Combined C/C++, Java and Web application security CL-CJW. Classroom 4 days

(1)

CL-CJW

Combined C/C++, Java and Web

_{application security}

Classroom

_{4 days}

To serve in the best way heterogeneous development groups that are using various

platforms simultaneously during their everyday work, we have merged various topics

into a combined course that presents diverse secure coding subjects in didactic manner

on a single training event. This course combines C/C++ and Java platform security to

provide an extensive, cross-platform secure coding expertise.

Concerning C/C++, common security vulnerabilities are discussed, backed by practical

exercises about the attacking methods that exploit these vulnerabilities, with the focus

on the mitigation techniques that can be applied to prevent the occurrences of these

dangerous bugs, detect them before market launch or prevent their exploitation.

Security components and service of Java are discussed by presenting the different APIs

and tools through a number of practical exercises where participants can gain hands-on

experience in using them. The course also covers security issues of Web services and

the related Java services that can be applied to prevent the most aching threats of the

Internet based services. Finally, web- and Java-related security vulnerabilities are

demonstrated by easy-to-understand exercises, which not only show the root cause of

the problems, but also demonstrate the attack methods along with the recommended

mitigation and coding techniques in order to avoid the associated security problems.

Audience: C/C++ and Java developers, architects and testers Preparedness: Advanced C/C++, Java and Web

Exercises: Hands-on

Outline

IT security and secure coding Web application vulnerabilities Client-side security

Foundations of Java security Practical cryptography Java security services

Security relevant C/C++ programming bugs and flaws Buffer overflow

Some additional native code-related vulnerabilities Java specific vulnerabilities

Using security testing tools Knowledge sources

Content

Security technologies and services: Java language security solutions, Java Virtual Machine (JVM) and

Java Runtime Environment (JRE); ByteCode Verifier and Classloader; Security Manager and Access Controller, managing permissions with the PolicyTool; Java Cryptography Architecture (JCA) and Java Cryptographic Extension (JCE), Java Secure Socket Extension (JSSE), Java Authentication and Authorization Service (JAAS), Java Keystore (JKS) and the KeyTool; SOAP and REST; Transport-layer security, application- and container-managed authentication, authorization; End-to-end security; Web Services Security (WSS), username/password authentication, signing (XML Signature) and encryption (XML Encryption)

Common security vulnerabilities and mitigation techniques: Buffer Overflow (BOF), heap overflow;

integer problems: widthness bug, signedness bug, arithmetic overflow, integer mishandling case study – Android Stagefright bug; Printf Format String bug (PFS); array indexing problems, unicode bug, side channels: the RSA timing attack, Time-of-Checking-to-Time-of-Usage (TOCTTOU) race conditions, Directory Traversal Vulnerability (DTV); No eXecute (NX bit) access mode of Virtual Memory Management (VMM); Data Execution Prevention (DEP); Address Space Layout Randomization (ASLR) – PaX, ExecShield; Stack Smashing Protection (SSP) – /GS, StackGuard, ProPolice; Source Code Analyzers (SCA tools).

(2)

Java-related vulnerabilities: integer overflows in Java (e.g. the CRC32 bug); Calendar/ZoneInfo

deserialization bug (CVE 2008-5353); unsafe reflection; injection flaws in Java (SQL Injection, Command Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF); unsafe Java Native Interface (JNI); improper error and exception handling; insecure randomness of java.util.Random; object hijacking; serialization of sensitive information; dangers of mobile code; Denial-of-Service (DoS) in Java (the “2.2250738585072012e-308 bug”), problem with inner classes, and many more…

Exercises: exploiting stack overflow – executing shell codes; crafting a printf format attack string –

write-what-where (WWW) possibilities; understanding integer problems; applying mitigation techniques; circumventing them by return-to-libc attack or argument overwriting; and many spot- and-correct-the-bug exercises. WS Security with username and password; XMLS Signature; XML Encryption; exploiting SQL injection step-by-step; crafting Cross-Site Scripting attacks; uploading and running executable code; crashing through JNI; proof-of-concept exploit of Calendar/ZoneInfo deserialization bug; using reflection to break accessibility modifiers; object hijacking; preventing serialization; exploiting mobile code vulnerabilities; crashing Java with magic double values; exploiting inner classes.

Participants attending this course will:

Understand basic concepts of security, IT security, cryptography and secure coding Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them Learn client-side vulnerabilities and secure coding practices

Learn to use various security features of the Java development environment

Be informed about recent vulnerabilities in various platforms, frameworks and libraries Realize the severe consequences of unsecure buffer handling in native code

Understand the architectural protection techniques and their weaknesses Learn about typical coding mistakes and how to avoid them

Get practical knowledge in using security testing tools Get sources and further reading on secure coding practices

