I wanted to make sure I fully understood what was going on under the hood here so I started asking questions about the static testing and how it works. They've got a nice looking portal where you name your application, give it a version, assign it to a group of developers, and point it to your compiled code (WAR, EAR, JAR, etc). Once you upload your binaries, their system basically runs a disassembler on it to get it into assembly code. It's then at this level that they start looking for vulnerabilities. They said that this process takes about 3 days initially and then maybe 2 days after the first time because they are able to re-use some data about your application. Once complete, they say they are able to provide you a report detailing your vulnerabilities and how to fix them.

The thing that immediately struck me as worth noting here was the 2-3 day turnaround. This means that our developers would need to wait a fairly substantial amount of time before getting any feedback on the vulnerability status of their code. In a world full of Agile development, 2-3 days is a lifetime. Compare that to static source code testing where you get actionable results at compile time. The edge here definitely goes to source code testing as I believe most people would prefer the near-instant gratification.

The next thing worth noting was that they are taking binary files and disassembling them in order to find vulnerabilities. This lends itself to one major issue which is how can you determine with any accuracy the line number of a particular vulnerability written in let's say Java from assembly code generated by disassembling the binaries. By default, it's simply not possible. This vendor claimed that they can by adding in some debug strings at compile time, but even then I'd contend that you're not going to get much. I'm guessing they have some heuristics that are able to tell what function generated a set of assembly code, but I'm extremely skeptical that they can do anything with variable names, custom code functions, etc. I've seen some source code scanners, on the other hand, that not only tell you what line of code is affected, but are able to give you an entire list of parameters that have been consequently affected by that vulnerability. The edge here definitely goes to source code testing.

The main benefit that I can see with binary testing vs source code testing is that we can test code that we didn't write. Things like APIs, third-party applications, open source, etc are all things that we now have visibility into. The only problem here is that while we now can see the vulnerabilities in this software, they are unfortunately all things that we can't directly influence change in, unless we want to send our developers off to work on somebody else's software. I'd argue that scanning for vulnerabilities in that type of code is their responsibility, not ours. Granted, it'd be nice to have validation that there aren't vulnerabilities there that we're exposing ourselves to by uptaking it, but in all honesty are we really going to take the time to scan somebody else's work? Probably not. The edge here goes to binary testing with the caveat being that it's in something that I frankly don't care as much about.

This isn't the complete list of pros and cons by any means. It's just me voicing in writing some concerns that I had about the technology while talking to this particular vendor. In my opinion, the benefits of doing source code testing far outweigh any benefits that we could get from testing compiled binary files. What do you think about the benefits of one versus the other? I'd certainly love for someone to try to change my mind here and show me where the real value lies in binary testing.

Let me preface this by saying that I'm the guy who gives the training to our developers on the OWASP Top 10, writing secure code, etc.  I'd like to think that I have a pretty good handle on programming best practices, input validation, and HTML encoding.  I built all kinds of validation into this application and thought that the vulnerability scan would come up empty.  For the most part I was right, but there was one vulnerability, one flaw in particular, that found it's way into every form in my application.  In fact, I realized that I've made this exact same mistake in almost every PHP form that I've ever written.  Talk about a humbling experience.

So here's what happened.  I created a simple page with a form where the results of that form are submitted back to the page itself for processing.  Let's assume it looks something like this:

<html>
 <body>
  <?php
  if (isset($_REQUEST['submitted']) && $_REQUEST['submitted'] == '1') {
    echo "Form submitted!";
  }
  ?>
  <form action="<?php echo $_SERVER['PHP_SELF']; ?>">
   <input type="hidden" name="submitted" value="1" />
   <input type="submit" value="Submit!" />
  </form>
 </body>
</html>

It looks fairly straightforward, right? The problem has to do with that $_SERVER['PHP_SELF'] variable. The intent here is that PHP will display the path and name of the current page so that the form knows to submit back to the same page.  The problem is that $_SERVER['PHP_SELF'] can actually be manipulated by the user.  Let's say as the user I change the URL from http://www.webadminblog.com/example.php to http://www.webadminblog.com/example.php"><script>alert('xss');</script>.  This will end the form action part of the code and inject a javascript alert into the page.  This is the very definition of cross site scripting.  I can't believe that with as long as I've been writing in PHP and as long as I've been studying application security, I've never realized this.  Fortunately, there are a couple of different ways to fix this.  First, you could use the HTML entities or HTML special character functions to sanitize the user input like this:

htmlentities($_SERVER['PHP_SELF]);

htmlspecialchars($_SERVER['PHP_SELF]);

