OWASP Summer of Code 2008

OWASP is now launching the Summer of Code 2008 (SoC 2008)

• The SoC 2008 is an open sponsorship program were participants/developers are paid to work on OWASP (and web security) related projects.
• The SoC 2008 is also an opportunity for external individual or company sponsors to challenge the participants/developers to work in areas in which they are willing to invest additional funding.
• The Open Web Application Security Project (OWASP) is a worldwide free and open community focused on improving the security of application software. The mission is to make application security "visible," so that people and organizations can make informed decisions about application security risks.
• The only requirement is that the candidate shows the potential to accomplish the project's objectives/deliveries and the commitment to dedicate the time required to complete it in the appropriate period.

More Details

Hacking Web Applications – Truly Simple

Application Hacking is the trend of the industry. It started with viruses and worms – The age of anti-virus. It evolved with the internet as more corporations developed internal and external networks – The age of Network Security. Now as industry has been powered with World Wide Web, information security has reached its third age – The age of Application Security. Application attack is one of the hardest attacks to recognize and defend against, as it uses your programs and systems against you.

If we recall the attacks few years back, we see that most of the organizations including NASA, CIA and Yahoo were attacked. These attacks were mostly at network layer of the corporate systems. The network layer is now very secure and hackers find it difficult if not impossible to attack at the network layer. Today, applications are the target. Attackers steal credit card numbers from bank site and an intruder breaks into a corporate application stealing sensitive employee information. Hackers use the application sitting behind the strong firewall and use a loop hole in the application to access corporate and customer data. As the industry embraces the benefits of e-business, the use of Web based technologies will continue to grow. However, as these technologies evolve, the vulnerabilities are being discovered at a similar rate. Secure implementation of these technologies cannot be achieved without a consistent approach to Web Application Security. Also the convergence of regulatory demands for application security with an increasingly security-savvy software buyer is driving a serious impetus for change.

Whether a security breach is made public or confined internally, the fact that a hacker has broken into your online assets should be a huge concern to organizations. Quite a large number of organizations are reactive to security incidents, pretending that the problem will go away. They respond with short-term fixes and the problems re-emerge rapidly. They fail to recognize the value of information and company reputation as opposed to cost of addressing security vulnerabilities.

Unlike certain worms and viruses that exploit the network security weaknesses, web application attacks go after flaws in the application itself. For example, an attacker could tamper with a part of HTTP request and use buffer overflows to corrupt an application by having it execute arbitrary code. In this way, an attacker could take control of the web or application server.

Ahh! We have a very strong password policy. But are passwords sufficient? Passwords are only as trustworthy as the people using them. If you rely on passwords to protect your online assets, then you are relying entirely on the people logging in and out. Let’s just draw a real world example. With popularity of social networking sites like www.orkut.com, we find thousands of people listing down their organization name and their work profile in public. What’s more concerning is they also list their family members with information of names and ages of their children. There is very high probability that a hacker may be able to find out a person’s password from the above information and get inside the organization’s defenses very quickly. Passwords are not sufficient to provide security to your online applications.

Does your firewall protect online assets? The traditional function of a firewall is to regulate the ports and services running on the server. Web applications by and large use port 80; and the firewall keeps this port open. This is the gold spot for the attackers. The beauty of application attack lies in sneaking through your firewall and use the application itself to break it. Firewalls cannot protect you from this happening.

With hacking tools being readily available and the complexity of attacking decreasing, it is relatively easy to find flaws in an application. A hacker could easily change the hidden fields of an online shopping site indicating price and smartly walk away without paying money. This is largely because while building applications, some of the most basic security measures, to keep information secure, were ignored. The cost of poor application security can be far greater than most organizations can imagine.

Organizations must take a proactive approach in protecting their critical web applications. The need lies in understanding how important application security is in the software development cycle. Application security must align as early as during requirement gathering, making way in secure design, development and deployment.

We are witnessing the emergence of more security-savvy buyer of software asking questions about the security practices and those are having a big impact on purchase decision. In long run, these companies will surely enjoy a higher return on investment.

Virtualization : Is it Secure?

