WCF Basics and Security overview WCF Overview. WCF security model. Attacks and countermeasures. (If Time Permits) WCF exposes endpoints for clients and services to exchange messages. WCF uses addresses, bindings and contracts (ABC model). Bindings specify protocols, encodings and security. The security model includes transfer security modes (none, transport, message, mixed, both) and credentials (Windows, username/password, certificates, tokens). Common attacks include information disclosure, elevation of privilege, denial of service, and tampering. Countermeasures include configuration, authorization and message inspection.

1. WCF Basics and Security overview
Yaron Hakon
Application Security Consultant
2Bsecure
yaron@2bsecure.co.il
WCFWCF
Agenda.Agenda.
•• WCF Overview.WCF Overview.
• WCF Security model.
• Attacks and countermeasures. (If Time Permits)

2. WCF is.WCF is.
• WCF services expose endpoints that
clients and services use to exchange
messages.
Call CenterCall Center
Asp.netAsp.net AppApp MOBILE EMPLOYEESMOBILE EMPLOYEES
-- JAVAJAVA
CUSTOMERSCUSTOMERS
-- ApplicationApplication
VARIOUS PLATFORMSVARIOUS PLATFORMS
The Imperative to ConnectThe Imperative to Connect
J2EE APP
SERVER
J2E APP
OTHERS
.NET
framework
ExistingExisting
J2EE ApplicationJ2EE ApplicationMOBILEMOBILE
EMPLOYEE APPEMPLOYEE APP
.NET
framework
IDM
HTTPHTTP HTTPSHTTPSTCPTCPIPIP WSE .. .. .. ..WSE .. .. .. ..
Enterprise
Services

3. Windows Communication FoundationWindows Communication Foundation
INTEROPERABILITY PRODUCTIVITY
SERVICE-ORIENTED
DEVELOPMENT
• Unifies today’s
distributed
technologies
• Visual Studio
2005 integration
• loosely-coupled
services
• Config-based
communication

4. WSWS--* Protocol Support* Protocol Support
XMLXML
MessagingMessaging
SecuritySecurity TransactionsTransactionsReliableReliable
MessagingMessaging
MetadataMetadata
WCFWCF –– A B CA B C
•• A ServiceA Service EndpointEndpoint has anhas an AddressAddress, a, a BindingBinding, and a, and a ContractContract
(ABC).(ABC).
•• AnAn AddressAddress is a network address indicatesis a network address indicates wherewhere the service isthe service is
located.located.
•• AA BindingBinding specifiesspecifies howhow a client can communicate with thea client can communicate with the
endpoint including transport protocol, encoding, and securityendpoint including transport protocol, encoding, and security
requirements.requirements.
•• AA ContractContract identifiesidentifies whatwhat operations are available to the clients.operations are available to the clients.
ClientClient ServiceService
AABBCC
AddressAddress
Where?Where?
ContractContract
What?What?
BindingBinding
How?How?
CCBBAA
CCBBAA
CCBBAA

5. WCF Run Time
WCFWCF –– Architecture & channel stackArchitecture & channel stack
Configuration:
Bindings:
Protocol
Encoding
Transport
Security
Dispatcher
Send
incoming
requestChannel Stack
Service Interface
Method A Method B
WCF Service
code
.Net Assembly
contract
Data, Message,
Service contracts
….
Client Code
Channel Stack
Proxy Class
A B
Protocol
Reliability
Security
Protocol
Reliability
Security
C
B
A( address)
Understanding Bindings optionUnderstanding Bindings option
• Protocols:
• Security, Reliable messaging capability, Transaction .
• Encoding:
• Xml Text, MTOM, Binary.
• Transport:
• TCP, HTTP/S, Name Pipes , Custom.

6. Binding Transport Encoding security transaction Interopera-
BasicHttpBinding Https text None, Transport,
Message, Mixed
no WS-I
WSHttpBinding Https textMTO
M
None, Transport,
Message, Mixed
yes WS-*
WSDualHttpBinding Http textMTO
M
None, Message yes WS-*
WSFederationBinding None, Message,
Mixed
yes WSF
NetTcpBinding TCP Binary None, Transport,
Message, Mixed
no .NET
NetPeerTcpBinding P2P Binary None, Message,
Transport, Mixed
yes Peer
NetNamedPipeBinding IPC Binary None, Transport yes .NET
NetMsmqBinding MSMQ Binary None, Message,
Transport Both
yes .NET
MsmqIntegrationBinding MSMQ Binary None, Transport yes MSMQ
Understanding Standard BindingsUnderstanding Standard Bindings
System.ServiceModel namespace includes the fallowing predefined Bindings:
1.Building1.Building
WindowsWindows
CommunicationCommunication
FoundationFoundation
ServiceService

