OWASP

Hvem er jeg?

Jobber som utvikler
Faggruppeleder for sikkerhet i BEKK
OWASP Norway Chapter-leder
Medlem av Norwegian Honeynet Project
Twitter: @webtonull

OWASP Top 10

Gratis PDF (som alt annet fra OWASP)
Kan kjøpes som bok til selvkost

Bevissthet - ikke en standard
Gulv - ikke tak

Versjoner: 2003, 2004, 2007, 2010, 2013
Community effort

Kategorisering

Threat Agents	Attack Vectors	Weakness Prevalence	Weakness Detectability	Technical Impacts	Business Impacts
App Specific	EASY	WIDESPREAD	EASY	SEVERE	App / Business Specific
	AVERAGE	COMMON	AVERAGE	MODERATE
	DIFFICULT	UNCOMMON	DIFFICULT	MINOR

OWASP Top 10 2013

A1 - Injection
A2 - Broken Authentication and Session Management
A3 - Cross Site Scripting (XSS)
A4 - Insecure Direct Object Reference
A5 - Security Misconfiguration
A6 - Sensitive Data Exposure
A7 - Missing Function Level Access Control
A8 - Cross Site Request Forgery (CSRF)
A9 - Using Libraries with Known Vulnerabilities
A10 - Unvalidated Redirects and Forwards

Consider who can gain access to your sensitive data and any backups of that data. This includes the data at rest, in transit, and even in your customers’ browsers. Include both external and internal threats.
Attackers typically don’t break crypto directly. They break something else, such as steal keys, do man-in-the-middle attacks, or steal clear text data off the server, while in transit, or from the user’s browser.
The most common flaw is simply not encrypting sensitive data. When crypto is employed, weak key generation and management, and weak algorithm usage is common, particularly weak password hashing techniques. Browser weaknesses are very common and easy to detect, but hard to exploit on a large scale. External attackers have difficulty detecting server side flaws due to limited access and they are also usually hard to exploit.
Failure frequently compromises all data that should have been protected. Typically, this information includes sensitive data such as health records, credentials, personal data, credit cards, etc.
Consider the business value of the lost data and impact to your reputation. What is your legal liability if this data is exposed? Also consider the damage to your reputation.

A6 Sensitive Data Exposure

Sammenslåing av Top 10:

2010-A9: Insufficient Transport Layer Protection
2010-A7: Insecure Cryptographic Storage

Threat Agents	Attack Vectors	Weakness Prevalence	Weakness Detectability	Technical Impacts	Business Impacts
App Specific	DIFFICULT	UNCOMMON	AVERAGE	SEVERE	App / Business Specific

Eksempel - Cookies

Set-Cookie: SESSION=sa9d8712hiuhias89d721

Set-Cookie: SESSION=sa9d8712hiuhias89d721; Secure

Scan av 100 000 norske domener utført av Einar Otto Stangvik (@einaros)
30% av domener med cookies over HTTPS brukte Secure-flagget

Anyone with network access can send your application a request. Could anonymous users access private functionality or regular users a privileged function?
Attacker, who is an authorized system user, simply changes the URL or a parameter to a privileged function. Is access granted? Anonymous users could access private functions that aren’t protected.
Applications do not always protect application functions properly. Sometimes, function level protection is managed via configuration, and the system is misconfigured. Sometimes, developers must include the proper code checks, and they forget. Detecting such flaws is easy. The hardest part is identifying which pages (URLs) or functions exist to attack.
Such flaws allow attackers to access unauthorized functionality. Administrative functions are key targets for this type of attack.
Consider the business value of the exposed functions and the data they process. Also consider the impact to your reputation if this vulnerability became public.

A7 Missing Function Level Access Control

Utvidelse av 2010-A8: Failure to Restrict URL Access

Threat Agents	Attack Vectors	Weakness Prevalence	Weakness Detectability	Technical Impacts	Business Impacts
App Specific	EASY	COMMON	AVERAGE	MODERATE	App / Business Specific

Some vulnerable components (e.g., framework libraries) can be identified and exploited with automated tools, expanding the threat agent pool beyond targeted attackers to include chaotic actors.
Attacker identifies a weak component through scanning or manual analysis. He customizes the exploit as needed and executes the attack. It gets more difficult if the used component is deep in the application.
Virtually every application has these issues because most development teams don’t focus on ensuring their components/libraries are up to date. In many cases, the developers don’t even know all the components they are using, never mind their versions. Component dependencies make things even worse.
The full range of weaknesses is possible, including injection, broken access control, XSS, etc. The impact could range from minimal to complete host takeover and data compromise.
Consider what each vulnerability might mean for the business controlled by the affected application. It could be trivial or it could mean complete compromise.

A9 Using Components with Known Vulnerabilities

Ny i 2013, men tidligere en del av 2010-A6: Security Misconfiguration

Threat Agents	Attack Vectors	Weakness Prevalence	Weakness Detectability	Technical Impacts	Business Impacts
App Specific	AVERAGE	WIDESPREAD	DIFFICULT	MODERATE	App / Business Specific

Hva er problemet?

80% koden i en applikasjon kommer fra biblioteker
Statistikk fra Sonatype:
- 133 millioner downloads
- 29 millioner hadde kjente sårbarheter
Jo eldre, jo verre - sårbarheter fikses i det skjulte

Hvor er feilen?

Historie fra virkeligheten

OWASP Dependency Check

https://www.owasp.org/index.php/OWASP_Dependency_Check

Command line scanner
Maven plugin
Jenkins plugin

Bruker http://nvd.nist.gov/ som kilde
Kildekode på GitHub

OWASP SafeNuget

https://www.owasp.org/index.php/OWASP_SafeNuGet

Sårbarheter i nuget-pakker
Integrasjon i Visual Studios byggeprosess

Bruker egen kilde basert på release notes fra pakker
Kildekode på GitHub

Komersielle alternativer

Sonatype CLM
- Java og .NET
- Består av flere komponenter
  - Integrasjon i Eclipse
  - Integrasjon i Maven og Jenkins
  - Integrasjon i Nexus

Retire.js

What you require you must also retire https://github.com/bekk/retire.js

Nytt open source-prosjekt - første release i dag!
JavaScript-biblioteker

Retire.js

Kilde: Manuelt vedlikeholdt fra release notes og issue trackers

Deteksjon:

Filnavn/URL

http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js

Kommentarer/innhold
```
/*!
 * jQuery JavaScript Library v1.5.1
```
Hash av minifisert fil
Kjøring av kode
```
jQuery.fn.jquery
Handlebars.VERSION
```

Retire.js - kommandolinje


Usage: retire [options]

Options:

-h, --help       output usage information

-v, --verbose    output all identified JavaScript libraries (not just vulnerable ones)
-p, --package    limit node scan to packages where parent is mentioned in package.json (ignore node_modules folder)
-n, --node       Run node dependency scan only
-j, --js         Run scan of JavaScript files only (ignore node)

--jspath <path>  Folder to scan for javascript files (node-scan always scans current folder and subfolders)

Hvem er jeg?

OWASP Top 10

Kategorisering

OWASP Top 10 2013

A6 Sensitive Data Exposure

Eksempel - Cookies

A7 Missing Function Level Access Control

A9 Using Components with Known Vulnerabilities

Hva er problemet?

Hvor er feilen?

Historie fra virkeligheten

OWASP Dependency Check

OWASP SafeNuget

Komersielle alternativer

Retire.js

Retire.js

Retire.js - kommandolinje

Demo

Retire.js - Chrome extension

Demo

Spørsmål?