cat slave diary

Blog

  • SANS Top 20

    The SANS Top 20 2006 update has been posted.

    SANS Top 20 2006

    I helped write the C1 Web App Sec section:
    C1. Web Applications

    We’re working on the updated OWASP Top 10 2007 which interlinks with that. It’s an interesting experience writing something like this for a completely different audience than web developers. As it’s coding issues, the SANS folks wanted things like configuration changes which system administrators could change and improve the security. But that’s not what this section is about.

    Hopefully, next year, we can get more focus on the changes organizations who write or buy code can do to improve their security. In the near term, when it’s done, check the OWASP Top 10 2007. It’s very cool and has CSRF in it!

  • Greebo has gone missing

    Greebo, my first cat, has disappeared from her new home at my brother’s.

    Mistress Greebo

    As this is on the same road where she was run over back in 2001, I’m a bit worried. Tuesday will mark a week of her not being around, and realistically the upper bounds for her to return by herself if she’s just having a sulk. I hope that she has found a new home and carer – it can be tough to move and not have your previous cat slave living with you, and two small children trying to pull your tail.

    She is microchipped. Luckily, we changed the contact details for her in the week prior to our honeymoon, so if a vet or the pound finds her, we will get a call to the right address. However, since she was chipped in NSW, it’s not entirely clear if they share data with the Victorian animal registry. I will find out tomorrow.

    If she stays missing by the time we leave for the USA, I will take Meebles with us to the USA. I miss my babies desperately, and I want them to be close to us. I hope Greebo is okay, wherever she is.

  • Survey at Casa de Grossman

    Jeremiah sent me a survey to fill in. Normally, I don’t like participating in surveys, but this time I made an exception. Jeremiah noted that my responses, although not quite in the boxes he had set out, were still actually pretty useful.

    So here are my responses:

    1. How many code reviews did you do in 2006?

    I do a few but very large code reviews, each involving more than 100,000 lines of code. So although not high in number, the programs process literally billions of dollars in transactions every day. Therefore, extreme care needs to be taken. I am not a automated scanner boy and would be negligent if I only used a tool like PMD or LAPSE to find my findings.

    2. What reporting standard do you use?

    Jeremiah’s choices here did not include many of the normals, including CWE / CVE from Mitre, OWASP anything (that said, Jeremiah has his own biases to WASC), etc. We also have regulatory regimes on top of webappsec specific lists, which are also not mentioned.

    I’m not sure of the validity of this question except to say that it should be the subject of more research.

    3. Do you use commercial application scanners during security assessments?

    Actually, no.

    I use PMD, Find Bugs, and LAPSE, all open source or freebie tools. They are for extreme low lying fruit, and in many cases, like not using “final” or “const” I never report on some of these findings as they have zero security impact.

    4. Average number of man-hours required to perform a thorough web application vulnerability assessment on the average commerce website?

    This should have been phrased to be PC “Average number of hours per review” as I know some hot chicks and some excellent queens working in our field. 🙂

    I do > 100 kLoc code bases, I was happy to see that folks are spending more than a week doing code reviews. I dare anyone to do a code review on a system which has > 40 systems it talks to directly, with over 200 seperate value functions and over 100 types of data assets in a week.

    Typically, for J2EE, I use the initial kLoc (as reported by sloccount) divide by 1000 to be the number of days and fatten the result by 25%. This works out most of the time. However, a revent Aspect Oriented Programming review using Spring Web Flow blew that estimate out of the water. 5000 lines took 2 weeks. ARGH. It pays to know your technology before you quote on a estimate, particularly if you’re doing fixed price code reviews.

    5. Do you recommend Web Application Firewalls?

    No.

    Unless the organization is a CMM level 5 organization that has nothing else to do and needs a new challenge. Seriously, unless the organization is able to tailor the WAF to the application and keep it up to date, WAFs, particularly appliance (=usually dumb) send the wrong message: that’s there’s a silver $25k bullet to your security problem. This is not the truth and I will not perpetuate it. In addition, such devices nearly always add complexity and add fire to the response | request splitting harm which is real and unavoidable when you add unnecessary devices.

    But an organization who sees it as defense in depth control, and is prepared to look after it, and investigate and escalate real problems rather than treat it as a “set and forget” will get a recommendation from me for a serious WAF tool, such as mod_security or similar.

    I’ve used mod_security to prevent DDoS against a customer a few years ago, and used properly, WAFs are an invaluable asset. But plonked in and forgotten, they are worse than useless – they give a false sense of security and cost a bucket of money that could have been used for a code review. Most (>90%) organizations in my view are simply not mature enough at IT security to look after them and thus should not use them.

    6. What do you think about the updated PCI Data Security Standard v1.1

    It’s a good start. However, in the latest edition automated scanner vendors are rubbing their hands with glee. We’re going to have SMEs pay a scanning firm for a clean bill of health (“We do the OWASP Top 10 as the PCI requires” — no you don’t, some of these issues are NP complete problems), and thus will get attacked by a business logic error, or a process error which scanners CANNOT find.