This fix would still allow the user to manipulate the URL, and thus, what is displayed on the page, but it would render the javascript invalid.  The second way to fix this is to use the script name variable instead like this:

$_SERVER['SCRIPT_NAME'];

This fix would just echo the full path and filename of the current file.    Yes, there are other ways to fix this.  Yes, my code example above for the XSS exploit doesn't do anything other than display a javascript alert.  I just wanted to draw attention to this issue because if it's found it's way into my code, then perhaps it's found it's way into yours as well.  Happy coding!

Agenda

1. Introduction to XML/Web Services Threats
2. Techniques for Defending XML Threats
3. XML Attack Examples and Classification
4. Review sample attacks

Introduction to XML Threats

• Explicit Attacks
  • Forced Disruption
  • Information Theft
  • Vendor Discovery
• Implicit Vulnerability
  • Perimeter Breach (embeeded virus, malware)
  • Infrastructure Malfunction (parser and data processing failures)

New Attack Vectors

• Protocol Firewalls are blind to XML
• Malware and virus delivered via SOAP attachments
• WSDL exposes schema and message structure
• Injection attacks exposed via XML parameters
• Data replay attacks

Security Testing - Base Requirements

• Security Framework
  • Sign, ENcrypt, Decrypt, SSL
• Identity Framework
  • Basic auth, SSL auth, WS-Security token auth
• Parameter Injection
  • Database or file driven
  • Permutations for security, identity, and SOAP/XML
• Concurrent Client Simultaneous Loading
  • Denial of Service Testing
• SOAP with Attachments
  • Malware and Virus testing
• Dynamic XSD Mutation
  • Derive SOAP vulnerability profile from WSDL schema

XML Security Gateway - Base Requirements

• Certified PKI Infrastructure (DOD PKI)
  • X509 Path validation
  • Sign/verify, SSL initiation, SSL termination
• Certified Security Architecture (FIPS)
  • Key management and storage
  • Physical security device
• Transaction Privacy
  • Encryption, decryption, SSL
• Transaction Integrity
  • Digital signature, signature verification, schema validation
• Transaction Accountability
  • Archiving, logging, reporting, and monitoring
• Transaction Threat Mitigation
  • Intrusion detection and prevention
  • Rate-based rules, size-based rules, anti-virus detection, pattern recognition
  • Structural integrity, protocol adherence, athorization attempts

XML Attack Examples and Classification

1. SQL Injection Attack
2. Denial of Service Attack
3. XSD Mutation Attack

XML Web Services SQL Injection Attack Example

• How to Attack
  • Construct SQL escape sequences
  • Construct SQL 1=1 query
  • Inject into XML node values
• Discovered Exposure
  • Sensitive data loss
  • Database corruption
• Used "SOAPSonar" tool to load WSDL and send responses

SQL Injection - XML Gateway Secured

• How to Defend
  • Deploy XML Gateway
  • Enable pattern scanning IDP rules
  • Configure response message size and complexity limits
• Advantages
  • Prevent Data Loss
  • Alert and Quarantine Attempted Breaches

XML Web Services based Denial of Service Attack

• How to Attack
  • Loading client with concurrent simultaneous threads
  • Coercive parsing attack
• Discovered Exposure
  • Unlimited message flow
  • Unfair service SLA distribution
  • Back-end CPU and I/O Saturation

Denial of Service - XML Gateway Secured

• How to Defend
  • Deploy XML gateway
  • Set allowed transaction rates (Group, user, or IP)
• Advantages
  • Message flow limited to specified rate

Another Example: Denial of Service through Coercive Parsing

• Sending malformed XML data (removing the ">" end tag) creates increased time to parse a request

