SlideShare a Scribd company logo
Vienna, October 16-17 2017
We hired hackers to hack us;
A case study about cloud-based authentication and
security in IBM Connections
Robert Farstad
@robertfarstad
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
PLATINUM	SPONSORS	
GOLD	SPONSORS	
SILVER	SPONSORS	
BRONZE	SPONSORS
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
This session…
…is mainly for you tech-people.
But very useful for everyone to see. Might be an eye-
opener.
No talk about:
•  What IBM Connections is…
•  What IBM Cnx can give you…
•  No ROI talk, what so ever!
•  How to use IBM Cnx!!
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
This session…
…is a case study where I will show you
•  an integration with Auth0.
•  how we hired hackers to hack us.
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Vienna, October 16-17 2017
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Vienna, October 16-17 2017
The customer
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
The customer -
•  Political party, won the election 2017, second time in a row.
•  Norways Prime Minister is Høyres leader.
•  60.000 members
•  Was a white-space customer.
•  Now: Connections + Docs + Sametime
•  IBM Reference Customer.
•  Security is a priority, more and more.
•  Election year = hacking attempts.
•  We hacked them first!
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
- cloud based authentication
Høyre used Auth0 for all websites.
Requirement for them to become a Connections
customer was:
•  Authentication integration with Auth0!
•  è POC – Item Consulting developed a TAI
mechanism towards Auth0.
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Vienna, October 16-17 2017
What is Auth0?
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
- cloud based authentication
You can connect any application.
•  Custom credentials: username + passwords
•  Social network logins:
•  Google, Facebook, Twitter, and any OAuth2, OAuth1 or OpenID
Connect provider.
•  Enterprise directories:
•  LDAP, Google Apps, Office 365, ADFS, AD, SAML-P, WS-
Federation, etc.
•  Passwordless systems:
•  Touch ID, one time codes on SMS, or email.
•  Supports several 2-factor solutions.
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
•  JSON Web Token
•  Secure API: (TLS v1.2, AES_128_GCM and uses
ECDHE_RSA as the key exchange mechanism. )
•  Extensible admin tool.
•  Monitoring, (#logins, where from, who fails, hack
attempts, alarms.)
•  Blocking
•  Logs
•  Synced with Høyres back-end member system via
MSSQL DB, securely!
- cloud based authentication
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
- cloud based authentication
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
- cloud based authentication
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
+ TAI
•  Item developed a WebSphere Application
•  TAI – Trust Association Interceptors.
•  èLTPA after authenticated
•  New Auth0 login page.
•  Logout pages are modified
•  Logs out of Auth0
•  Logs out of Websphere
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Devices used
Login	occurs	from:	
•  Browsers	
•  Apps	
•  Desktop	plugins.	
	
Technically,	the	login	procedures	are	
quite	different.
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Web-browsers
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Apps + Plugins
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Tivoli Directory server - TDS
◘  FREE/Bundled	LDAP	server	for	IBM	Connections	
◘  Standard	setup	between	WebSphere	and	TDS	
◘  Import	of	users	via	TDI/SDI	to	TDS.	
◘  From	MSSQL	Database	–	over	site2site	vpn.	
◘  Imports	only	the	most	relevant	fields	
Name,	email,	mobile,	position,	company,	department
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Tivoli Directory server – TDS + PTA
◘  Password	field	in	TDS	is	blank!	
◘  PTA	is	triggered.	
◘  What	is	PTA?	
◘  Pass	Through	Authentication	
◘  PTA	is	configured	to	search	in	
alternative	LDAP	source.	
◘  The	password	is	stored	in	Auth0	
◘  Our	PTA	source	is	TDI	/	SDI	
◘  TDI	calls	the	TAI	application	–	gets	
response	code	200	if	OK.	
◘  è	logged	in
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
What is TDI/SDI?
◘ Tivoli	Directory	Integrator	/	Security	Directory	Integrator	
◘ Data	manipulation	system,	limitless	possibilities.	
◘ Eclipse	based	– Javascript	coding.	
◘ Used	to	move,	consolidate,	manipulate	data.	
◘ Used	in	Connections	for	profile	data	import.	
◘ Best	tool	ever,	once	you´ve	learned	the	jift	of	the	gui	and	
debugger.
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
TDI – acting as an LDAP server.
◘ Simulates	an	LDAP	server	
◘ Gets	attempted	username	and	password	from	TDS	PTA.	
◘ Credentials	è	WebSphere	Auth0login	app.	
◘ WAS	app	è	REST	lookup	to	Auth0	API.	
◘ Gets	return	code	OK	or	NOT_OK.	
◘ TDI	receives	same	code	from	the	WAS	app.	
◘ TDS	PTA	receives	same	code	from	TDI.	
◘ TDI	runs	multiple	instances	–	Can	handle	large	load.
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
TDI – acting as an LDAP server.
Simple	code	–	extremely	powerful!
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
TDI – acting as an LDAP server.
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Did	they	get	in?	
We	hired	hackers
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
What	they	tested	
Login	
attempts	
SSL	+		
headers	
Apps	
Stolen	
laptop	
Me!	Sensitive	
information
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
	SSL	tests	
www.ssllabs.com	 Grade	was	bad	 After	hardening	
SSLChipersSuite,	honorChipersOrder	and	SSLV2	
+V3	disabling.	TLS	only
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
	SSL	tests	–	http	config	for	Grade	A	
SSLEnable	
SSLProtocolEnable	TLS	
SSLProtocolDisable	SSLv2	SSLv3	
#	Disable	SSLCompression	->	CRIME	ATTACK	
SSLCompression	off	
#Prefer	ECDHE-RSA	ciphers	
SSLCipherSpec	ALL	NONE	
SSLCipherSpec	TLSv12	TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256	
SSLCipherSpec	TLSv12	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256	
SSLCipherSpec	TLSv12	TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384	
SSLCipherSpec	TLSv12	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384	
SSLCipherSpec	ALL	TLS_RSA_WITH_AES_128_GCM_SHA256	
SSLCipherSpec	ALL	TLS_RSA_WITH_AES_256_GCM_SHA384	
SSLCipherSpec	ALL	TLS_RSA_WITH_AES_128_CBC_SHA256	
SSLCipherSpec	ALL	TLS_RSA_WITH_AES_256_CBC_SHA256	
#	Enabling	this	3	ciphers	mean	A-	rating	on	ssllabs	
SSLCipherSpec	ALL	TLS_RSA_WITH_AES_128_CBC_SHA	
SSLCipherSpec	ALL	TLS_RSA_WITH_AES_256_CBC_SHA	
SSLCipherSpec	ALL	SSL_RSA_WITH_3DES_EDE_CBC_SHA
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
	Headers	
securityheaders.io	 Grade	was	bad	 After	hardening	
HTTP	config	to	achieve	Grade	A:	
Header	always	set	Strict-Transport-Security	"max-age=31536000;	includeSubDomains;	preload”	
Header	set	Referrer-Policy	"same-origin”	
Header	set	X-Content-Type-Options	"nosniff”	
Header	set	X-XSS-Protection	"1;	mode=block”	
Header	set	X-Frame-Options	"DENY”	
Header	set	X-Frame-Options	SAMEORIGIN
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
The	Mobile	App	
Decompile	
• Android	app	is	decompilable	
• Broken	down	to	study	code	
Test	
• Tried	every	url	found	in	code	
Result	
• Found	no	insecurities!	
• But	MITM	attacks	were	possible!
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
MITM	-	Man-in-the-middle	attack	
An	employee	is	out	traveling	and	
connects	to	a	public	network	such	as	
a	hotel	or	airport	WIFI.		
	
