OWASP Top 10 - Primer

When developing a security strategy for web applications many companies have no idea where to begin. The Open Web Application Security Project (OWASP) understood this problem and developed the OWASP Top 10.

The OWASP top 10 are the top 10 vulnerabilities that are found in web applications. This will begin a 10-part series dedicated to each of these vulnerabilities.

If you are a developer, you should understand these vulnerabilities. Understanding them is critical into introducing less vulnerabilities into your code.

The OWASP Top 10:
A1 - Cross Site Scripting (XSS)
A2 - Injection Flaws
A3 - Malicious File Execution
A4 - Insecure Direct Object Reference
A5 - Cross Site Request Forgery (CSRF)
A6 - Information Leakage and Improper Error Handling
A7 - Broken Authentication and Session Management
A8 - Insecure Cryptographic Storage
A9 - Insecure Communications
A10 - Failure to Restrict URL Access

How to Hack: Hacking by Numbers?!

A course will be offered this year at Black Hat entitled, "Hacking by Numbers: PCI Edition." A quote from the appropriate literature:

The PCI Data Security Standard (DSS) has had a huge impact on the information security industry. One effect that it has had is to make annual penetration testing mandatory in some segments, and thereby spawn a whole new class of off-the-shelf penetration testers.

The term "off-the-shelf penetration testers" makes my stomach churn. It is my belief that hacking is more of an art than a science. Hacking is methodical, but takes a specific type of person to do it. Typical hackers are very methodical and analytic. In addition, ever hacker that I have ever met has a never-give-up mentality about them. This attribute is used as a feedback loop into the problem they are working on.

Sure some security work and/or security methodologies can be taught, but to be a "breaker" you have to have a certain personality type.

What are your thoughts on this? Feel free to tweet me about the topic. @miscsecurity

An XSS Primer - Understanding Cross Site Scripting

If it hasn't already, Cross-Site Scripting (XSS) will soon be replacing SQL injection as the new buzzword in the security sector.

XSS will continually be a topic on this blog as well as others [1],[2],[3],[4]. Due to this fact, I think a primer would be a good idea for those who don't know or understand this problem.

Many articles have been written about Cross-Site Scripting and if you want to have a better understanding of the problem, I suggest you read those documents (Links at the bottom of the post).

Basically, There are 3 types of Cross-Site Scripting:

1. Stored/Non-Reflective/Persistent Cross Site Scripting (User visits the XSS'ed page)
   
2. Non-Stored/Reflective/Reflected Cross Sited Scripting (User clicks a link that embeds the script into the loaded page)
   
3. DOM Based Cross Site Scripting (please read this article)
   

All of these names make it confusing for a first timer to understand XSS. There really should be a better web application security standards organization. Here is a breakdown of Persistent XSS and Reflective XSS. These are the big two that most people talk about when they are referring to Cross Site Scripting. If you understand these well, you will be able to participate in 90% of XSS conversations.

Persistent Cross-Site Scripting
Persistent XSS is arguablly more dangerous than reflective XSS. This attack embeds the malicious script permenatly into the web application. The script will then wait until people access the page it is located on.

Here is an attack using Persistent Cross-Site Scripting:

1. The victim visits a website they trust, amazon.com.
2. A script has been inserted by an attacker on a page they happen to visit while on amazon.com.
   
3. The script executes in the context of amazon.com.
4. The victim is then compromised.
   

Note: Obviously, someone can increase the chances of the victim visiting this page (step 2) through social engineering, phishing, etc.

Reflective Cross-Site Scripting
These are the ones the media usually reports on. [1],[2],[3]. In this attack, some type of social engineering is involved for the attack to be successful.

Here is an attack, using Reflective Cross-Site Scripting:

1. The victim gets an email/Instant Message that contains a link.
2. The victim clicks the link. (Requires User Intervention)
   
3. A script has been inserted by an attacker on the page they then visit.
   
4. The script executes in the context of that site.
   
5. The victim is then compromised.
   

Note: I want to reitterate that this attack requires some type of user intervention (step 2).

Why is Cross-Site Scripting Bad?
Cross-Site Scripting can lead to all sorts of different exploits, including system compromise. For an attacker to do this, they need to break out of the browser's context. We have seen examples that breaking out of the browser is not that hard to do.

In addition, an attacker can also establish a bi-directional channel using iframes. This creates a man-in-the-middle attack. The attacker can then intercept key strokes, use the victim as an intranet portscanner, and even stealing creditials. The attacker is only limited by their knowledge of scripting.

Example of a bi-directional channel

Hopefully, this gives you a better understanding of Cross-Site Scripting. Feel free to leave comments if you don't understand something and I will address it in the article.

Additional Resources:
Cross-Site Scripting (XSS) FAQ
OWASP Guide to XSS
XSS tutorial
XSS Video Tutorial (via youtube)
XSS Attack API

5 Key Factors of Complexity

Brian J. Truskowski, General Manager of Internet Security Systems (ISS), gave a keynote presentation at RSA 2009. His talk touched on an interesting topic that he referred to as the "5 Key Factors of Complexity."

He identifies that the key cause of compromise is human nature; the ability that humans are susceptible to social engineering. Instead of focusing on securing systems, Mr. Truskowski argues that we should design systems that are "resistant to human frailty." He goes on to state, that designing these systems (by reducing complexity) is difficult.

