Common WebApp Vulnerabilities and What to Do About Them

QUALITY. PRODUCTIVITY. INNOVATION.

endava.com

CommonWebSecurityThreats…and whattodoaboutthem

EoinWoodsEndava

3

3

Introductions

EoinWoods• CTOatEndava• Careerhasspannedproductsandapplications• Architecture andsoftware engineering• Bull,Sybase,InterTrust• BGI(Barclays)andUBS

• Longtimesecuritydabbler• Increasinglyconcernedatcyberthreatfor“normal”systems

4

4

Content

IntroducingWebSecurityThreatsTheOWASPWebVulnerabilitiesListUsefulToolstoKnowAboutReviewingDefencesSummary

IntroducingWebSecurityThreats

6

6

WebSecurityThreats

Weneedsystemsthataredependableinthefaceof• Malice• Error• Mischance

Peoplearesometimesbad,stupid orjustunlucky

Systemsecurityaimstomitigatethesesituations

7

7

WebSecurityThreats

Systemthreatsaresimilartoreal-worldthreats:• Theft• Fraud• Destruction• Disruption

Anythingofvalue mayattractunwelcomeattention

“Irobbanksbecausethat’swherethemoneyis”–WillieSutton

8

8

WebSecurityThreats

Whydowecareaboutthesethreats?• Athreatisariskofaloss ofsomesort

Commontypesoflossare:• Time• Money• Privacy• Reputation• Advantage

9

WebSecurityThreats

Securitytodaymitigatestomorrow’sthreat

Digitalchannelsdemandwebsecurity• SysteminterfacesontheInternet• IntrospectionofAPIs• Attacksbeing“weaponised”• Today’sinternalappis

tomorrow’s“digitalchannel”

10

10

WhoareOWASP?

TheOpenWebApplicationSecurityProject• Largelyvolunteerorganisation,largelyonlineExiststoimprovethestateofsoftwaresecurity• Research,tools,guidance,standards• Runslocalchaptersforfacetofacemeetings(UKhas10+)“OWASPTop10”projectliststopapplicationsecurityrisks• ReferencedwidelybyMITRE,PCIDSSandsimilar• Updatedeveryfewyears(2003,2004,2007,2010,2013)

11

11

OtherSelectedSecurityOrganisations

MITRECorporation• CommonVulnerabilitiesandExposures(CVE)• CommonWeaknessesEnumeration(CWE)

SAFECode• FundamentalPracticesforSecureSoftwareDevelopment• Training

Therearealotofotherstoo(CPNI,CERT,CIS,ISSA,…)

OWASPWebVulnerabilitiesList

13

13

OWASPTop10- 2013

#1InjectionAttacks#2AuthenticationandSessionManagement#3CrossSiteScripting(XSS)#4DirectObjectReference#5SecurityMisconfiguration#6SensitiveDataExposure#7FunctionLevelAccessControl#8CrossSiteRequestForgery(CSRF)#9ComponentVulnerabilities#10UnvalidatedRedirectsandForwards

Thesemaylook“obvious”butappearonthelistyearafteryear,basedonreal vulnerabilitydatabases!

14

14

#1InjectionAttacks

Unvalidated inputpassedtoaninterpreter• OperatingsystemandSQLaremostcommon

Defencesinclude“escaping”inputs,bindvariables,usingwhitelists,…

SELECT * from table1 where name = ’%1’

Set‘%1’to‘OR1=1-- …thisresults inthisquery:

SELECT * FROM table1 WHERE name = ’’ OR 1=1 --

15

15

#2BrokenAuthenticationorSessionManagement

• HTTPisstateless- somesortofcredentialsenteverytime• Credentialonnon-TLSconnectioncanbetamperedwith• SessionIDoftendisplayedbutcanbeusedaslogindetails• Defencesarestrongauthenticationandsession

managementcontrols

a5f3dd56ff32 a5f3dd56ee33

16

16

#3CrossSiteScripting

• Occurswhenscriptisinjectedintoauser’swebpage• Reflected attack– crafted linkinemail…• Persistent attack- database records, sitepostings,activitylistings

• Allowsredirection,sessiondatastealing,pagecorruption,…• Defencesincludevalidationandescapingontheserver-side

http://www.veracode.com/security/xss

17

17

#4InsecureDirectObjectRefs

Directlyreferencingfilenames,IDsandsimilarinrequests• Notauthenticatingaccesstoeachontheserver• e.g.relyingonlimitedlistofoptionsreturnedtoclient• Clientcanmodifyrequestandgainaccesstootherobjects

Defencesincludeusingpseudoreferencesonclientandauthenticatingallobjectaccesses

http://mysite.com/view?id=file1.txt

…howabout:http://mysite.com/view?id=../robots.txt ??