    I’m happy to work with PCI to fix up the next edition, but honestly, the most recent release is just better than before.

    7. Checking for XSS on public websites without permission?

    This is extreme grey area and I lean towards “illegal”.

    My personal take is that now that methods are well known to craft really bad JS malware, that poking a public website without authority is just dumb. Don’t do it. If the sites are based upon a public piece of software like UltimaBB or phpBB, sure, go ahead download the software and test offline. That’s what security research is all about. But don’t prod or take out public websites.

    In Australia, the computer crimes act and complementary state laws are deliberately vague to allow the book to be thrown at you. If you’re a nuisance, the terms of “unauthorized access” are so vague as to mean you are up a certain creek without a paddle if the owner takes offense. And it’s criminal, not civil trouble you’re in. Police are strapped for cash, and if they think they can obtain publicity and an easy conviction, they will come after you. That gets them more funds and resources if they are successful.
    Here’s the actual text. You decide:

    Computer trespass.

"9A. A person must not gain access to, or enter, a computer system or part
of a computer system without lawful authority to do so.
Penalty: 25 penalty units or imprisonment for 6 months."

    Daniel Cuthbert, an excellent OWASP contributor, was prosecuted and convicted under the much more nebulous UK Computer Misuse Act for having a go at a charity’s website. He now can’t emigrate to Australia, and had difficulty finding work in his chosen industry. Do not try this at home.

    http://www.samizdata.net/blog/archives/008118.html

  • Attack vector for Windows Genuine Disadvantage

    The other day, WGA decided that my volume licensed copy of Visio was a pirated copy. This is laughable… and annoying. Luckily, the situation sorted itself out; I have Visio 2007 installed and I was able to use that until Microsoft used the rubber hose on WGA’s servers.

    But it got me to thinking how a hostile Trojan could cause massive disruption. Product IDs are easily tamperable. If the user is an administrator, all a Trojan or virus has to do is change the Product ID for Microsoft products (Windows, Office, etc) to random values. It doesn’t need to set it to known pirated Product IDs, but just random ones. These are unlikely to validate under WGA, and millions of folks will end up with software which can open, but not print or save documents. Or in Windows’ case, not boot after 30 days.

    Microsoft’s only solution for this would be a massive program of issuing new ProdIDs to legitimate customers at a massive cost to everyone (including Microsoft), or to give up on WGA altogether.

    If product IDs are susceptible to change, and they are, they must be better protected by the WGA process. If I’ve thought of this, and I’m not precisely hostile, imagine what the organized crime dudes can do.

  • MITRE Vulnerability trends released

    In September, MITRE talked about statistical proof that apps still suck on a mail list. In fact, web apps suck much more than any other form of vulnerability.

    MITRE was surprised that their data set was so popular, and cleaned it up and released it.

    http://cwe.mitre.org/documents/vuln-trends.html 

    These will form the basis of the OWASP Top 10 2007, and as I’m also working on the SANS Top 20 2006 will contain some or all of this detail, with some luck.

  • Reviewing Spring Web Flow apps (and JSTL and Spring Framework)

    Well, I’ve just had the (somewhat dubious) pleasure of reviewing my first Spring Web Flow app. Initially, I thought ARRRRGH Aspect Oriented Programming (AOP) dudes are on crack…

    and then

    I got the Kool-Aid. Here’s the low down for all you l33t code reviewers: it makes doing code reviews extremely hard … and extremely easy.

    About a year and a bit ago, when I was (re-)writing the OWASP Guide, I realized that checklists don’t work. So how do you review code if you’re not looking for say Runtime.exec()? In my day job, technical issues such as cross-site scripting and SQL injections, although embarrasing, are hardly worthwhile compared to the sort of losses that can happen if business logic is wrong.

    Sure the checklist approach, particularly OWASP Guide 2.x, produces huge reports, but does it mean anything? In short, no. The value is where the business is. That means understanding what the code does. And along the way, you can have a look at the dangerous stuff, like XSS and SQL injections.
    So I started looking at flows more throughly. In normal J2EE programs, this can be a little tricky. In SOA, where apps are strung together dynamically, it seems like it’s impossible.

    flows.xml

    Start here and then find the sub-flows (often in flows/*.xml). If you know what you’re doing, you can produce a directed graph to understand the flows. This is key to understanding the important flows, and review them early and often.

    Once you have decided upon a particular flow, follow it from what I will call the home flow, through to completion.

    SWF uses continuations. This is different to many frameworks, but is closer to the way HTTP works in the real world. Tomorrow, we’ll look at what continuations are, and how to exploit them.

  • Come see me at Ruxcon

    My next speaking engagement (I’m such a junket slut) is Ruxcon.

    Ruxcon’s site

    See you there!

  • How many inaccuracies can a single song contain?

    I don’t know about you, but I find artists who know very little of what they complain about frustrating. I am not talking about irony and the lack of it in Ironic by Alannis Morrisette, but I wish I was a punk rocker (with flowers in my hair) by Sandi Thom. If you’re a fan of this song, please don’t get me wrong, it’s a nice song, but it’s woefully inaccurate.

