Download as PDF, PPTX
![DATA VALIDATION - SQL INJECTION
// paramaterized
query( "select name from emp where emp_id=$1",
[123] )
// prepared
query( {
name:"emp_name",
text:"select name from emp where emp_id=$1",
values:[123]
})](https://image.slidesharecdn.com/fullstacksurvivingwebsecurity-160713170749/85/Surviving-Web-Security-35-320.jpg)
Uploaded byGergely Németh
Surviving Web Security
This document discusses various security vulnerabilities and strategies for defending against attacks. It begins by describing common attacks like SQL injection, brute force attacks, and session hijacking. It then outlines approaches to mitigate these risks such as implementing SSL, input validation, secure cookies, and keeping dependencies up-to-date. The document stresses that security is a shared responsibility and must be incorporated into development practices through techniques like writing stories with security acceptance criteria.
Surviving Web Security
- 1. Gergely Nemeth Surviving WebSecurity github.com/gergely | twitter.com/nthgergo | gergely@risingstack.com
- 2. TRACE - NODE.JSMONITORING https://trace.risingstack.com
- 3. WHAT DO THEYHAVE IN COMMON?
- 4. WHAT DO THEYHAVE IN COMMON? TOGETHER, ALMOST 1 BILLION USER ACCOUNTS COMPROMISED https://haveibeenpwned.com
- 5.
- 6. Lots of high-profilevulnerabilities such as Shellshock Hearthbleed
- 7. an average of 158days time-to- fix security issues
- 8. in some industriessecurity tickets may be open for more than 2 years
- 9. XSS affects 47% CRFSaffects 24% of all web apps.
- 10.
- 11. ATTACK TREES “formal, methodicalway of describing the security of systems, based on varying attacks” Bruce Schneier
- 12. ATTACK TREES Open safe Picklock Learn combo Cut open Bad setup Find it written Learn from target Blackmail Eavesdrop Bribe Listen to convo Get target to say
- 13. ATTACK TREES to getthe most out of attack trees, you have to combine them with knowledge on the attackers
- 14. ATTACK TREES Open safe(P) Pick lock (I) Learn combo (P) Cut open (P) Bad setup (I) Find it written (I) Learn from target (P) Blackmail (I) Eavesdrop (I) Bribe (P) Listen to convo (P) Get target to say (I)
- 15. An Example AttackTree of a Trace Account
- 16. EXAMPLE ATTACK TREEOF A TRACE ACCOUNT Get access to account Modify credentials in the database Learn password Get access to database Social engineering Get access to DMZ Listen on the transport layer Brute force Bypass access control SQL Injection Session hijack Insecure dependency
- 17. EXAMPLE ATTACK TREEOF A TRACE ACCOUNT
- 18.
- 19. SECURE TRANSPORT LAYER Getaccess to account Modify credentials in the database Learn password Get access to database Social engineering Get access to DMZ Listen on the transport layer Brute force Bypass access control SQL Injection Session hijack Insecure dependency
- 20. SECURE TRANSMISSION -SSL HTTP is a clear-text protocol
- 21. SECURE TRANSMISSION -SSL Vulnerable against man-in-the-middle attacks
- 22. SECURE TRANSMISSION -SSL HTTP is a clear-text protocol - Always use HTTPS
- 23. Defend Against Brute- forceattacks
- 24. BRUTE-FORCE ATTACKS Get accessto account Modify credentials in the database Learn password Get access to database Social engineering Get access to DMZ Listen on the transport layer Brute force Bypass access control SQL Injection Session hijack Insecure dependency
- 25. BRUTE-FORCE PROTECTION var email= req.body.email var limit = new Limiter({ id: email, db: db }) limit.get(function(err, limit) { })
- 26. BRUTE-FORCE PROTECTION -TIMING ATTACKS // the bad solution if (userEnteredPassword === passwordFromDb) { return true } return false
- 27. BRUTE-FORCE PROTECTION -TIMING ATTACKS T R A C E T R A C E T R A C E T R I C K x
- 28. PASSWORDS - EQUALITYCHECK Always use fixed- time comparison
- 29. BRUTE-FORCE PROTECTION -TIMING ATTACKS // the good solution var cryptiles = require('cryptiles') if (cryptiles.fixedTimeComparison( userEnteredPassword, passwordFromDb) ) { return true } return false
- 30. Defend Against SQL InjectionAttacks
- 31. SQL INJECTION Get accessto account Modify credentials in the database Learn password Get access to database Social engineering Get access to DMZ Listen on the transport layer Brute force Bypass access control SQL Injection Session hijack Insecure dependency
- 32. DATA VALIDATION -SQL INJECTION This attack vector consists of injection of a partial or complete SQL query via user input
- 33. DATA VALIDATION -SQL INJECTION select username, password from users where username=$username can become: select username, password from users where username=john or 1=1
- 34. DATA VALIDATION -SQL INJECTION Defend against it with parameterized queries / prepared statements
- 35. DATA VALIDATION -SQL INJECTION // paramaterized query( "select name from emp where emp_id=$1", [123] ) // prepared query( { name:"emp_name", text:"select name from emp where emp_id=$1", values:[123] })
- 36.
