Web Application Security and Why You Should Review Yours

1 .Web Application Security And Why You Need To Review Yours David Busby Percona 

2 .Who am I? ● David Busby ○ Contracting for Percona since January 2013 ○ 18+ years as sysadmin / devops / security ○ Volunteer work: ■ Assistant Scout Leader ■ Assistant Instructure (computing for children) ■ ex-Assistant coach Ju-Jitsu (Nidan) ○ Security “nut” ■ Lifetime member of the “tinfoil hat” club ○ C.I.S.S.P ■ 581907 2 

3 .Talk Agenda ● What we will cover ○ What is an “attack surface”? ○ Acronym hell, just what do those mean ? ○ Vulnerability naming, new trend or benefit ? ○ Detection, Prevention, or both ? ○ Emerging technologies / projects. ○ 2014 -> 2019 highlights ○ Live compromise demo covering everything we’ve discussed as ‘bad’ ■ Video for time 3 

4 .What is an attack surface ? 

5 .What is an attack surface ? Assessing your attack surface can feel like... 5 

6 .What is an attack surface ? What it really is ... I built an awesome Failed to Fined in EU court SaaS everyone will consider data for GDPR violation like! privacy Built an awesome unaware of the Web app now full web application for dangers of of ‘adult’ content. hosting cat pictures user-content Who cares about Breach / hack ? Just ship it now! security anyway We’ve got ? insurance! 6 

7 .What is an attack surface ? ● An attack surface is any point in which your org, person, application, provider may be attacked. ○ Your web application ○ Your database ○ Your physical systems ■ Yes we’re also including your laptops, cellular device and the all B.Y.O.D ○ Your network ○ Your staff! ○ Your hosting, processing, other providers. ■ Insurance providers will only “pay out” if you can prove you have taken commercially reasonable measures to protect your system(s) and data. ■ They are not the “catch all” safety net some perceive them to be. 7 

8 .What is an attack surface ? ● Application ○ Sanitize ALL user inputs. ○ Implement audit logs! ■ An audit log should contain enough detail to reverse the actions taken. ■ An audit log should contain accurate time keeping. ■ An audit log MUST be shipped OFF the device on which it is generated. ○ Recurring audit procedures. ■ Logs are GREAT! Unless no one is looking at them ... ○ Mandatory access control ○ Ingress and Egress filtering ○ Web Application Firewalls (WAF) ■ aka Layer 7 firewall ○ Intrusion Prevention Systems ○ Implement CSRF / XSRF protections ■ e.g. csrf_tokens in cookies. 8 

9 .What is an attack surface ? ● Database ○ Network Isolation! ■ Only allow access from known web app nodes! ■ Only allow access to known hosts! ■ Default (on most RDBMS) is to bind to 0.0.0.0:$DB_PORT (which is listen to all interfaces) ■ ~5M MySQL hosts noted on shodan.io ● 5.0, 5.1, both forks are EOL! ○ Selective permissions ■ STOP granting “ALL ON *.*” Please! ○ Password complexity ■ Still important today! ○ Mandatory Access Control ■ SELinux in enforcing mode please! ■ GRSecurity, AppArmor etc. 9 

10 .What is an attack surface ? ● Physical Systems ○ LIMIT physical access to your systems ○ Barclays bank in 2014 had £1.3m stolen ■ Adversaries used KVM over 2.4Ghz wifi after posing as a service company ■ No one checked, and they were allowed unchallenged access to workstations. ■ Social engineering ? This is nothing new this is con-artistry. ○ Deploy multiple layers of protection for physical assets. ■ 2FA - (yes you can have this even on laptops) ■ Encryption (LUKS, eCryptFS, Bitlocker, Filevault) - especially on laptops! ○ Disable unneeded services / functionality ■ Your 1u rackmount likely does not need bluetoothd! ○ Do not rely on a single measure for protection e.g. biometrics. ■ The mythbusters defeated a >$10k biometric lock with a photocopier ... ○ Challenge “implied trust” a badge or uniform != ID ■ It is OK to ask for ID and check for authorization, ● we do this with systems without thinking about it, ● we should apply this to people too! 10 

11 .What is an attack surface ? ● Network ○ Isolation! (A.C.L) ■ Your web app needs to talk to your database service. ■ It doesn’t need to talk to SSH on the server. ■ OS Native firewall works if nothing else: ● iptables, ufw, pfctl, NetFirewallRule. ○ Your chosen DBMS DOES NOT need to be accessible from everywhere! ■ MongoDB, Elasticsearch -> Ransomware ? ● No! Malicious users taking advantage of DBMS left open (default OTB configuration) ! ● Vertifications.io Breach in Feb 2019 was MongoDB left open (>2Bn records leak) ! ○ Network Intrusion Detection System - NIDS / Network Intrusion Prevention System (NIPS) ■ Suricata, Zeek (formerly Bro), Snort, are all great and OSS! ● (I use suricata which can be both) ○ Segregation ■ Implement vlans and ACLs ■ prevent cross-vlan traffic unless implicitly allowed! 11 

12 .What is an attack surface ? ● Your staff (layer 8, meatware, P.E.B.K.A.C ...) ○ Awareness training ○ Social media training and policy ■ It _used_ to be hard to find out about an organisation now it’s all open for all to see in most cases. ● Linkedin, facebook, instagram, etc ... ○ B.Y.O.D ■ Your “smart” phone, is the single most valuable asset to an adversary. ● It’s unlikely to have any hardening, D.L.P protection. ● It’s likely to have access to Mail, Cloud files, calendars, VPN, SSH, RDP, VNC, etc ... ● It’s likely to be running an out of date OS ○ Remote (wireless) attacks ■ WiFi: Karma (was Jasager), Rogue A.P. (hostapd), etc... ■ Bluetooth: bluesnark, snoopi, BtleJuice, etc ... 12 

