AppSec Bugs: A Case of Déjà Vu for JIT Compilers
September 30, 2019

John Matthew Holt
Waratek

Just-in-time (JIT) compilers have had their fair share of bug-fighting experience. Before movies like Wargames and Hackers inspired the first generation of breakers, most users were concerned with the speed, or lack thereof, of their programs. The compiler community responded with JIT compilers to accelerate application performance.

Then in the mid 90s, memory management bugs were the plague of the programming industry. Again, the runtime/compiler community realized they could solve this problem with automatic memory management inside the JIT compiler.

Security Bugs: An Evolving Threat

Today, performance bugs and memory bugs are the least of the worries facing the developer community. Instead, a new crisis has surfaced: security bugs. Security bugs are so much more concerning than the other bugs because security bugs will get you "pwned!"

To tackle this, there has been a deluge of scanning and filtering tools developed for programmers to find code flaws. DevOps tools like static, dynamic and interactive application security testing (SAST, DAST, IAST), and runtime application self-protection (RASP), or network tools like intrusion detection or prevention systems (IDS, IPS), and unified threat management (UTM), all find or filter vulnerabilities but do nothing to fix the underlying vulnerable code. For that, there are only two ways that buggy code can be modified and fixed: with a human programmer or a JIT compiler.

New Roles for JIT Compilers

State-of-the-art JIT compilers today are constantly looking for ways to optimize executing code by learning and analyzing everything about an application's code. This deep application code intelligence, which was so effectively applied to performance bugs and memory management bugs in the past, is now being applied to discover and remediate security bugs.

In this security context, the JIT compiler leverages existing analysis of application code to additionally analyze for security vulnerabilities. When it finds one, it's a seamless step to fix it: The JIT compiler simply rewrites the vulnerable code with the necessary security controls to fix the underlying vulnerability.

Benefits of JIT Compilers

Since this analysis and change is done in the runtime, the JIT compiler also adds a layer of security without having to modify any source code.

The benefits of this can be liberating for DevOps teams that face disruption to existing projects every time a new vulnerability is exposed. Given that more than 22,000 vulnerabilities were discovered in 2018, this ability to protect applications without requiring programmer resources allows development teams to apply fixes during periods where they will have the least impact on the business.

Further, for many organizations that have legacy code, they may no longer be able to access the source code for fear that any modifications could prove catastrophic to the application. For security remediation, the JIT compiler can be used to remediate vulnerabilities in the byte code — not the source code — reducing or eliminating the risks that often lead to broken applications.

The threat that security bugs pose to businesses keeps many a DevOps team up at night. But to JIT compilers, this isn't their first rodeo. In fact, it's just another case of déjà vu.

John Matthew Holt is Founder and CTO of Waratek
Share this

Industry News

May 06, 2021

Splunk announced the new Splunk Observability Cloud, the full-stack, analytics-powered and enterprise-grade Observability solution.

May 06, 2021

Gluware unveiled its DevOps for NetOps framework featuring Gluware Lab, its integrated development environment (IDE).

May 06, 2021

Ambassador Labs announced the new Ambassador Developer Control Plane (DCP), whichgives developers the ability to manage the entire modern software development lifecycle for Kubernetes environments using tools and processes that are familiar to them.

May 06, 2021

Code Dx and Secure Code Warrior have teamed up to launch Project Better Code, an initiative to tackle a major challenge facing innovative organizations today – pushing the pace of software development without compromising software security.

May 06, 2021

Pegasystems announced the latest evolution of its Pega Infinity software suite to help speed and simplify digital transformation (DT) initiatives, Pega Infinity version 8.6.

May 06, 2021

Accurics announced that its open source project Terrascan, which enables teams to detect compliance and security violations across Infrastructure as Code (IaC), now integrates with the Argo Project.

May 05, 2021

Amazon Web Services announced the general availability of Amazon DevOps Guru, a fully managed operations service that uses machine learning to make it easier for developers to improve application availability by automatically detecting operational issues and recommending specific actions for remediation.

May 05, 2021

SmartBear has added API testing support for the popular, open source event streaming platform, Apache Kafka.

May 05, 2021

Red Hat unveiled its Developer Sandbox for Red Hat OpenShift, an OpenShift-based development environment designed to enable organizations to accelerate the path from code to production for Kubernetes-based applications.

May 05, 2021

DevOps Institute announced the lineup for SKILup Days in the second quarter of 2021.

May 05, 2021

Idera announced the acquisition of Xblend Software.

May 04, 2021

ThoughtSpot announced the launch of ThoughtSpot Everywhere.

May 04, 2021

Perforce Software announced the availability of virtual devices (Android emulators and iOS simulators) as part of the comprehensive device lab within Perfecto’s Intelligent Test Automation platform.

May 04, 2021

LogiGear announced the newest release of its flagship TestArchitect™ Enterprise product, TestArchitect Enterprise 9.0.

May 04, 2021

Rafay Systems announced new enhancements to its flagship Kubernetes Management Cloud (KMC).