The document discusses the importance of secure code reviews as a method to identify and resolve security vulnerabilities in software development. It highlights various security practices, including threat modeling, static code analysis, and manual code reviews, while also addressing the common reasons for coding vulnerabilities. Additionally, it provides examples of potential input validation vulnerabilities like SQL injection and emphasizes the need for proper input handling and secure coding practices.

1. Secure Code Review
-Sunil
PART - I

2. Is Code Review Easy?

3. Asset
Definition: “an item of property owned by a
person or company, regarded as having
value and available to meet debts,
commitments, or legacies”

4. Tom & Jerry

5. Threat

6. Vulnerability

7. Security Engineers

8. A Suggestion!
Before starting Threat Modeling warn
development team that “ Do Not Hide
Sensitive information from Doctors, Lawyers
and SECURITY ENGINEERS”
But you can from GF/Wife

9. Where does code review fit?
• Get Security RequirementsRequirements
• Perform Threat ModelDesign
• Static code Analysis
• Manual Code Review
Coding
• Penetration TestingTesting
• Server Configuration Review
• Network Configuration Review
Deployment

10. Cost of Bug Fixing

11. Code Review in One Slide

12. Why Code Review?
• It is too expensive or time consuming but it is the
fastest way to find many security problems.
• Tools are more like spell-checkers or grammar-
checkers. While important, they don't understand the
context, and miss many important security issues.
• Use security code review to find a problem, and
penetration testing to prove that it is exploitable

13. WHY DOES CODE HAVE VULNERABILITIES?
• Not taught about secure practices in
school/college
• Increase in new technologies and
protocols at a shocking rate
• Businesses are not spending the
appropriate amount of time on security
• Copy & Paste

14. Push Backs for the Code Review
“We never get hacked (that I know of), we
don’t need security”
“We have a firewall that protects our
applications”
"We trust our employees not to attack our
applications"

15. "...we know, there are known knowns; there are things we
know we know. We also know there are known unknowns;
that is to say we know there are some things we do not
know. But there are also unknown unknowns -- the ones we
don't know we don't know."
- Donald Rumsfeld
Best Quote

16. Things to Keep in Mind
Code
Context
Audience
Importance
Priority

17. THREAT MODELING
Step -1
17

18. Threat Modeling
● Structured approach to Analyze the security of the application
● Allows to understand the entry points to the application and their
associated threats.
● Not an approach to review code.
● Threat Modeling will be done in design phase of SDLC.
● Threat modeling will ensure the security builtin from the very beginning
of the application development.

19. Different Ways to perform Threat Modeling
• Attack Centric
• Software Centric
• Asset Centric
• Worst Case Analysis
• Negation Analysis
• Defensive
• Offensive
• Threat Traceability Matrix

20. My Presentation in Slide Share

21. CODE REVIEW
21

22. Free static analysis tools

23. Commercial static analysis tools

24. Disadvantages of Static Code Analyzers
• Business Logic Flaws remain untouched
• Limited scope
• Custom validations
• Design flaws
• Application specific recommendations

25. Code Review Flow Chart
Code Submitted for
MCR
Has
context
of code
been
defined?
Perform Code
Review
Record Findings
and
Recommendatio
ns
Schedule a meeting
Policies Standards Guidelines
YES
NO
Submit the Final
Report

26. Manual Code Review
• Identification of Entry points(Will be done as part of Threat Model)
• Identification of the trust boundaries in the code. (same)
• Identification of data paths and storage classes(like DBs).(same)
• Identification of authorization components.(same)
• Identification of authentication components.(same)
• Review of input validation and encoding methods.
• Review of logging components.
• Review of Cryptography risks
• Identify Use cases for the application(Threat model)

27. Checklist Should Include Attacks on…
• Data/Input Validation
• Authentication
• Authorization
• Cookie/Session Management
• Error Handling/Information leakage
• Logging/Auditing
• Cryptography
• Secure Code Environment

28. Checklist Should Include Attacks on…
• Data/Input Validation(Some Vulnerabilities)
• Authentication
• Authorization
• Cookie/Session Management
• Error Handling/Information leakage
• Logging/Auditing
• Cryptography
• Secure Code Environment

29. Input Validation Vulnerabilities
These are the Input Validation vulnerabilities that I am going to cover
in this session:
• Command Injection
• Log Forging
• SQL Injection
Remaining vulnerabilities in next session.

