Downloaded 23 times
More Related Content
![[Wroclaw #4] WebRTC & security: 101](https://cdn.slidesharecdn.com/ss_thumbnails/webrtc-161027194925-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Jon McCoy - AppSec-USA-2014 Hacking C#(.NET) Applications:Defend by Design
Jon McCoy - AppSec-USA-2014 Hacking C#(.NET) Applications:Defend by Design
- 1. AppSec USA 2014 Denver, Colorado Hacking .NET/C# Applications: Defend By Design Jon McCoy DigitalBodyGuard
- 2. What is aDefendable System What is a Strong/Weak Design How to view a Software System This Speech
- 3. Thanks To ThanksAppSec/OWASP A Critical part of the security world
- 4. Introduction Jon McCoy- DigitalBodyGuard • Software Engineer • Digital Security • Application Level Security • .NET Framework Expert • Attack and Defense
- 5. Overview Work Area: PenTesting and Active Defender Specialize: .Net Framework Systems
- 6. What is aThick Client? GrayWolf Demo Context
- 7. Share What IHave Seen Context
- 8. What is a Context Defendable API
- 9. What is a Context Defendable API
- 10. Focus of thistalk Daemon API Service
- 11. Focus of thistalk = =
- 12. Focus of thistalk = =
- 13. Focus of thistalk Daemon Business Units Service Security Network
- 14.
- 15. Cyber Attack Users Web Server DB
- 16. Client Wants itsecure
- 17. Communications POS API/DAL Crypto Honey-Pot Log Detection Crypto Web Log
- 18. Communications Web Service SOPE/REST Encrypted Auth Auth Web Service SOPE/REST Encrypted
- 19.
- 20.
- 22.
- 23. Critical Units CreditCards Production DB $1,000,000 $20,000,000 User Info DB $100,000
- 24.
- 25.
- 26. Critical Units CreditCards Production DB $1,000,000 $20,000,000 User Info DB $100,000
- 27.
- 28. Lets say youare “Secure” I ”PenTester” will hit you at • Network • Computer Login • Employees • Hardware • TechSupport • ………..
- 29.
- 30. Lets say youare “Secure” I ”The Hacker” will Attack • Users • Your Physical Infrastructure • Your Web-Face • All Digital Devices • ……….. • Except (X/Y/Z)
- 31.
- 33.
- 34. On Problem StillGood Everything is Bad
- 35. Security Review •We took full control of Domain Admin • We took full control of Network • We took full control of Database Systems • We took full control of Physical Security • We took full control of File Management • We took full control of Back Up….. • ………..
- 36. On Problem Everythingis Bad
- 37. How do weFix This
- 38. Critical Units CreditCards Production DB $2,000,000 $20,000,000 User Info DB $200,000
- 39. Layered Defenses CreditCards Production DB $2,000,000 $20,000,000 User Info DB $200,000
- 40. Layered Defenses CardsHash User Info DB Credit Cards Production DB
- 41. Layered Defenses CardsHash User Info DB Credit Cards Production DB
- 43.
- 44.
- 45. API Type: OWIN.org REST – SOPE – Socket DB Type: Node.JS – Neo4Net de Database Node Database – Sharding & Segmentation Security: OAuth (2) RSA 4096 – AES 256 – MAC(message authentication code)
- 46. Layered Defense •Detect and Protect the Perimeter • Guard and Respond • Build Choke Points • Find the Weak Blind Spots • …………
- 47. “Client Remediates theIssues” Client is stronger
- 48.
- 49. Layered Defense Attackingas Hackers
- 50.
- 51. Security Review •We took Admin in 2-4 hours(Tell Client 8 Hours) • We took full control of Network • We took full control of Database Systems • We Failed to control of Physical Security • We took full control of File Management • We Failed to control of Back Up….. • ………..
- 52. How do weFix This
- 53. Layered defense Detectionand Response
- 54.
- 56. Now Security CanStart Now we have started talking the same Language
- 57. IT => Developer = Pattern Anit-Pattern Segmentation = = Good Design Bad Design Separation
- 58. Developer => DBA Claims Facade Controllers = Authentication = View = Actions
- 59. Security => Developer Security Test Attack Vector Security Controls = Security Unit Test Security User Story Defendable Systems = =
- 60. Now Security CanStart Language = Context
- 61. Communications Get toknow the Client Web Data Processing Strong API/DAL
- 62.
