Security evolution into Engineering Productivity

I just started reading the 'How Google Tests Software' book and Patrick Coperland Forward really hit me.

He basically describes how Testing inside Google went from being a separate discipline (Testing vs Coding) to a integral part of the development process and eventually evolved into what is now called 'Engineering Productivity'

And that is exactly what application security needs to do. We need to stop being a TAX and start delivering Engineering Productivity (which ironically is already happening today, since, when you find a good success stories on Application Security, you usually find a good Engineering Productivity story).

You can read it Patrick's Forward online at Safari and just replace Testing with Security.

Just like security is today, testing (at Google) was a separate discipline. With separate skill sets, objectives and focus.

A couple key issue were:

• the lack of development skills that Testers had, 
• how good developers (in the testing team) would be absorbed by development teams 
• how the existing testers were ok with the status quo
• how non-integrated the whole process was

To see how much Google has evolved,  read this job application for a Google 'Engineering Productivity Manager' and look at how much development skills they ask for.

Today we have the exact same issues in security. Most Security teams don't have strong development backgrounds and even when they do they have very little experience in actually writing real world applications (vs mini-tools and scripts).

Also today, a very large number of successful security teams are happy with being a 'badometer' and delivering PDF after PDF to their clients (vs delivering Tests and Automation of their knowledge/findings)

In a way that is why the O2 Platform doesn't have more traction. There are not enough players that have the type of problem that the O2 Platform was designed to solve (for example look at the latests http://googletesting.blogspot.co.uk entries and that is exactly the type of stuff that I do with O2 (I guess to get the Googlers interested I also need to make O2 run in Javascript and Python :) )

More and more I think that Application Security needs to align itself with Testing, since (as the 'How Google Tests Software' book shows) they are much more mature in figuring out how bake their practice into the development lifecycle.

What is interesting is that Application Security does have it very special place in this ecosystem, since usually everybody else cares that  'THE Application Works' , while the security camp is probably the only one that cares about 'HOW the Application works'


So the challenge is how do transform our current Security Practices into an Engineering Productivity world


Related Posts:

• Secure coding (and Application Security) must be invisible to developers
• No more PDFs with Security Findings 

GTAC 2011 - Google Test Automation Conference

Just found GTAC (http://www.gtac.biz/home) and it looks like there are a good number of talks that are really interesting.

Here are the Talks page http://www.gtac.biz/talks which ironically page crashes Chrome since it tries to load up a very large number of video players :)

The agenda is quite impressive http://www.gtac.biz/agenda and although there is only one security focused presentation ('How Hackers See Bugs' by Hugh Thompson) I bet security is covered by other presentations.

Look for example how there is no OWASP references (including I believe) project leaders. If OWASP wants to change application security, this is the one of the places to be. That said, not all is lost, since I just noticed that Hugh Thompson  did a presentation at OWASP MSP in March (http://hughthompsonowaspmsp.eventbrite.com , videos not online)

Freelance Brief - Improve cross browser CSS of main TeamMentor GUI

This is a brief for a freelancer expert in Browser compatibility issues

Problem: Improve the cross browser CSS of the main TeamMentor GUI (as seen on https://owasp.teammentor.net/)
Deliverable: Patch for https://github.com/TeamMentor-OWASP/Master  repository
Budget: 100 USD
Apply at: https://www.elance.com/job/30027361/proposals


Technical details:


Currently there are subtle CSS differences between the multiple browsers and Operating System that need to be corrected.

The focus should be on the Font family and sizes.

Here is TeamMentor GUI showing https://owasp.teammentor.net/ on multiple Browsers and Operation Systems:

Chrome and Firefox on Windows:

IE on Windows:

Safari and Chrome on OSX:

The brief is to provide a number of CSS fixes as patches (first one to deliver gets the contract)

The source code is at https://github.com/TeamMentor-OWASP/Master  and the live server is at https://owasp.teammentor.net/)

Bonus Points: Figure out why the checkboxes of the Filters overflow in Chrome on OSx (see screenshot above) 

Freelance Brief - Fix IE layout issue in TeamMentor Eval Page

This is a brief for a freelancer expert in IE compatibility issues

Problem: Fix the IE 7,8,9 layout problem that happens in the http://docs.teammentor.net/xml/Eval and http://docs.teammentor.net/xml/Customer pages
Deliverable: Patch for https://github.com/TeamMentor/TeamMentor-Documentation repository
Budget: 100 USD
Apply at: https://www.elance.com/job/30027086/proposals


Technical details:


The 3.1 version of TeamMentor supports the creation and delivery of pure XML content. This technique is used to create an marketing page made of an xml file (http://docs.teammentor.net/xml/Eval) and an XSL file (http://docs.teammentor.net/xml/xslt_LandingPage_Variation_2). The http://docs.teammentor.net/xml/Customer xml page uses the same XSL.

