derouault
inria [*] fr>. Participants non-affiliated with Inria or IRISA will be asked to present an ID at the reception desk of the IRISA building.
To receive the SoSySec announcements, please subscribe to the SoSySec mailing list:
https://sympa.inria.fr/sympa/subscribe/sosysec
All past and future SoSySec talks are listed at :
https://www.creachlabs.fr/en/seminars-keeping-date-latest-research/sosy… ----------------------------------------------------------------------
Séminaire en présentiel ouvert à tous mais avec inscription obligatoire au moins 48h à l'avance pour *tous* les participants en présentiel auprès de Nadia Derouault <nadia [*] derouaultinria [*] fr>. Les participants externes devront se présenter à l'accueil avec une pièce d'identité.
Vous pouvez vous abonner à nos annonces de séminaires :
https://sympa.inria.fr/sympa/subscribe/sosysec
et consulter la liste des exposés passés et à venir :
https://www.creachlabs.fr/en/seminars-keeping-date-latest-research/sosysec-seminar