30. Entry points to the Code
Browser input
Cookies
Property files
External processes
Data feeds
Service responses
Flat files
Command line parameters
Environment variables

31. BAD CODE
try
{
String clg=request.getparameter(“clgname”);
Class.forName("com.mysql.jdbc.Driver");
Connection con=DriverManager.getConnection("jdbc:mysql://localhost:3306/bank","root","alamuri");
Statement st=con.createStatement();
ResultSet rs=st.executeQuery("SELECT tablename FROM logins where clgname='"+clg+"';");
tableNames="login information trans";
process = runtime.exec("cmd /c mysqldump -u root -h localhost --password=alamuri bank> C:backup"+filename);
message="BackUp done Successfully.....";
}
catch(Exception e)
{
out.println("Exception while taking backup“+e+”while taking back up for”+clg);
log.warn(“Failed while taking backup for”+clg);
}

33. Command Injection
try
{
String clg=request.getparameter(“clgname”);
Class.forName("com.mysql.jdbc.Driver");
Connection con=DriverManager.getConnection("jdbc:mysql://localhost:3306/bank","root","alamuri");
Statement st=con.createStatement();
ResultSet rs=st.executeQuery("SELECT tablename FROM logins where clgname='"+clg+"';");
tableNames="login information trans";
process = runtime.exec("cmd /c mysqldump -u root -h localhost --password=alamuri bank> C:backup"+filename);
message="BackUp done Successfully.....";
}
catch(Exception e)
{
out.println("Exception while taking backup“+e+”while taking back up for”+clg);
log.warn(“Failed while taking backup for”+clg);
}

34. Command Injection
try
{
String clg=request.getparameter(“clgname”);
Class.forName("com.mysql.jdbc.Driver");
Connection con=DriverManager.getConnection("jdbc:mysql://localhost:3306/bank","root","alamuri");
Statement st=con.createStatement();
ResultSet rs=st.executeQuery("SELECT tablename FROM logins where clgname='"+clg+"';");
tableNames="login information trans";
process = runtime.exec("cmd /c mysqldump -u root -h localhost --password=alamuri bank> C:backup"+filename.sql & rm –rf /);
message="BackUp done Successfully.....";
}
catch(Exception e)
{
out.println("Exception while taking backup“+e+”while taking back up for”+clg);
log.warn(“Failed while taking backup for”+clg);
}

35. Improper Error Handling & Log forging
try
{
String clg=request.getparameter(“clgname”);
Class.forName("com.mysql.jdbc.Driver");
Connection con=DriverManager.getConnection("jdbc:mysql://localhost:3306/bank","root","alamuri");
Statement st=con.createStatement();
ResultSet rs=st.executeQuery("SELECT tablename FROM logins where clgname='"+clg+"';");
tableNames="login information trans";
process = runtime.exec("cmd /c mysqldump -u root -h localhost --password=alamuri bank> C:backup"+filename+".sql");
message="BackUp done Successfully.....";
}
catch(Exception e)
{
out.println("Exception while taking backup“+e+”while taking back up for”+clg);
log.warn(“Failed while taking backup for”+clg);
}

36. Log forging
If input for clg is “random college %0d%0a%0a INFO: Backup successful for Random college”
catch(Exception e)
{
out.println("Exception while taking backup“+e+”while taking back up for”+clg);
log.error(“Failed while taking backup for”+clg);
}
Output:
ERROR: Failed while taking backup for random college
INFO: Backup successful for Random college

37. INFORMATION LEAKAGE

38. Hard Coded Credentials
try
{
String clg=request.getparameter(“clgname”);
Class.forName("com.mysql.jdbc.Driver");
Connection con=DriverManager.getConnection("jdbc:mysql://localhost:3306/bank","root","alamuri");
Statement st=con.createStatement();
ResultSet rs=st.executeQuery("SELECT tablename FROM logins where clgname='"+clg+"';");
tableNames="login information trans";
process = runtime.exec("cmd /c mysqldump -u root -h localhost --password=alamuri bank> C:backup"+filename+".sql");
message="BackUp done Successfully.....";
}
catch(Exception e)
{
out.println("Exception while taking backup“+e+”while taking back up for”+clg);
log.warn(“Failed while taking backup for”+clg);
}

39. Source Code Analyzer didn’t find the second one….
try
{
String clg=request.getparameter(“clgname”);
Class.forName("com.mysql.jdbc.Driver");
Connection con=DriverManager.getConnection("jdbc:mysql://localhost:3306/bank","root","alamuri");
Statement st=con.createStatement();
ResultSet rs=st.executeQuery("SELECT tablename FROM logins where clgname='"+clg+"';");
tableNames="login information trans";
process = runtime.exec("cmd /c mysqldump -u root -h localhost --password=alamuri bank> C:backup"+filename+".sql");
message="BackUp done Successfully.....";
}
catch(Exception e)
{
out.println("Exception while taking backup“+e+”while taking back up for”+clg);
log.warn(“Failed while taking backup for”+clg);
}

