Some hacking for the weekend (with an AppSensor and O2 Platform flavour)

(originally posted to the OWASP leaders list)

---------- ---------- ---------- ---------- ---------- ---------- ---------- 

As you can see on Please hack TeamMentor 3.4.1 (learn, maybe be paid or even get a job) I'm inviting the world to hack the app I'm been working for the past years.

You can either do a pure black-box (on https://tm-appsensor.azurewebsites.net ) or look at the source code (clone from https://github.com/TeamMentor/Dev and run locally or in Azure (only needs .NET 4.0, no DB install required) 

There is quite a lot of OWASP influence in this release of TeamMentor, from the O2 Platform FluentSharp libraries (which make me a lot more productive as a developer), to the AppSensor-like features (see below) and the multiple OWASP-inspired coding strategies used to keep the app secure (look for example at the ASMX and WCF security tests or the .NET Security Demands).

What is really cool and I'm very excited about, is the first pass at adding AppSensor capabilities to this app. 

Please hack TeamMentor 3.4.1 (learn, maybe be paid or even get a job)

TeamMentor (TM) is the project I have been the main developer for the past couple of years, and as we approach another release (v3.4.1), I would like to invite you all to have a go and hack it (i.e. find security vulnerabilities, report them to us, learn a bit and maybe even get paid or get a job offer :)

TeamMentor is a web-based Security KB with tons of prescriptive security guidance, how-tos and guidelines. It is built on C# .NET 4.0,  jQuery with a bit of AngularJS;  and you can see in action at https://www.teammentor.net (you can create an eval account and have access to the entire content for 15 days)

Changing the way User Sessions are handled by TeamMentor (will be 3.3 Release HotFix 3)

One feature we introduced in TeamMentor 3.3 was the limitation of only allowing one user session to be active at any given time.

This had the nice side effect of 'preventing user account reuse'.

In practice, this meant that TM users had to stop using shared accounts (like the admin account), which was a good thing.

But, it created nasty side effects where the user can only be logged in once across all its devices. And an even worse side-effect happened when we implemented a SSO solution for a client, and we realized that for the cases where there was one SSO token shared across multiple users, we would have to create an TM account per user session!

So we went back to the Concurrent Logins Have Broken  issue, reopened it and changed it priority to P0 (which means that this will be another 3.3 HotFix)

The rest of this post shows the workflow that I took when making the code 3.3 HotFix #3 changes, testing them and pushing the new version to GitHub.

How TeamMentor creates SHA256+PBKDF2 password hashes and stores them in XML files

In the 3.3. version of TeamMentor there was a significant change in how the user's password hash is submitted and stored.

In version 3.2. we used a SHA256 hash of “username+password” (created either on the client (browser) or server) which was stored in the user’s xml file (which is a serialization of the in memory user-object).

Although we never stored the user’s password on disk (in fact in most cases we never even sent it to the server), due to advances in processing power and Credentials Brute Force Attacks, in 2013 that is not a secure way to store password anymore.

After some threads (see TM stores passwords insecurely issue), it was agreed that a solution based on PBKDF2 should be used.

TeamMentor 3.3 RC4 - Final tests, please have a go

Hello, we're on the final stretch for releasing a major update to TeamMentor and it would be great if you give it a test drive!

The current release is called TM 3.3. and is mainly focused on a number of changes we developed specifically for our TeamMentor.net version (i.e. the public read-only version of TeamMentor). The source code is published on the main TM repository, at the 3_3_Release branch (see  https://github.com/TeamMentor/Master/tree/3_3_Release )

The Email RegEx that (could had) DOSed a site

While I was writing the UnitTests for TeamMentor's NewUser validator (see Validating a POCO DataContract using .NET's DataAnnotations Validator ), I had a weird result in one of the tests.

I basically got a 'never ending execution' scenario on this UnitTest:

Is this a safe way to do a .NET Server Redirects? (and deal with A10: Unvalidated Redirects and Forwards)

The objective is to prevent A10: Unvalidated Redirects and Forwards in TeamMentor (version 3.3 had an issue with it)

Here is the code that does the redirection from user import (LoginReferer parameter):

Is the TeamMentor Development/SDL team as good as it gets? (from a security point of view)

As we're having another internal (which should be public but is a topic for another post) debate/email-thread at SI/TM about the 'best way to handle user passwords/hashes', I was thinking "is this (TM SDL) as good as it gets?"

Here is what we have today (regarding TeamMentor's SDL and Team):

Interesting Encoding problem with TeamMentor Japanese translation

Here an interesting prob I had to deal today with the first pass of TeamMentor's translation into Japanese.

The translation phase was quite sweet. We sent the TeamMentor Xml files file to the translation company, which they were able to plug into their system, and once completed, they send us back a zip with the translated xml files :)

That zip was then uploaded (via drag and drop) into a TM test server (see video of that workflow here) and it all worked .... except for the metadata and filters:

FLOSSHack TeamMentor and the 'sausage making process' that is software/application development

OWASP's FLOSSHack events are a really powerful initiative.

"...Free/Libre Open Source Software Hacking (FLOSSHack) events are designed to bring together individuals interested in learning more about application security with open source projects and organizations in need of low cost or pro bono security auditing. FLOSSHack provides a friendly, but mildly competitive, workshop environment in which participants learn about and search for vulnerabilities in selected software. In turn, selected open source projects and qualified non-profit organizations benefit from additional quality assurance and security guidance...." 

See FLOSSHack_One for the details (and vulnerabilities discovered) of the first event.

OWASP's FLOSSHack is one of those 'magical' spaces where the OWASP's community and its projects can come together and add a lot of value.

Couple XSS issues and XSS-By-Design (in TeamMentor)

The security review of TeamMentor (TM) has raised a couple XSS issues which seem (so far) to require user-intervention, where the user (or admin) are required to inject the payload in order to trigger it (i.e. they are attacking themselves).

Here is a small description of the issues and how to reproduce them (this really should be a script):

TeamMentor Vulnerability Disclosures: CSRF , ClickJacking and Get Password Hash from Browser Memory

Following the Test and Hack TeamMentor server with 3.2 RC5 code and SI library post, Dinesh Shetty took the challenge and sent me 3 nice documents with a number of security issues on the 3.2 version of TeamMentor (note that we are also Creating an TeamMentor Security Bounty Program)

Here are some comments on the 3 issues, and below you can see the PDFs he submitted:

Creating an TeamMentor Security Bounty Program

Following the unofficial success of the Test and Hack TeamMentor server with 3.2 RC5 code and SI library request (with already a couple vulnerabilities disclosed), I'm very happy to say that SI is going to make it official.

We will be creating an TeamMentor Security Bounty Program for this week, which is when we are doing a Security Push for TeamMentor (before it is released officially next week).

There still needs to be a bit of thinking on this, with the rules-of-engagement defined, but here is the thinking so far:

Test and Hack TeamMentor server with 3.2 RC5 code and SI library

Here is test server with the lastest build and SI Library  http://teammentor32.apphb.com (on AppHarbor's cloud)

There are tons of changes on this new 3.2 version and I've been working solidly on this release for the past 3 months. Some of the new features are REALY cool and I will try to blog about them (specially the automation/backend features provided by using the latest version of O2 FluentSharp APIs)