XML Web Services Based XSD Mutation Attack

• How to Attack
  • Obtain WSDL
  • Derive message structure and types from WSDL schema
  • Send SOAP message mutations based on schema
• Discovered Exposure
  • Code paths not handled for exceptions
  • Stack traces returned with implementation details
  • Application failure

XSD Mutation Attack - XML Gateway Secured

• How to Defend
  • Deploy XML Gateway
  • Enforce inbound message structure and type validation
  • Cleanse outbound data (stack traces, sensitive data)
• Advantages
  • Reduce parser impact on web service
  • Remove vendor and implementation details in response
  • Protect application layer code paths on web service

XSD Mutation - Secured

1. Deploy specialized XML Gateways - Packet firewalls and HTML application firewalls are insufficient
2. Validate XML against a robust schema
3. Tighten Schema: restrict unbounded strings, etc
4. Enforce XML specific detection rules (node depth, recursive payloads)

Best Practices for Countermeasures

• Information Control - Outbound
  • Restrict SOAP Faults
  • Protect Sensitive Information
  • Audit Transaction Flows
• Information Control - Inbound
  • Tighten Payloads
  • Enforce SLA
  • Disallow SQL, virus, malicious code
• Use Web Services Penetration Testing Product
• Deploy XML web Services Gateway
• Deploy Centralized XML Security

What's Changed?

• It's about Risks, not just vulnerabilities
  • New title is: "The Top 10 Most Critical Web Application Security Risks"
• OWASP Top 10 Risk Rating Methodology
  • Based on the OWASP Risk Rating Methodology, used to prioritize Top 10
• 2 Risks Added, 2 Dropped
  • Added: A6 - Security Misconfiguration
    • Was A10 in 2004 Top 10: Insecure Configuration Management
  • Added: A8 - Unvalidated Redirects and Forwards
    • Relatively common and VERY dangerous flaw that is not well know
  • Removed: A3 - Malicious File Execution
    • Primarily a PHP flaw that is dropping in prevalence
  • Removed: A6 - Information Leakage and Improper Error Handling
    • A very prevalent flaw, that does not introduce much risk (normally)

1. A1- Injection: Tricking an application into including unintended commands in the data sent to an interpreter. (http://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet)
2. A2 - Cross Site Scripting (XSS): Raw data from attacker is sent to an innocent user's browser.  For large chunks of user supplied HTML, use OWASP's AntiSamy to sanitize this HTML to make it safe.  (http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet)
3. A3 - Broken Authentication and Session Management: Means credentials have to go with every request.  Should use SSL for everything requiring authentication.
4. A4 - Insecure Direct Object Reference: This is part of enforcing proper "Authorization", along with A7 - Failure to Restrict URL Access.
5. A5 - Cross Site Request Forgery (CSRF): An attack where the victim's browser is tricked into issuing a command to a vulnerable web application.  Vulnerability is caused by browsers automatically including user authentication data with each request.  (Check out OWASP CSRFGuard, OWASP CSRFTester, http://www.owasp.org/index.php/CSRF_Prevention_Cheat_Sheet)
6. A6 - Security Misconfiguration: All through the network and platform.  Don't forget the development environment.  Think of all the places your source code goes.  All credentials should change in production.
7. A7 - Failure to Restrict URL Access: This is part of enforcing proper "authorization", along with A4 - Insecure Direct Object References.
8. A8 - Unvalidated Redirects and Forwards: Web application redirects are very common and frequently include user supplied parameters in the destination URL.  If they aren't validated, attacker can send victim to a site of their choice.
9. A9 - Insecure Cryptographic Storage: Storing sensitive data insecurely.  Failure to identify all sensitive data.  Failure to identify all the places that this sensitive data gets stored.  Failure to properly protect this data in every location.
10. A10 - Insufficient Transport Layer Protection

OWASP Top 10 Risk Rating Methodology

• Attack Vector (How hard for an attacker to use this flaw - 1 (Easy), 2 (Average), 3 (Difficult))
• Weakness Prevalence (How often is it found - 1 (Widespread), 2 (Common), 3 (Uncommon))
• Weakness Detectability (How hard is it for an attacker to find the flaw - 1 (Easy),  2 (Average), 3 (Difficult))
• Technical Impact (1 (Severe), 2 (Moderate), 3 (Minor))

This is generic across the internet, not specific to any organization.

