Abridged version of my mvc security presentation covering the OWASP Top 10 security vulnerabilities and how they can be mitigated against in the Microsoft Mvc framework. Covers SQL Injection, XSS, CSRF etc. There is a source code project to go with this presentation with all of the solutions implemented at https://github.com/johnstaveley/SecurityEssentials

1. Web Security
By John Staveley
Dot Net Notts 29/02/2016
https://uk.linkedin.com/in/johnstaveley/
@johnstaveley

2. Overview

Why Security?
– (case studies)

Who are the hackers?

How?
– (with solutions)

SecurityEssentials.sln

...and then on the server

Further resources

Summary

Questions

3. Who am I?

John Staveley

Mvc.net developer

Not a security expert!

4. Why Security? - Some headlines

ZdNet 2014, “Hundreds of millions of records have been
stolen this year through hacks and data breaches as a result
of poor, or flawed security.”

Davos 2015, “Every time we talked to a top 500 company
about cyber-security, they'd say to us: 'talk to my technology
guy', now the board of directors and the CEOs of the
companies pay attention. There is a new sense of urgency" –
Head of a security company

FSB 2013, 41% of small businesses are a victim of cyber
crime.

5. Why Security? - Some headlines

ZdNet 2014, “Hundreds of millions of records have been
stolen this year through hacks and data breaches as a result
of poor, or flawed security.”

Davos 2015, “Every time we talked to a top 500 company
about cyber-security, they'd say to us: 'talk to my technology
guy', now the board of directors and the CEOs of the
companies pay attention. There is a new sense of urgency" –
Head of a security company

FSB 2013, 41% of small businesses are a victim of cyber
crime.

6. Why Security? - Some example breaches

Sony – films, confidential email, payroll

Target – 110 million records lost including credit card details.
Current cost $110m

Home Depot – 56m credit card, 53m email addresses

JPMorgan – 10s of millions of customers data lost

BadUSB

ICloud celebrity pictures

Snapchat – 13Gb of data

Ebay – 145 million user records lost. $220m loss

Heartbleed

etc

7. Why Security? - and the rest...

8. Why Security?

Loss of reputation

Blacklisting

Litigation

Fines e.g. Data protection act, PCI compliance

9. What we will/won't cover

WILL:

Web application security (MVC)

WON'T:

Physical security

Network security

Trojans, Worms, Viruses

IDS, Firewalls, Honey pots

Internal threats

Advanced persistent threats

DDOS

Social Engineering

10. Presentation Approach

OWASP Top 10

Not for profit

Cover all technologies

Reviewed every 3 years

Helps you prioritise

Chapter outline

What is the hack?

Who has been affected by it?

What are the mitigations/countermeasures?

Questions

DEMO

SecurityEssentials.sln

https://github.com/johnstaveley/SecurityEssentials

11. 1 – SQL Injection

12. SQL Injection – What is it?

13. SQL Injection – What is it?
string strQry = "SELECT * FROM Users WHERE
UserName='" + txtUser.Text + "' AND Password='" +
txtPassword.Text + "'";
EXEC strQry
Put in username field: Admin' And 1=1 –
SELECT * FROM Users WHERE UserName='Admin'
And 1=1 --' AND Password=''
Put in password field: '; DROP TABLE Users --
SELECT * FROM Users WHERE UserName='' AND
Password=''; DROP TABLE Users –'
http://www.not-secure.com/products?Id=14
Havij
http://youtu.be/RBUOJpAfMn4?t=1m28s

14. 2 - Broken authentication and session management

Password security

Session Hijacking

Weak Account Management

15. Password Security

What is it? - Storage, Policy and entry

Password storage

Plain text = No security (http://plaintextoffenders.com/)

Base64 encoding = No security

Avoid Encryption – can be broken

Use hashing (password = 5f4dcc3b5aa765d61d8327deb882cf99)

Common hashes can be googled

Use a salt

Don't use RC4, MD4, MD5 and SHA-1

HashCat http://youtu.be/pTDGz7vN3NE?t=12s

Use PBKDF2, SCrypt, Bcrypt

Passwords Policy:

Enforce minimum complexity

Do not reject special characters

Validate passwords against a list of known bad passwords

Do not allow personal information in the password

Password Entry:

Don't disallow paste on a web page

16. Password Security - Examples

Case Study: Richard Pryce

Case Study: Ebay May 2014

Up to 145 million users affected

$200m loss

Poor password encryption blamed

Case Study: LinkedIn 2012

6.5 million user accounts stolen by Russian criminals

17. Password Security - Examples

https://haveibeenpwned.com/

SecurityEssentials.sln pwd: Hash, checking, strength

18. Session hijacking – The What

19. Session Hijacking – The how

Concept – Man In The Middle (MITM)

Opening up the browser

CSRF

Sensitive data exposure

DEMO: Session stealing using document.cookie=""

20. Session Hijacking - Countermeasures

Counter client code access of cookies (MITM): HttpOnly

Counter auth token 'Sniffing' – Use HttpsOnly (Anti-XSS)

<forms loginUrl="~/Account/Login" timeout="60" requireSSL="true"
slidingExpiration="false"/>

Private error logging/trace

Reducing session timeout reduces exposure

Track sessions - session invalidated during logoff?