Detailed table of contents

Day 1

IT security and secure coding



Nature of security



IT security related terms



Definition of risk



Different aspects of IT security



Requirements of different application areas



IT security vs. secure coding



From vulnerabilities to botnets and cyber crime

 Nature of security flaws  Reasons of difficulty

 From an infected computer to targeted attacks



Classification of security flaws

 Landwehr’s taxonomy  The Fortify taxonomy

 The Seven Pernicious Kingdoms  OWASP Top Ten 2013

Web application vulnerabilities



SQL Injection

 Exercise cars.com – SQL Injection  SQL Injection exercise

 Typical SQL Injection attack methods  Blind and time-based SQL injection  SQL Injection protection methods



Other injection flaws

 Command injection

 Exercise – Command injection



Cross-Site Scripting (XSS)

 Persistent / Reflected XSS exercise  XSS prevention

 XSS prevention tools in Java



Broken authentication and session management

 Exercise cars.com – Authentication bypass



Cross Site Request Forgery (CSRF)

 Exercise cars.com –Cross Site Request Forgery (CSRF)  CSRF prevention



Insecure direct object reference



Unvalidated file upload



Security misconfiguration



Failure to restrict URL access

(4)



Unvalidated redirects and forwards

Client-side security



JavaScript security

 Same Origin Policy

 Exercise – Client-side authentication

 Client-side authentication and password management  Protecting JavaScript code

 Exercise – JavaScript obfuscation  Clickjacking

 Exercise – Do you Like me?  Protection against Clickjacking

 Anti frame-busting – dismissing protection scripts  Protection against busting frame busting



AJAX security

 XSS in AJAX

 Script injection attack in AJAX  Exercise – XSS in AJAX

 Exercise CSRF in AJAX – JavaScript hijacking  CSRF protection in AJAX



HTML5 Security

 HTML5 clickjacking attack – text field injection  HTML5 clickjacking – content extraction  Form tampering

 Exercise – Form tampering  Cross-origin requests

 Exercise – Client side include

Day 2

Foundations of Java security



The Java environment



Java security



Low-level security – the Java language

 Java language security  Access modifiers  Type safety

 Automatic memory management  Java execution overview

 Bytecode Verifier  Class Loader

 Protecting Java code



High-level security – access control

 Protection domains

 Security Manager and Access Controller  Permission checking

(5)

 Exercise Applet – Security policy for applets  Exercise Applet – Policy Tool

Practical cryptography



Cryptosystems

 Elements of a cryptosystem



Symmetric-key cryptography

 Providing confidentiality – encrypted communication  Symmetric encryption algorithms

 Block cipher modes of operation  Comparing the modes of operation  Hash or message digest

 Hash algorithms

 Message Authentication Code (MAC)

 Providing integrity and authenticity with a symmetric key



Asymmetric (public-key) cryptography

 Public-key encryption

 Rule of thumb – possession of private key  The RSA algorithm

 Introduction to RSA algorithm

 Encrypting with RSA

 Digital signing with RSA

 Blind signature



Public Key Infrastructure (PKI)

 Man-in-the-Middle (MiM) attack  Digital certificates against MiM attack

 Certificate Authorities in Public Key Infrastructure  X.509 digital certificate

 Exercise Jars – Granting permission to signed code

Java security services



Java security services – architecture



Authentication and authorization

 Java Authentication and Authorization Service (JAAS)  JAAS architecture

 Typical ways of gathering authentication information

 Exercise JAAS – Using JAAS for authentication and authorization



Cryptographic services

 Java Cryptography Architecture / Extension (JCA/JCE)  Using Cryptographic Service Providers

 Engine classes and algorithms

 Exercise Sign – Generating and verifying signatures  Exercise Sign – Using alternative providers

 The Bouncy Castle (BC) provider  Installing the Bouncy Castle  Using the Bouncy Castle services



Secure communication

(6)

 Message structure  SSL/TLS handshake

 Java Secure Socket Extension (JSSE)

 Exercise Https – Switching from HTTP to HTTPS

Day 3

Security relevant C/C++ programming bugs and flaws



x86 machine code, memory layout, stack operations

 Intel 80x86 Processors – main registers

 Intel 80x86 Processors – most important instructions  Intel 80x86 Processors – flags

 Intel 80x86 Processors – control instructions

 Intel 80x86 Processors – stack handling and flow control  The memory address layout

 The function calling mechanism in C/C++ on x86  Calling conventions

 The local variables and the stack frame

 Function calls – prologue and epilogue of a function  Stack frame of nested calls

 Stack frame of recursive functions

Buffer overflow



Stack overflow

 Buffer overflow on the stack  Overwriting the return address  Exercise BOFIntro

 Exercise BOFShellcode



Protection principles

 Specific protection methods

 Protection methods at different layers  The PreDeCo matrix of software security

 Stack overflow – Prevention (during development)  Stack overflow – Detection (during execution)



Stack smashing protection

 Stack smashing protection variants  Stack smashing protection in GCC

 Exercise BOFShellcode – Stack smashing protection  Effects of stack smashing protection

 Bypassing stack smashing protection – an example  Stack overflow – Anti-exploit techniques



Address Space Layout Randomization (ASLR)

 Stack randomization with ASLR  Using ASLR

 Circumventing ASLR: NOP sledding

 Exercise BOFASLR – Circumventing ASLR with NOP sledging

(7)