Started a new "Prevention Cheatsheet Series" that the Top 10 references (XSS, SQL Injection, Transport Layer Security, CSRF, Direct Object Reference).

What is actually being released is RC1 of the Top 10 and they are encouraging people to provide comments through the end of the year and then use that feedback to post the final Top 10 in January 2010.

• Before anyone starts building complex systems, they need to design.
• We create threat models on completed designs.
• What about during design?
• Book: "Core J2EE Patterns Best Practices and Design Strategies"
• If you use J2EE development, chances are you're using patterns documented here
• Core J2EE patterns are used extensively
• Patterns are used in JSF, Velocity, Struts, Tapestry, Spring, and Proprietary Frameworks

Example: Project: Analyze Patterns

Use to Implement:

• Synchronization Tokens as Anti-CSRF Mechanism
• Page-level authorizations

Avoid:

• XSLT and Xpath vulnerabilities
• XML Denial of Service
• Disclosure of information in SOAP faults
• Publishing WSDL files
• Unhandled commands
• Unauthorized commands

Project Goals

• Analyze patterns for security pitfalls to avoid
• Determine how patterns can implement security controls
• Provide advice portable to most frameworks

A security pattern is not the same as a security analysis of a pattern.

Uses

• Designing new web application frameworks (make the next generation of frameworks secure by default)
• Designing new apps that use the patterns
• Source code review of existing apps
• Runtime assessment of existing apps
• Integrate with threat modeling of new or existing apps

You can help:

• Tell developers
• Improve the analysis

Next Steps?

• Add code review and examples to the existing pattern book
• Look at other pattern books to see if there are other patterns that we should analyze

Our Dream

• New web application framework idea + Design-time security analysis = Secure-by-default web application framework

Don't use threat modeling to help you with the things you already have checklists for.

Do this because you want to understand the intersection of your stakeholder's goals and the architecture.

What is a Threat?

• An agent who attacks you?
• An attack?
• An attack's consequence?
• A risk?

What is a Threat Model

• Depiction of
  • The system's attack surface
  • Threats who can attack the system
  • Assets threats may compromise
• Some leverage risk management practices
  • Estimate probability of attack
  • Weight impact of successful attack

Threat

• Capability
  • Access ot the system
  • Able to reverse engineer binaries
  • Able to sniff the network
• Skill Level
  • Experienced hacker
  • Script kiddie
  • Insiders
• Resources and Tools
  • Simple manual execution
  • Distributed bot army
  • Well-funded organization
  • Access to private information
• Threats help
  • Encourage thorough throught about how intentions for misuse
  • Determine "out of bounds" scenarios

Threat Modeling as a Process

• Know thy enemy and how they attack you (who, what, how, why, impact, mitigation)

Threat Modeling - High-level Process

1. Diagram Structure
2. Identify Assets
3. Identify Threats
4. Stitch Threats onto Structure
5. Enumerate Doomsday Scenarios
6. Document Misuse/Abuse
7. Enumerate Attack Vectors
8. Iterate

1. Diagram the Software

• Different methods of diagraming (likes the whiteboard the best)

1.1  - Anchor in Software Architecture

Consider where attacks occur

Top-down

• Enumerate business objects
  • Sensitive data
  • Privileged functionality

Bottom-up

• Enumerate application entities
  • Sensitive data
  • Privileged functionality

Look for

• Middleware
• Open source
• Frameworks

1.2 - Identify Application Attack Surface

• Are there different privilege levels?
• Connectivity between services and processes

1.3 - Annotate with Design Patterns

• Are there pieces that whitebox testings is unable to analyze?
• What types of frameworks is the application using?
• Where are there command patterns?
• Where is there an inversion of control?

1.4 - Consider Patterns' Responsibilities

• Document specific standards for implementing each responsibility
• List out each pattern, piece of app, and associated standards

1.5 - Enumerate Potential Failures in Design Elements

1.6 - Find Key Structural Componenets

Component diagrams show critical choke points for security controls

1.7 - Identify Frameworks

Showing frameworks indicates where important service contracts exist 'up' and 'down'

1.8 - Explicitly Identify Controls

2 - Identify Assets

2.1 - Identify Critical Data Assets

• Do I have PII?
• Things that proxy for PII like sessions?