13 .What is an attack surface ? ● Your staff (layer 8, meatware, P.E.B.K.A.C ...), continued ○ Malicious USB devices ■ Malicious H.I.D., rubberDucky, BadUSB, pwnpi, malduino, bashbunny, usbninja ■ Think twice before plugging that USB device into your system ... ● USB ‘condoms’ exist, now more commonly known as USB Data blockers. ○ Malicious peripheral devices. ■ Thunderstike2 targeted Thunderbolt devices. ■ PCILeech - D.M.A. access via Thunderbolt allowed recovery of filevault2 passwords. ○ Social engineering... ■ “Hello I’m calling from the windows support centre about your windows PC...” ■ “Do you have a phone? Could I borrow it for a magic trick? ... BYE!” 13 

14 .“High tech gadgets” ● The BBC Article on the Barclays £1.3m “haul” noted the use of “high tech” gadgets. ○ They are now commodity gadgets! ■ RubberDucky $45 ■ bashBunny $100 ■ Maldunio £13.00 / £24.00 (Elite) ■ usbNinja $99 ■ WiFi pineapple ● Nano $100 ■ You also can use a PiZero and some soldering for all this. ○ Accessing the tools to demonstrate “Edge case black hat nonsense” has never been easier. ○ Use a wireless mouse / keyboard ? ■ Sorry, not sorry ... >) 14 

15 .“High tech gadgets” 15 

16 .“High tech gadgets” ● Let’s talk about malicious HID... ■ Live demo time! 16 

17 .Acronym Hell Just what do they mean? 

18 .Acronym hell? 18 

19 .Acronym hell? ● In Security we <3 acronyms as much (if not more) than DevOps, Sysadmins, DevSec ... ○ I.P.S ■ Intrusion Prevention System (Can be Host based, Network Based or both) ● H.I.P.S, N.I.P.S ■ Host Based: ● File Consistency Enforcement ○ I.D.S ■ Intrusion Detection system (Again can be host based, network based or both) ● H.I.D.S, N.I.D.S ■ Host Based: ● File Consistency Monitoring ● Auditd can be set to monitor (watch) directories. ● Inotify events can be used if you want to ‘roll your own’ ○ W.A.F ■ Web Application firewall ● Layer 7 protection against SQLi, XSS, and other known attacks ● mod_security 19 

20 .Acronym hell? ● Continued ... ○ S.C.A.D.A ■ Supervisory Control And Data Acquisition ● Industrial foundries, nuclear power plants, hydroelectric dams, diesel engine testing facilities, point of sale, Hospital beds ... ■ I.o.T ● Internet of Things ● If there can be a thing, and you can put a webserver on the thing; should you put a webserver on the thing ? - Viss ■ A.C.L ● Access Control Lists ■ P.O.L.P ● Path of Least Privilege ■ M.A.C + D.A.C ● Mandatory Access Control ● Discretionary Access Control ○ There’s plenty more ... 20 

21 .Vulnerability naming Stupidity or ... ? 

22 .Vulnerability naming ● MeltDown ○ CVE-2017-5715,CVE-2017-5753 ● Spectre ○ CVE-2017-5754 ● P.O.O.D.L.E ○ CVE-2014-3556 ● C.R.I.M.E ○ CVE-2012-4929 ● B.E.A.S.T ○ CVE-2011-3389 ● HeartBleed ○ CVE-2014-0160 ● DirtyCow ○ CVE-2016-5195 22 

23 .Vulnerability naming ● Naming _can_ help ... ○ There are of course some exceptions such as: ■ When $media completely fail to understand the problem e.g. “Heart Bleed Virus” ■ When $expert uses this for satire and is taken seriously by $media instead. 23 

24 .Detection, Prevention, Both, Neither ? 

25 .Detection, Prevention, Both ? ● Detection ○ I.D.S ■ Can be on your hosts / servers ● Hostbased Intrusion Detection System ● Aka File consistency monitoring ■ Can be on your hosts / servers / firewalls network ● Monitors network for known intrusions ● Rule based (Signature based). 25 

26 .Detection, Prevention, Both ? ● Detection ○ I.D.S 26 

27 .Detection, Prevention, Both ? ● Prevention ○ I.P.S ■ Can be on your hosts / servers ● Hostbased Intrusion Prevention System ● Aka File consistency enforcement ■ Can be on your hosts / servers / firewalls network ● Monitors and prevents network for known intrusions ● Rule based. 27 

28 .Detection, Prevention, Both, Neither ? 28 

29 .Detection, Prevention, Both ? ● No single solution is going to cover all your use cases. ● I.D.S is great ○ _IF_ someone/something is watching the logs 24x7 and responding to them ● I.P.S is great ○ _until_ it blocks your staff trying to do something and they use an insecure network to do it anyway. ■ e.g.: Our corporate web filter is blocking access to your support portal, so I am accessing it in the office from my cell phone ... ● Choose what fits your use case ○ I.P.S on webapps makes sense if you don’t expect file edits. ■ They are really easy to write (I wrote one in python using gamin to hook inotify events, to work with SCM to produce diff and revert php files ON_WRITECLOSE) ○ I.P.S makes sense on the network edge ■ RUN RECURRING TESTS/Exercises! 29