7. WCFWCF -- HostingHosting
• User Application - Custom host app.
• IIS host (WS).
• Window service app.
• + IIS version 7.0, - Windows Activation Services -
WAS.
• Configuration Sharing.
• Application pool – Sandboxing
• Support for non-HTTP transport protocols
• Read more :http://msdn2.microsoft.com/en-
us/library/ms733109.aspx
Self Host.Self Host.
• configure the endpoints…
• Add endpoint information for the Web service in App.config .
• Address (httphttps…. )
• Binding
• Contract
• create listener objects for each address.
• listening for requests : productsServiceHost.Open();
Close()

8. IIS HostIIS Host
• Project assemblies are built in the bin folder.
• Add a service definition file – svc (name of the class that
IIS will execute and the name of the assembly holding
this class ).
• Add endpoint information for the Web service in
Web.config .
• Address (iis and SVC address )
• Binding
• Contract
• Deploy the service in iis
• Add new site for the service.
2.Building2.Building
Self Host For WCFSelf Host For WCF
ServiceService

9. 3.Hosting WCF Service3.Hosting WCF Service
in IISin IIS
Consuming WCF ServiceConsuming WCF Service
• Select preferred client.
• Service Reference.
• Configuration - ABC
• Consume.

10. 4.Consuming WCF service4.Consuming WCF service
from console applicationfrom console application
Good to knowGood to know
• Multiple Service Endpoint.
• Expose Service in different endPoint for different Clients.
• Configuring Service Instance Context Modes:
• [ServiceBehavior(InstanceContextMode =
InstanceContextMode.PerSession)]
• PerSession :open new session for etch client, close the session when client
abort.
• Default (max-10 connection) , Cant share data between service instance.
• PerCall- create new instance etch time the client invokes an operation and the
service close after the call finish.
• Hard to implement state.
• Single – open one instant of the service for all.
• Open in the first time service call come. Close by the server.
• Sharing Data between +- ? .
• Using MSMQ and Transaction.

11. 5.Consuming WCF service in5.Consuming WCF service in
self host With 2 endpoint fromself host With 2 endpoint from
different clients.different clients.
console application &console application & ASP.netASP.net
Agenda.Agenda.
• WCF Overview.
•• WCF Security model.WCF Security model.
• Attacks and countermeasures. (If Time Permits)

12. security in every WCF operation callsecurity in every WCF operation call
• Service contract
• Operation contract- Fault contract
• sc behavior- Client credentials, Service credentials.Client credentials, Service credentials.
• Operation behavior
• Host configuration
• Method configuration and code
• Proxy configuration
• Binding configuration-
[ServiceContract (ProtectionLevel = ProtectionLevel.Sign)]
public interface IMyContract
{
[OperationContract]
void SignMethod(…);
}
[OperationContract(ProtectionLevel = ProtectionLevel.EncryptAndSign)]
void EncryptAndSignMethod(…);
}
[ServiceContract (ProtectionLevel = ProtectionLevel.Sign)]
public interface IMyContract
{
[OperationContract]
void SignMethod(…);
}
[OperationContract(ProtectionLevel = ProtectionLevel.EncryptAndSign)]
void EncryptAndSignMethod(…);
}
Transfer security ConceptsTransfer security Concepts
• Message integrity.
• Tampering.
• Message privacy.
• Sensitive data.
• Confidentiality.
• mutual authentication.
• Client server Authentication.
• Replay attacks.
• Denial of service attacks.

13. Transfer security modesTransfer security modes
• None.
• No client credentials are provided to the service.
• Clear Text Messages over non secure Transport layer.
• Transport security - integrity, privacy, and mutual authentication.
• Secure transport protocols - https, tcp, ipc ,msmq. point-to-point,
• all communication on the channel encrypted.
• client's credentials are encrypted along with the rest of the message,
• Message security- integrity, privacy, and mutual authentication.
• encrypts the message itself.
• end-to-end security.
• communicate securely over nonsecure transports.
• Mixed.
• Transport security for message integrity , privacy & service
authentication.
• Message security for securing the client credentials.
• point-to-point security.
• Both - integrity, privacy, and mutual authentication.
• both Transport security and Message security
Explain the Mode scenarioExplain the Mode scenario -- TransportTransport
• Encrypts the entire message
• Sender must trust all intermediaries
• Restricts protocols that can be used
SSL SecuritySSL Security SSL SecuritySSL Security

14. Explain the Mode scenario MessageExplain the Mode scenario Message
Security ContextSecurity Context
•End to end message security independent of transport
•Supports multiple protocols and multiple encryption
technologies
•Encrypt only parts of the message
Transfer Security Mode
• Bindings. Programmatically or Administratively.
Binding None Transport Message Mixed Both
BasicHttpBinding Y (default) Y Y Y N
NetTcpBinding Y Y (default) Y Y N
NetPeerTcpBinding Y Y (default) Y Y N
NetNamedPipeBinding Y Y (default) N N N
NetMsmqBinding Y Y (default) Y N Y
WSHttpBinding Y Y Y (default) yes N
WSFederationBinding Y N Y (default) yes N
WSDualHttpBinding Y N Y (default) N N