2.2 - Identify Interfaces as Proxies for Data

2.3 - Identify Assets flow through the System

• Assets exist not only in rest, but also flow through the system
• Think about where there are points you could stop the data from going

2.4 - Identify Critical Application Entities

2.5 - Identify 'Intermediate' Asset Objectives

Identify:

• Sensitive data
• Privileged function

Look out for:

• Proxies, facades, etc
• Services
• UI vs implementation
• Aggressive caching scheme

2.6 - Identify Equivalence-classes

• In essence an escalation of privilege connector
• Ex: Putting username and password and password reset questions on the same page puts them on the same equivalence-class without reauthentication and defeats the security control

3 - Identify Threat Agents

3.1 - Anchor Threats in Use Cases

• What is the dumbest things that a user can do?
• What is the most malicious thing a user can do?

4.1 - Identity Principal Resolution

• Arrows indicate resolution of principal/assertion propagation

4.2 - Place Threats on Diagram

4.3 - Show Authorization in Structure

• Coloration shows authorization by role
• Color modules by who you would need to be to access them and look where the colors change
• Has never NOT found a vulnerability for John

5 - Enumerate Doomsday Impacts

5.1 - Assign Threats Malicious Intent

• What is each Threat's motivation?
• What would drive escalation?
• Why would each try beyond the first hurdle?

5.2 - Instanstiate Doomsday Attack

6.1 - Add in Misuse Cases

Convert Actors to Threats

• Abuse - Make actors behave stupidly
• Misuse - Make actors deviant/evil

6.2 - 'Cache' Misuse in a 'Cookbook'

7 - Enumerate Attack Vectors

7.1 - Pilfer technology-specific security standards

7.2 - Pilfer community resources

7.3 - Pass technology-specific resources as your own

• When testing finds an attack:
  • First, decide if its impact warrants further exploration
  • Are additional impacts possible?
  • Consider what conceptual goals the attack supports
  • Then consider who could launch the attack against the application

• After analysis converges, iterate secure design

• Showcase great OWASP projects
• Provide the best, freely distributable application security tools/documents
• Ensure that the tools provided are easy to use as possible
• Continue to document how to use the tools and how the modules were created
• Align the tools with the OWASP Testing Guide v3 to provide maximum coverage
• Awesome training environment

330,081 total downloads as of 10/5/2009

~5,094 GB of bandwidth since launch (7/2008)

Most downloads in 1 month = 81,607 (3/2009)

Available Tools: 26 "Significant"

• Web Scarab
• Web Goat
• CAL9000
• JBroFuzz
• WSFuzzer
• Wapiti
• Burp Suite
• Paro
• Spike Proxy
• Rat Proxy
• w3af
• Grendel Scan
• Nikto
• nmap
• Zenmap
• sqlmap
• SQL Brute
• Metasploit
• ....

OWASP Documents

• Testing Guide v2 & v3
• CLASP
• Top 10 for 2007
• Top 10 for Java Enterprise Edition
• AppSec FAQ
• Books (CLASP, Top 10 2007, Top 10 + Testing + Legal, WebGoat and Web Scarab, Guide 2.0, Code Review)
• WASC Threat Classification
• OSTTMM

Where are we going?

• Project Tindy (Live CD installed to a virtual hard drive, persistence, VMware, VirtualBox, and Paralles)
• Project Aqua Dog (OWASP Live CD on a USB drive, VM install + VM engine + USB drive = mobile app sec platform, currently testing, Qemu is the current VM engine)
• Much easier URL - AppSecLive.org
• Community site around OWASP Live CD
• Online Tool DB (331+ tools)
• New release will be based on Ubuntu instead of SLAX
• Create .deb packages for every tool
• Create a repository for packages
• Add dependency info to packages
• Brings the 26,000+ existing packages to the Live CD
• More fun cool stuff like Wubi (install Ubuntu onto an existing windows desktop to be able to dual-boot without repartitioning windows)

Design Goals

• Easy for users to keep updated
• Easy for project lead to keep updated
• Easy to produce releases (every 6 months)
  • Crank out new .debs when new tool releases
  • Continually updating repository
• Focused on just application security - not general pen testing
  • Both dynamic and static tools
  • Developer tools also

OWASP Education Project

• Natural ties between these projects
  • Already being used for training classes
  • Need to coordinate efforts to make sure critical pieces aren't missing form the OWASP Live CD
  • Training environment could be customized for a particular class thanks to the individual modules
    • Student gets to take the environment home
  • As more modules come online, even more potential for cross pollination
  • Builder tools/docs only expand its reach
  • Kiosk mode?