The XML+XST transformation into HTML happens on the client (i.e. browser) and looks like this in Chrome/Firefox:

The problem is that it looks like this in IE (note how it is left justified)

The brief is to provide a IE specific patch for this problem (first one to deliver gets the contract)

The source code is at https://github.com/TeamMentor/TeamMentor-Documentation and the live server is at http://docs.teammentor.net/xml/Eval

Bonus Points: Figure out why the '& included inside the HTML Object tags' encoding is lost, when editing the XSL via thisTeamMentor Notepad Interface: http://docs.teammentor.net/notepad/xslt_LandingPage_Variation_2

O2 REPL scripting video with Audio (consuming YouTube data)

This video shows the power of O2's REPL environment, for example to quickly create several GUIs to visualize the data received from YouTube.

As you noticed, this video contains Audio (99% of the O2 videos created so far are silent). In this case I'm providing a running commentary of the creation of the list you can see in the 39 O2 Platform videos with 12k YouTube views post

So here is a question to you: does the audio helps to understand what is going on better?

39 O2 Platform videos with 12k YouTube views

After uploading the O2 Installer video, I took at look at the O2 related videos stats and was amazed to see that there were 20 subscribers with about 12,000 views of O2 related videos :)

Looking at the list of those videos, there are some really good gems in there, so for reference here they are:

• O2 Script to Download List of YouTube Videos - Apr 12
• O2 Platform v4.0 Installer and quick tour of its scripting tools - Apr 12
• O2 Demo - Auto patching of Asp.NET response.Write - Nov 11
• A developer's rant about security professional - Oct 11
• Writing an O2 'IE Automation' Script for JPetStore Account Creation - Jul 11
• Using O2 to view ESAPI's call-flow graphs - Jul 11
• JpetStore - View Spring MVC Controllers and CommandClasses - Jul 11
• JpetStore - Start Server and Make sure everything is working - Jul 11
• JpetStore - BlackBox Exploits - Jul 11
• Fixing a bug in an O2 Script - Jul 11
• Writing an O2 Script to login into Veracode - Jul 11
• O2 Platform - MediaWiki Page Editor - Viewing, Editing and Creating content - Oct 10
• O2 Platform - WebScarab - Custom O2.avi - Oct 10
• O2 Platform - Gui Automation PoC - Using Notepad.avi - Oct 10
• O2 Platform - Findings Viewer - IBM AppScan Source 7 0 - Oct 10
• O2 Platform - Tool - Using OpenPgp to Encrypt or Decrypt.h2 - Oct 10
• O2 Platform - UnitTest - Twitter_XSS_Vuln_in_ManageDomains - Oct 10
• O2 Platform - Tool - Create Twitter Accounts - Oct 10
• Tool - Find Physical Location via MAC Address (using Google's APIs).h2 - Oct 10
• O2 Platform - View IBM AppScan 7.9 scan files - Aug 10
• O2 Video - Demo Script - HacmeBank Full PoC - Jul 10
• WebGoat - First Example of O2's WebGoat API  - Jun 10
• O2 Platform - Amazon S3 Browser - Jun 10
• O2 Platform - DotNet - Convert VBNet into CSharp - Jun 10
• O2 Platform - DotNet - Convert CSharp into VBNet - Jun 10
• O2 Platform - XSS PoC builder - Jun 10
• O2 Platform - Javascript Stats Viewer - Jun 10
• O2 Platform - Javascript AST Viewer - Jun 10
• HacmeBank - wizard to start server - Jun 10
• HacmeBank - exploit's execution gui - Jun 10
• O2 Platform - Installing V1.0 Beta (22-June-2010) - Jun 10
• O2 Platform - Blogger API (post new blog entry) - May 10
• Using WatiN to create a GMail account - May 10
• O2 Script - API for BTOpenZone (Ask for credentials) - May 10
• O2 Script - API for BTOpenZone - May 10
• Using the O2 .NET Ast Engine - May 10
• Using O2 to Write a tweet - May 10
• Updating O2 XRules Database - May 10
• O2 Tool OzasmtQuery - Editing data - Feb 09
• O2 Tool OzasmtQuery - Viewing Data - Feb 09

If you want to see how I created this list, take a look at the first video or at O2 Script to get YouTube videos list

Video of O2 Platform v4 Installer and quick demo of its scripting tools

Here is a video of how to install the latest (v4) version of the OWASP O2 Platform and a quick demo of some of O2 scripting tools I bet most of you have never seen that O2's Graph scripting environment :) .

