Owasp Top10 2010 rc1
Download as PPTX, PDF0 likes3,358 views
The document discusses the OWASP Top 10 web application security risks and their associated attack techniques, including injection flaws, broken authentication, cross-site scripting, and cryptographic issues. It presents various risks, countermeasures, and best practices for securing web applications, emphasizing the importance of robust security configurations and regular assessments. Additionally, the document features insights from Antonio Fontes, an expert in web security and OWASP chapter leader.
![COUNTERMEASURES ?(cont’d)Choose best validation strategy!Best: WhitelistWhen all possible values are known (enums, if/else if statements, regular expressions, …)Graylist:Enforce business rules:Type: string, numeric, byte, …Range: >0, <MaxInt, [a-z]{3,20}Weakest: Blacklistif(input.IndexOf(“<script>”)>=0)//reject24Antonio Fontes / Confoo Conference, Montreal / 2010](https://image.slidesharecdn.com/confoo-owasp-top10-100311112237-phpapp02/85/Owasp-Top10-2010-rc1-24-320.jpg)
![What are the countermeasures?Sanitize output, encode to destination format:For XML output, use predefined entities:<says>“here is my <script>”</says> <says><![CDATA[here is my <script>]]></says><says>my input is <script></says> <says>my input is <script></says>53Antonio Fontes / Confoo Conference, Montreal / 2010](https://image.slidesharecdn.com/confoo-owasp-top10-100311112237-phpapp02/85/Owasp-Top10-2010-rc1-53-320.jpg)
![What are the countermeasures?Implement unpredictable requests for all sensitive actionsUse temporary random hidden control fields:<input type=hidden name=check value=ab23b4a/>Link forms to the user session:if(!(Request.Form[“checker”]).Equals(SessionID)) // return errorUse CAPTCHAUse out-of-band verification:SMS / Voice call / Cryptographic tokens, etc.59Antonio Fontes / Confoo Conference, Montreal / 2010](https://image.slidesharecdn.com/confoo-owasp-top10-100311112237-phpapp02/85/Owasp-Top10-2010-rc1-59-320.jpg)
![what if?Encrypting user passwords with AES256$password = encrypt($get_[“password”],AES256,key);63reversible encryption!Antonio Fontes / Confoo Conference, Montreal / 2010](https://image.slidesharecdn.com/confoo-owasp-top10-100311112237-phpapp02/85/Owasp-Top10-2010-rc1-63-320.jpg)
![what if?Hashing user passwords with md5$password = md5($get_[“password”]);64weak algorithm!Antonio Fontes / Confoo Conference, Montreal / 2010](https://image.slidesharecdn.com/confoo-owasp-top10-100311112237-phpapp02/85/Owasp-Top10-2010-rc1-64-320.jpg)
![what if?Hashing user passwords with SHA-256$password = sha($get_[“password”]);65Missing seed!Antonio Fontes / Confoo Conference, Montreal / 2010](https://image.slidesharecdn.com/confoo-owasp-top10-100311112237-phpapp02/85/Owasp-Top10-2010-rc1-65-320.jpg)
![what if?Building keys with Math.RandomByte[] key = Math.RandBytes(128);66Weak random number generator!Antonio Fontes / Confoo Conference, Montreal / 2010](https://image.slidesharecdn.com/confoo-owasp-top10-100311112237-phpapp02/85/Owasp-Top10-2010-rc1-66-320.jpg)
![what if?Deriving a key from human entered secret$key = md5($GET_[“secret”]);67Weak key entropy!Antonio Fontes / Confoo Conference, Montreal / 2010](https://image.slidesharecdn.com/confoo-owasp-top10-100311112237-phpapp02/85/Owasp-Top10-2010-rc1-67-320.jpg)
Owasp Top10 2010 rc1
- 1. OWASP Top 10 - 2010 rc1The Top 10 Most Critical Web Application Security RisksAntonio FontesOWASP Geneva Chapter Leaderantonio.fontes@owasp.org
- 2. Agenda10 ways to attack web applicationsThe OWASP Top 10 rc1 ProjectIntegrating the Top 10 in an existing SDLC/SALCQ&A2Antonio Fontes / Confoo Conference, Montreal / 2010
- 3. About the OWASPOpen Web Application Security Project“Helping organizations secure their web applications.”Documentation and tools projects130 local chapters worldwidehttp://www.owasp.orgAntonio Fontes / Confoo Conference, Montreal / 20103
- 4. About me…Antonio Fontes, from Geneva (Switzerland)>1999: Web developer>2005: Ethical hacker / Security analyst>2008: Security & Privacy manager (banking software ISV)>2008: OWASP Geneva Chapter Leader >2010: Information Security Consultant SANS/CWE Top 25 Most Dangerous Programming Errors contributor4Antonio Fontes / Confoo Conference, Montreal / 2010