But	instead,	connects	to	a	hackers	
wifi	hotspot.	
Then	clicks	on	“Continue”….	
	
He/she	will	give	the	hacker	running	a	
MITM	attack,	full	visibility	over	the	
traffic.
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
MITM	-	Man-in-the-middle	attack
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
MITM	-	Man-in-the-middle	attack	
mobile-config.xml	has	the	solution	for	
the	connections	app.	
	
Don´t	press	“Continue”!.	Tell	your	
admins	to	fix	it.
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Demo	time	
The	demo	consisted	of	showing	a	
MITM	attack	+	username/password	
“cluster	bomb”	attack	using	free	tool	
Burp	Suite.
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Accident	waiting	to	happen
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
What	did	they	find	when	they	got	in?	
Stolen	Laptop	Scenario
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Stolen	Laptop	Scenario	
•  Not	hard	to	find	password	on	PC	
•  Once	in,	passwords	to	sites	are	
normally	stored	in	browser.	
•  Saved	wifi	hotspots	gives	hackers	
GPS	coordinates	=>	can	drive	up	
alongside	your	company's	building	
and	connect.	
•  Hackers	found	sensitive	
information	open	to	all	of	the	IBM	
Connections	users.	
Don´t	expose	login	information	
available	to	everyone!
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
They	hacked	me!	
Or	at	least,	they	tried	to…
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
They	hacked	me!	
•  They	knew	who	I	was.	
•  Googled	me,	found	my	blog.	
•  In	one	of	the	screenshots,	a	
password	was	censored.
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
They	hacked	me!	
I	was	a	weak	link…	
How	hard	is	it	for	hackers	to	find	IT	
staff	at	your	company?	
	LinkedIn	search…	Google	search…	
	
Google	is	both	your	friend	and	your	
enemy.	
•  Bad	censoring!!	
•  Found	6	out	of	9	chars	by	
matching	font,	size	and	studied	
curves.
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Avoid	stress
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
•  Mask/hide	better!	
•  Hackers	are	clever	
bastards.	
•  Hackers	has	A	LOT	of	
free	time.	
•  Implement	2-factor	
authorization	
mechanism,	like	Auth0	
•  Hide	your	stuff.	
•  Once	again:	Hackers	are	
clever	bastards.	
•  Lockout	policy	–	i.e.	5	
attempts	=>	locked	out…	
Hackers	has	tools	for	that!	
•  Train	your	users!
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
Useful	links:	
Check	SSL:	https://ssllabs.com	
Check	Headers:	https://securityheaders.io	
Analyze	CSP:	https://report-uri.io/home/analyse	
What	can	your	browser	support?	http://caniuse.com/#search=referrer%20policy	
	
Auth0	multi-factor	authentication:	https://auth0.com/docs/multifactor-authentication	
	
Burp	Suite:	https://portswigger.net/burp	
	
Ethical	Hacker	Certification:	https://www.eccouncil.org/programs/certified-ethical-hacker-ceh/	
	
My	blog:	http://blog.robertfarstad.com	
Twitter:	https://www.twitter.com/robertfarstad	
Item	Consulting:	https://www.item.no
Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
PLATINUM	SPONSORS	
GOLD	SPONSORS	
SILVER	SPONSORS	
BRONZE	SPONSORS

More Related Content

What's hot

Developing Enterprise Collaboration in the Cognitive Era
Developing Enterprise Collaboration in the Cognitive EraDeveloping Enterprise Collaboration in the Cognitive Era
Developing Enterprise Collaboration in the Cognitive Era
LetsConnect
 
Project Pink Note – New Note Editor Based on IBM Docs Technology
Project Pink Note – New Note Editor Based on IBM Docs TechnologyProject Pink Note – New Note Editor Based on IBM Docs Technology
Project Pink Note – New Note Editor Based on IBM Docs Technology
LetsConnect
 
Announcing the Connections Cloud Catalog: How to Get new Apps fresh out of th...
Announcing the Connections Cloud Catalog: How to Get new Apps fresh out of th...Announcing the Connections Cloud Catalog: How to Get new Apps fresh out of th...
Announcing the Connections Cloud Catalog: How to Get new Apps fresh out of th...
LetsConnect
 
Rostelecom Social Platform (100,000+ employees)
Rostelecom Social Platform (100,000+ employees)Rostelecom Social Platform (100,000+ employees)
Rostelecom Social Platform (100,000+ employees)
LetsConnect
 
Automate IBM Connections Installations and more
Automate IBM Connections Installations and moreAutomate IBM Connections Installations and more
Automate IBM Connections Installations and more
LetsConnect
 
Customization & Extensibility in IBM Connections Pink
 Customization & Extensibility in IBM Connections Pink Customization & Extensibility in IBM Connections Pink
Customization & Extensibility in IBM Connections Pink
LetsConnect
 
Five Steps to Successful Adoption of IBM Connections in your Organisation
Five Steps to Successful Adoption of IBM Connections in your OrganisationFive Steps to Successful Adoption of IBM Connections in your Organisation
Five Steps to Successful Adoption of IBM Connections in your Organisation
LetsConnect
 
The next wave of change
The next wave of changeThe next wave of change
The next wave of change
LetsConnect
 
