Here are the key things to report: - Vulnerability type - Location (file, line number) - Short description - Impact - Recommendation Provide enough context for developers to understand and fix. Prioritize vulnerabilities by severity and risk. 29 Softwar S cur  REPORTING SQL Injection: Location: \source\ACMEPortal\updateinfo.aspx.cs: Description: The code below is build dynamic sql statement using • Weakness Metadata unvalidated data (i.e. name) which can lead to SQL Injection - High severity - Data exposure and system access - Recommend using parameterized

1. SECURE CODE REVIEW:
MAGIC OR ART?
A Simplified Approach to Secure Code Review
Sherif Koussa - AppSec USA
Softwar S cur

2. 2 Softwar S cur

3. ABOUT ME
Today
2011
2009
2008
3 2006 Softwar S cur

4. ABOUT ME
Today
2011
2009
2008
3 2006 Softwar S cur

5. ABOUT ME
Today
2011
2009
2008
3 2006 Softwar S cur

6. ABOUT ME
Today
2011
2009
2008
3 2006 Softwar S cur

7. ABOUT ME
Today
2011
2009
2008
3 2006 Softwar S cur

8. TAKE AWAYS
4 Softwar S cur

9. TAKE AWAYS
• Components of an effective secure code review process
4 Softwar S cur

10. TAKE AWAYS
• Components of an effective secure code review process
• Simplified secure code review process
4 Softwar S cur

11. TAKE AWAYS
• Components of an effective secure code review process
• Simplified secure code review process
• How to kickoff your internal security code review process
4 Softwar S cur

12. WHAT DOES CODE REVIEW
DO BEST?
5 Softwar S cur

13. WHAT DOES CODE REVIEW
DO BEST?
• Systematic approach to uncover security flaws
5 Softwar S cur

14. WHAT DOES CODE REVIEW
DO BEST?
• Systematic approach to uncover security flaws
• Close to 100% code coverage
5 Softwar S cur

15. WHAT DOES CODE REVIEW
DO BEST?
• Systematic approach to uncover security flaws
• Close to 100% code coverage
• Better at finding design flaws
5 Softwar S cur

16. WHAT DOES CODE REVIEW
DO BEST?
• Systematic approach to uncover security flaws
• Close to 100% code coverage
• Better at finding design flaws
• Find all instances of a certain vulnerability
5 Softwar S cur

17. WHAT DOES CODE REVIEW
DO BEST?
• Systematic approach to uncover security flaws
• Close to 100% code coverage
• Better at finding design flaws
• Find all instances of a certain vulnerability
• The only way to find certain types of vulnerabilities
5 Softwar S cur

18. 6 Softwar S cur

19. 6 Softwar S cur

20. Usain Bolt -
Olympics 2012
6 Softwar S cur

21. How I think I
Look at the Gym
Usain Bolt -
Olympics 2012
6 Softwar S cur

22. How I think I
Look at the Gym
Usain Bolt -
Olympics 2012
How I
Actually Look
6 Softwar S cur

23. How I think I
Look at the Gym
Usain Bolt -
Olympics 2012
How I
Actually Look
6 Softwar S cur

24. 7 Softwar S cur

25. 7 Softwar S cur

26. HOW
DEVELOPERS
THINK OF
THEIR
APPLICATIONS
7 Softwar S cur

27. HOW
DEVELOPERS
THINK OF
THEIR
APPLICATIONS
7 Softwar S cur

28. HOW
DEVELOPERS
THINK OF
THEIR
APPLICATIONS
Until S**t
Hits The Fan
7 Softwar S cur

29. HOW
DEVELOPERS
THINK OF
THEIR
APPLICATIONS
Until S**t
Hits The Fan
7 Softwar S cur

30. WHAT ARE WE LOOKING
FOR?
8 Softwar S cur

31. WHAT ARE WE LOOKING
FOR?
• Software Weaknesses
8 Softwar S cur

32. WHAT ARE WE LOOKING
FOR?
• Software Weaknesses
• Application Logic Issues
8 Softwar S cur

33. WHAT ARE WE LOOKING
FOR?
• Software Weaknesses
• Application Logic Issues
• DeadDebug Code
8 Softwar S cur

34. WHAT ARE WE LOOKING
FOR?
• Software Weaknesses
• Application Logic Issues
• DeadDebug Code
• Misconfiguration Issues
8 Softwar S cur

