Webapp security by Hermès Engineering

Transcript

1. Security in Web Applications
3. Fran¸ cois Roland Herm` es Engineering consultant Software architect at bpost francois.roland@hermes-ecs.com @FrRoland
4. Herm` es Engineering IT consultancy services About 80 IT specialists Belgium and Luxembourg
5. Business Intelligence Operational IT
7. systems cryptography
12. identify investigate diagnose
13. Agenda Psycho-sociological Aspect Authentication and Identity Attacks Prevention Detection and Analysis
14. The Team Krzysztof Magusiak Micha¨ el Lacroix Vincent Gribomont
15. Psycho-sociological Aspect
16. Internet Security History Army, Universities, ...
17. Internet Security History Army, Universities, ... Security?
18. Internet Security History Army, Universities, ... Security? ARPANET
19. Nowadays... It’s everywhere!
21. PlayStation Network outage (2011) 77 million accounts affected.
22. Finance requirements Security measures Guarantees Protection
23. Infosecurity Europe 2003 survey 90% of surveyed people
24. Infosecurity Europe 2003 survey 90% of surveyed people password
25. Infosecurity Europe 2003 survey 90% of surveyed people password
29. 1. password 2. 123546 3. 12345678 4. abc123 5. qwerty 6. monkey 7. letmein 8. dragon 9. 111111 10. baseball 11. ...
31. 1password https://agilebits.com/onepassword lastpass https://lastpass.com pwdhash https://www.pwdhash.com
32. Security Usability
33. Security Usability secure password simple password
34. Security Usability secure password simple password authentication no authentication
35. Security Usability secure password simple password authentication no authentication encoded data plain text
36. Authentication and Identity
37. Identity Who you are.
38. Identity Who you are. Authentication Are you who you claim to be?
39. Identity Who you are. Authentication Are you who you claim to be? Authorization What are you allowed to do?
40. Identification and confidentiality
41. How does HTTP work? GET /wiki/Hypertext_Transfer_Protocol HTTP/1.1 Host: en.wikipedia.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:19.0) Gecko/20100101 Firefox/19.0 Accept: text/html,application/xhtml+xml, application/xml;q=0.9,*/*;q=0.8 Cookie: mediaWiki.user.id=m5MFt3bI4Lrx; Connection: keep-alive ...
42. Symmetric cryptography
43. Asymmetric cryptography
44. Public-private keys
45. Symmetric Asymmetric Fast Slow Pre-shared secret No pre-shared secret Owner(s) of the secret Owner of the private secret
48. Hash + Salt
49. Hash + Salt
50. Hash + Salt
51. Signatures Input hash() "6f5902ac237024bd" encrypt() Private key Digital Signature
52. Authentication means
53. Authentication means Password
54. Authentication means Password Tokens
55. Authentication means Password Tokens One time passwords
56. Authentication means Password Tokens One time passwords Certificates
57. Authentication means Password Tokens One time passwords Certificates Signature challenge
58. Authentication means Password Tokens One time passwords Certificates Signature challenge Single Sign-On
59. Password policy
60. Password policy The most common form of authentication
61. Password policy The most common form of authentication Should be easily changeable
62. Password policy The most common form of authentication Should be easily changeable Different passwords for different services
63. Password policy The most common form of authentication Should be easily changeable Different passwords for different services Sufficient complexity
64. Password policy The most common form of authentication Should be easily changeable Different passwords for different services Sufficient complexity Sufficient length
65. Password policy The most common form of authentication Should be easily changeable Different passwords for different services Sufficient complexity Sufficient length Mix lower-case and upper-case characters
66. Password policy The most common form of authentication Should be easily changeable Different passwords for different services Sufficient complexity Sufficient length Mix lower-case and upper-case characters Use number and special digit
67. Password strength
68. Password complexity
69. Tokens
70. One time passwords
71. One time passwords - choice and distribution
72. Certificates
73. Certificate Authority Private organism (e.g. VeriSign/Symantec, Comodo, Thawte,. . . )
74. Certificate Authority Private organism (e.g. VeriSign/Symantec, Comodo, Thawte,. . . ) Verify the identity of certificate applicants
75. Certificate Authority Private organism (e.g. VeriSign/Symantec, Comodo, Thawte,. . . ) Verify the identity of certificate applicants Sign, send and maintain certificates and revocation list
76. Certificate Authority Private organism (e.g. VeriSign/Symantec, Comodo, Thawte,. . . ) Verify the identity of certificate applicants Sign, send and maintain certificates and revocation list Self-signature
77. Certificates - What are they made of? Certificate: Data: Version: 1 (0x0) Serial Number: 7829 (0x1e95) Signature Algorithm: md5WithRSAEncryption Issuer: C=ZA, ST=Western Cape,... OU=Certification Services Division, CN=ThawteServerCA/emailAddress=... Validity Not Before: Jul 9 16:04:02 1998 GMT Not After : Jul 9 16:04:02 1999 GMT
78. Subject: C=US, ST=Maryland,... OU=FreeSoft, CN=www.freesoft.org Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:be ...:41:8f Exponent: 65537 (0x10001) Signature Algorithm: md5WithRSAEncryption 93:5f...:68:9f