 Protection through Virtual Memory Management  Access Control on memory segments

 The Never eXecute (NX) bit

 Exercise BOFShellcode – Enforcing NX memory segments



Return-to-libc attack – Circumventing the NX bit

 Arc injection / Return-to-libc attack

 Exercise BOFShellcode – The Return-to-libc attack  Multiple function calls with return-to-libc



Return oriented programming (ROP)

 Exploiting with ROP  ROP gadgets

 Combining the ROP gadgets  Exercise BOFROP



Heap overflow

 Memory allocation managed by a doubly-linked list  Buffer overflow on the heap

 Steps of freeing and joining memory blocks  Freeing allocated memory blocks

 TLS Heartbeat Extension

 Heartbleed – a simple explanation  Heartbleed – fix in v1.0.1g

 Protection against heap overflow

Some additional native code-related vulnerabilities



Array indexing – spot the bug!



The Unicode bug



Directory Traversal Vulnerability



Type mismatch – Spot the bug!



Exercise TypeMismatch



Serialization errors (TOCTTOU)



Attacks with symbolic links



Exercise TOCTTOU



Shellshock bash vulnerability

 Shellshock – basics of using functions in bash  Shellshock – vulnerability in bash

 Exercise - Shellshock

 Shellshock fix and counterattacks

 Exercise – Command override with environment variables

Day 4

Java specific vulnerabilities



Input validation

 Input validation concepts  Unsafe JNI

(8)

 Integer overflow in Java  Integer problems

 Representation of negative integers

 Integer ranges

 Integer representation by using the two’s complement

 The integer promotion rule in C/C++

 Arithmetic overflow – spot the bug!

 So why ABS(INT_MIN)==INT_MIN?

 Signedness bug – spot the bug!

 Widthness integer overflow – spot the bug!

 A case study – Android Stagefright  Stagefright – a quick introduction

 Some Stagefright code examples – spot the bugs!

 Integer problem mitigation

 Avoiding arithmetic overflow – addition

 Avoiding arithmetic overflow – multiplication

 Dealing with signed/unsigned integer promotion

 Safe integer handling in C

 The SafeInt class for C++

 A real-world integer overflow vulnerability

 The actual mistake in java.utils.zip.CRC32

 Deserialization in Java

 A real-world deserialization vulnerability

 The most exploited flaw in Java

 The actual mistake in java.util.Calendar – spot the bug!

 Java Calendar object deserialization

 Exploiting the Java Calendar object deserialization

 Patch for Java Calendar object deserialization problem

 Exercise CVE-2008-5353-poc –Deserialization

 Exercise – Deserialization

 Implementation of a command dispatcher

 Unsafe reflection – spot the bug!



Improper use of security features

 Problems related to the use of security features  Insecure randomness

 Week PRNGs in C

 Stronger PRNGs in C and Linux

 Week PRNGs in Java

 Hardware-based RNGs

 Exercise RandomTest

 Using random numbers in Java – spot the bug!

 Password management  Exercise – Google cracking

 Password management and storage

 Special purpose hash algorithms for password storage

 BDKDF2 and bcrypt implementations in C/C++

 Some other typical password management problems

 Exercise Hard coded passwords

 Accessing private fields with reflection in Java

 Exercise Reflection – Accessing private fields with reflection



Improper error and exception handling

 Typical problems with error and exception handling  Empty catch block

(9)

 Overly broad catch  Using multi-catch in Java

 Returning from finally block in Java – spot the bug!  Catching NullPointerException

 Exception handling – spot the bug!

 Exercise – Information leakage through error reporting  CVE-2012-4681 vulnerability

 Vulnerability in ClassFinder.findClass()  Calling ClassFinder.findClass()

 Exploiting the CVE-2012-4681 vulnerability



Time and state problems

 Time and state related problems  Concurrency – spot the bug!  Calling Thread.run()

 Exercise ThreadRun – Calling Thread.run()  Race condition in servlets – spot the bug!  Race condition – spot the bug!

 ArrayList vs Vector



Code quality problems

 Dangers arising from poor code quality  Poor code quality – spot the bug!  Unreleased resources

 Exercise Object Hijack

 Immutable String – spot the bug!  Exercise Immutable Strings

 Serializable sensitive – spot the bug!  Exercise Serializable Sensitive

 A generic Denial of Service attack against the Java environment  The “2.2250738585072012e-308 bug”

 The double bug in Tomcat

 The vulnerable code of DoubleValue() in FloatingDecimal.java  Triggering the infinite loop

 Exercise Double Bug



Mobile code

 Risks associated with mobile code  Private arrays – spot the bug!

 Private arrays – typed field returned from a public method  Critical public – spot the bug!

 Exercise Critical Public  Possible attack scheme  Inner classes – spot the bug!  Problem with inner classes

 The decompiled class file containing an inner class  Exercise Inner Class

Combined C/C++, Java and Web application security CL-CJW. Classroom 4 days

CL-CJW