40. Example 1
void handle_cc_info(HttpServletRequest request) {
cc_num=request.getParameter(“cc_num”);
cvv=request.getParameter(“cvv”);
if (!is_valid_cvv(cc_num,cvv) {
log.info(cvv+” is not a valid for cc number ”+cc_num));
throw new AuthroizationException();
}
log.info(cvv+” is valid for cc number ”+cc_num));
...
}

41. Example 1
void handle_cc_info(HttpServletRequest request) {
cc_num=request.getParameter(“cc_num”);
cvv=request.getParameter(“cvv”);
if (!is_valid_cvv(cc_num,cvv) {
log.info(cvv+” is not a valid for cc number ”+cc_num));
throw new AuthroizationException();
}
log.info(cvv+” is valid for cc number ”+cc_num));
...
}

42. Example 2
<form name="f1" action="usercheck.jsp" method=“GET">
<B>User Name: </B><input type="text" name="username"/>
<B>Password: </B><input type="password" name="password"/>
<input type="submit" value="Log in" onClick="display()"/>
</form>

43. Example 2
<form name="f1" action="usercheck.jsp" method=“GET">
<B>User Name: </B><input type="text" name="username"/>
<B>Password: </B><input type="password" name="password"/>
<input type="submit" value="Log in" onClick="display()"/>
</form>
What if I use HTTPS?
It will logged in application logs and intermediate proxy logs

44. SQL Injection
try
{
String clg=request.getparameter(“clgname”);
Class.forName("com.mysql.jdbc.Driver");
Connection con=DriverManager.getConnection("jdbc:mysql://localhost:3306/bank","root","alamuri");
Statement st=con.createStatement();
ResultSet rs=st.executeQuery("SELECT tablename FROM logins where clgname='"+clg+"';");
tableNames="login information trans";
process = runtime.exec("cmd /c mysqldump -u root -h localhost --password=alamuri bank> C:backup"+filename);
message="BackUp done Successfully.....";
}
catch(Exception e)
{
out.println("Exception while taking backup“+e+”while taking back up for”+clg);
log.warn(“Failed while taking backup for”+clg);
}

45. SQL Injection
If input for clg is “random college’; DROP TABLE college;--”
The query becomes:
SELECT college FROM logins where clgname='random college’; DROP
TABLE college;--”

46. Preventions for SQL Injection
Stored Procedures
Hibernates
Input validation
Prepared Statements

47. Improper use of Prepared Statements
String sql = "SELECT bal,name From information WHERE accno =
“+request.getParameter("accno");
pstmt=con.prepareStatement(sql);
rs=pstmt.executeQuery();
String sql = "SELECT bal,name From information WHERE accno = ?";
pstmt=con.prepareStatement(sql);
pstmt.setString(1, request.getParameter("accno"));
rs=pstmt.executeQuery();

48. Stored Procedures- Oracle PL/SQL
PROCEDURE SafeGetBalanceQuery( UserID varchar, Dept
varchar)
AS BEGIN
SELECT balance FROM accounts_table WHERE user_ID = UserID
AND department = Dept;
END;

49. Stored Procedures- Oracle PL/SQL
PROCEDURE SafeGetBalanceQuery( UserID varchar, Dept
varchar)
AS BEGIN
SELECT balance FROM accounts_table WHERE user_ID = UserID
AND department = Dept;
END;

50. Stored Procedures- Oracle PL/SQL- FIX
PROCEDURE AnotherSafeGetBalanceQuery( UserID varchar, Dept varchar)
AS
stmt VARCHAR(400); result NUMBER;
BEGIN stmt := 'SELECT balance FROM accounts_table WHERE user_ID = :1
AND department = :2';
EXECUTE IMMEDIATE stmt INTO result USING UserID, Dept;
RETURN result;
END;

51. Stored Procedure – SQL Server
PROCEDURE SafeGetBalanceQuery( @UserID varchar(20), @Dept varchar(10))
AS BEGIN
SELECT balance FROM accounts_table WHERE user_ID = @UserID AND department = @Dept
END

52. Example code
PROCEDURE SafeGetBalanceQuery( @UserID varchar(20), @Dept varchar(10))
AS BEGIN
SELECT @sql=‘ SELECT balance FROM accounts_table WHERE user_ID = @UserID
AND department = @Dept ‘
EXEC(@sql)
END