SecurityEssentials.sln web.config with transforms

21. Weak account management – What is it?

Owning the account

Why?
– Sensitive data
– Admin privileges

Registration

Logon

Remember me

Password reset

Change account details

Logoff

Call Centre

22. Weak account management – Case Study

23. Weak account management – Case Study

News contained details Sarah Palin used Yahoo mail

Security Information

Birthday?

2 minutes on Wikipedia

Zip Code?

Wallisa only has 2 postcodes

Where did you meet your spouse?

High School

=> Password reset

24. Weak account management - Countermeasures (1)

Account enumeration - Can occur on registration, logon or
password reset forms

Success - “An account reset key has been emailed to you”

Failure - “That user account does not exist”

Success or Failure - “An account reset key has been
emailed to you”

Use Https ([RequireHttps]) to protect sensitive data

25. Weak account management - Countermeasures (2)

Brute force Logon - Do not lock out on incorrect logon –
DOS

Brute force Registration/Password reset:
– CAPTCHA and/or throttling to prevent brute force
– http://anti-captcha.com/

Verify email address by sending an email

Re-challenge user on key actions e.g. prompt for old
password when entering new password

Log and send email when any account state changes

26. Weak account management - Countermeasures (3)

Password reset

Don't send new password out – DOS

Send email with expiring token (1 hour)

Security questions: Concise, Specific, has a large range of answers, low
discoverability, constant over time

Never roll your own membership provider or session
management – use the default one in the framework

Outsource the solution e.g. Azure Active Directory or
OpenId

SecurityEssentials.sln – Account Management process,
anti-enumeration, logging, email verification, email on
change, activity log, throttling, CAPTCHA, auto-complete
off, increase logon time failure

27. 3 – Cross Site Scripting (XSS)

28. Cross site scripting (XSS) – What is it?
www.mysite.com/index?name=Guest
Hello Guest!
www.mysite.com/index?name=<b>Guest<b>
Hello Guest!
www.mysite.com/index?name=Guest<script>alert('Gotcha!')</script>
Hello Guest!
www.mysite.com/index?name=<script>window.onload = function() {var
link=document.getElementsByTagName("a");link[0].href="http://not-real-
xssattackexamples.com/";}</script>
www.mysite.com/index?name=<script>Insert evil script here</script>

29. Cross site scripting (XSS) – What is it?

Encoded data vs unencoded
e.g. &lt;b&gt;Guest&lt;b&gt; vs <b>Guest</b>

Cookie theft!
<script>alert(document.cookies)</script>

Concept: Don't trust your users!

Reflected vs Persisted XSS

Attack Vector: Social Network, Email etc

30. Cross site scripting (XSS) – Examples

Case Study: Legal Helpdesk

Enabler:

Session stealing

DOS

Sensitive data exposure

Ebay, Sep 2014 – http://www.makeuseof.com/tag/ebay-security-breach-
reconsider-membership/

About.com, Oct 2014 – 99.98% of links susceptible
– Mar 2015 – still unpatched

31. Cross site scripting (XSS) - Countermeasures

Validate untrusted data – don't trust your users!

Sources of data – html post, urls, excel/csv import, import of
database

Mvc3 - “A potentially dangerous Request.Form value was
detected from the client”, except:

What if you want to post HTML? [AllowHTML]

Countermeasure: Encode reflected data

Mvc3 encodes Html by default

Except @Html.Raw(Model.MyStuff)

For 'safe' HTML fragments use WPL (AntiXSS) Library for
HTML, CSS, URL, JavaScript, LDAP etc

Concept: Black vs White listing

SecurityEssentials: Incorporation of AntiXSS Library

Comparison with ASP.Net web forms

32. 4 – Insecure Direct Object
References

33. Insecure direct object references – what is it?
www.mysite.com/user/edit/12345
// Insecure
public ActionResult Edit(int id)
{
var user = UnitOfWork.UserRepository.Get(e => e.Id == id);
return View("Details", new UserViewModel(user);
}
// Secure
public ActionResult Edit(int id)
{
var user = UnitOfWork.UserRepository.Get(e => e.Id == id);
// Establish user has right to edit the details
if (user.Id != UserIdentity.GetUserId())
{
HandleErrorInfo error = new HandleErrorInfo(new Exception("INFO: You do not have
permission to edit these details"));
return View("Error", error);
}
return View("Edit", new UserViewModel(user);
}

34. Insecure direct object references - Examples

Immobilise Jan 2015

Citigroup, 2011
– 200,000 customer details exposed

35. Insecure direct object references - Countermeasures

Check the user has permission to see a resource
– Don't expose internal keys externally
– Map keys to user specific temporary non-guessable ones to
prevent brute force

Frequently overlooked:
– Ajax calls
– Obfuscation of paths does not work
– Passing sensitive data in urls