According to Mr. Truskowski, the 5 key factors of complexity and the key to designing these systems are:

1. Threats
   
2. Compliance
3. Technology
4. Economics
   
5. Business Needs

Contrary to security, Businesses have to keep focused on all of these factors or they will be unsuccessful. Vendors however, are according to Mr. Truskowski, only focused on one of these factors... Threats. He argues, If an enterprise doesn't focus on compliance, they are fined. If a business doesn't focus on business needs, the business can't change.

"It's like building the titanic. The ship's designers optimized around being able to withstand collisions at the sacrifice of maneuverability. There have been many theories over the years over why the Titanic sank, from Brittle steel to sub-standard rivets. But, in reality, it is obvious why the Titanic sank. It couldn't get out of the way of the iceberg. The Titatic's designers focused on size, strength, resilience, and luxury but not on maneuverability."

I think Mr. Truskowski's talk was the hidden gem at RSA. It is an interesting idea for security vendors to begin focusing on things other than threats. Of course, if the idea gets legs, it will be 10-15 years before any change occurs. It is great to see people thinking holistically about security.

The video/webcast can be seen here: (5 Factors of Complexity starts at 19:49)

http://media.omediaweb.com/rsa2009/webcast.htm?id=3_1

Buzzword: Managed Services

What is the word most likely to be heard at a non-technical security conference? If you said, "Managed Services," "Managed Information technology services," "Managed Solutions" or some variant of it, then you have been spending too much time at security conferences.

Managed Services is the idea that you take some piece of your company and have someone else do it. Companies typically take something that is expensive for them to do and then outsource it. For instance, most large companies pay an accounting firm, such as a Big 4,  to do their taxes instead of having a dedicated tax department. This of course is an analog managed service, and is sometimes regulated by compliance. Another analog managed service would be a law firm.

The type of managed service this article is referring to is a digital one. The idea that you can pay someone to outsource some piece of your general solution. That could be web hosting services or security services.

Although managed services is not a new idea, it is gaining snow-ball style momentum. There are, of course, companies who have built their entire model on Managed Services such as Savvis and Akamai. More recently, larger companies are jumping on the band wagon to also offer managed solutions. These companies include, AT&T, BT, and an unlikely candidate Amazon with their S3 cloud/EC2.

So, if you want to make sure your company can play with the big boys, make sure you have a managed service solution.

Note: Totally off topic from the Buzzword itself is the site, www.managedsoultion.com. They cashed in on the buzzword and actually named the company after the buzzword. I am going to start making a note on each buzzword to see if any other companies have done the same. Great Marketing!

Buzzword: Compliance

Compliance is not a new buzzword, in fact in other industries compliance has been around a long time. During the RSA conference, every vendor had the word compliance on their cardboard bulletin board, an adult version of a diorama. [1]

What are the different types of compliance?

In computer security, compliance began with the government. This is where all good ideas come from (sarcasm). Over time compliance regulations evolved into something that was "needed" by the industry to make sure that corporations took steps to protect their user's data. It is sad that corporations need an intervening body to tell them that they should secure their data. However, this is why HIPPA and SOX came about. Why should a hospitial spend money to protect patient's records? That is crazy talk!

I have been in the security community for a long time and I hate to tell you but companies will never care about security. They will do the minimum thing required in order to satisfy the masses. In the U.S. the only thing that matters is the bottom line. Companies pay for Cost-Benefit analysis on things to determine what the corporate strategy should be. Corporations don't do this because they care about the result, they do it to save money, thus being profitable for their shareholders.

If the only thing that matters is the bottom line, you need independent regulatory agencies to mandate certain rules for the greater good.

As long as consumers believe that the products they buy are safe, they will continue to buy them.

Let's take the protection on a container of Tylenol. In 1982, a bunch of people were poisoned in Chicago because someone decided to put potassium cyanide in random bottles of Tylenol. What was the result of this? The market share of Tylenol dropped from 35% to 8%. It took an entire year for Johnson & Johnson to grab the market share again. They did this by creating a triple-sealed package and dropped their cost to be more competitive. After this Johnson & Johnson grabbed more market share than they had before!

In this example, the consumer stopped trusting that Tylenol was safe and subsequently stopped buying Tylenol. They didn't stop buying medicine just Tylenol. The attacker could of poisoned other bottles too, but that didn't matter. What the customer cared about was the saftey of a product. When the consumer felt good about Tylenol again, they begin buying the product again.

The purpose of compliance is to make the consumer feel safe. The government needed to step in and mandate in order to have the people feel protected.

Does compliance work?

It depends on who you ask. Mike Bailey doesn't think so. However, others do. For instance, Companies that make profit from compliance defiantly think it works.

Why is compliance so often talked about?

Companies that do cost-benefit analysis like the ones above need to be compliant. They will comply the cheapest way they can, thus keeping their operating costs low. Companies will continue to offer cheaper and cheaper compliance products. Just remember, they get what they pay for.

Verizon's 2009 Data Breach Investigation Report

Verizon's annual data breach investigation report came out last week, and I finally had a chance to read through it. I read others security bloggers synopsis of it but none of them seemed to point out anything that was interesting to me.

Here is the interesting bit that I found: Verizon actually recorded someone using XSS as an attack vector.

Typically, it is very difficult to find anything online that points to people using XSS maliciously. Most of the time, XSS is used to increase page views (recent Mikeyy worm) or for popularity (Sammy Worm).

We, the security community, now have some type of hard evidence to explain how XSS could potentially be an issue for companies. Is this enough to bring awarness to management?


Technorati Tags: Verizon 2009 Data Breach Investigation report 2009 XSS Sammy Worm Mikeyy