A presentation delivered at WordCamp Miami 2016 about security best practices in web development by SiteLock Director of Products & Technology Binod Purushothaman and Lead Security Analyst Logan Kipp.

1. BEYOND THE
BASICS:
Building security into your
development projects
WORDCAMP MIAMI2 0 1 6

2. BIO
Binod Purushothaman
Director, Product & Technology @SiteLock
§ Heads the product development team.
§ Lead several technology startups in the
manufacturing and finance sectors in India and
the United States.

3. BIO
Logan Kipp
Lead Security Analyst @SiteLock
§ Provides SiteLock's Partners and Support
Services Division with information and training on
emerging technologies and threats.
§ Has seven years experience in the website
hosting and security technology field, previously
working at GoDaddy.

4. INTRODUCTION
§ Malware: Things Get Ugly
§ XSS: A WordPress Story
§ Plugins: Dance the Tango

5. MALWARE

6. MALWARE

7. MALWARE

8. MALWARE

9. MALWARE

10. MALWARE

11. MALWARE

12. MALWARE

13. MALWARE

14. MALWARE

15. MALWARE

16. MALWARE

17. MALWARE

18. MALWARE

19. MALWARE

20. MALWARE

21. ANOTHER REASON FILE
MONITORING IS IMPORTANT!

22. XSS
“Cross-site scripting (XSS) is a type
of computer security vulnerability
t y p i c a l l y f o u n d i n w e b
applications. XSS enables attackers to
inject client-side script into web pages
viewed by other users.”
-
Wikipedia

23. XSS
SiteLock Research Team picks up possible XSS
vulnerability in plugin during routine SAST scan.
§ File: settings.php
§ Argument: $curr

24. XSS
Found $curr set at line 195/196, where it’s set to
Default if $cntr is empty, or the value of $cntr if not.
Variable $cntr set at lines 91/92. If
$_GET[‘scounter’] set, inherits value. Could this be
a reflective XSS vulnerability?

25. XSS
Let’s find out. We simply need to pass a
harmless XSS string in the
$_GET[‘scounter’] variable to get a proof of
concept, like a document.cookie alert.
Something like:
?page=slider-
settings&scounter=<script>alert(document.co
okie)</script>

26. XSS
Great success.

27. BUT IF YOU USE A
WEB APPLICATION FIREWALL…
These types of attacks are blocked.

28. RECENT RESEARCH
Free WordPress Plugin -- “Tango”
§ File Management
– View & Edit
– Zip & Unzip
§ Database Management
– Easy backups

29. VULNERABILITY EXAMPLE: TANGO

30. VULNERABILITY EXAMPLE: TANGO

31. VULNERABILITY EXAMPLE: TANGO
The plugin consists of four files.

32. VULNERABILITY EXAMPLE: TANGO
Curious. Startup relies on a file
existing.

33. VULNERABILITY EXAMPLE: TANGO
What would happen if we renamed
the readme.txt then?

34. VULNERABILITY EXAMPLE: TANGO

35. VULNERABILITY EXAMPLE: TANGO

36. VULNERABILITY EXAMPLE: TANGO
$ls /

37. VULNERABILITY EXAMPLE: TANGO
What else could we do here? Anything.
§ Grab external files.
§ Dump the file structure.
§ Trash everything.
$dd if=/dev/random of=/dev/sda

38. VULNERABILITY EXAMPLE: TANGO

40. CODE STARTS SIMPLE
MY CODE

41. C O D E B E C O M E S C O M P L E X
T H E M E S
+
C O M P O N E N T S
+
F R A M E W O R K
+
P L U G I N S
+

42. ATTACKERS INCREASE THEIR
COMPLEXITY

43. MYPLUGIN

44. XSS VULNERABILITY
No
escaping
or
sani-za-on
used.

45. STATIC CODE ANALYSIS RESULTS:
TRUECODE

46. CODE ANALYSIS

47. XSS FIXED
Use
WordPress
esc_html()
to
remove
the
vulnerability

48. BUILT-IN WORDPRESS FUNCTIONS
§ Always use WP built-in functions
– esc_html()
– sanitize_text_field()
– update_option()

49. UPDATED SCAN RESULTS

50. INSECURE SDLC

51. SECURE SDLC

52. -END-