35. WHAT CONSTITUTES A
SUCCESSFUL SECURE CODE
REVIEW
9 Softwar S cur

36. WHAT CONSTITUTES A
SUCCESSFUL SECURE CODE
REVIEW
Security Code Review Mindset
9 Softwar S cur

37. WHAT CONSTITUTES A
SUCCESSFUL SECURE CODE
REVIEW
Security Code Review Mindset
+
9 Softwar S cur

38. WHAT CONSTITUTES A
SUCCESSFUL SECURE CODE
REVIEW
Security Code Review Mindset
+
Security Code Review Process
9 Softwar S cur

39. 10 Softwar S cur

40. 10 Softwar S cur

41. SECURITY CODE REVIEW
MINDSET
10 Softwar S cur

42. SECURITY CODE REVIEW
MINDSET
• Where is the data coming from?
10 Softwar S cur

43. SECURITY CODE REVIEW
MINDSET
• Where is the data coming from?
• Original Intent -> Malicious Intent?
10 Softwar S cur

44. SECURITY CODE REVIEW
MINDSET
• Where is the data coming from?
• Original Intent -> Malicious Intent?
• Any mitigating controls?
10 Softwar S cur

45. IMPORTANT ASPECTS IN ANY
PROCESS
11 Softwar S cur

46. IMPORTANT ASPECTS IN ANY
PROCESS
• Reconnaissance: Understand the app
11 Softwar S cur

47. IMPORTANT ASPECTS IN ANY
PROCESS
• Reconnaissance: Understand the app
• Threat Modeling: Enumerate inputs, threats and attack surface
11 Softwar S cur

48. IMPORTANT ASPECTS IN ANY
PROCESS
• Reconnaissance: Understand the app
• Threat Modeling: Enumerate inputs, threats and attack surface
• Automation: Low hanging fruits
11 Softwar S cur

49. IMPORTANT ASPECTS IN ANY
PROCESS
• Reconnaissance: Understand the app
• Threat Modeling: Enumerate inputs, threats and attack surface
• Automation: Low hanging fruits
• Manual Review: High-risk modules
11 Softwar S cur

50. IMPORTANT ASPECTS IN ANY
PROCESS
• Reconnaissance: Understand the app
• Threat Modeling: Enumerate inputs, threats and attack surface
• Automation: Low hanging fruits
• Manual Review: High-risk modules
• Confirmation and PoC: Weed out false positive
and confirm high-risk vulns.
11 Softwar S cur

51. IMPORTANT ASPECTS IN ANY
PROCESS
• Reconnaissance: Understand the app
• Threat Modeling: Enumerate inputs, threats and attack surface
• Automation: Low hanging fruits
• Manual Review: High-risk modules
• Confirmation and PoC: Weed out false positive
and confirm high-risk vulns.
• Reporting: Communication back to the development team.
11 Softwar S cur

52. FULL APPLICATION SECURITY
CODE REVIEW PROCESS
Reconnaissance!
Reporting! Threat Modelling!
Security
Skills! Checklist!
Tools!
Confirmation & PoC! Automation!
Manual Review!
12 Softwar S cur

53. SIMPLIFIED APPLICATION
SECURITY CODE REVIEW
PROCESS
Trust*Boundary*
Iden=fica=on* Automation
OWASP* Checklists*
Top*10*
Tools*
Manual
Reporting
Review
13 Softwar S cur

54. SIMPLIFIED APPLICATION
SECURITY CODE REVIEW
PROCESS
Trust*Boundary*
Iden=fica=on* Automation
OWASP*
OWASP TOP Top*10*
Checklists*
10 Driven
Tools*
Manual
Reporting
Review
13 Softwar S cur