- 5. And about you?Coders? Testers?Managers?Hardcore OWASP Top 10 users?5Antonio Fontes / Confoo Conference, Montreal / 2010
- 6. Just taking the temperature…6© Randal Munroe (xkcd.com)Antonio Fontes / Confoo Conference, Montreal / 2010
- 7. Part 1: Top 10 major web application attack techniques7Antonio Fontes / Confoo Conference, Montreal / 2010
- 8. Attacking the infrastructureAttacking the applicationAttacking the usersOther attacks8Antonio Fontes / Confoo Conference, Montreal / 2010
- 9. Attacking the infrastructurehitting the weakest layer9Antonio Fontes / Confoo Conference, Montreal / 2010
- 10. 10 ; ) Are all demo apps removed?Is the web server up to date?Is the admin area protected from external access?Is directory indexing been disabled?Were all default passwords changed?Are all unnecessary scripts removed?Are there any backup/test/unused resources?Is the web server up to date?Have all default passwords been changed?Are all unnecessary services disabled?Are all unnecessary accounts disabled?Have all default passwords been changed?Is the system up to date?© Darwin Bell@flickrAre all unnecessary paths closed?Are all unnecessary ports closed?Is the admin interface reachable from the web?Can an administrative account be broken?Is the device up to date?Antonio Fontes / Confoo Conference, Montreal / 2010
- 11. Risk A6: Security misconfiguration11Antonio Fontes / Confoo Conference, Montreal / 2010
- 12. What is the risk?If there is a weaker link than the web application itself, the attacker will switch to the flawed layer. What are the countermeasures?Harden all layersReduce services and accounts to the minimumNo default passwordsKeep everything up to dateApply security guidelines (OS security, Web server security, Application server security, etc.)Keep default web application configuration safe“Deploy securely on a secure architecture”12Antonio Fontes / Confoo Conference, Montreal / 2010
- 13. Attacking the infrastructureAttacking the applicationAttacking the usersOther attacks13Antonio Fontes / Confoo Conference, Montreal / 2010
- 14. Attacking the applicationinjecting hostile code…14Antonio Fontes / Confoo Conference, Montreal / 2010
- 15. what if?15Antonio Fontes / Confoo Conference, Montreal / 2010
- 16. 16what if?SELECT * FROM users usrWHERE usr.username = 'admin ';--‘AND usr.password = ‘bb21158c733229347bd4e681891e213d94c685be’Antonio Fontes / Confoo Conference, Montreal / 2010
- 17. 17what if?Antonio Fontes / Confoo Conference, Montreal / 2010
- 18. what if?18Antonio Fontes / Confoo Conference, Montreal / 2010
- 19. 19 Any user input is a potential attack vector.Antonio Fontes / Confoo Conference, Montreal / 2010
- 20. Risk A1: Injections20Antonio Fontes / Confoo Conference, Montreal / 2010
- 21. RISK?Any application entry point can be used as a vector to inject hostile content that will modify expected behaviors.GOOD TO KNOWAll non-binding query languages are exposed! (LDAP and Xpath….)21Antonio Fontes / Confoo Conference, Montreal / 2010
- 22. COUNTERMEASURES?All input can be modified client-side. Be sure to validate:Querystring parametersForm fields (hidden fields also count)File submissions : if you’re expecting a picture, then make sure it is a picture!CookiesHTTP headers: all fields, including referrer are “user input”22Antonio Fontes / Confoo Conference, Montreal / 2010
- 23. COUNTERMEASURES? (cont’d)Neverpaste user input into query commands (SQL, Xpath, LDAP, OS commands, etc.):Use binding variables such as SQL parameters:If no binding model, encode input before pasting:Doubled quotes (‘’) for SQL serverEscaped quotes (\’) for MySQL (PHP addslashes is helpful!)Etc.23Antonio Fontes / Confoo Conference, Montreal / 2010
- 24. COUNTERMEASURES ?(cont’d)Choose best validation strategy!Best: WhitelistWhen all possible values are known (enums, if/else if statements, regular expressions, …)Graylist:Enforce business rules:Type: string, numeric, byte, …Range: >0, <MaxInt, [a-z]{3,20}Weakest: Blacklistif(input.IndexOf(“<script>”)>=0)//reject24Antonio Fontes / Confoo Conference, Montreal / 2010