SecurityEssentials.sln User edit

36. 5 – Security Misconfiguration

37. Security Misconfiguration – What is it?

Unnecessary features enabled e.g. FTP, SMTP on a web
server, ports opened

Default accounts and passwords still enabled and
unchanged

Errors reveal internal implementation e.g. Trace.axd

38. Security Misconfiguration - Examples

Webcams, Nov 2014

Secure Elmah, Google inurl:elmah.axd “error log for”

39. Security Misconfiguration - Countermeasures

Encrypt connection string

Server retail mode

Ensure application is set for production – automate using
MVC config transforms

SecurityEssentials.sln web.config

40. 6 – Sensitive Data Exposure

41. Sensitive Data exposure – What is it?

Email addresses

Contents of emails

Passwords

Auth token

Credit card details

Private pictures

42. Sensitive Data exposure - Examples

Snapchat Jan 2014
– Phone number upload feature brute forced

Tunisian ISP
– Login pages for Gmail, Yahoo, and Facebook
– Pulls the username and password, and encodes it with a weak
cryptographic algorithm

Wifi Pineapple
– https://www.youtube.com/watch?v=mf5ipnmvDxE

43. Sensitive Data exposure - Countermeasures

Use and enforce SSL/TLS – [RequireSSL]

www.startssl.com

Google: “SSL/TLS accounts for less than 1% of the CPU
load, less than 10KB of memory per connection and less
than 2% of network overhead.”

Encrypt sensitive data in storage

Disclosure via URL

Browser auto-complete

Don't store it! e.g. CVV code

SecurityEssentials forcing SSL, HSTS header, prevent
server information disclosure, web.config

44. 7 – Missing Function Level Access
Control

45. Missing Function Level Access Control – What is it?

Checking the user has permission to be there

www.mysite.com/admin (Requires admin role!)

46. Missing Function Level Access Control - Countermeasures

Path level in web.config

Method level attribute e.g. [Authorize(Roles=”Admin”)]

Controller level Authorize attribute

Any point in code using identity features in .net
(System.Web.Security.Roles.IsUserInRole(userName,
roleName)

Use [NonAction]

Don't show links on UI to unauthorised functions

Don't make server side checks depend solely on
information provided by the attacker

Obfuscating links is no protection

Least Privilege

SecurityEssentials.sln unit tests

47. 8 – Cross Site Request Forgery

48. Cross-Site request forgery - What is it?

Attacker sends malicious link

<img src=”www.mysite.com/logoff” />

Requires to be logged on

49. Cross-Site request forgery - Examples

TP-Link Routers, Mar 2014

300,000 routers reprogrammed

DNS Servers changed

Exploit known for over a year

Brazil 2011, 4.5m DSL routers reprogrammed

50. Cross-Site request forgery - Countermeasures

Exploits predictable patterns, tokens add randomness to
request
@Html.AntiForgeryToken()
<input name="__RequestVerificationToken" type="hidden"
value="NVGfno5qe...... .......yYCzLBc1" />

Anti-forgery token
[ValidateAntiForgeryToken]

NB: Ajax calls

ASP.Net web forms

SecurityEssentials (controller and ajax)

51. 9 - Using components with known vulnerabilities

Case Study: WordPress, 2013

3 Year old admin module

10s of thousands of sites affected

No Brute force protection

Possible effects:

Circumvent access controls

SQL Injection, XSS, CSRF

Vulnerable to brute force login

NuGet – keep updated

Apply Windows Update

SecurityEssentials.sln NuGet

52. 10 - Unvalidated redirects and forwards – What is it?

Attacker presents victim with an (obfuscated) url e.g.
https://www.trustedsite.com/signin?ReturnUrl=http://www.nastysite.com/

User logs into safe, trusted site

Redirects to nasty site, malicious content returned

Any redirecting url is vulnerable

MVC3 vulnerable

53. Unvalidated redirects and forwards - Countermeasures

MVC4 problem solved (for login):

54. Form Overposting – What is it?
[HttpPost]
public ViewResult Edit(User user)
{ TryUpdateModel( … }
[HttpPost]
public ViewResult Edit([Bind(Include = "FirstName")] User user)
{ TryUpdateModel( … ,propertiesToUpdate, … }

55. Securing your site – Code Cheat sheet (1)

Don't trust your users!

Use an ORM

Use a strong account management process

Captcha/throttling

Defeat account enumeration

Hash passwords, encrypt data

Least Privilege

Use and enforce SSL

Encode all output

Secure direct object references

[Authorize]/[Authorize(Roles=””)] users

Conceal errors and trace

Use antiforgery tokens

56. Securing your site – Code Cheat sheet (2)

Keep components up to date

Validate redirects

Form overposting

DDOS

Headers

Train staff in social engineering

57. ...and once on the server

Apply a good SSL policy on the server:
https://www.ssllabs.com/projects/best-practices/

Poodle

Encrypt the connection string on the production server

Enable retail mode on the production server

Patch the server

Run www.asafaweb.com on your site to check security
standards are enforced

58. Further Resources

OWASP Top 10

Pluralsight courses

CEH Certification

ZdNet

Security Now Podcast

59. Summary

Hacks have been increasing in number and sophistication

OWASP Top 10

Specific solutions in Mvc

60. Any Questions?