Top 5 Challenges of Social Business Adaptation & How to Resolve Them Effectively
Top 5 Challenges of Social Business Adaptation & How to Resolve Them EffectivelyTop 5 Challenges of Social Business Adaptation & How to Resolve Them Effectively
Top 5 Challenges of Social Business Adaptation & How to Resolve Them Effectively
LetsConnect
 
IBM Connections REST-API Waltz
IBM Connections REST-API WaltzIBM Connections REST-API Waltz
IBM Connections REST-API Waltz
Henning Schmidt
 
IBM Connections REST API Klompendans
IBM Connections REST API KlompendansIBM Connections REST API Klompendans
IBM Connections REST API Klompendans
Henning Schmidt
 
Introduction to Box Administration – See Why it Rocks!
Introduction to Box Administration – See Why it Rocks!Introduction to Box Administration – See Why it Rocks!
Introduction to Box Administration – See Why it Rocks!
LetsConnect
 
Christian Brothers Services Journey from On Premises Lotus Collaboration to C...
Christian Brothers Services Journey from On Premises Lotus Collaboration to C...Christian Brothers Services Journey from On Premises Lotus Collaboration to C...
Christian Brothers Services Journey from On Premises Lotus Collaboration to C...
LetsConnect
 
Writing your first Watson Work application, and why you’d want to
Writing your first Watson Work application, and why you’d want toWriting your first Watson Work application, and why you’d want to
Writing your first Watson Work application, and why you’d want to
LetsConnect
 
Enterprise collaboration driven by IBM Connections at Raytheon
Enterprise collaboration driven by IBM Connections at RaytheonEnterprise collaboration driven by IBM Connections at Raytheon
Enterprise collaboration driven by IBM Connections at Raytheon
LetsConnect
 
Migration from 5 to Connections 6 - been there, done that
Migration from 5 to Connections 6 - been there, done thatMigration from 5 to Connections 6 - been there, done that
Migration from 5 to Connections 6 - been there, done that
Sharon James
 
O365Engage17 - What’s New in Office 365 Security
O365Engage17 - What’s New in Office 365 SecurityO365Engage17 - What’s New in Office 365 Security
O365Engage17 - What’s New in Office 365 Security
NCCOMMS
 
Extend your development skills set using MS Graph
Extend your development skills set using MS GraphExtend your development skills set using MS Graph
Extend your development skills set using MS Graph
BIWUG
 
Session Flow advanced - Serge Luca, Isabelle van Campenhoudt
Session Flow advanced - Serge Luca, Isabelle van CampenhoudtSession Flow advanced - Serge Luca, Isabelle van Campenhoudt
Session Flow advanced - Serge Luca, Isabelle van Campenhoudt
aOS Community
 
O365Engage17 - The Latest and Greatest on Hybrid Exchange
O365Engage17 - The Latest and Greatest on Hybrid ExchangeO365Engage17 - The Latest and Greatest on Hybrid Exchange
O365Engage17 - The Latest and Greatest on Hybrid Exchange
NCCOMMS
 

What's hot (20)

Developing Enterprise Collaboration in the Cognitive Era
Developing Enterprise Collaboration in the Cognitive EraDeveloping Enterprise Collaboration in the Cognitive Era
Developing Enterprise Collaboration in the Cognitive Era
 
Project Pink Note – New Note Editor Based on IBM Docs Technology
Project Pink Note – New Note Editor Based on IBM Docs TechnologyProject Pink Note – New Note Editor Based on IBM Docs Technology
Project Pink Note – New Note Editor Based on IBM Docs Technology
 
Announcing the Connections Cloud Catalog: How to Get new Apps fresh out of th...
Announcing the Connections Cloud Catalog: How to Get new Apps fresh out of th...Announcing the Connections Cloud Catalog: How to Get new Apps fresh out of th...
Announcing the Connections Cloud Catalog: How to Get new Apps fresh out of th...
 
Rostelecom Social Platform (100,000+ employees)
Rostelecom Social Platform (100,000+ employees)Rostelecom Social Platform (100,000+ employees)
Rostelecom Social Platform (100,000+ employees)
 
Automate IBM Connections Installations and more
Automate IBM Connections Installations and moreAutomate IBM Connections Installations and more
Automate IBM Connections Installations and more
 
Customization & Extensibility in IBM Connections Pink
 Customization & Extensibility in IBM Connections Pink Customization & Extensibility in IBM Connections Pink
Customization & Extensibility in IBM Connections Pink
 
Five Steps to Successful Adoption of IBM Connections in your Organisation
Five Steps to Successful Adoption of IBM Connections in your OrganisationFive Steps to Successful Adoption of IBM Connections in your Organisation
Five Steps to Successful Adoption of IBM Connections in your Organisation
 
The next wave of change
The next wave of changeThe next wave of change
The next wave of change
 
Top 5 Challenges of Social Business Adaptation & How to Resolve Them Effectively
Top 5 Challenges of Social Business Adaptation & How to Resolve Them EffectivelyTop 5 Challenges of Social Business Adaptation & How to Resolve Them Effectively
Top 5 Challenges of Social Business Adaptation & How to Resolve Them Effectively
 
IBM Connections REST-API Waltz
IBM Connections REST-API WaltzIBM Connections REST-API Waltz
IBM Connections REST-API Waltz
 
IBM Connections REST API Klompendans
IBM Connections REST API KlompendansIBM Connections REST API Klompendans
IBM Connections REST API Klompendans
 
Introduction to Box Administration – See Why it Rocks!
Introduction to Box Administration – See Why it Rocks!Introduction to Box Administration – See Why it Rocks!
Introduction to Box Administration – See Why it Rocks!
 
Christian Brothers Services Journey from On Premises Lotus Collaboration to C...
Christian Brothers Services Journey from On Premises Lotus Collaboration to C...Christian Brothers Services Journey from On Premises Lotus Collaboration to C...
Christian Brothers Services Journey from On Premises Lotus Collaboration to C...
 
