Why Web Security Matters!
- 1. Why Web Security Matters! Philippe De Ryck @PhilippeDeRyck
- 2. 2 Years Ago in the “News” … 2 http://nieuws.vtm.be/binnenland/60632-overheidssites-gehackt-2-minuten
- 3. The Agenda for Today 3
- 4. About Me – Philippe De Ryck § Postdoctoral Researcher @ DistriNet (KU Leuven) § Focus on (client-side) Web security § Responsible for the Web Security training program § Dissemination of knowledge and research results § Target audiences include industry and researchers § Main author of the Primer on Client-Side Web Security § 7 attacker models, broken down in 10 capabilities § 13 attacks and their countermeasures § Overview of security best practices
- 5. Who Uses Portable Computers? 5
- 6. And Who Are You Most Afraid Of? 6
- 8. What Happens when You Submit a Form 8 GET login.html 200 OK Html page Fill out form POST login.php username: Philippe password: ... 200 OK Html page Open site
- 9. Form Data on the Network 9
- 10. You May Think an Attacker Needs This … 10
- 11. While He Actually Only Needs This … 11
- 12. Network Sniffing Is Straightforward 12 § Sniffing can be a completely passive attack § Just listen to the traffic and analyze it later § HTTPS protects you against network-based attacks § It encrypts the traffic, so that nobody else can read it
- 13. So Problem Solved Then? 13
- 14. So Problem Solved Then? 14
- 15. So Problem Solved Then? 15 http://arstechnica.com/security/2015/04/match-coms-http-only-login-page-puts-millions-of-passwords-at-risk/
- 16. There Is More besides Sniffing 16 Here you go Fake HTML page GET index.html 200 OK Html page Open site
- 17. There Is More besides Sniffing 17 § Instead of this … § You get this ...
- 18. SSL Stripping 18 § Instead of this … § You get this …
- 19. SSL Stripping 19 GET http://websec.be 200 OK Response page POST http://www.websec.be GET http://… 301 Moved GET https://… 200 OK Rewrite HTTPS URLs User: philippe & pass: pazzw0rd POST https://… websec.be
- 20. Preventing SSL Stripping with HSTS 20 GET https://websec.be websec.be 200 OK Response page Strict-Transport-Security: max-age=31536000; GET https://websec.be 200 OK Response page Strict-Transport-Security: max-age=31536000; websec.be GET https://www.websec.be 200 OK Response page Strict-Transport-Security: max-age=31536000;
- 21. HTTPS Is Really Worth the Effort 21 § An attacker on the network level can § Read all unprotected traffic, regardless of which application § Modify content from the browser to the server § Modify content form the server to the browser § Remove HTTPS if only used for specific pages or form submissions • This attack is called SSL Stripping and is very dangerous § Essentially take full control of the Web page § All of these attacks are invisible for most users § Even security experts fall for these if not paying attention § But a correct HTTPS deployment counters all of this …
- 22. How to Deploy HTTPS Correctly 22 § Configure your HTTPS with a valid certificate § These used to be expensive, but now there are free options § Let’s encrypt is backed by the EFF and offers free HTTPS certs § Deploy your entire website over HTTPS § Partial HTTPS still leaves you vulnerable against numerous attacks § The performance impact is very limited nowadays § Many major sites have switched to full HTTPS § Use state-of-the-art security techniques § HTTP Strict Transport Security (HSTS)
- 23. Back to the Video with Weird Usernames 23 http://nieuws.vtm.be/binnenland/60632-overheidssites-gehackt-2-minuten
- 24. Verifying a User’s Credentials 24 GET login.html 200 OK Html page POST login.php username: Philippe password: … 200 OK Html page Lookup User Check Password Load User Info
- 25. Communicating with a Database 25 § Application data is generally stored in a database § Most common technology is a relational database § Can be queried using SQL (Structured Query Language) ID username password email role 1 Administrator au28sj348aj2 [email protected] admin 2 Philippe secret [email protected] Editor 3 … … … …
- 26. Communicating with a Database 26 § Application data is generally stored in a database § Most common technology is a relational database § Can be queried using SQL (Structured Query Language) § When a user logs in, the application verifies his credentials SELECT * FROM users WHERE username = ‘ + username + ‘ AND password = ‘ + password + ‘ Username: philippe Password: secret SELECT * FROM users WHERE username = ‘philippe‘ AND password = ‘secret‘ Philippe – secret – [email protected] – editor
- 27. Communicating with a Database 27 § Application data is generally stored in a database § Most common technology is a relational database § Can be queried using SQL (Structured Query Language) § When a user logs in, the application verifies his credentials SELECT * FROM users WHERE username = ‘ + username + ‘ AND password = ‘ + password + ‘ Username: superman Password: kryptonite SELECT * FROM users WHERE username = ‘superman‘ AND password = ‘kryptonite‘
- 28. Communicating with a Database 28 § Application data is generally stored in a database § Most common technology is a relational database § Can be queried using SQL (Structured Query Language) § When a user logs in, the application verifies his credentials SELECT * FROM users WHERE username = ‘ + username + ‘ AND password = ‘ + password + ‘ Username: administrator Password: luckyguess SELECT * FROM users WHERE username = ‘administrator‘AND password = ‘luckyguess‘