15. Programmatically securing the basic binding
BasicHttpBinding binding2 = new BasicHttpBinding( );
binding2.Security.Mode =
BasicHttpSecurityMode.Message;
Administratively securing the basic binding
<bindings>
<basicHttpBinding>
<binding name = "SecuredBasic">
<security mode = "Message">
</security>
</binding>
</basicHttpBinding>
</bindings>

16. ••6. Use of transfer security6. Use of transfer security
–– basicHttpBindingbasicHttpBinding -->>>> WSHttpBinding.
WCF Trace view with Microsoft serviceWCF Trace view with Microsoft service
Trace Viewer.Trace Viewer. Before and afterBefore and after
Transport Security and CredentialsTransport Security and Credentials
• WCF lets you select from a number of possible client
credentials types.
• NTLM or Kerberos
• classic username and password.
• Windows security token.
• X509 certificate,
• Anonymous.

17. Transport security client credentialsTransport security client credentials
• WCF lets you select from a number of possible client credentials
types.
Binding None Windows UserName Certificate
BasicHttpBinding Y (default) Y Y Y
NetTcpBinding Y Y (default) N Y
NetPeerTcpBinding N N Y (default) Y
NetNamedPipeBinding N Y (default) N N
NetMsmqBinding Y Y (default) Y N
WSHttpBinding Y Y (default) Y Y
WSFederationBinding N/A N/A N/A N/A
WSDualHttpBinding N/A N/A N/A N/A
Message Security and CredentialsMessage Security and Credentials
• The same type of credentials as with Transport security.
• + Issued token credential type.
• http://msdn2.microsoft.com/en-us/library/ms731161.aspx

18. Message Security and CredentialsMessage Security and Credentials
Binding None Windows UserName Certificate Token
BasicHttpBinding N N N Y N
NetTcpBinding Y Y (default) Y Y Y
NetPeerTcpBinding N/A N/A N/A N/A N/A
NetNamedPipeBinding N/A N/A N/A N/A N/A
NetMsmqBinding Y Y (default) Y Y Y
WSHttpBinding Y Y (default) Y Y Y
WSFederationBinding N/A N/A N/A N/A N/A
WSDualHttpBinding Y Y (default) Y Y Y
AuthenticationAuthentication AuthorizationAuthorization
• Authentication:
• ASP.NET Membership Provider
• Custom Username and Password Validator
• Identity and Authentication
• Authorization
• Restrict Access With the PrincipalPermissionAttribute
• ASP.NET Role Provider with a Service
• ASP.NET Authorization Manager Role Provider with a Service
• Claims and Authorization with the Identity Model
• Delegation and Impersonation

19. ••7.Implement Message security7.Implement Message security ––
netTcpBinding.
8.Using X509 certificate unable https
communication to service.- server
authentication
••9.Implement Authorization9.Implement Authorization –– usingusing
PrincipalPermission.

20. WCF Relevant AttacksWCF Relevant Attacks
• Information Disclosure
• Http Headers. Metadata , logs/exception . Authentication /
Authorization
• Elevation of Privilege
• Check Authorization, Token Caches.
• Denial of Service
• Memory Consumption, max Secure Session.
• Tampering
• WS Addressing.
• Replay Attacks
• WS Addressing , transport security.
??

21. SummarySummary
•• WCF Overview.WCF Overview.
•• Unified existing technology .Unified existing technology .
•• Standards wide support.Standards wide support.
•• WCF Security model.WCF Security model.
•• Security by default.Security by default.
•• Can be done using configurationCan be done using configurationcode.code.
•• CredentialsCredentials –– X509, SAML, Kerberos, Card Spaces, custom.X509, SAML, Kerberos, Card Spaces, custom.
•• WCF countermeasures for common attack vectors.WCF countermeasures for common attack vectors.
•• MissMiss -- configuration can lead to vulnerability exposureconfiguration can lead to vulnerability exposure ..
•• Read more bout WCF Attacks from the references.Read more bout WCF Attacks from the references.
ReferencesReferences
• Books
• Microsoft Windows Communication Foundation Step by
StepbyJohn Sharp.
• MSDN:
• WCF Home - http://msdn2.microsoft.com/en-
us/library/ms735119.aspx
• Security programming - http://msdn2.microsoft.com/en-
us/library/ms731925.aspx
• Card space - http://cardspace.netfx3.com/
• Blogs
• Message inspector -
http://msmvps.com/blogs/paulomorgado/archive/2007/04/27
/wcf-building-an-http-user-agent-message-inspector.aspx
• WCF Security -
http://blogs.msdn.com/alikl/archive/2007/07/26/wcf-security-
in-intranet-scenario-thoughts-on-cons-and-pros.as
• User group.
• UG Page:
http://www.microsoft.com/israel/communities/usergroups/se
curedev.mspx
• UG Presentation Page:
http://www.2bsecure.co.il/NetSecGroup.aspx

22. Thank you !Thank you !
Yaron Hakon
Application Security Consultant
2Bsecure
yaron@2bsecure.co.il