Writing your first Watson Work application, and why you’d want to
Writing your first Watson Work application, and why you’d want toWriting your first Watson Work application, and why you’d want to
Writing your first Watson Work application, and why you’d want to
 
Enterprise collaboration driven by IBM Connections at Raytheon
Enterprise collaboration driven by IBM Connections at RaytheonEnterprise collaboration driven by IBM Connections at Raytheon
Enterprise collaboration driven by IBM Connections at Raytheon
 
Migration from 5 to Connections 6 - been there, done that
Migration from 5 to Connections 6 - been there, done thatMigration from 5 to Connections 6 - been there, done that
Migration from 5 to Connections 6 - been there, done that
 
O365Engage17 - What’s New in Office 365 Security
O365Engage17 - What’s New in Office 365 SecurityO365Engage17 - What’s New in Office 365 Security
O365Engage17 - What’s New in Office 365 Security
 
Extend your development skills set using MS Graph
Extend your development skills set using MS GraphExtend your development skills set using MS Graph
Extend your development skills set using MS Graph
 
Session Flow advanced - Serge Luca, Isabelle van Campenhoudt
Session Flow advanced - Serge Luca, Isabelle van CampenhoudtSession Flow advanced - Serge Luca, Isabelle van Campenhoudt
Session Flow advanced - Serge Luca, Isabelle van Campenhoudt
 
O365Engage17 - The Latest and Greatest on Hybrid Exchange
O365Engage17 - The Latest and Greatest on Hybrid ExchangeO365Engage17 - The Latest and Greatest on Hybrid Exchange
O365Engage17 - The Latest and Greatest on Hybrid Exchange
 

Similar to Social Connections 12. We hired hackers to hack us

IBM Connections Cloud extreme customization
IBM Connections Cloud extreme customizationIBM Connections Cloud extreme customization
IBM Connections Cloud extreme customization
Daniele Vistalli
 
IBM Connections Middleware – Connecting Blue/Green and PINK
IBM Connections Middleware – Connecting Blue/Green and PINKIBM Connections Middleware – Connecting Blue/Green and PINK
IBM Connections Middleware – Connecting Blue/Green and PINK
LetsConnect
 
The Collaboration Decathlon
The Collaboration DecathlonThe Collaboration Decathlon
The Collaboration Decathlon
LetsConnect
 
The World of Team Space Tools: Watson Workspace vs. Slack, Teams, Skype, and ...
The World of Team Space Tools: Watson Workspace vs. Slack, Teams, Skype, and ...The World of Team Space Tools: Watson Workspace vs. Slack, Teams, Skype, and ...
The World of Team Space Tools: Watson Workspace vs. Slack, Teams, Skype, and ...
LetsConnect
 
Creating innovative and exceptional business value in ATLAS Company using IBM...
Creating innovative and exceptional business value in ATLAS Company using IBM...Creating innovative and exceptional business value in ATLAS Company using IBM...
Creating innovative and exceptional business value in ATLAS Company using IBM...
LetsConnect
 
“Why Connections, Spark or Box?” made simple
“Why Connections, Spark or Box?” made simple“Why Connections, Spark or Box?” made simple
“Why Connections, Spark or Box?” made simple
LetsConnect
 
App dev and partner ecosystem for pink social connections 2017
App dev and partner ecosystem for pink   social connections 2017App dev and partner ecosystem for pink   social connections 2017
App dev and partner ecosystem for pink social connections 2017
Heath McCarthy
 
Turning the IBM Collaboration Ecosystem Pink
Turning the IBM Collaboration Ecosystem PinkTurning the IBM Collaboration Ecosystem Pink
Turning the IBM Collaboration Ecosystem Pink
LetsConnect
 
Pink Apps for Everyone: Introducing LiveGrid
Pink Apps for Everyone: Introducing LiveGridPink Apps for Everyone: Introducing LiveGrid
Pink Apps for Everyone: Introducing LiveGrid
LetsConnect
 
How IBM Watson Workspace is bringing cognitive conversations to the Mears Group
How IBM Watson Workspace is bringing cognitive conversations to the Mears GroupHow IBM Watson Workspace is bringing cognitive conversations to the Mears Group
How IBM Watson Workspace is bringing cognitive conversations to the Mears Group
LetsConnect
 
IBM Connections 6 Component Pack
IBM Connections 6 Component PackIBM Connections 6 Component Pack
IBM Connections 6 Component Pack
LetsConnect
 
Social Connections take team collaboration to the next level with IBM Watson ...
Social Connections take team collaboration to the next level with IBM Watson ...Social Connections take team collaboration to the next level with IBM Watson ...
Social Connections take team collaboration to the next level with IBM Watson ...
LetsConnect
 
Top 5 Challenges of Social Business Adaptation & How to Resolve Them Effectively
Top 5 Challenges of Social Business Adaptation & How to Resolve Them EffectivelyTop 5 Challenges of Social Business Adaptation & How to Resolve Them Effectively
Top 5 Challenges of Social Business Adaptation & How to Resolve Them Effectively
panagenda
 
IBM Connections vs. Office 365 – Episode III
IBM Connections vs. Office 365 – Episode IIIIBM Connections vs. Office 365 – Episode III
IBM Connections vs. Office 365 – Episode III
LetsConnect
 
Data Science Weekend 2017. Intento. Machine to Machine Communication in the ...
Data Science Weekend 2017.  Intento. Machine to Machine Communication in the ...Data Science Weekend 2017.  Intento. Machine to Machine Communication in the ...
Data Science Weekend 2017. Intento. Machine to Machine Communication in the ...
Newprolab
 
SocCnx11 - Two wrongs don't make a right - Troubleshooting Connections
SocCnx11 - Two wrongs don't make a right - Troubleshooting ConnectionsSocCnx11 - Two wrongs don't make a right - Troubleshooting Connections
SocCnx11 - Two wrongs don't make a right - Troubleshooting Connections
panagenda
 
Two wrongs don’t make a right – Troubleshooting Connections
Two wrongs don’t make a right – Troubleshooting ConnectionsTwo wrongs don’t make a right – Troubleshooting Connections
Two wrongs don’t make a right – Troubleshooting Connections
LetsConnect
 
Soccnx11 Two wrongs don't make a right - Troubleshooting Connections
Soccnx11 Two wrongs don't make a right - Troubleshooting Connections Soccnx11 Two wrongs don't make a right - Troubleshooting Connections
Soccnx11 Two wrongs don't make a right - Troubleshooting Connections
Nico Meisenzahl
 
IBM Connections REST API Hip-Hop
IBM Connections REST API Hip-HopIBM Connections REST API Hip-Hop
IBM Connections REST API Hip-Hop
Henning Schmidt
 
Developing IBM Connections Community Apps using Domino
Developing IBM Connections Community Apps using DominoDeveloping IBM Connections Community Apps using Domino
Developing IBM Connections Community Apps using Domino
LetsConnect
 