- 37. SESSION HIJACK Get accessto account Modify credentials in the database Learn password Get access to database Social engineering Get access to DMZ Listen on the transport layer Brute force Bypass access control SQL Injection Session hijack Insecure dependency
- 38.
- 39. COOKIES - COOKIEFLAGS - secure - this attribute tells the browser to only send the cookie if the request is being sent over HTTPS. - HttpOnly - this attribute is used to help prevent attacks such as cross- site scripting, since it does not allow the cookie to be accessed via JavaScript.
- 40.
- 41. DATA VALIDATION -XSS - Reflected Cross Site Scripting occurs when the attacker injects executable JavaScript code into the HTML response with specially crafted links - Stored Cross Site Scripting occurs when the application stores user input which is not correctly filtered. It runs within the user’s browser under the privileges of the web application.
- 42. DATA VALIDATION -XSS Defend against it with input validation
- 43. SECURITY HEADERS - Strict-Transport-Securityenforces secure (HTTP over SSL/TLS) connections to the server - X-Frame-Options provides clickjacking protection - X-XSS-Protection enables the Cross-site scripting (XSS) filter built into most recent web browsers - Content-Security-Policy prevents a wide range of attacks, including Cross-site scripting and other cross-site injections
- 44.
- 45. HANDLING DEPENDENCIES Get accessto account Modify credentials in the database Learn password Get access to database Social engineering Get access to DMZ Listen on the transport layer Brute force Bypass access control SQL Injection Session hijack Insecure dependency
- 46. HANDLING DEPENDENCIES You arewhat you require
- 47. HANDLING DEPENDENCIES Use retire.js/ the NSP CLI https://nodesecurity.io
- 48.
- 49.
- 50. RESTRICT DATABASE ACCESS Getaccess to account Modify credentials in the database Learn password Get access to database Social engineering Get access to DMZ Listen on the transport layer Brute force Bypass access control SQL Injection Session hijack Insecure dependency
- 51. ENVIRONMENT SETUP Put yourdatabases inside a VPN with your application servers
- 52. ENVIRONMENT SETUP Be carefulwith default passwords
- 53. ENVIRONMENT SETUP At least6.000+ Redis instances are compromised now
- 54.
- 55. 95% of allsecurity incidents involve human error
- 56.
- 57. Security must be partof the agile workflow
- 58. Stories should include acceptance criteriafor security
- 59. Given an unauthenticated user Whentries to view her profile Then redirected to the login EXAMPLE STORY
- 60. Developers should implement features withsecurity requirements in mind
- 61. Developers should implement features withsecurity requirements in mind LIKE OWASP TOP 10
- 62. https://www.owasp.org/index.php/OWASP_Top_Ten_Cheat_Sheet Injection Weak authentication and sessionmanagement XSS Insecure Direct Object References Security Misconfiguration Sensitive Data Exposure Missing Function Level Access Control Cross Site Request Forgery Using Components with Known Vulnerabilities Unvalidated Redirects and Forwards
- 63. Security is part ofyour job!