Virtual machines are often used by security researchers to sandbox malware samples for analysis, or to protect a machine from a potentially hazardous activity. The theory is that any security threat or malicious behaviour will be restricted to the virtual environment which can be discarded and then restored to pristine condition after use.

Virtual machines are sometimes thought of as impenetrable barriers between the guest and host, but in reality they're (usually) just another layer of software between you and the attacker. As with any complex application, it would be naive to think such a large codebase could be written without some serious bugs creeping in. If any of those bugs are exploitable, attackers restricted to the guest could potentially break out onto the host machine.

Tavis Ormandy working with Google Inc., investigated this topic and presented a paper at CanSecWest on a number of ways that an attacker could break out of a virtual machine.

Most of the attacks identified were flaws, such as buffer overflows, in emulated hardware devices. One example of this is missing bounds checking in bitblt routines, which are used for moving rectangular blocks of data around the display. If exploited, by specifying pathological parameters for the operation, this could lead to an attacker compromising the virtual machine process.

While you would typically require root (or equivalent) privileges in the guest to interact with a device at the low level required, device drivers will often offload the parameter checking required onto the hardware, so in theory an unprivileged attacker could be able to access flaws like this by simply interacting with the regular API or system call interface provided by the guest operating system.

Things you can do to help end Phishing

• Learn to recognize and avoid phishing. The Anti-Phishing Working Group has a good list of recommendations.
  


• Update your software regularly and run an anti-virus program. If a cyber-criminal gains control of your computer through a virus or a software security flaw, he doesn't need to resort to phishing to steal your information.
  


• Use different passwords on different sites and change them periodically. Phishers routinely try to log in to high-value targets, like online banking sites, with the passwords they steal for lower-value sites, like webmail and social networking services.

Using IT to Combat Money Laundering

Money Laundering in simple words is about making money that comes from a ‘source a’ look like it has come from ‘source b’. This in world of software is also called repudiating one’s identity. Money Laundering has been practiced generally by criminals trying to disguise the origins of money obtained from illegal activities to craft them in a way that they seem to originate from legitimate sources. This is mainly to prevent them connect them to criminal activity. The most common offenders in this process are drug traffickers, corrupt politicians, terrorists and con artists.

Financial Institutions and Banking Institutions are amongst the most vulnerable to Money Laundering as illegal money enters the economy via banks in the form of large cash deposits or illicit financial transactions.

Money Laundering typically has 3 main phases – Placement, Layering and Integration. The common methods used in each of these phases are mentioned below:

1. Placement Stage: This prefers to the physical disposal of bulk cash proceeds derived from illegal activity.
a. Cash paid into bank (mostly with staff involvement or mixed with proceeds of legitimate business.
b. Cash used to purchase high value goods, property or business assets.
c. Cash being exported.

2. Layering Stage: This refers to the separation of illegal entrance of money from their source by creating complex layers of financial transactions. Layering conceals the audit trail and provides anonymity.
a. Several bank to bank transfers
b. e-transactions between different accounts in different names in different countries
c. Changing money’s currency
d. Resale of goods or assets

3. Integration Stage: This refers to the reinjection of the laundered proceeds back into the economy in such a way that they re-enter the financial system as normal business funds.
a. False loan payments
b. Forged invoices used as cover
c. Presenting income from property or legitimate business assets to appear clean

Using Information Technology to combat Money Laundering

While money laundering techniques are becoming sophisticated, so is the technology used to fight it. IT systems cannot be viewed as perfect solutions for Anti-Money Laundering techniques, but current packages have following to offer. Use of these packages enables banks to know and understand their customers and their financial dealings to help them manage risks prudently.

1. Competent for Name Analysis
2. Offer case based account documentation acceptance and rectification
3. Assess Money Laundering Risks at both Account and Customer levels
4. Rules-based systems
5. Include Statistical and Profiling engines for monitoring customers
6. Use Neural Networks and Link Analysis to detect frauds
7. Time sequence matching to prevent Hawala cases
8. Can monitoring transactions for suspicious activity
9. Helps ensure compliance to Banking or Financial standards for Anti Money Laundering
10. Investigation Tools

Effect On Our Economy

Money laundering is one of the ongoing problems facing the international economy. The economic effects are on a broader scale. Developing countries often bear the brunt of modern money laundering because the governments are still in the process of establishing regulations for their newly privatized financial sectors. There is also a growing realization about the extent that money laundering and its relationship with organized crime are interlinked.