53. What if Input has:
1' OR '1'='1';EXEC master.dbo.xp_cmdshell 'dir'--'
Result:
PROCEDURE SafeGetBalanceQuery( @UserID varchar(20), @Dept varchar(10))
AS BEGIN
SELECT @sql=‘ SELECT balance FROM accounts_table WHERE user_ID = @UserID
AND department = 1' OR '1'='1';
EXEC master.dbo.xp_cmdshell 'dir'--'
EXEC(@sql)
END

54. Stored Procedure – SQL Server- FIX
PROCEDURE SafeGetBalanceQuery(@UserID varchar(20), @Dept varchar(10))
AS BEGIN
DECLARE @sql VARCHAR(200)
SELECT @sql = 'SELECT balance FROM accounts_table WHERE ' + 'user_ID = @UID AND department = @DPT'
EXEC sp_executesql @sql, '@UID VARCHAR(20),
@DPT VARCHAR(10)', @UID=@UserID,
@DPT=@Dept
END

55. Hibernates
Java
Application
POJO ORM Database

56. Hibernates
String tname = (String) req.getParameter("table");
String employeename = request.getParameter("name");
Session session = sessionFactory.getCurrentSession();
try{
session.beginTransaction();
SQLQuery query = session.createSQLQuery("SELECT * FROM " + tname +
"WHERE stuff=”+ employeename);
session.getTransaction().commit();
}
catch (Exception e) {}
session.close();

57. Vulnerable code
String tname = (String) req.getParameter("table");
String employeename = request.getParameter("name");
Session session = sessionFactory.getCurrentSession();
try{
session.beginTransaction();
SQLQuery query = session.createSQLQuery("SELECT * FROM " + tname +
"WHERE stuff=”+ employeename); // no input validation for tname & employeename
session.getTransaction().commit();
}
catch (Exception e) {} //no rollback
session.close();

58. Fixed Code
String tname = (String) req.getParameter("table");
….do input validation for tablename here……….
String employeename = request.getParameter("name");
Session session = sessionFactory.getCurrentSession();
Transaction tx=null;
try{
tx=session.beginTransaction();
SQLQuery query = session.createSQLQuery("SELECT * FROM " + tname + "WHERE stuff=?”);
query.setParameter(0, parameter1);
tx.commit();
}
catch (Exception e)
{
if (tx!=null) tx.rollback();
throw e;
}
finally {
sess.close();
}

59. Common methods which are used creating SQL queries in
Hibernates are as follows :
• Session.createSQLQuery(String queryString)
• Session.createQuery(String queryString)
• Session.createFilter(Object collection, String queryString)
• Session.find(String queryString)
• Query.executeUpdate()
• Query.getQueryString()

60. Query.executeUpdate()
String hql = "UPDATE Student set grade =”+request.getparameter(grade)+"WHERE id =”
+request.getparamter(rollno);
Query query = session.createQuery(hql);
query.executeUpdate();
String hql = "UPDATE Employee set salary = :grade " + "WHERE id = :rollno";
Query query = session.createQuery(hql);
query.setParameter("salary", request.getparameter(grade));
query.setParameter("empid", request.getparamter(rollno));
query.executeUpdate();

61. session.beginTransaction();
Query q1 = session.createQuery(taintSQL); //pretend taintSQL came from unchecked input
sql = q1.getQueryString(); //get taint
SQLsession.getTransaction.commit();
session.beginTransaction();
Query q2 = new QueryImpl(sql, session, parameterMetadata); //reuse taint SQL w/o validation
session.getTransaction.commit(); //evil prevailssession.close();
OWASP Example for Query.getQueryString():

62. SQL Injections Checklist
• Check for input validation
• Check for parameterized prepared
statements
• Check for ORDERBY clause
• Check for GROUPBY clause
• Check for parameters that we cannot
parametrize

63. Conclusion
NEXT PART

64. Credits
https://www.owasp.org/images/2/2e/OWASP_Code_Review_Guide-V1_1.pdf
https://www.owasp.org/index.php/Query_Parameterization_Cheat_Sheet
https://www.owasp.org/index.php/Hibernate-Guidelines
https://www.owasp.org/index.php/Hibernate
https://thenounproject.com/
http://arthurminduca.com/2014/03/07/quality-assurance-in-software-development-when-should-you-start-the-testing-process/
http://www.curbsideclassic.com
https://animationreview.files.wordpress.com/
https://theparalegalsociety.wordpress.com/2012/07/27/increase-your-productivity-the-desk-dragon-method/
https://pixabay.com/en/check-correct-mark-right-choice-40319/
http://gallery4share.com/w/wrong-symbol.html

65. Social Media
@anvsunil https://in.linkedin.com/in/anvsunil

66. THANK YOU