55. SIMPLIFIED APPLICATION
SECURITY CODE REVIEW
PROCESS
Trust*Boundary*
Automation OWASP Cheat
Iden=fica=on*
Sheets Series
OWASP*
OWASP TOP Top*10*
Checklists*
10 Driven
Tools*
Manual
Reporting
Review
13 Softwar S cur

56. DEFINE TRUST
BOUNDARY Trust*Boundary*
Iden=fica=on* Automation
OWASP* Checklists*
Top*10*
Tools*
Manual
Reporting
Review
14 Softwar S cur

57. TRUST BOUNDARY
• Trust Boundary is the virtual line where the trust level changes
• Privileges Change
• Untrusted Data Received
• Untrusted Data Sent
• Application’s Internal State Changes
Writing Secure Code, Second Edition Michael Howard and David LeBlanc
15 Softwar S cur

58. TRUST BOUNDARY -
EXAMPLE
Browser Front Controller DB
Data Access Layer
Business Objects
Internet
LAN
SOAP Client Web Services LDAP
Admin Front File
AD Server System
Controller
LAN
Admin Client
16 Softwar S cur

59. TRUST BOUNDARY -
EXAMPLE
Browser Front Controller DB
Data Access Layer
Business Objects
Internet
LAN
SOAP Client Web Services LDAP
Admin Front File
AD Server System
Controller
LAN
Admin Client
16 Softwar S cur

60. TRUST BOUNDARY -
EXAMPLE
Browser Front Controller DB
Data Access Layer
Business Objects
Internet
LAN
SOAP Client Web Services LDAP
Admin Front File
AD Server System
Controller
LAN
Admin Client
16 Softwar S cur

61. TRUST BOUNDARY -
EXAMPLE
Browser Front Controller DB
Data Access Layer
Business Objects
Internet
LAN
SOAP Client Web Services LDAP
Admin Front File
AD Server System
Controller
LAN
Admin Client
16 Softwar S cur

62. TRUST BOUNDARY -
EXAMPLE
Browser Front Controller DB
Data Access Layer
Business Objects
Internet
LAN
SOAP Client Web Services LDAP
Admin Front File
AD Server System
Controller
LAN
Admin Client
16 Softwar S cur

63. TRUST BOUNDARY -
EXAMPLE
Browser Front Controller DB
Data Access Layer
Business Objects
Internet
LAN
SOAP Client Web Services LDAP
Admin Front File
AD Server System
Controller
LAN
Admin Client
16 Softwar S cur

64. TRUST BOUNDARY -
EXAMPLE
Browser Front Controller DB
Data Access Layer
Business Objects
Internet
LAN
SOAP Client Web Services LDAP
Admin Front File
AD Server System
Controller
LAN
Admin Client
16 Softwar S cur

65. TRUST BOUNDARY -
EXAMPLE
Browser Front Controller DB
Data Access Layer
Business Objects
Internet
LAN
SOAP Client Web Services LDAP
Admin Front File
AD Server System
Controller
LAN
Admin Client
16 Softwar S cur

66. TRUST BOUNDARY -
EXAMPLE
Browser Front Controller DB
Data Access Layer
Business Objects
Internet
LAN
SOAP Client Web Services LDAP
Admin Front File
AD Server System
Controller
LAN
Admin Client
16 Softwar S cur

67. TRUST BOUNDARY -
EXAMPLE
Browser Front Controller DB
Data Access Layer
Business Objects
Internet
LAN
SOAP Client Web Services LDAP
Admin Front File
AD Server System
Controller
LAN
Admin Client
16 Softwar S cur

68. WAYS TO MARK TRUST
BOUNDARY
• Physical Source Code Separation.
• Naming Scheme
• Trust Boundary Safe: tbsProcessNameChange.java
• Trust Boundary UnSafe: tbuEditProfile.jsp
17 Softwar S cur