The huge profits that accrue to these criminals from areas such as drug trafficking, international fraud, arms dealing, trafficking in human organs, will be used not only to facilitate ongoing operations, but to consolidate the wealth, prestige and respectability of those in control of the criminal business.

Hawala transactions have a huge impact on the economy. Various commercial activities get influenced. In fact, the price of land has been spiraling due to the activities of this mafia. The root of the problem can be traced to the policies of Government both at the Centre and the State. Inflation, rise in the land prices and circulation of black money are among the effect of money laundering methods circulating in the system. If left uncontrolled, it would lead to creation of a parallel economy which will destabilize our country. These artificially created inflated financial sectors create errors in economic policies. Massive influxes of dirty cash into particular areas of the economy that are desirable to money launderers create false demand, and officials act on this new demand by adjusting economic policy.

Issues on a local scale relate to taxation and small-business competition. Money from illegal activity is often untaxed which means the rest of us ultimately have to make up the loss in tax revenue. Also, legitimate small businesses can't compete with money-laundering front businesses that can afford to sell a product for cheaper because their primary purpose is to clean money, not turn a profit.

Money Laundering is a major concern because of its scale, its capacity to exploit and influence the legitimate business world and its capacity for internationalization. These concerns have led to concerted international action for a solution to combat this growing menace called Money Laundering.

Guarding Against Credit Card Frauds

The percentage of people using plastic money (cards) for transactions is growing day by day and so are the card scams rising along. We often hear or read about credit card frauds in our daily and how people end up in nightmares seeing huge bills for things they actually have never purchased. Likewise even the credit card companies are paying off handsome amount from their profit share to cover these fraudulent transactions.

Let me bring up few ways in which these frauds happen. By and large for physical credit card transactions, the deception story starts when the person who takes your card for swipe copies your card information to some other device. Later these details are copied to fake cards which are genuine card look alike with complete hologram markings and logos. The poor card holder remains completely unaware that his card has been cloned until he notices bill amounts of things he has never purchased. One of the other common methods is making a hoax call (often representing as card issuer authority) to the card holder and trying to retrieve card details. Credit card bills lying in trash cans or public places are other avenues where fraud originates.

Regarding users using cards for online transactions, one can see a large number of ways in which card data can be compromised. Falling in prey of a nice email asking for card details in return of discounts, or emailing card details to a friend or being a victim of card details being copied by an illegal software installed in cyber cafes are most common lines of attack sources.

One of the reasons in increasing successful frauds is inadequate knowledge of the card owner on proper use of credit cards. Here’s how credit card owners can better safeguard from these frauds.
• Over a credit card transaction, keep an eye on your card as it is being swiped. Make sure it is being swiped only once for a single successful transaction and get back your card as quickly as possible.
• Sign your credit card as soon as you receive it.
• Be protective of your credit card number so that others around you can't copy it or capture it on a cell phone or camera.
• Be prompt in keeping a check on your credit card bills to verify there are no bogus charges. For any charges that you don’t recognize, report these charges promptly to the card issuer.
• For people using cards at hotels or restaurants, remember to draw a line through blank portions of the receipt where additional charges could be fraudulently added other than hotel tips.
• In case of change of your billing address, notify your credit card issuers in advance so that bills reach safe hands.
• Save your receipts so you can compare them with your monthly bills.
• Always give your phone number to the company for verification of suspicious transactions.
• Be wary of any phone call or email seeking details of your account.
• Never give away photocopies of both sides of your credit card for any purpose.
• For online transactions, using credit card, remember to go by HTTPS and not HTTP.
• Avoid having e-transactions in a publicly share machine like Internet café or open free wireless network.

Online Banking Security

Banks today are increasingly getting introduced to a number of security threats. The ones in headlines have been Phishing, Key Logging and Man-in-the-Middle. We will find a number of online banking users who are naïve to this kind of technology and the threats associated with it. It is necessary to help them understand the precautions they must take to prevent being a victim of online theft.