Crazy Pie in the Sky Idea

• .deb package + auto update + categories = CD profiles
• Allows someone to customize the OWASP Live CD to their needs
• Example Profiles:
  • Whitebox testing
  • Blackbox testing
  • Static analysis
  • Targe specific (Java, .Net)

What have you done for me lately?

• For Testers/QA testers
  • Wide array of tools, preconfigured and ready to go
  • Nice "jump kit" to keep in your laptop bag
  • Great platform to test or learn the tools
• For App Sec Professionals
  • Both dynamic and static tool coverage
  • Ability to customize the job your on
• For Trainers
  • Ready to go environment for students
  • Ability to customize for the class

Get Involved

• Join the mailing list
• Post on hte AppSecLive.org forums
• Download an ISO or VM
  • Complain or praise, suggest improvements
  • Submit a bug to the Google Code site
• Create a deb package of a tool
  • How I create the debs will be documented, command by command and I'll answer questions gladly
• Suggest missing tools, docs, or links
• Do a screencast of one of the tools being used on the OWASP Live CD

Learn More

• Google "OWASP Live CD"
• Download & Community Site (http://AppSecLive.org)

Everything is stored in /opt/owasp

WAF Fallacies (at least in regards to OWASP ESAPI WAF)

• WAFs add attack surface
• WAFs can create culture problems
• WAFs can't fix business logic vulnerabilities
• WAFs are way too expensive
• WAFs complicate networks

Why fix in ESAPI WAF vs Fix in code?

• Changing in ESAPI WAF is just a text file
• Shorter gap between time discovered and WAF fix vs code fix

Advantages of WAF

• Performance - Only your rules are checked, plus state is already managed by the app server
• Capability - being closer to the app lets us do more
• Process - Rules are closer to application owner, shortening discovery-to-patch time, also fix-to-patch-removal time

Principle: Make common tasks easy, uncommon tasks possible

General virtual patching functionality is easy to understand

Ability to write custom script rules as well "bean-shell-rules"
Fixing Injection Flaws is easy

Can fix business logic flaws with the WAF (missing authentication, missing functional access control, missing data layer access control)

Can add "outbound" security as well

• Add anti-clickjacking header
• Set uniform content-type
• Add HttpOnly flag
• Add secure flag
• Detect outbound information
• Replace outbound information

Takes advantage of early failing to make rules as optimized as possible

Now we see the tool demonstrated with several different vulnerabilities in a real-world application (JForum):

• Cross-Site Scripting Flaw (JForum XSS flaw is unable to be fixed with a WAF because of dynamic URLs)
• Unchecked Redirect
• Add HttpOnly
• Add anti-clickjacking header
• Privilege escalation

3 Different WAF Modes

• Log
• Block
• Redirect

Latency with all of the rules turned on is about 5%.  With selected rules is closer to 0%.  Basically an order of n magnitude where n is the number of rules enabled.  Comes out to milliseconds.

Agenda

• AppSensor Project
• Malicious Attackers
• Application Worms

Detecting Attacks the Right Way

• Integration
  • Detect INSIDE the application
  • Understand business logic
• Effectiveness
  • Minimal false positives
  • Immediate response
• Effort
  • Automatic detection
  • No manual work required

Detection Outside the Application (WAF)

• Application context not available
• No concept of access violations
• Custom application + Generic Solution != success
• Ex: Changing the account ID in /viewAccount?id=1002

Inside the Application is Best

• Understand application & business context
• Integration with authentication & user store

How Does AppSensor Protect the App?