Similar to Social Connections 12. We hired hackers to hack us (20)

IBM Connections Cloud extreme customization
IBM Connections Cloud extreme customizationIBM Connections Cloud extreme customization
IBM Connections Cloud extreme customization
 
IBM Connections Middleware – Connecting Blue/Green and PINK
IBM Connections Middleware – Connecting Blue/Green and PINKIBM Connections Middleware – Connecting Blue/Green and PINK
IBM Connections Middleware – Connecting Blue/Green and PINK
 
The Collaboration Decathlon
The Collaboration DecathlonThe Collaboration Decathlon
The Collaboration Decathlon
 
The World of Team Space Tools: Watson Workspace vs. Slack, Teams, Skype, and ...
The World of Team Space Tools: Watson Workspace vs. Slack, Teams, Skype, and ...The World of Team Space Tools: Watson Workspace vs. Slack, Teams, Skype, and ...
The World of Team Space Tools: Watson Workspace vs. Slack, Teams, Skype, and ...
 
Creating innovative and exceptional business value in ATLAS Company using IBM...
Creating innovative and exceptional business value in ATLAS Company using IBM...Creating innovative and exceptional business value in ATLAS Company using IBM...
Creating innovative and exceptional business value in ATLAS Company using IBM...
 
“Why Connections, Spark or Box?” made simple
“Why Connections, Spark or Box?” made simple“Why Connections, Spark or Box?” made simple
“Why Connections, Spark or Box?” made simple
 
App dev and partner ecosystem for pink social connections 2017
App dev and partner ecosystem for pink   social connections 2017App dev and partner ecosystem for pink   social connections 2017
App dev and partner ecosystem for pink social connections 2017
 
Turning the IBM Collaboration Ecosystem Pink
Turning the IBM Collaboration Ecosystem PinkTurning the IBM Collaboration Ecosystem Pink
Turning the IBM Collaboration Ecosystem Pink
 
Pink Apps for Everyone: Introducing LiveGrid
Pink Apps for Everyone: Introducing LiveGridPink Apps for Everyone: Introducing LiveGrid
Pink Apps for Everyone: Introducing LiveGrid
 
How IBM Watson Workspace is bringing cognitive conversations to the Mears Group
How IBM Watson Workspace is bringing cognitive conversations to the Mears GroupHow IBM Watson Workspace is bringing cognitive conversations to the Mears Group
How IBM Watson Workspace is bringing cognitive conversations to the Mears Group
 
IBM Connections 6 Component Pack
IBM Connections 6 Component PackIBM Connections 6 Component Pack
IBM Connections 6 Component Pack
 
Social Connections take team collaboration to the next level with IBM Watson ...
Social Connections take team collaboration to the next level with IBM Watson ...Social Connections take team collaboration to the next level with IBM Watson ...
Social Connections take team collaboration to the next level with IBM Watson ...
 
Top 5 Challenges of Social Business Adaptation & How to Resolve Them Effectively
Top 5 Challenges of Social Business Adaptation & How to Resolve Them EffectivelyTop 5 Challenges of Social Business Adaptation & How to Resolve Them Effectively
Top 5 Challenges of Social Business Adaptation & How to Resolve Them Effectively
 
IBM Connections vs. Office 365 – Episode III
IBM Connections vs. Office 365 – Episode IIIIBM Connections vs. Office 365 – Episode III
IBM Connections vs. Office 365 – Episode III
 
Data Science Weekend 2017. Intento. Machine to Machine Communication in the ...
Data Science Weekend 2017.  Intento. Machine to Machine Communication in the ...Data Science Weekend 2017.  Intento. Machine to Machine Communication in the ...
Data Science Weekend 2017. Intento. Machine to Machine Communication in the ...
 
SocCnx11 - Two wrongs don't make a right - Troubleshooting Connections
SocCnx11 - Two wrongs don't make a right - Troubleshooting ConnectionsSocCnx11 - Two wrongs don't make a right - Troubleshooting Connections
SocCnx11 - Two wrongs don't make a right - Troubleshooting Connections
 
Two wrongs don’t make a right – Troubleshooting Connections
Two wrongs don’t make a right – Troubleshooting ConnectionsTwo wrongs don’t make a right – Troubleshooting Connections
Two wrongs don’t make a right – Troubleshooting Connections
 
Soccnx11 Two wrongs don't make a right - Troubleshooting Connections
Soccnx11 Two wrongs don't make a right - Troubleshooting Connections Soccnx11 Two wrongs don't make a right - Troubleshooting Connections
Soccnx11 Two wrongs don't make a right - Troubleshooting Connections
 
IBM Connections REST API Hip-Hop
IBM Connections REST API Hip-HopIBM Connections REST API Hip-Hop
IBM Connections REST API Hip-Hop
 
Developing IBM Connections Community Apps using Domino
Developing IBM Connections Community Apps using DominoDeveloping IBM Connections Community Apps using Domino
Developing IBM Connections Community Apps using Domino
 

Recently uploaded

Legislation And Regulations For Import, Manufacture,.pptx
Legislation And Regulations For Import, Manufacture,.pptxLegislation And Regulations For Import, Manufacture,.pptx
Legislation And Regulations For Import, Manufacture,.pptx
Charmi13
 
Proposal: The Ark Project and The BEEP Inc
Proposal: The Ark Project and The BEEP IncProposal: The Ark Project and The BEEP Inc
Proposal: The Ark Project and The BEEP Inc
Raheem Muhammad
 
Genesis chapter 3 Isaiah Scudder.pptx
Genesis    chapter 3 Isaiah Scudder.pptxGenesis    chapter 3 Isaiah Scudder.pptx
Genesis chapter 3 Isaiah Scudder.pptx
FamilyWorshipCenterD
 
Using-Presentation-Software-to-the-Fullf.pptx
Using-Presentation-Software-to-the-Fullf.pptxUsing-Presentation-Software-to-the-Fullf.pptx
Using-Presentation-Software-to-the-Fullf.pptx
kainatfatyma9
 
怎么办理(lincoln学位证书)英国林肯大学毕业证文凭学位证书原版一模一样
怎么办理(lincoln学位证书)英国林肯大学毕业证文凭学位证书原版一模一样怎么办理(lincoln学位证书)英国林肯大学毕业证文凭学位证书原版一模一样
怎么办理(lincoln学位证书)英国林肯大学毕业证文凭学位证书原版一模一样
kekzed
 
