Cyber Security and Ireland Ireland is not an Island....As many of you know I am passionate about how we as a country secure the systems, networks and the critical elements of our national infrastructure that we all depend on. I was recently interviewed by the Irish Examiner for an article Cyber Crime: The New Battleground , they ran on the threat posed to Ireland by criminals and others with malicious intent. To be honest criminals go where the money is. I don't think GDP of an individual country matters given we throw funding at security but nothing seems to improve too much. Nation state attackers may be more conscious of geographic location for obvious reasons but overall its all just copper wire and IP numbers and 1's and 0's
Posts
Breaking Bad - Business Logic Abuse.
There was a recent discussion on the OWASP Testing guide list, a project I used to lead, in relation to "How to test for business logic issues" This is a real tough one to document in terms of "How to..." In saying that some of the biggest simulated financial fraud attacks I have ever committed for clients were based around business logic and authorization logic attacks. So how do we do it? This how is see the world, you may or may not agree. I look at an apps functionality as a Finite State Machine Certain inputs make the machine transition to a different state. Some states can only be reached from certain other states. Certain states are idempotent and others are transactional and have a permanent impact. We have a number of use cases to test this machine. 1. Positive use case - App does what it is meant to (positive sense) 2. Negative use case - App does what it is meant to (negative sense) 3. Abuse Case - User or data is trying to force app to d...
XSS = SQLI = CMDi=?
Why do we look at Cross Site Scripting, Command Injection and SQL injection in different ways? Why am I even writing about such old issues like SQLI, XSS, CMDi? Probably because they are very similar from a builder/prevention aspect but very different from a breaker/defender aspect. The Result is different: Cross Site Scripting (XSS): is a payload delivery mechanism. The vulnerability is used to deliver the payload (warhead) in this case client side script which does something. The attack used against a user so the attacker can do other stuff: Malware upload, Social Engineering, Identity Theft etc. Command Injection (CMDi): A direct attack on a system. Invoking system commands directly. Command injection is a payload attack as opposed to a delivery mechanism. SQL Injection (SQLI): A direct attack on a system also. Direct access to data or system configuration. The SQL injection attack is also a payload attack. The Root cause is the same: It all com...
A stitch in time....
Our Traditional approach to penetration testing, even large scale global penetration testing is to perform an annual/bi-annual pen test on our web applications. Question is who said once a year is enough? Most applications undergo at least quarterly updates and changes if not to provide value for customers but to ensure the web applications are fresh and to address any (hopefully) minor bugs. Cyber attackers can perform a continuous scan on your site to detect changes (code drops) and probe such changes to assess if any vulnerability has been introduced. Why do we think it is acceptable to perform a time-limited test of an application to help ensure security when a determined attacker may spend 10-100 times longer attempting to find a suitable vulnerability. The main reasons for a one-off test per year are simply economics: Testing takes resources Resources cost money Resources are scarce Push to deploy is stronger than push to secure Organisa...
Http-Only is not secure [testing]
Its been a while since i posted. I've been bogged down with code reviews and training but even when you deliver training you learn something new. This is particularly true when training developers keen to learn secure development. The conversations during the course tend to be more about building than breaking.... HTTP - one side of a many sided coin So on with today's rant......many penetration testers still feel testing an application surrounds testing the HTTP requests and responses between the browser an client; Crawl the application, flag interesting parameters and fuzz using a scanner like OWASP Zap proxy or whatever...... .......We hope the scanner renders the page as a browser sees it. If it doesn't how do we know the reaction of the application is being detected. Many scanners parse HTML pretty well but when it comes to javascript/jquery/client-side-code-execution that's where they fall over. One of the hardest things to do w...
How Simple can it be.....XSS Prevention....
Cross Site Scripting is sill a very common web vulnerability. Generally it is used to attack clients/users. It can be used for malware upload, botnet hooking, keylogging, a payload delivery system for clickjacking and CSRF attacks and much much more, all for 6 easy payments of $9.99...sorry got carried away there :) But is is easily preventable. You dont even have to know what XSS (type 0, type 1, type 2, DOM, Stored, Reflected) is to prevent it. One pretty simple way to prevent XSS is to use the OWASP ESAPI (Enterprise Security API). A very easy tool to use/invoke. It's also managed and attended to by Chris Schmidt ....A great guy... Regardless of what it does....if there was a mandate to use it on all redisplayed external input a site could become virtually XSS free!! (all for 6 easy payments of......). It's easy to deploy.... 1. Include in JSP (Java version) 2. Invoke in JSP 3. Job done!!! We include it by <%@ page import="org.owasp.esapi.ESAPI...