Web Security

What is OWASP?

What we will learn?

Top 10 Security Mistakes

1. Injection

Injection flaws, such as SQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing unauthorized data.

Example 

attackableQuery= "Select * from products where name=" + params[:id] + "'";
# Code expects a parameter in the url like  http://www.example.com/products?id=123
# Hacker could instead supply this http://example.com/products?id="; DROP+TABLE+'products';

Countermeasures

2. Cross Site Scripting

XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation and escaping.  XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

Example

class SearchController
  
  def show
    @title = params[:title]
    @results = call_to_backend
  end
end


#index/show.html.erb

<div id="title">
  (@results.title || @title).html_safe
</div>

# Allowing GET requests to change the state of the resource

<img src="http://www.webapp.com/project/1/destroy">

Countermeasures

3. Broken Authentication & Session Management

Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, session tokens, or exploit other implementation flaws to assume other users’ identities.

Example

Timeouts aren't set properly and user logs in terminal at library and then closes the browser instead of logging out. Then next user goes to the terminal and the user is still logged in. 

#Session ID is exposed as URL

http://example.com/sale/saleitems;jsessionid=2P0OC2JDPXM0OQSNDLPSKHCJUN2JV
?dest=Hawaii

Countermeasures

• Use SSL wherever possible, this will make it extremely difficult to sniff session-ids.
• Encrypt your session-ids and include user-ip's, username and timestamp in your session-id. 
• Forces the user to include spoof IP addresses
• We need to figure out what kind of damage can hacker makes when the session-id is stolen.
• We need to do some kind of audit assuming the session-id is stolen especially if its stolen for admin. 
• Should we ask user's to re-login to access extremely sensitive data?

4. Insecure Direct Object Reference

A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to access unauthorized data.

Example

# your collections url

http://opl.bibliocommons.com/projects/1


class ProjectsController
  before_filter :authenticate
  
  def show
    @project = @project_service.get(params[:id])
  end

  def authenticate
    #verify if the user is logged in
  end
end

# The mistake is logged in user can easily change the url and get the project # 2 as long as user is logged in.

Countermeasures

5. Cross Site Request Forgery (CSRF)

A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.

Example

http://example.com/app/transferFunds?amount=1500&destinationAccount=4673243243

<img src="http://example.com/app/transferFunds?amount=1500&destinationAccount=attackersAcct#" width="0" height="0" />

Countermeasures

References