Abstract: EnSign is an open-source suite of libraries that protect web applications from code injection attacks through the use of location-specific signatures. The signatures are unique identifiers that combine stable elements of a potentially vulnerable code statement, like its structure and keywords appearing in it, with features that depend on the statement’s execution context, such as stack traces and caller methods. During the system’s learning phase the libraries apply a cryptographic hash function on the combined elements and store the result in a table that the web application can access. When the application runs in a production setting the libraries create new signatures and use the table’s entries to validate the execution of vulnerable code statements. We have tested the EnSign libraries against more than 300 documented attacks on applications known for SQL, XPath, and JavaScript vulnerabilities. EnSign detected and thwarted all tested attacks.

Speaker bio: Diomidis Spinellis is a Professor in the Department of Management Science and Technology at the Athens University of Economics and Business, Greece. His research interests include software engineering, IT security, and programming languages. He has written the two award-winning “Open Source Perspective” books: “Code Reading” and “Code Quality” as well as dozens of scientific papers.

He is a member of the IEEE Software editorial board, authoring the regular “Tools of the Trade” column. Dr. Spinellis has written the UMLGraph tool and code that ships with Mac OS X and BSD Unix. He holds an MEng in Software Engineering and a PhD in Computer Science, both from Imperial College London. Dr. Spinellis is senior member of the ACM and the IEEE and a member of the Usenix association.