Recommended
Recommended
More Related Content
Similar to Well-Intentioned Paper Tigers - Misconceptions and Knowledge Gaps in Security
Similar to Well-Intentioned Paper Tigers - Misconceptions and Knowledge Gaps in Security (16)
Recently uploaded
Recently uploaded (20)
Well-Intentioned Paper Tigers - Misconceptions and Knowledge Gaps in Security
- 1. 1 Well-intentioned paper tigers Misconceptions and knowledge gaps in security
- 2. 2 About me ● Backend developer ● Security enthusiast ● Food lover ● @vangool_it
- 3. 3 Why is security so hard? ● Enormous field ● Unclear definition ● Moving target ● Unexpected angles ● Human factor ● Lack of education
- 4. 4 Secrets ● Plaintext secrets ● Secrets in source control ● Public secrets
- 5. 5 Passwords
- 6. 6 Password policies ● Too complicated ● Limiting length ● Not allowing password managers ● Unlimited length ● Character restrictions
- 7. 7 Password hashing ● Algorithms ● Salts ● Rehashing
- 8. 8 Password resets ● Security questions ● Token generation ● Database lookups ● Token comparisons ● Token lifetime
- 10. 10 Access controls ● Referer checking ● IP-based access controls ● Secret URLs ● Insecure direct object references
- 11. 11 User Impersonation ● Visible passwords ● Forged tokens ● Login as user
- 13. 13 Leaking information ● Error messages ● Publicly accessible log files ● Software versions ● Path/file traversal ● Source control directories
- 14. 14 File uploads ● Extension checking ● Metadata checking ● File validity checking ● Validation in general
- 15. 15 Limiting access ● Running everything as the same user ● Not having a separate web server user ● The docker group ● Mounting the docker socket in containers
- 16. 16 Cryptography
- 17. 17 Weak implementations ● Custom cryptography ● Weak algorithms ● Easily broken keys or IVs ● Key reuse ● Lack of signing
- 18. 18 Leaking information ● Leaking cryptographic keys ● Meaningful error messages (padding oracles!) ● Timing attacks ● ...
Editor's Notes
- Examples of unexpected angles: - SPECTRE/Meltdown - Heartbleed - Cryptographic side channel attacks
- Secrets in environment variables / dev secrets in .env file (or plaintext in config, nobody cares) Examples of public secrets: accessible config files, accessible SSH keys, leaks
- Everybody’s favorite kind of secret!
- NIST recommendations: minimum of 8 characters, maximum of at least 64, allow all characters, no other requirements on complexity Library recommendation: zxcvbn
- Secure algos: SHA-512, bcrypt, PBKDF2 Hashing security does not mean secure for passwords Rehashing: hash the old hashes Salts: can be sequential, need to be unpredictable – leaking one salt can leak other sequential salts, so just do random salts
- Paypal does security questions Token generation: CSPRNG – UUID is meant to be unique, not random Timing attacks on naive string comparisons Short lifetime on tokens
- Who am I vs What am I allowed to do
- Better: voters, Symfony firewall Check access on every request DO NOT TRUST USER INPUT IP: X-Forwarded-For Referer is also just a header
- Better: stay authenticated as original user, but make impersonation part of authorization Example: document authoring – permission check uses impersonated user, ownership is still original user
- All of these can give valuable information It’s not security through obscurity to hide potentially sensitive details
- Let’s write arbitrary user input to disk! In the web root! Yay! Drop validation altogether, prevent code execution in uploads directory entirely Better yet, separate server/container with files and only static content serving
- User sharing on shared hosting is problematic Regular users need access and possibilities web servers do not Docker group and docker socket are root-equivalent
- Easy to do, hard to do right
- NEVER ROLL YOUR OWN – it’s hard as balls, and easy to mess up Weak algorithms: like RC4 (WEP) Easily broken keys or IVs: 0 is a common IV Keys are not unlimited use Signing: integrity vs protection
- Padding oracles allow arbitrary decrypts/encrypts without knowing the key at any point Other attacks take many shapes – minimal information leakage can compromise entire systems
- What it is: relying on obscurity What it is not: hiding information to enhance security