- 29. Communicating with a Database 29 § Application data is generally stored in a database § Most common technology is a relational database § Can be queried using SQL (Structured Query Language) § When a user logs in, the application verifies his credentials SELECT * FROM users WHERE username = ‘ + username + ‘ AND password = ‘ + password + ‘ Username: administrator’-- Password: luckyguess SELECT * FROM users WHERE username = ‘administrator’-- Administrator– au28sj348aj2– [email protected] – admin
- 30. Communicating with a Database 30 § Application data is generally stored in a database § Most common technology is a relational database § Can be queried using SQL (Structured Query Language) § When a user logs in, the application verifies his credentials SELECT * FROM users WHERE username = ‘ + username + ‘ AND password = ‘ + password + ‘ Username: ‘ OR ‘1’ = ‘1’-- Password: SELECT * FROM users WHERE username = ‘‘ OR ‘1’ = ‘1’-- Administrator – au28sj348aj2– [email protected] – admin Philippe – secret – [email protected] – editor …
- 31. SQL Injection Attacks Are Problematic 31 § Injection problems are ranked #1 in the OWASP Top 10 § SQL injection a very common attack https://blog.sucuri.net/2015/10/joomla-sql-injection-attacks-in-the-wild.html
- 32. SQL Injection Attacks Are Problematic 32 § Injection problems are ranked #1 in the OWASP Top 10 § SQL injection a very common attack § The problem stretches beyond login forms § Everywhere where data is used in a query, injection exists § The payload that is injected can be anything … UPDATE users SET email = ‘ + email + ‘ WHERE username = ‘ + username + ‘ Email: [email protected] Username: philippe’; DROP DATABASE website;-- UPDATE users SET email = ‘[email protected]‘ WHERE username = ‘philippe‘; DROP DATABASE website;--
- 33. SQL Injection Attacks Are Problematic 33 https://xkcd.com/327/
- 34. Prepared Statements against SQL Injection 34 § An injection attack is caused by confusing data and code § The database cannot distinguish the query and the data anymore § It does not know what the intended behavior of the query was § Prepared statements declare the query up front § Data is inserted separately, and will never be interpreted as code SELECT * FROM users WHERE username = ‘?‘ AND password = ‘?‘ Username: administrator’-- Password: luckyguess SELECT * FROM users WHERE username = ‘administrator’--’AND password = ‘luckyguess’ SELECT * FROM users WHERE username = ‘administrator’--
- 35. Preventing SQL Injection Attacks 35 § The only correct defense is using Prepared Statements § Every language supports prepared statements § Is only a small effort to do this right in the application’s code § Escaping is often considered as an alternative defense § Dangerous characters (like ‘ and --) are replaced with safe versions § This approach is less effective and more error prone § Defending against SQL injection is technically not difficult § But it requires explicit action from the developer
- 37. A Quick Recap … 37 § Mobile computers and Wifi networks have changed the Web § Enabler of astonishing scenarios and applications § But security has become a lot more important as well § Network-level attacks have become much easier § Anyone sitting nearby can target a wireless user § Users are not necessarily the victim, but their employer may be § HTTPS offers protection against network-level attacks § Realize that it is important, and switch everything to HTTPS § Deploy it correctly, and keep your configuration up to date
- 38. A Quick Recap … 38 § SQL injection is a very old vulnerability § But it’s still very relevant today, as aptly illustrated in this talk § SQL injection can be very harmful § One of the major sources of data leaks § Can even give the attacker full control over your database § Preventing SQL injection is not difficult § Requires a bit of effort from the developer, but not very much § But you need to explicitly protect against these attacks
- 39. Managing Your Application’s Security 39 § You are not a security expert, and nobody expects you to be § Be knowledgeable about basic Web security concepts § Be involved in building the threat model of your application § Be aware of the contemporary Web security landscape § Find trustworthy people for the technical security aspects § Instruct your contractor to explicitly take security into account § Ask for evidence that they are knowledgeable about security § Verify the list of technical goals with a knowledgeable person
- 40. Managing Your Application’s Security 40 § Make security goals an explicit requirement § Contractors should deliver projects that follow current best practices § Plenty of resources available, for example from OWASP § Think about liability, and see if you can transfer it § Verify the security of your applications § Many companies can perform security reviews of your applications § Should be mandatory for critical systems • Passing a security review as a final requirement before delivering a project
- 41. Why Web Security Matters! Philippe De Ryck [email protected] /in/philippederyck https://distrinet.cs.kuleuven.be/events/websecurity/ @PhilippeDeRyck