79. Obtaining a certificate
80. One-way
81. Two-way
82. Signature challenge Number used O N C E
83. Multi-factor authentication IS OWNS KNOWS
84. Single sign-on - principle
85. SSO providers
86. Kerberos
87. Kerberos - How does it work?
88. What if a user lose his authentication mean?
89. Compromised authentication means Deactivate the compromised authentication mean
90. Compromised authentication means Deactivate the compromised authentication mean Authenticate the user by an uncompromised mean
91. Compromised authentication means Deactivate the compromised authentication mean Authenticate the user by an uncompromised mean Give him a new primary authentication mean
92. Lost password Security questions
93. Lost password Security questions Another channel (e-mail, post, sms)
94. Lost password Security questions Another channel (e-mail, post, sms)
95. Lost password Security questions Another channel (e-mail, post, sms)
96. Attacks
97. Administration access Acquire password Privilege escalation Guess the password Steal the password Bruteforce Session stealing Injection Social engineering Dump diving Sniff the password
98. Threat agents
99. Threat agents
100. Threat agents
101. Threat agents
102. What is a risk? The probable frequency and probable magnitude of future loss. – The Open Group
103. risk = likelihood ∗ impact
104. How is the web structured?
105. HTTP Request HTTP Response
106. DMZ Web server Web application server
107. Open Web Application Security Project https://www.owasp.org/
108. Top 10 1. Injection 2. Cross-site Scripting (XSS) 3. Authentication and Session Management 4. Insecure Direct Object References 5. Cross-site Request Forgery (CSRF) 6. Security Misconfiguration 7. Insecure Cryptographic Storage 8. Failure to Restrict URL Access 9. Insufficient Transport Layer Protection 10. Unvalidated Forwards and Redirects
109. Demo website Technologies Java website Spring Hibernate - h2database
110. 1. Injection Mallory Bob
111. 1. Injection widespread severe impact Mallory Bob
112. THE password
113. String query = "select * from users" + " where user_name = ’" + name + "’" + " and password = ’" + password + "’";
114. String query = "select * from users" + " where user_name = ’" + name + "’" + " and password = ’" + password + "’"; Parameterized interface String query = "select * from users" + " where user_name = ?" + " and password = ?"; PreparedStatement st = con.prepareStatement(query); st.setString(1, name); st.setString(2, password); ResultSet rs = st.executeQuery();
115. Other Countermeasures Escaping routines White list validation
116. 2. Cross-site scripting (XSS) Mallory Bob Alice
117. 2. Cross-site scripting (XSS) very widespread Mallory Bob Alice
118. <div> your content goes here </div>
119. <div> your content goes here </div> You can inject a part of the page.
120. <div> your content goes here </div> You can inject a part of the page. <div> escape(your content goes here) </div>
121. 3. Authentication and Session Management Alice Bob SessionID = 93a24360c Mallory SessionID = 93a24360c
122. 3. Authentication and Session Management severe impact Alice Bob SessionID = 93a24360c Mallory SessionID = 93a24360c
123. Session Stealing http://host.com/page; jsessionid=dfd4fa35df2... cross-site scripting (XSS)
124. Session Stealing http://host.com/page; jsessionid=dfd4fa35df2... cross-site scripting (XSS) Good authentication mechanism
125. 4. Insecure Direct Object References http://myhotel.com/user/152
126. 4. Insecure Direct Object References easy to exploit http://myhotel.com/user/152 Check permissions
127. 5. Cross-site Request Forgery (CSRF) Alice Bob Mallory
128. 5. Cross-site Request Forgery (CSRF) widespread Alice Bob Mallory
129. <img src="http://host.com/forum/thread1/ addComment?text=hello%20world" alt="" />
130. <img src="http://host.com/forum/thread1/ addComment?text=hello%20world" alt="" /> <form method="post" action="addComment"> <input type="hidden" name="token" value="sd5646sdfse8wd" /> ... </form>
131. 6. Security Misconfiguration
132. 6. Security Misconfiguration easy to exploit
135. ... more information for the attacker
136. 7. Insecure Cryptographic Storage ID NAME PASSWORD . . . 1 admin 2ezf5zf2d . . . 2 jacky toto . . . 3 k 123456 . . .
137. 7. Insecure Cryptographic Storage compromised data ID NAME PASSWORD . . . 1 admin 2ezf5zf2d . . . 2 jacky toto . . . 3 k 123456 . . .