If you want to install O2 now, download or clone it from : https://github.com/o2platform/O2_Install 

Here are a couple more details: Installer for O2 Platform v4.0 (first release) 

Video of TeamMentor.net in action

Using with Camtasia today I created a video of how to use the main TeamMentor GUI.

I was quite happy with the annotations added (TextBoxes and Balloons) :)

What do you think, do those annotations help?

On using Hashes as passwords (from client to server)

Following from the How to enforce password complexity on a Hash? post, here are some more thoughts on the use of a hash as password.

The key issue is that without SSL, there is no way we can really protect the user against somebody who is listening in (remember that the session ID is as good as a password).

In terms of the hash being the password (as it is with TeamMentor), if the hash is discovered, then it is as good as a password (although not usable via the GUI).

I quite like fact that the server never knows the password (it only knows the hash, which is the password salted with the username). Also note that on the server-side the hashes are stored by default in an XML file, since in a normal install there is no server-side-secure-storage capabilities.

The only attack I can see we might be able to mitigate is the reuse of stolen hashes. I.e. we could hash the current hash with the current sessionID on login, which would make it a 'only valid during this session token' which in a way is probably as secure as we can get. Note that if the attacker is able to grab the hash via traffic sniffing, then he can also grab the session ID (which for that session is as good as a hash). 

If we go down this route (hash+sesssionId), there is still going to be one moment when the username+password hash will need to be sent to the server (the one with no sessionId salt). That moment is when an account is created (the server needs to have a 'clean hash' to compare with the hash+sessionID hash :) )

At the moment, TeamMentor's most secure login solution is the Windows/AD integration which TeamMentor fully supports since 3.1.

Another option, is adding OAuth support (it would be great to be able to use Twitter, Google or Facebook as an identity provider)

Note: On the topic of the multiple type of hashes, see this answer in the OWASP Security 101 list by Michael Coates

GMail new design sucks. Google please learn from Apple not Microsoft

So it looks like GMail finally pulled the plug on using the 'old' Gmail design and is now forcing the 'new' design into its users.

The reason I don't like the new design is because I like the 'old' one ,and don't want to learn the new UI concepts dreamed up by Google designers.

Everytime I tried to use the new design I didn't like it. It didn't feel confortable and the things that I wanted to do where not dramatically simpler (or even intuitive). I'm sure that if I spent time with it I might start using it better (or be able to racionalize better why it sucks), but I have other things to do with my life.

This is the mistake that Microsoft makes over and over. Why do I have to learn how to do the stuff I already knew how to do? And if you are going to change it, at least it make a massive difference (for the better), but in a lot of case the number of steps are similar, only the path changes.

And this is where Apple (in most cases) gets it right. They are experts in making incremental changes that just feel 'right'

More and more I feel that it is important to have evolutionary changes (whose timeline can be moved back and forward), which btw,  is a sign of good engineering practices.

And it looks like I'm not the only one that fells like this:

• http://heresthethingblog.com/2011/11/02/gmail-reader-mail/
• http://groups.google.com/a/googleproductforums.com/forum/#!topic/gmail/MY0kVJ9ACak
• http://heresthethingblog.com/2012/04/19/gmail-heres-chance-google/ 

From the last link it looks like the only short term solution is to use the even older html-only version :(

Any ideas on how to get the GMail back to its previous state?

In fact, why doesn't Google provide a Git like history so we can revert back to the versions we like :)

30/Apr Update: Here are a couple solutions http://techably.com/make-gmail-older-look-permanent/4215/ (the bookmark one looks specially interesting)

Testing TeamMentor 2.0 security using O2

Here are a couple documents I created almost one year ago when I started looking at TeamMentor.