- 63.
- 64.
- 65.
- 66. Strong vs Weak Software DEMO
- 67.
- 68.
- 69.
- 70.
- 71.
- 72.
- 73.
- 74. Communications Two Completely POS Different Systems Web
- 75.
- 76. Communications POS Web IT/&/Networking DB
- 77. Teams POS !=WEB != DB != IT
- 78. Mockup Project Defendthe POS
- 79. Communications Trusted Network Point Of Sales Clients & Partners
- 80. Communications Built 5Years ago Changes Twice a year Only X can Access it
- 81.
- 82.
- 83.
- 84. Communications $250k Youwill prevent X/Y/Z Attacks Best “Buzzword” Protection
- 85. • Turn Key • Reliable • Low Long Term Cost • Free Upgrades for Three Years • ……….
- 86.
- 87.
- 88.
- 89.
- 90. Communications Secure System Log System Passive Detection
- 91. Communications API/DAL Log Detection
- 92. Communications API/DAL Log Detection
- 93. Communications Honey-Pot API/DAL Log Detection
- 94. Communications Honey-Pot API/DAL Log Detection
- 95. Communications API/DAL Honey-Pot Log Detection API/DAL
- 96. Communications API/DAL Honey-Pot Log Detection Data Management & Point To Point Crypto API/DAL
- 97. Communications API/DAL Honey-Pot Log Detection Crypto Crypto API/DAL
- 98. Communications API/DAL Honey-Pot Log Detection Crypto Crypto
- 99. Communications Segmented Network POS Auth
- 100. Communications Data API POS Auth Auth
- 101. • Segmented Hardware • Segmented User Authentication(NO AD!) • Segmented Management • Segmented Data Storage/Backup • Segmented Buildings • Segmented Developers • Segmented IT/Security • Segmented Power…….
- 102. Communications POS API/DAL Crypto Honey-Pot Log Detection Crypto Web
- 103. Communications POS Web Data API
- 104. Communications Data API POS Web SQL
- 105. Communications Security UserStories ----SQL Injection---- • Detect SQL-injection • Prevent SQL-injection • Respond to SQL-injection Data API POS Web SQL
- 106. Communications POS API/DAL Crypto Honey-Pot SQL-Injection=> Log Detection Crypto Web
- 107. Communications POS API/DAL Crypto Honey-Pot Log Detection Crypto Web SQL-Injection Protection
- 108. Communications POS API/DAL Crypto Honey-Pot Log Detection Crypto Web SQL-Injection Protection SQL Protection
- 109. SQL-Injection Protection SQL-Injection Protection
- 110. SQL-Injection Security UserStories ----SQL Injection---- • Detect SQL-injection • Prevent SQL-injection • Respond to SQL-injection Security Unity Test ----SQL Injection---- • API -> SQL-injection • Processing Logic -> SQL-injection • BackEnd -> SQL-injection • Detect Injection
- 111. SQL-Injection Security UserStories Occurred ----SQL Injection Occurred---- • Evaluate SQL-injection • If Critical Respond • If non-Critical Notify/Fix Security Unity Test ----SQL Injection Detection--- • API -> Notify • Processing Logic -> Notify • BackEnd -> Notify • LockDown Each Layer
- 112. Communications POS API/DAL Crypto Honey-Pot Log Detection Crypto Web SQL-Injection
- 113. Communications POS API/DAL Crypto Honey-Pot Log Detection Crypto Web
- 114.
- 115. Communications Data API POS Web SQL
- 116. Communications SOAP POSAPI/DAL Crypto Honey-Pot Log Detection Crypto - REST Web
- 117. Communications POS API/DAL Crypto Honey-Pot Log Detection Crypto Web SQL Protection SQL SOAP - REST
- 118. Communications POS API/DAL Crypto Honey-Pot Log Detection Crypto Web
- 119. Communications Data API POS Web SQL Log
- 120. Communications Data API POS Web SOPE/REST
- 121. Communications Data API POS Web SOPE/REST
- 122. Communications POS Web SOPE/REST Why? Not encrypt?