- 25. Attacking the applicationplaying with obvious identifiers…25Antonio Fontes / Confoo Conference, Montreal / 2010
- 26. what if?2699999999Antonio Fontes / Confoo Conference, Montreal / 2010
- 27. what if?271234567Antonio Fontes / Confoo Conference, Montreal / 2010
- 28. Risk A4: Insecure direct object references28Antonio Fontes / Confoo Conference, Montreal / 2010
- 29. What is the risk?All references can modified client-side. An attacker might be able to access and/or modify confidential information.What are the countermeasures?Never send internal references to the browser:Use temporary or random number mapping (#0, #1, #2, #3, etc.)OR combine referenced access with access control:SELECT * FROM item WHERE id = $id AND owner = $uIDUPDATE item … WHERE id = $id AND owner = $id29Antonio Fontes / Confoo Conference, Montreal / 2010
- 30. Attacking the applicationbreaking session and authentication mechanisms…30Antonio Fontes / Confoo Conference, Montreal / 2010
- 31. what if?31Antonio Fontes / Confoo Conference, Montreal / 2010
- 32. what if?32Antonio Fontes / Confoo Conference, Montreal / 2010
- 33. what if?33Antonio Fontes / Confoo Conference, Montreal / 2010
- 34. Risk A3: Broken authentication or session management34Antonio Fontes / Confoo Conference, Montreal / 2010
- 35. What is the risk?HTTP is a stateless protocol. Each request must transmit ‘session’ information over the network.Authentication mechanisms are highly targeted by attackers , at all levels: forms, traffic, stored data.What are the countermeasures?Use simple, centralized and standardized session mechanismEnable cookie security attributes (secure flag, httponly flag, encryption and integrity control)Validate session identifiers Is the sessionID coming from the right place?35Antonio Fontes / Confoo Conference, Montreal / 2010
- 36. countermeasures? (cont’d)Make sure ‘logoff’ actually invalidates the session.Prevent bruteforcing attacks, but also prevent denial of service on legitimate accountsEnforce secure password recoveryAuthenticate before resettingReview, review, review authentication (and logoff) code manually!36Antonio Fontes / Confoo Conference, Montreal / 2010
- 37. Attacking the applicationfinding hidden “secret” URLs…37Antonio Fontes / Confoo Conference, Montreal / 2010
- 38. what if?38Antonio Fontes / Confoo Conference, Montreal / 2010
- 39. what if?39Antonio Fontes / Confoo Conference, Montreal / 2010
- 40. Risk A7: Failure to restrict URL access40Antonio Fontes / Confoo Conference, Montreal / 2010
- 41. What is the risk?URLs that lead to confidential resources can be easily sent, stored (bookmarks), monitored (proxies, security devices) and sometimes, guessed. What are the countermeasures?Completely disallow access to sensitive file typesValidate ALL incoming requestsAuthorize explicitly (web.xml, ASP.Net page lifecycle, etc.)Don’t expose physical documents with permanent or guessable URLs41Antonio Fontes / Confoo Conference, Montreal / 2010
- 42. Attacking the infrastructureAttacking the applicationAttacking the usersOther attacks42Antonio Fontes / Confoo Conference, Montreal / 2010
- 43. Attacking the usersredirecting users elsewhere…43Antonio Fontes / Confoo Conference, Montreal / 2010
- 44. what if?44Antonio Fontes / Confoo Conference, Montreal / 2010
- 45. Risk A8: Non-validated redirects and forwards45Antonio Fontes / Confoo Conference, Montreal / 2010
- 46. What is the risk?An attacker may use your website reputation as a vector to redirect victims to a hostile website.What are the countermeasures?Never allow absolute URL redirection.If not possible: Use a whitelist of valid hostsShow a warning before redirecting the userIf using a “web portal”, make sure redirect pages do not include sensitive information in URLs (aka single-signon-on information)46Antonio Fontes / Confoo Conference, Montreal / 2010
- 47. Attacking the usersrunning client hostile code in the website…47Antonio Fontes / Confoo Conference, Montreal / 2010