The Intersection between Competition and Data Privacy – OECD – June 2024 OECD...
The Intersection between Competition and Data Privacy – OECD – June 2024 OECD...The Intersection between Competition and Data Privacy – OECD – June 2024 OECD...
The Intersection between Competition and Data Privacy – OECD – June 2024 OECD...
OECD Directorate for Financial and Enterprise Affairs
 
The Intersection between Competition and Data Privacy – COLANGELO – June 2024...
The Intersection between Competition and Data Privacy – COLANGELO – June 2024...The Intersection between Competition and Data Privacy – COLANGELO – June 2024...
The Intersection between Competition and Data Privacy – COLANGELO – June 2024...
OECD Directorate for Financial and Enterprise Affairs
 
Data Processing in PHP - PHPers 2024 Poznań
Data Processing in PHP - PHPers 2024 PoznańData Processing in PHP - PHPers 2024 Poznań
Data Processing in PHP - PHPers 2024 Poznań
Norbert Orzechowicz
 
一比一原版(unc毕业证书)美国北卡罗来纳大学教堂山分校毕业证如何办理
一比一原版(unc毕业证书)美国北卡罗来纳大学教堂山分校毕业证如何办理一比一原版(unc毕业证书)美国北卡罗来纳大学教堂山分校毕业证如何办理
一比一原版(unc毕业证书)美国北卡罗来纳大学教堂山分校毕业证如何办理
gfysze
 
Gamify it until you make it Improving Agile Development and Operations with ...
Gamify it until you make it  Improving Agile Development and Operations with ...Gamify it until you make it  Improving Agile Development and Operations with ...
Gamify it until you make it Improving Agile Development and Operations with ...
Ben Linders
 
ServiceNow CIS-ITSM Exam Dumps & Questions [2024]
ServiceNow CIS-ITSM Exam Dumps & Questions [2024]ServiceNow CIS-ITSM Exam Dumps & Questions [2024]
ServiceNow CIS-ITSM Exam Dumps & Questions [2024]
SkillCertProExams
 
IEEE CIS Webinar Sustainable futures.pdf
IEEE CIS Webinar Sustainable futures.pdfIEEE CIS Webinar Sustainable futures.pdf
IEEE CIS Webinar Sustainable futures.pdf
Claudio Gallicchio
 
The Intersection between Competition and Data Privacy – CAPEL – June 2024 OEC...
The Intersection between Competition and Data Privacy – CAPEL – June 2024 OEC...The Intersection between Competition and Data Privacy – CAPEL – June 2024 OEC...
The Intersection between Competition and Data Privacy – CAPEL – June 2024 OEC...
OECD Directorate for Financial and Enterprise Affairs
 
Prsentation for VIVA Welike project 1semester.pptx
Prsentation for VIVA Welike project 1semester.pptxPrsentation for VIVA Welike project 1semester.pptx
Prsentation for VIVA Welike project 1semester.pptx
prafulpawar29
 
2 December UAE National Day - United Arab Emirates
2 December UAE National Day - United Arab Emirates2 December UAE National Day - United Arab Emirates
2 December UAE National Day - United Arab Emirates
UAE Ppt
 
SASi-SPi Science Policy Lab Pre-engagement
SASi-SPi Science Policy Lab Pre-engagementSASi-SPi Science Policy Lab Pre-engagement
SASi-SPi Science Policy Lab Pre-engagement
Francois Stepman
 
AWS User Group Torino 2024 #3 - 18/06/2024
AWS User Group Torino 2024 #3 - 18/06/2024AWS User Group Torino 2024 #3 - 18/06/2024
AWS User Group Torino 2024 #3 - 18/06/2024
Guido Maria Nebiolo
 
2023 Ukraine Crisis Media Center Annual Report
2023 Ukraine Crisis Media Center Annual Report2023 Ukraine Crisis Media Center Annual Report
2023 Ukraine Crisis Media Center Annual Report
UkraineCrisisMediaCenter
 
The Intersection between Competition and Data Privacy – KEMP – June 2024 OECD...
The Intersection between Competition and Data Privacy – KEMP – June 2024 OECD...The Intersection between Competition and Data Privacy – KEMP – June 2024 OECD...
The Intersection between Competition and Data Privacy – KEMP – June 2024 OECD...
OECD Directorate for Financial and Enterprise Affairs
 
Bridging the visual gap between cultural heritage and digital scholarship
Bridging the visual gap between cultural heritage and digital scholarshipBridging the visual gap between cultural heritage and digital scholarship
Bridging the visual gap between cultural heritage and digital scholarship
Inesm9
 

Recently uploaded (20)

Legislation And Regulations For Import, Manufacture,.pptx
Legislation And Regulations For Import, Manufacture,.pptxLegislation And Regulations For Import, Manufacture,.pptx
Legislation And Regulations For Import, Manufacture,.pptx
 
Proposal: The Ark Project and The BEEP Inc
Proposal: The Ark Project and The BEEP IncProposal: The Ark Project and The BEEP Inc
Proposal: The Ark Project and The BEEP Inc
 
Genesis chapter 3 Isaiah Scudder.pptx
Genesis    chapter 3 Isaiah Scudder.pptxGenesis    chapter 3 Isaiah Scudder.pptx
Genesis chapter 3 Isaiah Scudder.pptx
 
Using-Presentation-Software-to-the-Fullf.pptx
Using-Presentation-Software-to-the-Fullf.pptxUsing-Presentation-Software-to-the-Fullf.pptx
Using-Presentation-Software-to-the-Fullf.pptx
 
怎么办理(lincoln学位证书)英国林肯大学毕业证文凭学位证书原版一模一样
怎么办理(lincoln学位证书)英国林肯大学毕业证文凭学位证书原版一模一样怎么办理(lincoln学位证书)英国林肯大学毕业证文凭学位证书原版一模一样
怎么办理(lincoln学位证书)英国林肯大学毕业证文凭学位证书原版一模一样
 
The Intersection between Competition and Data Privacy – OECD – June 2024 OECD...
The Intersection between Competition and Data Privacy – OECD – June 2024 OECD...The Intersection between Competition and Data Privacy – OECD – June 2024 OECD...
The Intersection between Competition and Data Privacy – OECD – June 2024 OECD...
 
The Intersection between Competition and Data Privacy – COLANGELO – June 2024...
The Intersection between Competition and Data Privacy – COLANGELO – June 2024...The Intersection between Competition and Data Privacy – COLANGELO – June 2024...
The Intersection between Competition and Data Privacy – COLANGELO – June 2024...
 
