This document discusses hackers and software security. It provides examples of past hacks such as those on Sony Pictures and Citigroup. It outlines why software security is important when handling sensitive user information. The document discusses how hackers think and different types of hackers. It recommends following security principles like defense in depth, least privilege, and keeping security simple. It provides references for further reading on application security topics.

1. Hackers:
The Internet's Immune System
Disclaimer: Use this knowledge in positive man-ner.
Help development of secure software.

2. Who's Fault??

3. Who's Fault??

4. Who's Fault??
 Security Failure of
respective nations
 Intelligence Failure
 Failure to prevent
such incidents
 Failure to implement
Security Framework
efficiently/

5. It is because of Osama and Kasab
 That we know about our security flaws
 That we learn the Hard way, but we did.
Think b4 attacking again,
We are Stronger!

6. How do vaccines work?

7. The Internet's Immune System
 It is a constant fight between application
developers and hackers.- Who Wins?
 Aim of this presentation is to share knowl-edge
about developing secure applications.
 Understanding how Hackers think.
 Security Principles

8. Why Software Security?
 Application Security is an unsaid require-ment
 Most of the applications deal with at least
one of the following
 Financial Information
 Credit Cards
 Account Numbers
 Customer's Personal Information
 Name
 Contact information

9. Information Sensitivity
 Information about Special People like
 Expecting Parents
 LGBT Community
 Rich & Affluent
 Sports Persons
Is 10 to 50 times more valuable than the
rest of people, as they are target cus-tomers
of various products.

10. Why people hack Software?
 Fun/ Pride
 Money
 Free goodies
 Processing power/coin minting
 Advertisements
 Mind Wash (Religion/Politics)
 Wars
 To bring out vulnerabilities
 Irritating processes

11. Types of hackers
 Black Hat
 Grey Hat
 White Hat

12. Hack-1
 Sony Pictures
 $171 million
 Hacked in April to June 2011
 Hacked By: LulzSec
 Cause: SQL Injection
 The hack affected 77 million accounts and
is still considered the worst gaming com-munity
data breach ever. Attackers stole
valuable information: full names, logins,
passwords, e-mails, home addresses, pur-chase
history, and credit card numbers.

13. SQL Injection

14. Hack-2
 Citigroup
 $2.7 million
 Hacked in June 2011
 Caused by: poor implementation of authoriza-tion.
Secure data accessible to unauthorized
users. (URL parameter checks missing)
 Exposed the financial data of more than
360,000 customers

15. User Profile Bug
 Consider a user story:
 “As an Admin user, I would like to see the pro-file
of any selected user in the system”

16. User Profile Bug
 UI / Service / Controller / DAO
 Select * from Users where userid =? – passed from
user's input

17. User Profile Bug
 User Story Extension
 “As a logged in user, I should be able to view
my profile”
 Developers are lazy
 Concept of re-usability
 Select * from Users where userid =? – passed from
user's profile

18. Hack-3
 AT&T
 $2 million
 The US carrier was hacked last year, but said
no account information was exposed. They
said they warned one million customers about
the security breach. Money stolen from the
hacked business accounts was used by a
group related to Al Qaeda to fund terrorist at-tacks
in Asia. According to reports, refunding
costumers cost AT&T almost $2 million.

19. Hack-4
 Reginaldo Silva was paid $33,500
 XML external entity vulnerability
https://www.facebook.com/whitehat

20. XML external entity vulnerability
 Similar to SQL Injection
 Tainted data is inserted in XML
 XML Processor processes tainted data and be-comes
hacker's slave.

21. Is this a hack??
 Kind of legal
 You can switch it off- Third Party Cookies
 Ads all around

22. Third Party Cookies
 Old Standards->RFC 2109 and RFC 2965
 specify that browsers should protect user privacy and not
allow sharing of cookies between servers by default;
 The newer standard-> RFC 6265,
 explicitly allows user agents to implement whichever third-party
cookie policy they wish

23. Third Party Cookies
Advertising companies use third-party cookies to track a
user across multiple sites. In particular, an advertising
company can track a user across all pages where it has
placed advertising images or web bugs. Knowledge of the
pages visited by a user allows the advertising company to
target advertisements to the user's presumed preferences.

24. How do Hackers Think?
 Make advantage of any available clues
 Error Messages
 Time Taken for request to respond
 Social Networking
 Input fields- XSS
 SQL Injection

25. Error Messages
User Story 1:-
 “As a user of the system, I want my account to
be safeguard against more than 3 invalid re-tries.
My account must be locked, if someone
attempts to use trial and error to guess my
password.”
User Story 2
 “All error messages must be clear and easy to
understand.”

26. Error Messages
 “Your username is Invalid”
 “Your password is Invalid”
 “You have made 'x' unsuccessful attempts to
login. After 3 unsuccessful attempts, your ac-count
would be locked out.”
 “You have entered invalid username or pass-word.
Please retry”

27. Error Messages
 Soln.
 Do not reveal any information which should not
be. Directly or Indirectly.
 Make use of CAPTCHA for repetitive requests.

28. Time taken to Respond

29. Time taken to Respond
 Soln.
 Consistent response time for valid and invalid
requests.
 Add client identifiers, and respond with a delay
of 100n nano seconds.
 Where n= number of attempts previously made
 1,100, 10,000, 1,000,000

This wouldn't cause much impact on normal users, but
would delay hacker's activities hugely.

30. Security Questions
 “What was your first school?”
 “Where did you first met your spouse?”
 “What is your birth place?”
 Disadvantage 1: All info is available on Social
Networking Sites.
 Disadvantage 2: My first school was
 Seventh day adventist Sr. Sec School
 Seventh day
 7th day
 Seven day
 seven day
 seventhday

31. Renowned Hackers
 Kevin Mitnick
 Anonymous
 lolzsec

32. Security Principles

33. Apply defense in depth
Anti Virus software
authentication and authorization security
BioMatrics
DMZ
Firewalls (hardware or software)
Hashing passwords
Intrusion protection and detection system
Logging and auditing
Vulnaribility detection
Physical Security
Timed access control
Internet Security Awareness
VPN
Sandboxing

34. Positive security model

35. Fail securely
 Throw meaningful/clear exceptions
 Failure in security mechanism should lead to
disallowing of the operation (In Most Cases)
 Enable Logging and auditing on exceptions
 Analysis of exceptions

36. Principle of Least Privilege
 Begin with least privileges
 Provide additional privileges only if required,
and after scrutiny

37. Avoid security by obscurity

38. Keep security simple
 To Implement
 To Understand
 To Extend
 To Validate

39. If you like it today
Planning to do an XTR covering
 Send Email from any account
 Log the user out by sending an email (url)
 Movie ticket Denial of Service
 Security Certification in sysinfo.
 HackMe Challange

40. References
 http://en.wikipedia.org/wiki/Web_application_security
 http://www.hotforsecurity.com/blog/top-5-corporate-losses-due-to-hacking-1820.html
 https://www.owasp.org/index.php/How_to_write_insecure_code
 ClearlyExplained.com
 http://en.wikipedia.org/wiki/Defense_in_depth_%28computing%29
 9lessons.blogspot.com
 http://www.gethow.org/