18

18

#5SecurityMisconfiguration

Securityconfigurationisoftencomplicated• Manydifferentplacestoputit,complexsemantics• LayersfromOStoapplicationallneedtobeconsistent

Itiseasytoaccidentallymissanimportantpart• OSfilepermissions?• .htaccess files?• Sharedcredentialsintestandproduction?Allowsaccidentalaccesstoresourcesorevensitemodification

Mitigationviascanning,standardisation,simplicityandautomation

19

19

#6SensitiveDataExposure

Issensitivedatasecuredintransit?• TLS,messageencryptionIssensitivedatasecuredatrest?• Encryption,tokenisation,separationRisksincludelossofdataorspoofingattacksMitigationviathreatanalysis,limitingscope,standardisation

https://askleo.com

20

20

#7FunctionLevelAccessControl

Relyingoninformationsenttotheclientforaccesscontrol• e.g.pagemenuomitting“update”and“delete”optionforarecord

• Notcheckingtheaction(function)beingperformedontheserverClientcanguesstherightrequestformfortheotheractions• Bypassedsecuritymodel- alsosee#4InsecureObjectReferences

Nevertrusttheclient- checkauthorisationforeveryrequest

http://www.example.com/gettxn?txnid=4567

à http://www.example.com/updttxn?tid=4567&value=100.00

21

21

#8CrossSiteRequestForgery

Usertriggersmaliciouscodethatsubmitsfraudulentrequestusingbrowsersecuritycontext• e.g.clickalink=>runJavaScript=>changeGithub password

Varioussubtlevariationsonthismakedefencequitedifficult• Howyoudoyouknowitistheuser?

Primarydefenceisthe“challengevalue”inpages• Checkforthelatestchallengevalueinrequests• Addauthenticationstepsforsensitiveoperations• Keepshortsessionswithreallogoutprocess

22

22

#9KnownVulnerableComponents

Source:marketwired.com

23

23

#9KnownVulnerableComponents

Manycommonlyusedcomponentshavevulnerabilities• SeeweeklyUS-CERTlistforafrighteningrealitycheck!• MuchOSSdoesn’thavewellresearchedvulnerabilitiesFewteamsconsidersecurityoftheir3rdpartycomponents• Andkeepingeverythinguptodateisdisruptive

Considerautomatedscanningof3rdpartycomponents,activelyreviewvulnerabilitylists,keepcomponentspatched

24

24

#10UnvalidatedRedirectsandForwards

Redirectingorforwardingtotargetsbasedonparameters

AvoidusingparametersforredirectorforwardtargetsWhereparameteris neededuseakeyandmaponserver

http://www.mysite.com/selectpage?pageid=emea_home.html

-> http://…/selectpage?pageid=pishinghome.com

(Withoutcarefulvalidationthisredirectsusertomaliciouspage)

25

25

SummaryofAttackVectorTypes

Interpreterinjections• OperatingSystem,SQL,…

Pageinjections• HTML,XSS(JavaScript)

LackofValidation• trustingclientsiderestrictions• allowingsession IDsandcookiestobereused,• notcheckinginputfields thoroughly• parameter valuesdirectlyinpagesandlinks

Missingdataprotection• dataloss, spoofing,maninthemiddle,…

Platform• configurationmistakes,vulnerabilities, complexity

UsefulTools

27

• DeliberatelyinsecureLAMPwebapplication

• SoruninaVM!• Providesexamplesofthe

OWASPTop10inaction• Useittoexploreand

understandthem

Mutillidaewww.irongeek.com http://sourceforge.net/projects/mutillidae/

28

• Commercialproxy,scanning,pentest tool

• Verycapablefreeversionavailable

• Inspecttraffic,manipulateheadersandcontent,…

• MadeinKnutsford!

BurpSuitehttp://portswigger.net/burp

29

• ChromeandSwitchySharp orothersimilarpairing

• AllowseasyswitchingofproxyservertoBurpSuite

BrowserandProxySwitcher

30

• AutomatedSQLinjectionanddatabasepentesttool

• OpensourcePythonbasedcommandlinetool

• Frighteninglyeffective!

