Web System Security

Jamie Pate

• Sr Web Developer
• Fortinet
• Fortigate firewall appliance

Overview of basic aspects of Web System Security

Web Systems

what is a web system

The internet is a Series of tubes

• historically non-secure
  • plain text -> https
• connecting (all) computers
• can't block everything
  • providing a service
• increasingly complicated systems
• clients and servers

Links to exploit

• Transport and protocols
  • plain text
  • ssl/tls and https
  • mitm
• Web Serving Software
  • holes in Apache, IIS, Nginx etc
  • configuration issues
    • information disclosure
    • xss reflection

CGI - Server programs

Custom code running on a web server

• Fewer eyeballs
• Naive implementations
  • validation
  • xss
  • csrf
• Library imports
  • unknown quality
  • orphaned code
  • ↱

Database

• Parameterized queries
• input sanitation
• whitelisting

or else:

bobby-tables.com

Web Clients

• HTML5 feature explosion
• 19% decrease in 2013
• 47% increase since 2009
• Most browser vulnerabilities patched in less than 30 days.

secunia.com

Statistics for 2013
Market share counts installations, not active users

Web Client

Attacks enabled by sites:

• XSS Cross Site Scripting
  • Unsanitized user input presented as content
  • xss-game.appspot.com
• CSRF Cross Site request forgery
  • Trick users into posting to authenticated url
  • Prevented with a session-unique CSRF form parameter

honeybadger.io

n0p.net 2006

Secure Transport

Transmit via HTTPS

• Layers HTTP on SSL/TLS
• Prevents:
  • Wiretapping
  • Man In The Middle
• Certificate authorities are a weak link
  • HSTS Strict-Transport-Security header
  • Public key pinning
    • NTP-based attacks

HeartBleed

OpenSSL

TLS Heartbeat

April 7th 2014:

A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64kB of memory to a connected client or server

Root Cause

Buffer under-read:

        unsigned int payload;
        unsigned int padding = 16; /* Use minimum padding */
 
       /* Read type and payload length first */
       hbtype = *p++;
       n2s(p, payload); //n2s macro copies 16 bits from p to payload (length) without validation!
       pl = p;

        if (s->msg_callback)
                s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
                        &s->s3->rrec.data[0], s->s3->rrec.length,
                        s, s->msg_callback_arg);
 
        if (hbtype == TLS1_HB_REQUEST)
                {
                unsigned char *buffer, *bp;
                int r;
 
                /* Allocate memory for the response, size is 1 byte
                 * message type, plus 2 bytes payload length, plus
                 * payload, plus padding
                 */
               buffer = OPENSSL_malloc(1 + 2 + payload + padding); //magic numbers, \o/
                bp = buffer;
 
                /* Enter response type, length and copy payload */

//...
                /* Random padding */
                RAND_pseudo_bytes(bp, padding);
 
               r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);

Resolution

        unsigned int payload;
        unsigned int padding = 16; /* Use minimum padding */
 
        if (s->msg_callback)
                s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
                        &s->s3->rrec.data[0], s->s3->rrec.length,
                        s, s->msg_callback_arg);
 
+       /* Read type and payload length first */
+       if (1 + 2 + 16 > s->s3->rrec.length)
+               return 0; /* silently discard */
+       hbtype = *p++;
+       n2s(p, payload); //copy 16 bits from p as payload length
+       if (1 + 2 + payload + 16 > s->s3->rrec.length)
+               return 0; /* silently discard per RFC 6520 sec. 4 */
+       pl = p;
+
        if (hbtype == TLS1_HB_REQUEST)
                {
                unsigned char *buffer, *bp;
+               unsigned int write_length = 1 /* heartbeat type */ +
+                                           2 /* heartbeat length */ +
+                                           payload + padding;
                int r;
 
+               if (write_length > SSL3_RT_MAX_PLAIN_LENGTH)
+                       return 0;
+
                /* Allocate memory for the response, size is 1 byte
                 * message type, plus 2 bytes payload length, plus
                 * payload, plus padding
                 */
+               buffer = OPENSSL_malloc(write_length);
                bp = buffer;
 
                /* Enter response type, length and copy payload */
//...
                /* Random padding */
                RAND_pseudo_bytes(bp, padding);
 
+               r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, write_length);
 
                if (r >= 0 && s->msg_callback)
                        s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
+                               buffer, write_length,
                                s, s->msg_callback_arg);

Social Root Causes

openbsd.org

Enter LibreSSL

Shell Shock

Bourne Again SHell

aka "bashdoor"

Environment Variable Expansion

Coding like it's 1989:

+ #define SEVAL_FUNCDEF 0x080       /* only allow function definitions */
+ #define SEVAL_ONECMD  0x100       /* only allow a single command */

Opaque state machines!

          struct fd_bitmap *bitmap;
  
+         if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def)
+       {
+         internal_warning ("%s: ignoring function definition attempt", from_file);
+         should_jump_to_top_level = 0;
+         last_result = last_command_exit_value = EX_BADUSAGE;
+         break;
+       }
+ 
          bitmap = new_fd_bitmap (FD_BITMAP_SIZE);
          begin_unwind_frame ("pe_dispose");

Only allow function definitions (don't call them!)

evalstring.c

Social Cause

• The flaws in Bash were in a quite obscure feature that was rarely used.
• Most of Bash was written in 1989. C code style has come a long way
• Code appears to have grown organically, liberal use of global variables 

After Shock

• Scrutiny caused by shellshock revealed that the fix was incomplete.
• At least 5 more vulnerabilities
• privilege escalation
• DOS
•  memory corruption, and possible arbitrary code execution
• Generally not as ... shocking

Web System Security

Web security has many layers

• Http daemon
• Database
• Browser/client
• Network

Top 10 Intrusions

1. Bash.Function.Definitions.Remote.Code.Execution
2. OpenSSL.ChangeCipherSpec.Injection
3. PHP.CGI.Argument.Injection
4. OpenSSL.TLS.Heartbeat.Information.Disclosure
5. HTTP.URI.SQL.Injection
6. Joomla.JCE.Extension.Remote.File.Upload
7. HTTP.XXE
8. OpenSSL.Heartbleed.Attack
9. Open.Flash.Chart.PHP.File.Upload
10. Adobe.Flash.Player.Argument.Index.Memory.Corruption

http://www.fortiguard.com/fortiguard_labs/threat_monitor