    In the olden days, scientist philosophers like Galileo, da Vinci, Newton and Franklin were masters not only in their respective fields and great minds, but accomplished authors, musicians, artists, and in Franklin’s case, statesmen. As with most of my geeky friends, we are passionate authors, voracious readers, keen collectors of music and often musicians in our own right, love museums and galleries and the arts. However, many “artists” do not respect our arts and sciences.

    Let’s go through a few of the foibles of this song:

    • “In 77 and 69, there was revolution in the air”    Where? In 1968, there was the France student riots and Prague Spring, of which only one, the French student riots made any difference with an election being called. In 1969, besides the Viet Nam war, very little revolution happened. Maybe she’s talking about Woodstock. 1977 was the beginning of the Sandinista revolution in Nicaragua, and the seeds of the Iranian revolution, but hardly progressive revolutions as the singer calls it out. The song’s main theme is punk (anarchy) and flowers in the hair (the hippy / free love movement), which is an expression of baby boomers “me me me” selfishness despite its best intentions. We owe a huge debt to the hippies for freeing up attitudes but little else. Anarchy exists today – see Darfur and a host of other hot beds of human misery and crimes against humanity. No one can claim to want anarchy without understanding what it truly represents. 1977 saw the release of Never mind the bollocks… by the Sex Pistols. Punks hated the hippies, so I’m unsure of why she wanted to be both. Anyway, disco / techno won the battle, not punk 😉
    • “Not everybody drove a car”    This is still true today, and if anything, anti-car choices in the major metropolises of London and so on make it very difficult for people to drive to where they’re going. The car is a symbol of freedom and personal mobility, so I’m not sure why this is a bad thing. The days of most people not owning a car or the ability to drive are long, long gone. This is more of a pre-World War II thing. My grand parents owned cars from the end of the war onwards. Certainly, by the end of the 1960’s most families had at least one car and it was an essential part of life.
    • “When accountants didn’t have control”    This is especially amusing. A&R and accountants in the music industry have been entrenched for years. In Dirk Gently’s Holistic Detective Agency, written in the early 1980’s, the main protagonist fought against the A&R types and noted with extreme wit that music contracts were the devil’s work. This didn’t happen overnight. This is not a product of today’s society, but that of the exploitative music industry she so bitterly complains about.
    • “And the only way to stay in touch was a letter in the mail”    This is also particularly funny. Although I’ve personally only written a couple of actual letters to friends, and none in the last 17 years of being on the Internet, the phone system has been around for quite some time. Telegrams predated the phone system by the some considerable time; the first Atlantic telegraph line was completed in 1858, some 111 years before 1969. It was possible to call internationally from the 1920’s onwards with the laying of submarine cables, and from the 1960’s onwards with the launch of Telstar in 1962.
    • And the super info highway was still drifting out in space    The network that became the first nodes of the Internet were established in 1969 as ARPANET. It has only recently been extended to our local solar system – with a modified form of TCP/IP used to communicate with the Mars Orbiters to form the interplanetary internet (see http://www.ipnsig.org).
    • When record shops were still on top/And vinyl was all that they stocked    This ignores the 8 track (from 1965 onwards) and the compact cassette (from onwards), both of which were popular in 1969 and 1977 respectively.

    Although this song appeals to those hankering after a time long ago, the time the chanteuse desires never existed. I wish that artists were a bit more respectful of history and less hostile to modern life. I’d rather be alive now than living in the past; the world is a beautiful place and it is what you make of it.

    Boomshanka, peace.

  • Behavior profiling for web apps

    I regularly read Bruce Schneier’s blog. Last week, he blogged about behaviorial profiling.

    One of the key methods of detecting fraud is anomaly checks. I think this can be done statistically by reviewing history about a user and determining how likely it is that they will perform any particular set of actions. I am thinking about writing a security pattern on how to do this in a general fashion – ie determine “usual behavior” by what they’ve done before and see if the new input matches known past behavior within confidence levels.
    For example, if a user always uses Firefox to access a web app, and they are located in Australia, and generally does less than a couple of hundred dollars per session, is it right to flag behavior which comes from an agentless connection from Brazil right up to the daily maximum? But this might match a Brazilian user’s normal behavior. A behaviorial profiling security pattern might sort things out or at least provide a clue as to unusual behavior, and would benefit many applications if it was easily available and implementable.
    However, my statistics is not as it once was. Dear readers – are any of you half decent with statistics? If so, feel free to suggest a suitable method of determining what is significant (or likely) and based upon a set of general inputs. Even links to a decent maths / stats site so I can brush up. I own a HP 48G+ ubercalculator if that helps, and a spare 49G which I keep at work (in RPN mode, natch!) in case I need to think deep thoughts.

  • Ajax Security

    Good news, everyone!

    I’m writing a new book on Ajax Security. You can follow development at

    http://www.ajaxsecurity.info/
    I am looking for a co-author to bring the book to fruition faster (and to avoid marital breakdown!), so if you’re interested and have lots of Ajax and security experience (20 years or better!) and have the mad writing skillz to write at least 125 pages, please drop me a line.