• Take many requests for an attacker to find a vulnerability
• Takes fewer requests by AppSensor to determine that the user is malicious

AppSensor is Faster than Attacker

• User identified as malicious and blocked before a vulnerability is found

Categories of Detection

• Request
• Authentication
• Access Control
• Session
• Input
• Encoding
• Command Injection
• File IO
• User Trend
• System Trend

Attack Detection: Real vs Cyber World

• Why do bank robbers get caught?
• Why don't hackers get caught?

Let's Change Things - Applications Should...

• Detect attacks
• Understand normal use vs suspicious use
• Instantly identify attackers
• Shutdown attackers in real time
• Modify application accessibility for defense

Detecting Malicious Users

• Many malicious attacks are obvious and not "user error"
  • POST when expecting GET
  • Tampering with headers
  • Submissions of XSS attack

Detecting Malicious Users

• Bypassing client side input validation
• Transaction using functionality not visible to user role
• Multiple access control violations
• Change of user agent midsession
• Double encoded data

The Code

• Leverages ESAPI!
• 3 lines to setup AppSensor
• 2 lines per AppSensor detection point

Setting up AppSensor

1. Configure response action object (log logout, account lock)
2. Create AppSensorIntrusionDetector with response action object
3. Set ESAPI intrusion detector

Defining Response Policies

• ESAPI.properties file
• Define
  • Threshold count
  • Interval of events
  • Response action
  • Per exception type or aggregate

2 Lines to Use AppSensor

1. Check for "maliciousness"
2. Create new AppSensorException

Understanding the Intrusion Exception

new AppSensorIntrusion Exception(

• request.getServletPath(),
• "ACE1",
• "User Message",
• "Direct object tampering with ..."

);

AppSensor vs Scanners

• Tools attempt 10,000s of generic attacks
• AppSensor stops automated scans nearly instantly

AppSensor vs Human Attackers

• Very difficult for attacker
• Requires advanced obfuscation for each attack
• Multiple probes == detection

Application Worms on the Rise

• Twitter Worm
• MySpace Samy WOrm
• Huge damages for site
  • Remediation
  • Cleanup
  • Bad PR
  • Infected Users
• Leverage XSS and CSRF

Detecting/Preventing an Application Worm

• Can you find/fix all XSS?
• Pattern matching easily foiled
• Block the common factor!
  • Worms use XSS and CSRF for propagation
  • 1000% usage increase -> problem
  • Our example: updateProfile, updateStatus, updateName

Case Study: Samy

• MySpace Application Worm
• XSS worm embedded in User Profile
• Exponential Growth of Samy's friends

Samy vs AppSensor

• AppSensor detects uptick in addFriend usage
• Compares against trended info
• Automatic response initiated
  • Alert admin +200% add friend usage
  • Alerts admin 2nd time +500% add friend usage
  • Automatically shuts down add friend feature
• Result
  • Worm contained
  • Add friend temporarily disabled
  • Site stays up

Benefits of Trend Monitoring

• Detection of
  • Application worms
  • Scripted attacks/probing
  • CSRF attacks
• Alerting of excessive activity
• Selective feature shutdown for overall stability

AppSensor in Action

• Demo social networking app
• Defended with AppSensor trend monitoring

What's Under the Hood?

• REST communication between AppSensor & App
• Support Response Actions (warn user, logout user, disable user, etc)

AppSensor Brain

• Drools - Rule Based System
• Support for complex rule sets - much more than just counting feature usage
• Evaluates objects in Drools memory

The Exploit

• XSS infects victim's "Status" with worm
• CSRF adds victim as friend of Charlie

Defend with AppSensor

• AppSensor Policy
  • Notify admin if events > 5
  • Disable service if events > 10
• AppSensor notices anomaly - alerts admin
• After 10 events AppSensor disables just that feature of the site
• Users protected, worm contained, site stays up

Trend Monitoring Benefits

• Auto detection of attacks
• ...

Agenda

• What is AJAX?
• AJAX and Web App Security
• AJAX and Test Automation
• Vulnerability Examples: XSS, CSRF, & JavaScript Hijacking
• AJAX Best Security Practices
• Demo
• Q&A

What is AJAX?