SQLMaphttp://sqlmap.org

31

• Commercialtoolsuitewithonlinedatabase

• Scansbuildpipelinesforcomponentsecurityvulnerabilities

• Alertsanddashboardsformonitoring

Sonatype ComponentLifecycleManagerhttp://www.sonatype.com/nexus

32

32

BlackDuckHub

• Commercial toolanddatabase foropensourcesecurity,audit&compliance• Scansbuildpipelines lookingforopensourcewithknownvulnerabilities• Alertsanddashboardsformonitoring

https://www.blackducksoftware.com

Demonstrations

34

34

Mutillidae

MutillidaeBurpSuite(proxy)Browserwith

proxyplugin

35

35

AnExampleMulti-StepAttack- Impersonation

Attacksrarelyusejustonevulnerability

1.SQLInjection

User listobtained

PersistentXSS

achieved

XSSScriptexecuted

4.Stealbrowserstate

Sessionsetc.saved

ReviewingDefences

37

37

KeyWebVulnerabilityDefences

Don’ttrustclients(browsers)• Validation,authorisation,…Identify“interpreters”,escapeinputs,usebindvariables,…• Commandlines,webpages,databasequeries,…Protectvaluableinformationatrestandintransit• UseencryptionjudiciouslySimplicity• VerifyconfigurationandcorrectnessStandardiseandAutomate• Forceconsistency,avoidconfigurationerrors

38

38

Don’tTrustClients

Bewarywhentrustinganythingfromabrowser• Youdon’tcontrolit• Sophisticatedcodeexecution(&injection)platform• Outputcanbemanipulated

Assumeorpreventtampering• TLSconnectionstoavoid3rd partyinterception• Shortlivedsessions• Reauthenticate regularly&beforesensitiveoperations• Considermulti-factor authentication• Useopaquetokensnotrealobjectreferencesforparams• Validateeverything

39

39

Watchoutforinjection

Manypiecesofsoftwareactasinterpreters• BrowserforHTMLandJavaScript• Operatingsystemshells– system(“mv $1 $2”)• Databases– querylanguages• Configurationfiles

Assumethatsomeonewillworkitout!• Avoidcreatingcommandsusingstringmanipulation• Uselibrariesandbindvariables

• Escapeallstringsbeingpassedtoan“interpreter”• Useathirdparty“escaping”library(e.g.OWASP)

• Rejectexcessivelylongstrings(e.g.username>30char)

40

40

ProtectValuableInformation

Defenceindepth– assumeperimeterbreach• Encryptmessagingasstandard• Considerdatabaseencryption• Considerfileorfilesystemencryption

Howeverencryptioncomplicatesusingthedata• Slowseverythingdown• Canyouquerywhileencrypted?• Messageroutingonsensitivefields(inheaders)• Howdoyoumanageandrotatethekeys?• Whataboutrestoreondisasterrecovery?

http://getacoder.com

http://slate.com

41

41

Simplicity&Standardisation

Complexityistheenemyofsecurity• “Youcan’tsecure

whatyoudon’tunderstand”- Schneier• Specialcaseswillbeforgotten

Simplify,StandardiseandAutomate• Simplerthingsareeasiertocheckandsecure• Standardisinganapproachmeansthereareno

specialcasestoforgettohandle• Automationeliminateshumaninconsistencies

fromtheprocesssoavoidingatypeofrisk

http://innovationmanagement.se/

Summary

43

43

Summary

Muchofthetechnologyweuseisinherentlyinsecure• MitigationneedstobepartofapplicationdevelopmentAttackingsystemsisbecomingindustrialised• Digitaltransformationisprovidingmorevaluable,insecuretargetsFundamentalattackvectorsappearagainandagain• Injection,interception,pagemanipulation,validation,configuration,…

Mostrealattacksexploitaseriesofvulnerabilities• Eachvulnerabilitymaynotlookserious,thecombinationisMostmitigationsnotdifficultbutneedtobeappliedconsistently• …andmayconflictwithotherdesirablequalities

44

44

Books

45

Thankyou

QUALITY.PRODUCTIVITY.INNOVATION.

EoinWoodsCTO

[email protected]

+442073671000

en_ewoods