ارائه در مورد ضرورت ایجاد امن نرم‌افزار و روش‌های انجام آن

1. Web Application
SecuritySecure Developing
Mahdi Dolati
mahdidolati@ut.ac.ir
‫الرحیم‬ ‫الرحمن‬ ‫اهلل‬ ‫بسم‬

10. An example to see why

11. TopTen Attacks
• OpenWeb Application Security Project
• Injection
• Broken Authentication and Session Management
• Cross-Site Scripting (XSS)
• Insecure Direct Object References
• Security Misconfiguration
owasp.org/index.php/Top_10_2013-T10

12. SQL Injection
http://www-935.ibm.com/services/us/iss/xforce/trendreports/

13. SQL Injection

14. • Fill in the blanks!
• SELECT OrderId
FROM Sales
WHERE CustomerId = ‘ ’
• SELECT OrderId
FROM Sales
WHERE CustomerId = ‘’
UNION
SELECT Table_Name
FROM INFORMATION_SCHEMA.Table; -- ’
SQL Injection

15. SELECT OrderID
FROM Sales
WHERE CustomerID = ‘ ’
Giving Information to the Attacker
‘
‘

16. Giving Information to the Attacker

17. Hide the Error
•
• try {
resultSet = READ FROM DATABASE;
} catch(error) {
redirect(“home.html”);
}
if(resultSet.RowCount > 0)
redirect(“history.html”);
else
redirect(“home.html”);
Read From
DB
Error?
Is
Result
> 0
Go to
“home”
Go to
“history”
Yes
Yes
No
No

18. CustomerID = ‘
CustomerID = ‘ ;
delay 1 min. ;--
Wait 1 min.
Go to “home”
Go to “home”
Blind SQL Injection

19. Is the first letter of the
name of the first table an
‘A’ No, it’s not
go to “home”
Is the first letter of the
name of the first table an
‘B’ Yes, it is
go to “history”
SELECT OrderID FROM Sales WHERE CustomerID = ‘’ OR
MID(
(SELECT table_name FROM INFORMATIN_SCHEMA.tables LIMIT 1)
, 1, 1) = ‘A’
Blind SQL Injection

20. Solutions
• Validate Input
• No SQL syntax
• No single quote
• What about Mr. JohnO’Malley?
• No single quote attack
• URL encoding
• Prevent OR 1 = 1
• Regex
• Encode or escape

21. Solutions
• Validate Input
• No SQL syntax
• No single quote
• Prevent OR 1 = 1
• Regex
• Encode or escape

22. Solutions
• Validate Input
• No SQL syntax
• No single quote
• Prevent OR 1 = 1
• Regex
• Encode or escape
Regexlib.com
Search for: person’s name
Allows apostrophes
SQL injection: X’ OR A IS NOT NULL

23. Solutions
• Validate Input
• No SQL syntax
• Escape input
• Insert backslash
• Parameterized queries
• Stored Procedures

24. Bake Security In

25. Cost
• “Economic Impacts of Inadequate Infrastructure for SoftwareTesting”
Nist.gov/director/planning/upload/report02-3.pdf
0
5
10
15
20
25
30
35
Req. / Design Coding / Unit Testing Integration Testing Customer Beta
Testing
Release
Relative Cost to Fix Software Defects

26. Time
Find
vulnerabilities
Hold
release to
fix
Fix
Schedule a
pentest
Pentest

27. HOW
to bake security in?

28. Training

29. Threat Modeling
• Ultimate pessimist’s game
• ManyApproaches
• Asset-centric
• Attacker-centric
• Software-centric
• Mitigation
• E.g. encrypt database

30. SDLThreat ModelingTool
• A Data Flow Graph
• STRID
• Spoofing
• Tampering
• Information disclosure
• Denial of service
• Elevation of privilege
Add
item
into
cart
View
cart
conte
nts
User database
ProductCatalog
Cart Database
User

31. Secure Coding Libraries
• Don't reinvent the wheel
• Code review
• Correctness or Disuse
• OWASP AntiSamy or MicrosoftAnti-XSS
• OpenSSL

32. Secure Coding Libraries
Bryan Sullivan andVincent Liu,WebApplication Security, McGraw Hill, 2011

33. Code Review

34. Static Analysis Tools
• White-BoxTesting
• Integrate them
• Build process
• Code repository server
• False positive reports

35. Automated AnalysisTools
Tool Lang / Framework Free / Commercial
FindBugs™ Java Free (LGPL)
OWASP LAPSE+ Java Free (GPL)
FxCop .NET Free (Ms-PL)
PHP Securoty
Scanner
PHP Free (GPL)
JSLint JavaScript Free (LGPL)
HP Fortify Source
Code Analyser
C/C++, .NET, Java,
PHP, others
Commercial

36. SecurityTesting
• Functional test approach
• Black-BoxTesting
• Just like a Hacker
• Active
• Passive

37. Black-BoxTestingTools
IBM Rational AppScan
• Active
• Commercial
OWASP WebScarab
• Reactive
• Free

38. Back-Box vs.White-Box
GoF# Scala Admin.php
System Boundary

39. Security Incident Response
planning

40. Industry Standard Secure Development
Methodologies

45. Trustworthy Computing Memo

46. training
• Core
Security
Training
Req.
• Establish
Security
Requiremen
ts
• Create
Quality
Gates/Bug
Bars
• Security &
Privacy Risk
Assessment
Design
• Establish
Security
Requiremen
ts
• Analyze
Attack
Surface
• Threat
Modeling
Impl.
• Use
Approved
Tools
• Deprecate
Unsafe
Functions
• Static
Analysis
Verif.
• Dynamic
Analysis
• FuzzTesting
• Attack
Surface
Review
Release
• Incident
Response
Plan
• Final
Security
Review
• Release
Archive
Resp.
• Execute
Incident
Response
Plan
Security Development Lifecycle
(SDL)
Microsoft.com/sdl

47. SDL-Agile

48. OWASP
Comprehensive LightweightApplication Security Process (CLASP)
Project manager
SecurityAuditor
Test Analyst
Implementer
Architect
Requirements
Specifier
Designer

49. `