• Asynchronous JavaScript And XML
• AJAX allows for a new generation of more dynamic, more interactive, faster Web 2.0 applications
• AJAX leverages existing technologies, such as DHTML, CSS< DOM, JSON, and the (a)synchronous XMLHTTPRequest (XHR)
• Not just a set of technologies, but a new Web application development approach and methodology
• XHR allows for (a)synchronous server requests without the need for a full page reload
• XHR "downstream" payload can be
  • XML, JSON, HTML/JavaScript snippets, plain text, serialized data, basically pretty much anything...
• Responses often get further processed using JavaScript and result in dynamic web page content changes through DOM modifications

AJAX Code Example

xhr = new XMLHttprequest();
xhr.open("GET", AJAX_call?foo-bar, true);
xhr.onreadystatechange = processResponse;
xhr.send(null);
function processResponse() {
if (xhr.readyState == 4) {
if (request.status == 200) {
response = xhr.responseText;
...
}
}
}

XHR and the Same Origin Policy

• Same origin policy is a key browser security mechanism
  • To prevent any cross-domain data leakage, etc
  • With JavaScript it doesn't allow JavaScript from origin A to access content/data from origin B
  • Origin refers to the domain name, port, and protocol
• In the case of XHR, the same origin policy does not allow for any cross-domain XHR requests
  • Developers often don't like this at all!

Common Cross Domain Workarounds

Cross-domain access is often still implemented by various means, such as:

• Open / Application (server-based) proxies
• Flash & Java Applets (depending on crossdomain.xml)
  • Ex: FlashXMLHttpRequest by Julien Couvreur
• RESTful web service with JavaScript callback and JSON response
  • EX: JSONscriptRequest by Jason Levitt

AJAX Frameworks

• AJAX frameworks are often categorized as either "Client" or "Proxy/Server" framework
• "Proxy/Server" frameworks sometimes result in unintended method/functionality exposure
• Beware of any kind of "Debugging mode" (Ex: Direct Web Remoting (DWR) debug=true)
• Remember: Attackers can easily "fingerprint" AJAX frameworks
• Beware of JavaScript Hijacking
  • Don't use HTTP GET for "upstream"
  • Prefix "downstream" JavaScript with "while(1);"

AJAX and Web App Security

• AJAX potentially increases the attack surface
  • More "hidden" calls mean more potential security holes
• AJAX developers sometimes pay less attention to security, due to it's "hidden" nature
  • Basically the old mistake of security by obscurity
• AJAX developers sometimes tend to rely on client side validation
  • An approach that is just as flawed with or without AJAX
• Mash-up calls/functionality are often less secure by design
  • 3rd party APIs (Ex: feeds, blogs, search APIs, etc) are often designed with ease of use, not security in mind
  • Mash-ups often lack clear security boundaries (who validates, who filters, who encodes/decodes, etc)
  • Mash-ups often result in untrusted cross-domain access workarounds
• AJAX sometimes promotes dynamic code (JavaScript) execution of untrusted response data

AJAX / Web 2.0 and Test Automation

• Spidering is more complex than just processing ANCHOR HREF's; various events need to be simulated (Ex: mouseover, keydown, keyup, onclick, onfocus, onblur, etc)
• Timer events and dynamic DOM changes need to be observed
• Use of non-standard data formats for both requests and responses make injection and detection hard to automate
• Page changes after XHR requests can sometimes be delayed
• In short, you need to have browser like behavior (JavaScript engine, DOM & event management, etc)

Cross-Site Scripting (XSS)

• AJAX is changing the game a little bit since the script tag may already be there, just need to look for JSON or JavaScript snippets to inject yourself into

Cross-Site Request Forgery (CSRF)

• Want to send a token for AJAX requests as well

JavaScript Hijacking

• Attacker code (override Array constructor)
• Render the JavaScript on the wire useless to anyone who doesn't have access to the code itself
• The attacker cannot sanitize the JavaScript since they do not have access to the code

AJAX Best Security Practices

Pretty much all the usual Web app security best practices apply:

• Analyze and know your security boundaries and attack surfaces
• Beware of reliance on client-side security measures
• Assume the worst case scenario for all 3rd party interations
  • 3rd parties can inherently not be trusted!
• Be extremely careful when circumventing same origin policy
• Avoid/limit the use of dynamic code/eval()
• Beware of JavaScript Hijacking
• Implement anti-CSRF defenses