- 123. Communications Web SOPE/REST Why? Not encrypt?
- 124. Communications Publicly Exposed Web Do Not Trust SOPE/REST
- 125. Design Pattern ExposedSystem BURN THEM!!!!
- 126. Communications I/O POS Web SOPE/REST
- 127. Communications I/O POS Web Detect and Burn SOPE/REST Detect and Burn
- 128. Communications I/O POS Web Service
- 129. Quick Tangent BetterWeb Server Layout
- 130. Communications Web Service SOPE/REST Encrypted SOPE/REST Encrypted Web Service
- 131. Communications Web Service SOPE/REST Encrypted Auth Auth Web Service SOPE/REST Encrypted
- 132.
- 133. Communications POS API/DAL Crypto Honey-Pot Log Detection Crypto Web
- 134.
- 135. Communications POS WebBridge
- 136. Communications POS WebBridge
- 137. Communications POS Web Bridge Detection is Easy Locking it down is Easy Everything is Hard Detection is Easy
- 138. If Breach Occurs POS Rotate Security Web Lock it All Down Respond Aggressively Burn it all Down Bridge Replace Server Fix Exploit
- 139. Communications POS API/DAL Crypto Honey-Pot Log Detection Crypto Web
- 140. For a SecureSegmentation - Developers Need To Design And Control • FireWalls • Network Layout • System Provisioning • System Security • ………
- 142. Communications API/DAL Honey-Pot Log Detection POS Web Port:1234 Incoming TCP/UDP From: 10.88.10.1 To: 10.88.11.255 Port:7676 Incoming TCP/UDP From: 10.88.88.1 To: 10.88.99.111
- 144.
- 145. For Developer SecurityUser Stories ----Core DataBase is Hacked----
- 146. For Security SecurityUser Stories ----Core DataBase is Hacked----
- 147. For SysAdmin SecurityUser Stories ----Core DataBase is Hacked----
- 148. For CxO SecurityUser Stories ----Core DataBase is Hacked----
- 149. For ……….. SecurityUser Stories ----Core DataBase is Hacked----
- 150. Communications POS API/DAL Crypto Honey-Pot Log Detection Crypto Web Log
- 151. Communications POS API/DAL Crypto Honey-Pot Log Detection Crypto Web Log
- 152. Security User Stories ----Core DataBase is Hacked---- • Prevent Changing the Logs • Prevent Access to Other DBs
- 153.
- 154. Systems Game Theory Anti-Fragile
- 155. Security User Stories ----Lost DataBase Bridge---- • Keep WebServer Up • Take Services Down • Sync After Bridge is Up
- 156. Communications POS API/DAL Crypto Honey-Pot Log Detection Crypto Web Log
- 157. Security User Stories ----Lost DataBase Bridge---- • Keep WebServer Up • Take Services Down • Sync After Bridge is Up
- 158.
- 159. • Security UserStories • Security Unit Test • Security Response Stories
- 160. Communications POS API/DAL Crypto Honey-Pot Log Detection Crypto Web Log
- 161. Security Response Stories ----Hacker on Core Bridge---- • Guns • Fire • Pain
- 162. Security Response Stories ----Hacker on Core Bridge---- • Activate Full Security Response • Revoke All Security Tokens • Lock Down All Choke Points
- 163.
- 165. Security User Stories ----Lost POS Ingress--- • Revoke Old POS Privileges • Standup New POS System • Standup New POS Auth System
- 166. Communications Data API POS Auth Auth Auth
- 167. Communications Data API POS Auth Auth Auth
- 169.
- 171. If Extra Time Fun Attack Demo GrayWolf Demo Context
- 172.
- 173. 173 MORE INFORMATION@: www.DigitalBodyGuard.com JonM@DigitalBodyGuard.com Jon McCoy
Editor's Notes
- #4 First off, As Security by definition happens behind closed doors, AppSec/OWAS{P gives us the chance to talk openly about this, sharing in the win and burdens of what we are going up against. To me this out of band communication is a large part of what makes OWASP a critical part of the security world.
- #6 I am here to condense my years of work in defending corporate players. I am going to take on a very specific roll of application defender, of company defender, of This is what I think Works for Me