Dip Your Toes in the Sea of Security (PHP Berkshire Nov 2015)

Dip Your Toes
in the Sea of Security
James Titcumb
PHP Berkshire Meetup - November 2015

James Titcumb
www.jamestitcumb.com
www.roave.com
www.phphants.co.uk
www.phpsouthcoast.co.uk
@asgrim
Who is this guy?

Some simple code...
<?php
$a = (int)filter_var($_GET['a'], FILTER_SANITIZE_NUMBER_INT);
$b = (int)filter_var($_GET['b'], FILTER_SANITIZE_NUMBER_INT);
$result = $a + $b;
printf('The answer is %d', $result);

The Golden Rules
(my made up golden rules)

OWASP
& the OWASP Top 10
https://www.owasp.org/

Application Security
(mainly PHP applications)

Always remember…
Filter Input
Escape Output

© 2003 Disney/Pixar. All Rights Reserved.
SQL Injection (#1)

SQL Injection (#1)
http://xkcd.com/327/

SQL Injection (#1)
1. Use PDO / mysqli
2. Use prepared / parameterized statements

SQL Injection (#1)
<?php
// user_id=1; DROP TABLE users; --
$user_id = $_GET['user_id'];
$sql = "
SELECT * FROM users
WHERE user_id = {$user_id}";
$db->execute($sql);
✘

SQL Injection (#1)
<?php
$user_id = $_GET['user_id'];
$sql = "
SELECT * FROM users
WHERE user_id = :userid";
$stmt = $db->prepare($sql);
$stmt->bind('userid', $user_id);
$stmt->execute();
✓

exec($_GET)
https://github.com/search?q=exec%28%24_GET&ref=cmdform&type=Code

eval()
https://github.com/search?q=eval%28%24_GET&type=Code&ref=searchresults

Cross-Site Scripting / XSS (#3)

Cross-Site Scripting / XSS (#3)
● Escape output
<?php
$unfilteredInput = '<script type="text/javascript">...</script>';
// Unescaped - JS will run :'(
echo $unfilteredInput;
// Escaped - JS will not run :)
echo htmlspecialchars($string, ENT_QUOTES, 'UTF-8');

Cross-Site Request
Forgery / CSRF (#8)
http://www.factzoo.com/invertebrates/cuttlefish-chameleon-of-the-sea.html

<?php
if (!$isPost) {
$csrfToken = base64_encode(random_bytes(32)));
$_SESSION['csrf_token'] = $csrfToken;
// ... output the form ...
echo '<input type="hidden" name="csrf_token" value="'.$csrfToken.'" />';
} else if ($isPost) {
if (hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
die("Token invalid...");
}
// ... handle the form ...
}
Cross-Site Request Forgery / CSRF (#8)

Errors, Exceptions &
Logging (#6)

Errors, Exceptions & Logging (#6)

curl + https
<?php
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
✘

curl + https
<?php
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_CAINFO, "/path/to/certificate");
✓

We are not all
security experts!

We are not all
security experts!
… but we CAN write secure code

Be the threat
Think Differently

What do you want?
Think Differently

How do you get it?
Think Differently

Threat Modelling
D.R.E.A.D.
© Buena Vista Pictures

Threat Modelling
Damage
R
E
A
D

Threat Modelling
Damage
Reproducibility
E
A
D

Threat Modelling
Damage
Reproducibility
Exploitability
A
D

Threat Modelling
Damage
Reproducibility
Exploitability
Affected users
D

Threat Modelling
Damage
Reproducibility
Exploitability
Affected users
Discoverability

Authentication
& Authorization

Authentication
Verifying Identity

Case Study: Custom Authentication
We thought about doing this…

Case Study: Custom Authentication
We thought about doing this…
✘

Password Hashing
password_hash()

Authorization
Verifying Access

CRYPTOGRAPHY
IS
HARD
NEVER EVER “ROLL YOUR OWN”

CRYPTOGRAPHY
IS
HARD
NEVER EVER “ROLL YOUR OWN”
EVER!!!

I’ve got some
great ideas for
encryption...
Image: The Guardian (http://goo.gl/pUkyvO)

How to encrypt then?
libsodium PECL package

iptables
#!/bin/bash
IPT="/sbin/iptables"
$IPT --flush
$IPT --delete-chain
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP
# Loopback
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
# Inbound traffic
$IPT -A INPUT -p tcp --dport ssh -j ACCEPT
$IPT -A INPUT -p tcp --dport 80 -j ACCEPT
$IPT -A INPUT -p tcp --dport 443 -j ACCEPT
# Outbound traffic
$IPT -A OUTPUT -p tcp --dport 80 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 443 -j ACCEPT
$IPT -A OUTPUT -p udp --dport 53 -m state --state NEW -j ACCEPT

ufw
sudo ufw enable
sudo ufw allow 22
sudo ufw allow 80

Case Study: Be Minimal
Internets
Postfix
Squid Proxy
(badly configured)
hacker
spam

Resources
● http://securingphp.com/
● https://www.owasp.org/
● http://blog.ircmaxell.com/
● https://github.com/paragonie/random_compat
● https://github.com/ircmaxell/password_compat

The Golden Rules
1. Keep it simple
2. Know the risks
3. Fail securely
4. Don’t reinvent the wheel
5. Never trust anything / anyone

If you follow all this, you get...

Any questions? :)
...
James Titcumb @asgrim

Dip Your Toes in the Sea of Security (PHP Berkshire Nov 2015)

More Related Content

What's hot

Viewers also liked

Similar to Dip Your Toes in the Sea of Security (PHP Berkshire Nov 2015)

More from James Titcumb

Recently uploaded

Dip Your Toes in the Sea of Security (PHP Berkshire Nov 2015)