Data Processing in PHP - PHPers 2024 Poznań
Data Processing in PHP - PHPers 2024 PoznańData Processing in PHP - PHPers 2024 Poznań
Data Processing in PHP - PHPers 2024 Poznań
 
一比一原版(unc毕业证书)美国北卡罗来纳大学教堂山分校毕业证如何办理
一比一原版(unc毕业证书)美国北卡罗来纳大学教堂山分校毕业证如何办理一比一原版(unc毕业证书)美国北卡罗来纳大学教堂山分校毕业证如何办理
一比一原版(unc毕业证书)美国北卡罗来纳大学教堂山分校毕业证如何办理
 
Gamify it until you make it Improving Agile Development and Operations with ...
Gamify it until you make it  Improving Agile Development and Operations with ...Gamify it until you make it  Improving Agile Development and Operations with ...
Gamify it until you make it Improving Agile Development and Operations with ...
 
ServiceNow CIS-ITSM Exam Dumps & Questions [2024]
ServiceNow CIS-ITSM Exam Dumps & Questions [2024]ServiceNow CIS-ITSM Exam Dumps & Questions [2024]
ServiceNow CIS-ITSM Exam Dumps & Questions [2024]
 
IEEE CIS Webinar Sustainable futures.pdf
IEEE CIS Webinar Sustainable futures.pdfIEEE CIS Webinar Sustainable futures.pdf
IEEE CIS Webinar Sustainable futures.pdf
 
The Intersection between Competition and Data Privacy – CAPEL – June 2024 OEC...
The Intersection between Competition and Data Privacy – CAPEL – June 2024 OEC...The Intersection between Competition and Data Privacy – CAPEL – June 2024 OEC...
The Intersection between Competition and Data Privacy – CAPEL – June 2024 OEC...
 
Prsentation for VIVA Welike project 1semester.pptx
Prsentation for VIVA Welike project 1semester.pptxPrsentation for VIVA Welike project 1semester.pptx
Prsentation for VIVA Welike project 1semester.pptx
 
2 December UAE National Day - United Arab Emirates
2 December UAE National Day - United Arab Emirates2 December UAE National Day - United Arab Emirates
2 December UAE National Day - United Arab Emirates
 
SASi-SPi Science Policy Lab Pre-engagement
SASi-SPi Science Policy Lab Pre-engagementSASi-SPi Science Policy Lab Pre-engagement
SASi-SPi Science Policy Lab Pre-engagement
 
AWS User Group Torino 2024 #3 - 18/06/2024
AWS User Group Torino 2024 #3 - 18/06/2024AWS User Group Torino 2024 #3 - 18/06/2024
AWS User Group Torino 2024 #3 - 18/06/2024
 
2023 Ukraine Crisis Media Center Annual Report
2023 Ukraine Crisis Media Center Annual Report2023 Ukraine Crisis Media Center Annual Report
2023 Ukraine Crisis Media Center Annual Report
 
The Intersection between Competition and Data Privacy – KEMP – June 2024 OECD...
The Intersection between Competition and Data Privacy – KEMP – June 2024 OECD...The Intersection between Competition and Data Privacy – KEMP – June 2024 OECD...
The Intersection between Competition and Data Privacy – KEMP – June 2024 OECD...
 
Bridging the visual gap between cultural heritage and digital scholarship
Bridging the visual gap between cultural heritage and digital scholarshipBridging the visual gap between cultural heritage and digital scholarship
Bridging the visual gap between cultural heritage and digital scholarship
 