Consumer education becomes a key element to prevent the manifestation of a number of risks into frauds. It is much easier for the experienced eyes of an internet-savvy user to detect potential phishing attempts when compared with a customer who has recently migrated from old school of banking to more recent modes.

On a happy note, there are solutions in the market to tackle problems of phishing, key loggers and man-in-the-middle attacks. But these are expensive solutions and not full proof.

Business Security Buy-In: Given the customer base or other reasons, it has not been easy for the banks to justify investing in secure solutions for online banking. In fact, many banks are willing to compensate for the fraud losses of the customers as they find it more cost effective than putting up a secure solution.

Security Challenges: Banks have to continuously evaluate the risks, cost of technology solutions and even upgradations. .It gets all the more challenging due to a variety of technological solutions available in the market, each addressing individual problems but none offering a one-stop solution.

Typo-Squatting - In the Spotlight

A dangerous cyber practice known as Typo-Squatting is in spotlight again. Attackers or Typo-squatters register domains using common misspellings of popular brands, products, and people in order to redirect consumers to alternative websites.

Should a user accidentally enter an incorrect website address, they may be led to an alternative website owned by a cybersquatter. If the intended website is "example.com"

• A common misspelling, or foreign language spelling, of the intended site: exemple.com
• A misspelling based on typing errors: xample.com or exxample.com
• A differently phrased domain name: examples.com
  
• A different top-level domain: example.org

Once in the typo-squatter's site, the user may be tricked into thinking that they are in fact in the real site; through the use of copied or similar logos, website layouts or content.

How to Build Secure Software

This article on "How to build Secure Software" written by Dharmesh M Mehta appeared in The Times of India - Bangalore on 7th January 2008.

Leading Change

Hello All....

I have been taking a few lectures on 'Change Management in Enterprise' in one of the management institutes in Mumbai. We talked about McKinsey's Principles and Lewin's Principles for Change Management. Then I came across this wonderful piece on Leading Change from John Kotter.

John P. Kotter, a world-renowned expert on leadership at Harvard Business School, has been the premier voice on how the best organizations actually “do” change.

This is what he says...Hope people interested would enjoy as I did. In the world of IT, even inclining organizations to look into Security requires a 'Change'. Let us all try and achieve the BEST CHANGE. :)

Why do we need leaders?

Leadership is required for mobilising people to handle challenging times. In a world that has no challenges, things are fine and you don’t require leaders. In such a world, you don’t need to mobilise people for handling any crisis. But unfortunately, in our world, we a have huge number of challenges in the government, non-profit and business sectors; we have many challenges in the developing and the developed world. Hence, we require leadership in our world. In fact, in our world, the need for leadership is more now than ever before. In our current world of business, we cannot afford to restrict leadership to just the top management positions. Every employee, every engineer should rise to a leadership role. They should step in to solve customer problems; they should step in to solve internal company problems. The number of people that we need to provide leadership is huge now. The turbulences in life will never stabilise, and I see the demand for leaders going up steadily.

How are leaders different from managers?

Leaders mobilize people. Their role is to undertake challenging goals that involve change. Leaders focus on changing behaviour, while managers focus on existing circumstances. For example, if there is a DVD player that is built well, we don’t require a leader to press the on/off button, because there is no challenge in it and no change is involved. I am not saying that managers are not important. Of course, they are important since it is not just the story of one DVD player. It is the story of 100,000 DVD players in 20 different countries where things can get complicated. Managers are important in that they should manage all these different DVD players in different countries, and ensure that they play the right movies at the right time. But the role of leaders is different. They often create the systems that the managers manage. For example, initially, there was the VHS system and the tapes that we were used to. It took leadership to change the user habits into something better. In the case of the battle between Sony and VHS, the amount of leadership that was required initially to drive the battle was much greater than after they won. Leadership is important at times of change because most of the time, the systems are not in place and leaders drive change and face challenges that are humongous. In short, in the case of stable existing systems, you need managers, while in the case of new turbulent situations that require a change, you need leaders.

Do leaders always drive change?

