STOPPING LAYER 7 ATTACKS with F5 ASM. Sven Müller Security Solution Architect

(1)

STOPPING LAYER 7 ATTACKS

with F5 ASM

Sven Müller

(2)

Agenda

• Who is targeted

• How do Layer 7 attacks look like

• How to protect against Layer 7 attacks

• Building a security policy

• Layer 7 DDOS protection

(3)

Cyber-attacks in the News for 2011

(4)

Cyber-attacks in the News for 2012

(5)

(6)

(7)

Example: SQL-Injection

$id = $_GET['id'];

$result = "SELECT first_name, last_name FROM users WHERE user_id = '$id'";

(8)

$id = $_GET['id'];

$result = "SELECT first_name, last_name FROM users WHERE user_id = '$id'";

Attacker inserts : ' or 1=1 #

This results into: SELECT first_name, last_name FROM users WHERE user_id = ‘’ or 1=1#

1=1 is always true, so all entries will be returned 

(9)

Tools and Bot-networks make it easy for attackers to generate a huge amount of requests. Interesting DDOS example: Facebook hosted DDOS with notes app

Facebook Notes allows users to include <img> tags.

Whenever a <img> tag is used, Facebook crawls the image from the external server and caches it. Facebook will only cache the image once. However, using random get parameters, the cache can be by-passed and the feature can be abused to cause a huge HTTP GET flood.

<img src=http://targetname/file?r=1></img> <img src=http://targetname/file?r=1></img>

...

<img src=http://targetname/file?r=1000></img>

(10)

Number of involved Facebook servers: 112

Example: L7-DDOS

Or use Google to do DDOS attacks:

(11)

Network Security does not help against Application attacks (Layer 7)

PORT 80 PORT 443

Attacks Now Look To Exploit Application Vulnerabilities Perimeter Security Is Strong Forceful Browsing Cross-Site Scripting Cookie Poisoning SQL/OS Injection Hidden-Field Manipulation Parameter Tampering Buffer Overflow Brute force attacks Layer 7 DOS Webscraping CSRF Viruses Botnets Fishing Proxies ! Infrastructural Intelligence ! Non-compliant Information High Information Density = High Value Attack ! Forced Access to Information But Is Open to Web Traffic

(12)

(13)

!

Non-compliant Information

Webapplication Firewall (WAF) protects on Layer 7

! Unauthorised Access ! Infrastructural Intelligence

WAF allows only legitimate requests

WAF Stops bad requests and responses ! Unauthorised Access Browser

(14)

ICMP flood SYN flood SSL renegotiation Data leakage Slowloris attack XSS Network Firewall WAF WAF

(15)

Common attacks on web applications

BIG-IP ASM delivers comprehensive protection against critical web attacks

CSRF Cookie manipulation

OWASP top 10 Brute force attacks

Forceful browsing Buffer overflows

Web scraping Parameter tampering SQL injections Information leakage

Field manipulation Session high jacking

Cross-site scripting Zero-day attacks

Command injection ClickJacking

(16)

Protect web applications and data from layer 7 attacks, and enable compliance, such as PCI DSS, with the Silverline Web Application Firewall service which is built on BIG-IP Application Security Manager and backed by 24x7x365 support from F5 experts.

Silverline Web Application Firewall (WAFaaS)

Proven security effectiveness as a convenient cloud-based service

Legitimate User

L7 Protection:

Geolocation attacks, DDoS, SQL injection, OWASP Top Ten attacks, zero-day threats, AJAX

applications, JSON payloads

Public Cloud Hosted Web App

Private Cloud Hosted Web App

VA/DAST Scans

Policy can be built from 3rd_{Party DAST}

Web Application Firewall Services WA F Cloud Physical Hosted Web App Attackers _{F5 Silverline} WAF

(17)

(18)

Different ways to build a policy

Security policy checked

Security policy applied

DYNAMIC POLICY BUILDER INTEGRATION WITH APP SCANNERS PRE-BUILT POLICIES

Automatic • No knowledge of the app required • Adjusts policies if app changes Manual • Advanced configuration for custom policies

• Virtual patching with continuous application scanning

• Out-of-the-box

• Pre-configure and validated • For mission-critical apps

including: Microsoft, Oracle, PeopleSoft

(19)

Policy Builder Deployment Wizard

(20)

Identify, virtually patch, mitigate vulnerabilities

Import vulnerabilities into BIG-IP ASM

Mitigate web app attacks Scan application with a

web application security scanner: Hacker Clients • Generic Scanner • Qualys • IBM • WhiteHat • Cenzic • HP WI

(21)

F5 security experts proactively monitor, and fine-tune policies to protect web applications and data from new and emerging threats.

• Expert policy setup • Policy fine-tuning

• Proactive alert monitoring • False positives tuning

• Detection tuning

• Whitelist / Blacklist Set up and monitoring

Availability & Support Expert Policy Setup and Management

Active Threat Monitoring

Reduce operating costs

by outsourcing WAF policy management to F5 SOC experts

(22)

(23)

Automatic HTTP/S DoS attack detection and protection

• Accurate detection technique—based on latency and/or transaction per second (TPS) • Three different mitigation techniques escalated serially

• Focus on higher value productivity while automatic controls intervene

IDENTIFY POTENTIAL ATTACKERS DROP ONLY THE ATTACKERS

(24)

Highly accurate anti-bot and scanner protection

• Differentiate between script and browser • Inspection of user interaction with browser • Distinguish real-user from bot

• Mitigate automated attacks, scanners, botnets and intellectual property scrappers

• Detect a persistent scrapper that uses multiple ip addresses or a single request session

ASM Website

Application Security Web Bot

(25)

Browser Fingerprinting

• Uniquely identify browsers by their customized attributes such as • Screen resolution • Time zone • Default fonts • User agent • Installed plug-ins • http://browserspy.dk/

• Statistical method – however strong enough • https://panopticlick.eff.org/

(26)

IP intelligence service

IP address feed updates every 5 min

Geolocation database Botnet Anonymous requests Anonymous proxies Scanner Restricted region or country Attacker Custom application Financial application

Internally infected devices and servers

(27)

(28)

Detailed logging with actionable reports

(29)

Attack Expert System in ASM

1. Click on info tooltip

Attack expert system makes responding to vulnerabilities

faster and easier: Violations are represented graphically, with a tooltip to

(30)

Enhanced visibility and analysis

Statistics collected

URLs Methods

Server/client latency Client IPs and geos Throughput User agents

Response codes User sessions

Views

Virtual server Pool member Response codes

URLs and HTTP methods

Application analytics for assured availability

• ASM logs provide deeper intelligence grouped by application and user

• Rules can be applied based on user behavior

• Latency monitoring provides:

• Business intelligence/capacity planning

• Troubleshooting and performance tuning

(31)

• Securely communicate with Silverline SOC experts

• View centralized attack and threat monitoring reports with details

including:

• source geo-IP mapping

• blocked vs. alerted attacks

• blocked traffic and attack types • alerted attack types

• Threats*

• bandwidth used • hits/sec*

• type of traffic and visits (bots v. humans)*

WAFaaS: Gain attack insights and intelligence

F5 Customer Portal

Customer Portal Compliance Visibility & Attack Reports

(32)