How I Used a JSON Deserialization 0day to Steal Your Money on the Blockchain
Industry experts analyze emerging threats surrounding How I Used a JSON Deserialization 0day to Steal Your Money on the Blockchain.
Summary
Uses a JSON deserialization zero-day to steal blockchain funds.
Related talks
Main Stage·40 min
Hao Xing · Zekai Wu
Hao Xing and Zekai Wu disclose a universal zero-day deserialization bypass in Fastjson, exploiting Java web services to execute RCE and drain crypto nodes.
Black Hat·40 min
Lachlan Davidson
Engineers explore architecture and security mechanisms for Discovering React2Shell: JavaScript’s Long-Awaited Deserialization Flight-mare.
Black Hat·37 min
Bofei Chen · Yinzhi Cao · Lei Zhang · Xinyou Huang · Yuan Zhang · Min Yang
Engineers explore architecture and security mechanisms for JDD: In-depth Mining of Java Deserialization Gadget Chains.