69. AUTOMATION Trust*Boundary*
Iden=fica=on* Automation
OWASP* Checklists*
Top*10*
Tools*
Manual
Reporting
Review
18

70. AUTOMATION
• Super Greps (keyword Search)
• Automated Unit-Tests
• Static Code Analysis Tools
19 Softwar S cur

71. AUTOMATION
STATIC CODE ANALYSIS TOOLS
• Security Code Review <> Running a Tool
Pros Cons
Scales Well False Positives
Low Hanging Fruit Application Logic Issues
Can be Taught New Tricks Collections
Frameworks
20 Softwar S cur

72. OPEN-SOURCE STATIC CODE
ANALYSIS TOOLS
Java
.NET
C++
21 Softwar S cur

73. OPEN-SOURCE STATIC CODE
ANALYSIS TOOLS
Java
.NET
C++
21 Softwar S cur

74. AUTOMATION
22 Softwar S cur

75. AUTOMATION
• SQL Injection
• Cross-Site Scripting
• Parameter Tampering
• Encryption Usage Flaws
• Security Misconfiguration
• External Code Reference
• Log Forging
22 Softwar S cur

76. AUTOMATION
• SQL Injection • Insecure Random Number
Generation
• Cross-Site Scripting
• Command Injection
• Parameter Tampering
• XML Injection
• Encryption Usage Flaws
• XPATH Injection
• Security Misconfiguration
• External Code Reference • LDAP Injection
• Log Forging • BufferOverflows
22 Softwar S cur

77. 23
CUSTOMIZE YOUR TOOLS!cur
Softwar S

78. MANUAL
REVIEW Trust*Boundary*
Iden=fica=on* Automation
OWASP* Checklists*
Top*10*
Tools*
Manual
Reporting
Review
24 Softwar S cur

79. WHAT NEEDS TO BE
MANUALLY REVIEWED?
• Authentication & Authorization Controls
• Encryption Modules
• File Upload and Download Operations
• Validation ControlsInput Filters
• Security-Sensitive Application Logic
25 Softwar S cur

80. AUTHENTICATION &
AUTHORIZATION FLAWS
26 Softwar S cur

81. AUTHENTICATION &
AUTHORIZATION FLAWS
26 Softwar S cur

82. AUTHENTICATION &
AUTHORIZATION FLAWS
Web Methods Do Not Follow Regular ASP.NET
Page Life Cycle
26 Softwar S cur

83. ENCRYPTION FLAWS
27 Softwar S cur

84. ENCRYPTION FLAWS
27 Softwar S cur

85. ENCRYPTION FLAWS
There is a possibility of
returning empty hashes
on error
27 Softwar S cur

86. FILE UPLOADDOWNLOAD
FLAWS
28 Softwar S cur

87. FILE UPLOADDOWNLOAD
FLAWS
28 Softwar S cur

88. FILE UPLOADDOWNLOAD
FLAWS
28 Softwar S cur

89. FILE UPLOADDOWNLOAD
FLAWS
An attacker can bypass
validation control
28 Softwar S cur

90. REPORTING Trust*Boundary*
Iden=fica=on* Automation
OWASP* Checklists*
Top*10*
Tools*
Manual
Reporting
Review
29 Softwar S cur

91. REPORTING
SQL Injection:
Location: sourceACMEPortalupdateinfo.aspx.cs:
Description: The code below is build dynamic sql statement using
• Weakness Metadata unvalidated data (i.e. name) which can lead to SQL Injection
51 SqlDataAdapter myCommand = new SqlDataAdapter(
• Thorough Description
52 "SELECT au_lname, au_fname FROM author WHERE
au_id = '" +
53 SSN.Text + "'", myConnection);
• Recommendation Priority: High
Recommendation: Use paramaterized SQL instead of dynamic
• Assign Appropriate Priority concatenation, refer to http://msdn.microsoft.com/en-us/library/
ff648339.aspx for details.
Owner: John Smith
30 Softwar S cur

92. SIMPLIFIED APPLICATION
SECURITY CODE REVIEW
PROCESS
Trust*Boundary*
Iden=fica=on* Automation
OWASP* Checklists*
Top*10*
Tools*
Manual
Reporting
Review
31 Softwar S cur

93. QUESTIONS?
sherif.koussa@owasp.com
sherif@softwaresecured.com
Softwar S cur
32