Detecting and Defending Against Security Vulnerabilities for Web 2.0 Applications

Detecting and Defending Against Security

Vulnerabilities for Web 2.0 Applications

Ray Lai, Intuit

Share experience how to detect and defend

security vulnerabilities in Web 2.0 applications

using open source security tools

Agenda

Detect

Defend

Learn

Which is Easier to Hack?

Web 1.0 App Web 2.0 App

Top 3 Security Vulnerabilities •Unvalidated input parameters •Broken access control

•Broken authentication and session management

Top 3 Security Vulnerabilities •Cross-site scripting

•Injection flaw

•Malicious file execution

What’s New About Web 2.0 Security?

OWASP 2007 Top 10 Web 2.0 Examples

Cross-site scripting +++ Flash: cross-site flashing

Injection flaws ++++ AJAX, mash-up

Malicious file execution +++

Insecure direct object reference + JavaScript™ Object Notation (JSON)

Cross-site request forgery +++ Flash

Information leakage / improper error handling

+++++ AJAX, JSON Broken authentication and session

management

++++ Cross-domain, mash-up Insecure cryptographic storage +

Insecure communications ++

Use Case Scenario

Use Open Source / commercial security tools to examine

WebGoat (and Roller) from

SecuriBench

Example #1: Post-Me

Characteristics

•Plain data input screen •No sensitive personal data •High usage, high traffic

Scenarios: newsgroup, forum, blogs, etc.

How can I re-direct readers

to my malicious website?

Example #1: What’s the Issue?

What happens: Hackers post a message with the malicious URL or parameters:

<IMG SRC="attack?screen=7&menu=410&transferFunds=4000" width="1" height="1" />

Cross-site Request Forgery

Result: when reading the posting, newsgroup readers will invoke a malicious URL

Example #2: Online Travel

Scenarios: online travel service, mash-up

Characteristics

•AJAX with JSON

•Financial transactions •Mash-up, possibly

Example #2: What’s the Issue?

What happens: Hackers intercepts the JSON, tampers it,

and posts it.

JSON Poisoning

{ "From": "Boston", "To": "Seattle", "flights": [ {"stops": "0", "transit" : "N/A", "price": "$0"},

{"stops": "2", "transit" :

Example #3: Change Password

Scenarios: online services, mash-up

Characteristics

•SOAP-based Web services •Perhaps mash-up

•HTTP or HTTPS, depends

Can I change

Example #3: What’s the Issue

SOAP Injection

What happens: Hackers tries changing the password,

intercepts the SOAP message, tampers it, and posts it.

Result: hackers change

someone’s password for future

<?xml version='1.0' encoding='UTF-8'?> … <wsns0:Body>

<wsns1:changePassword>

<id xsi:type='xsd:int'>101</id> <password xsi:type='xsd:string'>

bar</password>

</wsns1:changePassword> </wsns0:Body>

What About Flex Application…

Cross-site Flashing

What About…

Phishing attack

Ad malware

Botnet

ActiveX controls

Agenda

Detect

Defend

Defensive Coding: Examples

Cross-site request forgery Filter specific tags (e.g. <IMG>)

Prompt user with security token for important actions or high value transactions

Shorter time period for user sessions

JSON poisoning Client-side and server-side input validation JavaScript output encoding

Obfuscate JavaScript

SOAP injection Use of nonce

WS-Security best practices Turn off WSDL

Strategy #2: Custom Security Test

Category Public / Open Source Commercial

Discovery tools NMAP Nessus

Web server vulnerabilities Nikto

Code quality* OWASP, FindBugs Fortify, Klockwork

Application vulnerabilities Paros AppScan, Hailstorm

Penetration testing WebScarab, Paros, SwfIntruder

Hybrid security testing

Agenda

Detect

Defend

Lesson 2: What You Can and Can’t Do

Obvious, e.g.

•

Information leakage

•

Port scan

•

OS fingerprinting

•

Web server

vulnerabilities scanner

Difficult ones, e.g.

•

Cross-site Scripting

•

Cross-site Request Forgery

•

Denial of Service

Hard ones, e.g.

•

New Web 2.0

vulnerabilities

Lesson 3: Summary

Don’t practice penetration testing tools on

production system!

“Trust no one”

Do we know what to detect, or to test

Different security testing tools provide different

findings

For More Information

Concepts

•

OWASP top 10 vulnerabilities

http://www.owasp.org/index.php/Category:Vulnerability

•

Cannings , Dwivedi and Lackey. Hacking Exposed Web 2.0.

McGrawHill, 2008

•

Andrew Andreu. Professional Pen Testing for Web Applications

•

Shyamsuda and Gould. You Are Hacked. JavaOne

_{Conference 2007}

http://developers.sun.com/learning/javaoneonline/2007/pdf/TS-6014.pdf

Security Incident Updates

•

Top 10 Web 2.0 attack vectors

http://www.net-security.org/article.php?id=949

•

http://www.us-cert.gov/current/current_activity.html

•

CERN

http://security.web.cern.ch/security/

For More Information

(cont’d)

Tutorial

•

http://www.irongeek.com/i.php?page=security/hackingillustrated

Tools

•

http://sectools.org/

•

http://www.cotse.com/tools/

•

http://www.securityhaven.com/tools.html

•

http://framework.metasploit.com/

•

http://www.paneuropa.co.uk/penetration_testing.htm

•

http://www.owasp.org/index.php/Category:OWASP_Download

Ray Lai, [email protected]