February 26-28, 2020
Montreal, Canada
5 Unicode vulnerabilities that could byte you
The number of Unicode code points has never stopped to grow just like its integration in modern technologies. Your web application is likely to support input and output formatted in UTF-8 character encoding. In this talk, you will learn about the security implications. What are the potential side effects of normalizing a UTF-8 string? How encoding can affect security controls? What are the security risks brought by punycode domains?
Philippe Arteau
ServiceNow
Philippe is a security engineer at ServiceNow. He has an interest in software development, penetration testing and security code review. He also maintains Find Security Bugs, the open-source Java static analysis tool.
He discovered significant vulnerabilities in several popular applications like Google Chrome, DropBox, Runkeeper, Jira and more. He has presented at various conferences including Black Hat Arsenal, SecTor, AppSec USA, ATLSecCon, 44CON and JavaOne.
Montreal 2020 sponsored by