- 48. what if?48Antonio Fontes / Confoo Conference, Montreal / 2010
- 49. what if?49Antonio Fontes / Confoo Conference, Montreal / 2010
- 50. Risk A2: Cross-site scripting50Antonio Fontes / Confoo Conference, Montreal / 2010
- 51. What is the risk?An attacker might inject client-side hostile code in the web application, which will be returned to a victim.51Antonio Fontes / Confoo Conference, Montreal / 2010
- 52. What are the countermeasures?Sanitize output. Encode to destination format.For HTML output, use HtmlEntities:<div id=“comment”>Here is my <script>attack</script></div> <div id=“comment”>Here is my <script>attack</script></div>52Antonio Fontes / Confoo Conference, Montreal / 2010
- 53. What are the countermeasures?Sanitize output, encode to destination format:For XML output, use predefined entities:<says>“here is my <script>”</says> <says><![CDATA[here is my <script>]]></says><says>my input is <script></says> <says>my input is <script></says>53Antonio Fontes / Confoo Conference, Montreal / 2010
- 54. Attacking the usersreplaying predictable requests…54Antonio Fontes / Confoo Conference, Montreal / 2010
- 55. what if?55Antonio Fontes / Confoo Conference, Montreal / 2010
- 56. what if?56Antonio Fontes / Confoo Conference, Montreal / 2010
- 57. Risk A5: Cross-site Request Forgery57Antonio Fontes / Confoo Conference, Montreal / 2010
- 58. What is the risk?An attacker might build her own website and trigger requests on the visitor’s browser. (yes, that’s exactly what it seems to be...)58Antonio Fontes / Confoo Conference, Montreal / 2010
- 59. What are the countermeasures?Implement unpredictable requests for all sensitive actionsUse temporary random hidden control fields:<input type=hidden name=check value=ab23b4a/>Link forms to the user session:if(!(Request.Form[“checker”]).Equals(SessionID)) // return errorUse CAPTCHAUse out-of-band verification:SMS / Voice call / Cryptographic tokens, etc.59Antonio Fontes / Confoo Conference, Montreal / 2010
- 60. Attacking the infrastructureAttacking the applicationAttacking the usersOther attacks60Antonio Fontes / Confoo Conference, Montreal / 2010
- 61. Other attacksbreaking weak cryptography…61Antonio Fontes / Confoo Conference, Montreal / 2010
- 62. what if?Encrypting with Base64$cookie = base64($sessionId);62It’s not encryption, it’s encoding!Antonio Fontes / Confoo Conference, Montreal / 2010
- 63. what if?Encrypting user passwords with AES256$password = encrypt($get_[“password”],AES256,key);63reversible encryption!Antonio Fontes / Confoo Conference, Montreal / 2010
- 64. what if?Hashing user passwords with md5$password = md5($get_[“password”]);64weak algorithm!Antonio Fontes / Confoo Conference, Montreal / 2010
- 65. what if?Hashing user passwords with SHA-256$password = sha($get_[“password”]);65Missing seed!Antonio Fontes / Confoo Conference, Montreal / 2010
- 66. what if?Building keys with Math.RandomByte[] key = Math.RandBytes(128);66Weak random number generator!Antonio Fontes / Confoo Conference, Montreal / 2010
- 67. what if?Deriving a key from human entered secret$key = md5($GET_[“secret”]);67Weak key entropy!Antonio Fontes / Confoo Conference, Montreal / 2010
- 68. what if?Using ECB mode of operation$bytes = encrypt($text, key);// returns: {0xAF00CADACCE34A4D}$bytes2 = encrypt($text, key);// returns: {0xAF00CADACCE34A4D}68Weak mode of operation!Antonio Fontes / Confoo Conference, Montreal / 2010
- 69. what if?Using CBC mode of operation$bytes = encrypt($text, key);// returns: {0xAF00CADACCE34A4D}$bytes2 = encrypt($text, key);// returns: {0xAF00CADACCE34A4D}69Non-random initialization vectors!Antonio Fontes / Confoo Conference, Montreal / 2010
- 70. what if?Decrypting with internal secretString clearText = CryptUtils.Decrypt($bytes, Parameters.SecretKey);70Hard-coded secret!Antonio Fontes / Confoo Conference, Montreal / 2010
- 71. what if?blablabla71Another problem.Antonio Fontes / Confoo Conference, Montreal / 2010
- 72. Risk A9: Insecure cryptographic storage72Antonio Fontes / Confoo Conference, Montreal / 2010