Social Connections 12. We hired hackers to hack us

  • 1. Vienna, October 16-17 2017 We hired hackers to hack us; A case study about cloud-based authentication and security in IBM Connections Robert Farstad @robertfarstad
  • 2. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 PLATINUM SPONSORS GOLD SPONSORS SILVER SPONSORS BRONZE SPONSORS
  • 3. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 This session… …is mainly for you tech-people. But very useful for everyone to see. Might be an eye- opener. No talk about: •  What IBM Connections is… •  What IBM Cnx can give you… •  No ROI talk, what so ever! •  How to use IBM Cnx!!
  • 4. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 This session… …is a case study where I will show you •  an integration with Auth0. •  how we hired hackers to hack us.
  • 5. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Vienna, October 16-17 2017
  • 6. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Vienna, October 16-17 2017 The customer
  • 7. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 The customer - •  Political party, won the election 2017, second time in a row. •  Norways Prime Minister is Høyres leader. •  60.000 members •  Was a white-space customer. •  Now: Connections + Docs + Sametime •  IBM Reference Customer. •  Security is a priority, more and more. •  Election year = hacking attempts. •  We hacked them first!
  • 8. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 - cloud based authentication Høyre used Auth0 for all websites. Requirement for them to become a Connections customer was: •  Authentication integration with Auth0! •  è POC – Item Consulting developed a TAI mechanism towards Auth0.
  • 9. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Vienna, October 16-17 2017 What is Auth0?
  • 10. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 - cloud based authentication You can connect any application. •  Custom credentials: username + passwords •  Social network logins: •  Google, Facebook, Twitter, and any OAuth2, OAuth1 or OpenID Connect provider. •  Enterprise directories: •  LDAP, Google Apps, Office 365, ADFS, AD, SAML-P, WS- Federation, etc. •  Passwordless systems: •  Touch ID, one time codes on SMS, or email. •  Supports several 2-factor solutions.
  • 11. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 •  JSON Web Token •  Secure API: (TLS v1.2, AES_128_GCM and uses ECDHE_RSA as the key exchange mechanism. ) •  Extensible admin tool. •  Monitoring, (#logins, where from, who fails, hack attempts, alarms.) •  Blocking •  Logs •  Synced with Høyres back-end member system via MSSQL DB, securely! - cloud based authentication
  • 12. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 - cloud based authentication
  • 13. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 - cloud based authentication
  • 14. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 + TAI •  Item developed a WebSphere Application •  TAI – Trust Association Interceptors. •  èLTPA after authenticated •  New Auth0 login page. •  Logout pages are modified •  Logs out of Auth0 •  Logs out of Websphere
  • 15. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Devices used Login occurs from: •  Browsers •  Apps •  Desktop plugins. Technically, the login procedures are quite different.
  • 16. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Web-browsers
  • 17. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Apps + Plugins
  • 18. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Tivoli Directory server - TDS ◘  FREE/Bundled LDAP server for IBM Connections ◘  Standard setup between WebSphere and TDS ◘  Import of users via TDI/SDI to TDS. ◘  From MSSQL Database – over site2site vpn. ◘  Imports only the most relevant fields Name, email, mobile, position, company, department
  • 19. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Tivoli Directory server – TDS + PTA ◘  Password field in TDS is blank! ◘  PTA is triggered. ◘  What is PTA? ◘  Pass Through Authentication ◘  PTA is configured to search in alternative LDAP source. ◘  The password is stored in Auth0 ◘  Our PTA source is TDI / SDI ◘  TDI calls the TAI application – gets response code 200 if OK. ◘  è logged in
  • 20. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 What is TDI/SDI? ◘ Tivoli Directory Integrator / Security Directory Integrator ◘ Data manipulation system, limitless possibilities. ◘ Eclipse based – Javascript coding. ◘ Used to move, consolidate, manipulate data. ◘ Used in Connections for profile data import. ◘ Best tool ever, once you´ve learned the jift of the gui and debugger.
  • 21. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 TDI – acting as an LDAP server. ◘ Simulates an LDAP server ◘ Gets attempted username and password from TDS PTA. ◘ Credentials è WebSphere Auth0login app. ◘ WAS app è REST lookup to Auth0 API. ◘ Gets return code OK or NOT_OK. ◘ TDI receives same code from the WAS app. ◘ TDS PTA receives same code from TDI. ◘ TDI runs multiple instances – Can handle large load.
  • 22. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 TDI – acting as an LDAP server. Simple code – extremely powerful!
  • 23. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 TDI – acting as an LDAP server.
  • 24. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Did they get in? We hired hackers
  • 25. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 What they tested Login attempts SSL + headers Apps Stolen laptop Me! Sensitive information
  • 26. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 SSL tests www.ssllabs.com Grade was bad After hardening SSLChipersSuite, honorChipersOrder and SSLV2 +V3 disabling. TLS only
  • 27. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 SSL tests – http config for Grade A SSLEnable SSLProtocolEnable TLS SSLProtocolDisable SSLv2 SSLv3 # Disable SSLCompression -> CRIME ATTACK SSLCompression off #Prefer ECDHE-RSA ciphers SSLCipherSpec ALL NONE SSLCipherSpec TLSv12 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 SSLCipherSpec TLSv12 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 SSLCipherSpec TLSv12 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 SSLCipherSpec TLSv12 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 SSLCipherSpec ALL TLS_RSA_WITH_AES_128_GCM_SHA256 SSLCipherSpec ALL TLS_RSA_WITH_AES_256_GCM_SHA384 SSLCipherSpec ALL TLS_RSA_WITH_AES_128_CBC_SHA256 SSLCipherSpec ALL TLS_RSA_WITH_AES_256_CBC_SHA256 # Enabling this 3 ciphers mean A- rating on ssllabs SSLCipherSpec ALL TLS_RSA_WITH_AES_128_CBC_SHA SSLCipherSpec ALL TLS_RSA_WITH_AES_256_CBC_SHA SSLCipherSpec ALL SSL_RSA_WITH_3DES_EDE_CBC_SHA
  • 28. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Headers securityheaders.io Grade was bad After hardening HTTP config to achieve Grade A: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload” Header set Referrer-Policy "same-origin” Header set X-Content-Type-Options "nosniff” Header set X-XSS-Protection "1; mode=block” Header set X-Frame-Options "DENY” Header set X-Frame-Options SAMEORIGIN
  • 29. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 The Mobile App Decompile • Android app is decompilable • Broken down to study code Test • Tried every url found in code Result • Found no insecurities! • But MITM attacks were possible!
  • 30. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 MITM - Man-in-the-middle attack An employee is out traveling and connects to a public network such as a hotel or airport WIFI. But instead, connects to a hackers wifi hotspot. Then clicks on “Continue”…. He/she will give the hacker running a MITM attack, full visibility over the traffic.
  • 31. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 MITM - Man-in-the-middle attack
  • 32. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 MITM - Man-in-the-middle attack mobile-config.xml has the solution for the connections app. Don´t press “Continue”!. Tell your admins to fix it.
  • 33. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Demo time The demo consisted of showing a MITM attack + username/password “cluster bomb” attack using free tool Burp Suite.
  • 34. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Accident waiting to happen
  • 35. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 What did they find when they got in? Stolen Laptop Scenario
  • 36. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Stolen Laptop Scenario •  Not hard to find password on PC •  Once in, passwords to sites are normally stored in browser. •  Saved wifi hotspots gives hackers GPS coordinates => can drive up alongside your company's building and connect. •  Hackers found sensitive information open to all of the IBM Connections users. Don´t expose login information available to everyone!
  • 37. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 They hacked me! Or at least, they tried to…
  • 38. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 They hacked me! •  They knew who I was. •  Googled me, found my blog. •  In one of the screenshots, a password was censored.
  • 39. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 They hacked me! I was a weak link… How hard is it for hackers to find IT staff at your company? LinkedIn search… Google search… Google is both your friend and your enemy. •  Bad censoring!! •  Found 6 out of 9 chars by matching font, size and studied curves.
  • 40. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Avoid stress
  • 41. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 •  Mask/hide better! •  Hackers are clever bastards. •  Hackers has A LOT of free time. •  Implement 2-factor authorization mechanism, like Auth0 •  Hide your stuff. •  Once again: Hackers are clever bastards. •  Lockout policy – i.e. 5 attempts => locked out… Hackers has tools for that! •  Train your users!
  • 42. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017
  • 43. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 Useful links: Check SSL: https://ssllabs.com Check Headers: https://securityheaders.io Analyze CSP: https://report-uri.io/home/analyse What can your browser support? http://caniuse.com/#search=referrer%20policy Auth0 multi-factor authentication: https://auth0.com/docs/multifactor-authentication Burp Suite: https://portswigger.net/burp Ethical Hacker Certification: https://www.eccouncil.org/programs/certified-ethical-hacker-ceh/ My blog: http://blog.robertfarstad.com Twitter: https://www.twitter.com/robertfarstad Item Consulting: https://www.item.no
  • 44.
  • 45. Social Connections 11 Chicago, June 1-2 2017Social Connections 12 Vienna, October 16-17 2017 PLATINUM SPONSORS GOLD SPONSORS SILVER SPONSORS BRONZE SPONSORS