Almost always, leadership produces change. Go back in history and read about the people who were great leaders, and you will see that they were always focused on change. They were always helping people to change their behaviour. They were always focused on changing systems. Look at Mahatma Gandhi — he induced change in Indian society: he mobilised Indians and changed the way they looked at their state of affairs.

Do leaders drive their selfish cause or altruistic cause?

More often, people are talking about the behaviour of people when they are talking about leadership. They think about the presidents or CEOs of companies when leaders are mentioned. That is not the right way. The belief is that people in those positions mobilize people. But, the reality is that most of the times they are just politicians, managers, or sometimes they are not good at any of these. That is not a good way of defining leadership.

Good leaders are always driving changes. They derive a sense of satisfaction out of the change they drive. Great leaders always do something for people. I call it altruistic because it is good for the people. They are progressing towards goals that the society needs.

What is India’s role in shaping effective future leaders?

India is becoming very important and has got a bigger role to play in the global economy. Offering services cheaper and better is not the end; it’s the beginning. You must lead the way. You need good leaders for that, but more often than not, you don’t get better leaders. Educational institutions should focus on mentoring good leadership.

Google Hacking

Web Hacking : Select a site, find a vulnerability
Google Hacking : Select a vulnerability, find a site :)

Some trials:

1. Advanced Operator : filetype

Search for filetype:mdb with keywords as users, passwords, credit, etc. View funny results.

2. Advanced Operator : allinurl
Cross-Site Frame Vulnerability allinurl: "url=http" "frame"

3. Directory Traversal Vulnerability
filetype: pl inurl:cg-bin inurl: file inurl:html

4. Spam Engines
filetype: cgi send mail

Is Software Security Testing Complicated?

Testing software for Security is something that can be quite complicated to do. Those that do test software are also those that have taken classes and know just what it is that they are doing.

If you are all into software, and are very familiar with it, as well as interested in testing it yourself, you are going to want to check out the software testing course that is held closest to you.
Many companies hire a 3rd party to give their employees a security testing course or build an in house team for providing this as a special service to teams across the organization.

I somehow believe that Security testing is something that comes a little easier to someone that understands or has written a software program before. If you have ever written a software application and are looking to get into testing, you are going to find that learning what you need to know to test will be easier for you than someone else.

Is virtual keyboard been considered?

Phishing is an attack where the attacker sends a mail making it look as if it has come from a bank or a financial institution and lures the victim into entering his sensitive information.

Image based keyboard (or virtual keyboards) were invented to make life harder for banking or phishing Trojan horses (specifically key-stroke loggers or key loggers), some even suggested they be used specifically to avoid these Trojan horses.

Clear Text Secrets

We often find applications storing secrets in a non-encrypted form which presents a severe security risk. If an attacker was able to retrieve & read the secrets, it could lead to compromise of the application, host or network, loss of revenue, loss of confidence of the user with the application.

"Sensitive"data like User Credentials, cryptographic keys must never be stored, cached, or sent unencrypted. For instance: logon passwords, PINs, credit card numbers, telephone calling card numbers, session ID that can be used to gain access to goods, services, or confidential information must always be stored and sent encrypted.

Avoid using proprietary encryption algorithms. Use trusted and proven standard algoriithms for encryption and have key lengths of at least 128 bits. Secure Socket Layer (SSL) must be configured to use at least a minimum of 128bit encryption and must not be allowed to fall back or accept weaker levels. Applications which use SSL must ensure that non-SSL connections are either denied or converted to SSL.

Managing Account Lockout

User Accounts are vulnerable to dictionary attacks or brute force attacks. These attacks are ones where user credentials are deduced through successive attempts. Using tools or scripts enable the attacker to automate the process and establish a positive match more quickly and efficiently.

The "Good Practices" would be:

1. Design usernames which are not predictable or guessable.
2. Strong password policy.
   
3. Disable user account after n failed login attempts which are successive.
4. You could also consider locking out account for a specified amount of time. For e.g. 30 mins.
5. Display generic error messages to user on failed login attempt. E.g. "Authentication Failed - Invalid Username / Invalid Password / Account Locked
6. No automatic account lockouts for admin accounts
   
7. Implement CAPTCHA's to prevent bots or automated username/password guessing.
   

Mitigating XSS Attacks in ASP.NET Apps

Most of the security analyst must be finding it difficult to completely eradicate chances of Cross Site Scripting Attacks. As far as Microsoft ASP.NET platform goes, it does provide a directive called ValidateRequest to check for input containing malicious code.