- 73. What is the risk?An attacker might not need as much time as you expected to decrypt your data.If one of these words sounds foggy to you, there is a risk:Asymmetric/symmetric encryption, offline encryption, online encryption, CBC, key entropy, initialization vector, ECB, message authentication code, PBKDF2 (RFC2898), constant time operation, Rijndael, AES, 3DES, DSA, RSA, ECC, SHA, keyring, DPAPI, … 73Antonio Fontes / Confoo Conference, Montreal / 2010
- 74. What are the countermeasures?Don’t do cryptography by yourselfUse business level APIs:Use open-source reference implementations (OpenSSL, Truecrypt, etc.)Use expert-community-driven libraries (OWASP ESAPI, …)Take classes…74Antonio Fontes / Confoo Conference, Montreal / 2010
- 75. Other attacksobserving the environment…75Antonio Fontes / Confoo Conference, Montreal / 2010
- 76. 76?© daquellamanera @flickrAntonio Fontes / Confoo Conference, Montreal / 2010
- 77. Risk A10: Insufficient transport layer protection77Antonio Fontes / Confoo Conference, Montreal / 2010
- 78. What is the risk?Traffic eavesdropping, due to insufficient transport layer protection.What are the countermeasures?Require an SSL encrypted link.Use appropriate certificates (signed and valid).Prevent cookies from leaving the encrypted link (“secure” flag enabled).78Antonio Fontes / Confoo Conference, Montreal / 2010
- 79. 79Antonio Fontes / Confoo Conference, Montreal / 2010WHAT IS THE RISK LEVEL ?LOWHIGH
- 80. Part 2: Assessing the risks induced by these 10 attacks80Antonio Fontes / Confoo Conference, Montreal / 2010
- 81. Hopefully, someone did it…81Antonio Fontes / Confoo Conference, Montreal / 2010
- 82. rating the risksAntonio Fontes / Confoo Conference, Montreal / 201082XSS (example)= 2,6x?
- 83. 83Antonio Fontes / Confoo Conference, Montreal / 2010OWASP Top 10 – 2010 RC1The top ten web application security risks
- 85. prevalence
- 86. detectability
- 87. impact (CIA, AAA)Testers search patterns
- 88. typical cases
- 89. mythsDevelopers mitigation steps (agnostic)
- 90. best practicesAdvanced material detailed attack scenarios
- 91. mitigation techniques (per technology)
- 92. further referencesTeachers / Students example scenariosAntonio Fontes / Confoo Conference, Montreal / 2010
- 93. 85Migration info removed entries
- 94. new entries
- 95. gap analysisAntonio Fontes / Confoo Conference, Montreal / 2010
- 96. Part 3: Integrating the Top 10 into an existing software development / acquisition lifecycle86Antonio Fontes / Confoo Conference, Montreal / 2010
- 97. Antonio Fontes / ConfooConference, Montreal / 2010The Top 10 in your SDLC/SALC87Secure codingMetrics analysisSecurity testingSecure designSoftware vendorPERSONEL TRAININGQUALITY ASSURANCESoftware buyerPenetration testDesign review reportsSecurity test resultsContract conditionsSLA support
- 98. ConclusionYour web application will be hacked. ; )88Antonio Fontes / Confoo Conference, Montreal / 2010
- 99. ConclusionBut if you use the Top 10…89Antonio Fontes / Confoo Conference, Montreal / 2010
- 100. ConclusionIt won’t be the cheap way…90Antonio Fontes / Confoo Conference, Montreal / 2010
- 101. ConclusionAnd it won’t be the embarrassing way…91Antonio Fontes / Confoo Conference, Montreal / 2010
- 102. ConclusionYou now know the 10 riskiest flaws in web applications.92Antonio Fontes / Confoo Conference, Montreal / 2010
- 103. ConclusionBut there’s still a lot to see…93CWE/SANS Top 25 Programming errorsWASC Threat ClassificationThreat modelingOWASP Application Security Verification Standard (ASVS)Open Software Assurance Maturity ModelAntonio Fontes / Confoo Conference, Montreal / 2010
- 104. Conclusionbefore becoming “secure”.94Antonio Fontes / Confoo Conference, Montreal / 2010
- 105. http://owasp.org/index.php/Top10(final version: end of March 2010)95Antonio Fontes / Confoo Conference, Montreal / 2010thank you :)
- 106. 96Antonio Fontes / Confoo Conference, Montreal / 2010
- 107. CopyrightYou are free:To share (copy, distribute, transmit) To remix But only if: You attribute this workYou use it for non-commercial purposesAnd you keep sharing your result the same way I did97Antonio Fontes / Confoo Conference, Montreal / 2010