140. 8. Failure to Restrict URL Access http://myhotel.com/admin
141. 8. Failure to Restrict URL Access easy to detect http://myhotel.com/admin Authorization
142. 9. Insufficient Transport Layer Protection
143. 9. Insufficient Transport Layer Protection easy to detect
145. 10. Unvalidated Forwards and Redirects Mallory Alice 1. request Bob 2. forward request 3. response http://host.com/forward.jsp? fwd=admin.jsp
146. 10. Unvalidated Forwards and Redirects easy to detect Mallory Alice 1. request Bob 2. forward request 3. response http://host.com/forward.jsp? fwd=admin.jsp
147. 10. Unvalidated Forwards and Redirects Alice bank.com 1. first request evil-bank.com 3. second request 2. redirect https://bank.com/secured/../redirect? url=http://evil-bank.com/secured
148. 10. Unvalidated Forwards and Redirects easy to detect Alice bank.com 1. first request evil-bank.com 3. second request 2. redirect https://bank.com/secured/../redirect? url=http://evil-bank.com/secured
149. Some other attacks Crashing a system Altering content Social engineering Breaking any password
150. What about just crashing the system?
151. Denial of Service (DoS)
152. DoS attack types
153. DoS attack types
154. And altering the content?
155. Man in the Middle attack
156. DMZ Web server Web application server
157. Social engineering
159. Quid pro quo, Clarice...
160. Phishing
162. Breaking a password?
163. Brute force
164. And so on...
165. Common points
166. Common points Improper input validation
167. Common points Improper input validation Injection
168. Common points Improper input validation Injection Cross-site scripting (XSS)
169. Common points Improper input validation Injection Cross-site scripting (XSS) Session Stealing via XSS
170. Common points Improper input validation Injection Cross-site scripting (XSS) Session Stealing via XSS Unvalidated Forwards and Redirects
171. Common points Improper input validation Missing authorization checks
172. Common points Improper input validation Missing authorization checks Insecure Direct Object References
173. Common points Improper input validation Missing authorization checks Insecure Direct Object References Failure to Restrict URL Access
174. Common points Improper input validation Missing authorization checks Misconfiguration
175. Common points Improper input validation Missing authorization checks Misconfiguration Other assumptions
176. Common points Improper input validation Missing authorization checks Misconfiguration Other assumptions Insecure Cryptographic Storage
177. Common points Improper input validation Missing authorization checks Misconfiguration Other assumptions Insecure Cryptographic Storage Insufficient Transport Layer Protection
178. Common points Improper input validation Missing authorization checks Misconfiguration Other assumptions Insecure Cryptographic Storage Insufficient Transport Layer Protection Denial of Service
179. Common points Improper input validation Missing authorization checks Misconfiguration Other assumptions Insecure Cryptographic Storage Insufficient Transport Layer Protection Denial of Service Man in the Middle
180. Common points Improper input validation Missing authorization checks Misconfiguration Other assumptions Education factor (social engineering)
181. Common points Improper input validation Missing authorization checks Misconfiguration Other assumptions Education factor (social engineering) Session stealing (cybercafe)
182. Common points Improper input validation Missing authorization checks Misconfiguration Other assumptions Education factor (social engineering) Session stealing (cybercafe) Social engineering
183. Common points Improper input validation Missing authorization checks Misconfiguration Other assumptions Education factor (social engineering) Session stealing (cybercafe) Social engineering Phishing
184. Common points Improper input validation Missing authorization checks Misconfiguration Other assumptions Education factor (social engineering) Session stealing (cybercafe) Social engineering Phishing Brute Force
185. Common points Improper input validation Missing authorization checks Misconfiguration Other assumptions Education factor (social engineering)
186. Prevention
187. Different moments Architecture Development Maintenance
188. Architecture The highest-level breakdown of a system into its parts [...] the decisions that are hard to change [...] there are multiple architectures in a system [...] what is architecturally significant can change over a system’s lifetime [...] and, in the end, architecture boils down to whatever the important stuff is. – Martin Fowler, Patterns of Enterprise Application Architecture
189. Security design. . .
190. Development: tips and tricks Passwords
191. Development: tips and tricks Passwords Session management
192. Development: tips and tricks Passwords Session management Input validation
193. Development: tips and tricks Passwords Session management Input validation Ad hoc protection
194. Secure development cycle
195. Penetration testing
196. Penetration testing consent of the owner needed
197. Tools - Vulnerabilities detector http://www.metasploit.com/ http://www.tenable.com/
198. Tools - Network NMAP http://nmap.org/ WebScarab https://www.owasp.org/
199. Tools - All in one BackTrack http://www.backtrack-linux.org/
200. Maintenance
201. Frameworks Your application is not the first.
202. Frameworks - examples http://www.springsource.org/ ESAPI https://www.owasp.org/ https://shiro.apache.org/ https://www.microsoft.com/net
203. Security in application servers The program that runs the web application Authentication management Directory listing disabling User session management Error handling Input encoding
204. Web Application Firewall
205. Secure protocols SSL TLS
206. Browser restrictions
207. E-mail
208. Variety of environments
209. Detection and Analysis
210. Honeypot
211. Network Intrusion Detection System
212. NIDS - detection types Signature-based detection Statistical anomaly-based detection Stateful protocol analysis
213. After an attack
214. How to know?
215. Analysis - tools
216. Noise as a diversion
217. Performances
218. Conclusion
220. THANK YOU www.hermes-ecs.com about us documents @FrRoland — francois.roland@hermes-ecs.com
221. Except where otherwise noted, this work is licensed under http://creativecommons.org/licenses/by-nc-nd/3.0/