This directive was present since .NET 1.1 version. However, I find several cases where the application team deviates from having this directive set to true for some business reasons. For eg. there is a rich text box in the web page which must allow any kind of input data. If ValidateRequest is configured for this web page or for the application as a whole, it will throw HttpRequestValidationException before the input is even processed by your code.

So we started recommending that you must use output validation i.e HTMLEncode all data echoed back on web page. You could also use the new Microsoft Anti-XSS library.

In conclusion, ValidateRequest should be turned on if it does not block valid user scenarios. However, even with ValidateRequest turned on, it MUST not be regarded as a full proof solution to mitigate XSS.

Useful resources:
http://msdn2.microsoft.com/en-us/library/ms998274.aspx
http://msdn2.microsoft.com/en-us/library/system.web.httprequestvalidationexception(vs.80).aspx
http://msdn2.microsoft.com/en-us/library/ms998274.aspx

Cheers.

PCI DSS Applicability Information

* These data elements must be protected if stored in conjunction with the PAN. This protection must be consistent with PCI DSS requirements for general protection of the cardholder environment. Additionally, other legislation (for example, related to consumer personal data protection, privacy, identity theft, or data security) may require specific protection of this data, or proper disclosure of a company's practices if consumer-related personal data is being collected during the course of business. PCI DSS, however, does not apply if PANs are not stored, processed, or transmitted.

** Sensitive authentication data must not be stored subsequent to authorization (even if encrypted).

SQL Injection in Stored Procedure : 2nd Case Study

Stored procedure with dynamic SQL and embedded parameters

The Stored Procedure

Create proc authenticate (@uid nvarchar(25),@pwd nvarchar(25))
as
DECLARE @uid VARCHAR(64)
DECLARE @pwd VARCHAR(64)
DECLARE @SQLString NVARCHAR(500)
DECLARE @ParmDefinition NVARCHAR(500)

/* Build the SQL string once.*/

SET @SQLString =
N'SELECT * FROM users WHERE userid = @uid AND password = @pwd'

SET @ParmDefinition = N'@login VARCHAR(64), @password VARCHAR(64)'


Server side code:

cmd.CommandText = "authenticate";
cmd.CommandType = CommandType.StoredProcedure;
cmd.Parameters.Add( "@uid", strUserName);
cmd.Paramerters.Add( “@pwd, strPassword);
con.Open();

string result = (string)cmd.ExecuteScalar();
oCon.Close();

In this case,bSQL Injection would NOT be possible. Hence what I would like to summarize is if at all we have to use dynamic SQL in stored procedure, always use embedded parameters in dynamic SQL

SQL Injection in Stored Procedure

Let us examine SQL Injection in Stored Procedure. This would be 1 of the vulnerable cases.

The Server Side Code would be something like:
oCmd.CommandText = "sp_login";
oCmd.CommandType = CommandType.StoredProcedure;
oCmd.Parameters.Add( "@loginId", strUserName);
oCmd.Paramerters.Add( “@password”, strPassword);
oCon.Open();
string result = (string)oCmd.ExecuteScalar();
oCon.Close();
====================================================================
The Stored Procedure would be:
CREATE PROC sp_login (@loginid nvarchar(25),@password)
AS
DECLARE @SQLString NVARCHAR(500)
DECLARE @loginid VARCHAR(64)
DECLARE @password VARCHAR(64)

/* Build the SQL string once.*/

SET @SQLString = 'SELECT * from cust_users WHERE login_id = '+ ''''+@loginid+'''' + 'AND password = '+ ''''+@password+''''

EXECUTE sp_executesql @SQLString

====================================================================

If the user input is as follows:
loginId = ' OR 1=1 --
password = junk

The above stored procedure will have an injection attack. The procedure executing will return all the rows because of the injected SQL.

Cheers.

Data Validation for App Security