These are a great example of the type of testing and security analysis I can do with O2 and what I would call a 'first pass at an Authorization Security mapping'

• v2.0 -TeamMentor WebServices Unit Tests.pdf
• v2.0 - Security Testing of TeamMentor WebServices - Part 1.pdf 
• v2.0 -Security Testing of TeamMentor WebServices - Part 2.pdf

Finally here is a very cool PoC that I did that allowed me to deploy (via new EC2 Image and remote O2 communications) a complete new server install of TeamMentor in a couple minutes (note that this was before I discovered Git)

• v2.0 -Tool for Deploying the TeamMentor to the Clould.pdf

OWASP Project Reboot 2012 - Here is a better model

In the last ROI on OWASP investment on Projects (ie paying leaders) post I mentioned that we need a better model to empower OWASP leaders with available funds (which seem to be at the moment about 100,000 USD)

My proposal / idea is to create a OWASP Project Sponsorship model based on these following simple rules:

• OWASP makes available a budget for OWASP Projects (for example 100k)
  
• OWASP leaders are free to use that money in anyway they want, with only the following restrictions:
  
• They can't pay another OWASP leaders or a company that an OWASP leader is directly connected to
• For amounts less than $500 they add its description to the respective OWASP WIKI page 24h before they commit to make the expense
• For amounts less than $5000 they add its description to the respective OWASP WIKI 7 days  before they commit to make the expense
• Each expense item is mapped to an individual OWASP leader and multiple OWASP Leaders can work together.
• Payments will be made by Alison on Invoice submission (by paypal or direct bank transfer)
  
• After the budget is spent (or in 6 months time), OWASP will review the outcomes and see if these rules need to be changed

And that's it!

This will allow the OWASP leaders (of any type) to just get on with it and find the best ways to take OWASP projects to the next level.

After you read this idea, take a look at the current Project Reboot Proposal at the OWASP Wiki.

From my point of view, there are a number of problems with that proposal:

• It allows the payment of OWASP leaders (see Why OWASP can't pay OWASP Leaders for a list of reasons why this is a bad idea)
  
• It doesn't learn from the past and all the hard work that went into the OWASP Season Of Code (SoC) concept - This proposal is basically OWASP SoC 2012, so at least least reuse what has been done before: https://www.owasp.org/index.php/Category:OWASP_Season_of_Code
  
• It puts the barrier of entry as an OWASP Membership (which is a 50USD registration) - I would put this barrier of entry at OWASP Leader level, since those are individuals that have earned OWASP's trust and have delivered (note that the issue of  'does an OWASP leader deserve to be OWASP leader' is a separate thread)
  
• There are a lot of pieces missing - If we are going down this path (which again is OWASP SoC 2012), then we will need to be as transparent and efficient as the last OWASP SoC. To get a better picture of what will need to be done, spend some time with the amazing pages that Paulo Coimbra (and the GPC) created on https://www.owasp.org/index.php/Category:OWASP_Season_of_Code (for example a lesson learned from past SoC is that all proposals must be submitted via the OWASP wiki)
  
• There is no Project Manager - Investing in OWASP projects in this way is a full time job. The first step should be to hire a project manager to work on this (one of the beauties of the model I propose above is that is much lighter to implement (since there is a high degree of self control)

Finally, don't get me wrong! Investing on OWASP's projects is one of most important things that OWASP needs to do, and if the Project Reboot Proposal is approved, we will be better than we were before.

The reasons for this post, is that I just think there is a better and simpler way of doing it :)

ROI on OWASP investment on Projects (ie paying leaders)

I was thinking about the crazy idea of paying OWASP leaders (still supported by a number of OWASP leaders) and I started wondering what was the ROI (Return of Investment) for OWASP and its community when OWASP did pay OWASP leaders (existing and new ones) to work.

For reference here are the projects sponsored in the past:

OWASP Autumn Of Code 2006  - 34,000$ USD invested on :

• WebScarab NG  ,  
• Live CD , 
• CAL9000 ,  
• SiteGenerator and ORG , 
• Pantera ,  
• Web Goat , 
• Testing Guide , 
• OWASP .NET Tools ,. 
• OWASP Website and Branding 

OWASP Spring Of Code 2007 - 117,500$ USD invested on:

• The OWASP Web Security Certification Framework ,
• SqlMap ,
• OWASP Site Generator , 
• Attacks Reference Guide ,
• The Scholastic Application Security Assessment Project,
• Inspekt: Input filtering and validation library for PHP ,
• Code review Project ,
• OWASP Certification Project ,
• OWASP Education Project ,
• OWASP The Anti-Samy Project ,
• Security throughout the SDLC ,
• OWASP WebGoat Solutions Guide ,
• OWASP WeBekci Project ,
• Python Tainted Mode ,
• WebScarab NG Security Test Automation ,
• Refresh Attacks list ,
• Best Practices & Countermeasures ,
• OWASP brand ,
• Web Application Security put into practice ,
• OWASP JBroFuzz Project ,
• Owasp Orizon Project ,
• Enigform: Firefox Addon for OpenPGP signing of HTTP requests ,
• OWASP LiveCD Education Project ,
• OWASP Java Project ,
• OWASP LiveCD Project ,
• Interim @ Aspect Offices ,
• Help with SpoC project management ,
• OWASP Corporate Application Security Rating Guide

OWASP Summer of Code 2008  $104,000 USD invested on

• 100% Completion
• OWASP Testing Guide v3 
• OWASP Ruby on Rails Security Guide v2 
• OWASP Live CD 2008 Project
• OWASP Code review guide, V1.1 
• OWASP AntiSamy .NET 
• OWASP .NET Project Leader
• OWASP Source Code Review OWASP Projects 
• OWASP AppSensor - Detect and Respond to Attacks from Within the Application
• OWASP Backend Security Project 
• OWASP Securing WebGoat using ModSecurity 
• OWASP Teachable Static Analysis Workbench Dmitry Kozlov 
• OWASP Access Control Rules Tester 
• OWASP Skavenger Matthias Rohr
• OWASP Online code signing and integrity verification service for open source community (OpenSign Server) 
• OWASP Code Crawler
• OWASP OpenPGP Extensions for HTTP - Enigform and mod_openpgp
• OWASP Application Security Verification Standard
• OWASP Classic ASP Security Project 
• OWASP UI Component Verification Project (a.k.a. OWASP JSP Testing Tool) 
• OWASP SQL Injector Benchmarking Project (SQLiBENCH)
• OWASP Spanish Project 
• OWASP Internationalization Guidelines Project 
• GTK+ GUI for w3af project
• OWASP Book Cover & Sleeve Design
• OWASP Individual & Corporate Member Packs, Conference Attendee Packs Brief 
• Above 50% Completion
• OWASP Orizon Project 
• OWASP Application Security Desk Reference (ASDR)
• OWASP Application Security Tool Benchmarking Environment and Site Generator refresh
• OWASP Education Project
• OWASP Python Static Analysis 
• Below 50%  Completion
• OWASP WeBekci Project Bunyamin Demir
• OWASP Positive Security Project 

As you can see there were a LOT of projects that OWASP sponsored

From a pure ROI point of view, we need to ask: "How many of these projects are successful (or even active) today?" and "How much impact did these this investment actually had?"


If we look purely from a project deliverables point of view, although there were a number of solid deliveries I think one will struggle to come up with a positive balance (specially since some of the best things done to these projects happened after this sponsorship).

But if we look at this from the point of view of:

• Bringing new energy to OWASP (namely OWASP leaders)
• Improve the research on WebAppSecurity
• Improving the connections and relationships between these OWASP Leaders
• Empowering these OWASP Leaders to be involved in other areas (and projects) at OWASP (note how a lot of the most active OWASP leaders today were involved)
• Creation of new Chapters (directly connected to a sponsored OWASP leader) , with some of these chapters also eventually organizing OWASP Conferences

I would say that the balance is massively positive!

So the question is: "if we want to achieve similar results today, should we pay OWASP leaders again or do something different?"

My view is that we need a new model, one that is based on the concept that 'OWASP cannot pay for OWASP leaders' and focused on empowering those leaders.

For more on this topic see:

• Why OWASP can't pay OWASP Leaders
• Project Management at OWASP
• Why large OWASP projects start to stale (and who should pay for the work) 
• OWASP: Proposed change for SoC: Use budget to pay for project related expenses  (from 2009)

Alternatives to IE WebBrowser Control in .NET

UPDATE (Jun/13): see When the best way to automate Chrome is to use ... Chrome (with examples on Google search, direct AngularJS scope manipulation and ChromeDriver javascript access) for a way to use the the actual chrome window inside a .NET process

UPDATE (Jan/13): See PoC - Selenium - Gui with 3 Hijacked Browser Windows.h2 post for a much better and powerful way to consume Chrome (and IE and Firefox) in another process

---

UPDATE (Jun/12): After this post was written I was able to use CefSharp to consume Chrome natively in C#:

• Running Chrome inside O2
• Video: Installing and running CefSharp (C# Chrome with WPF Browser)
• Video: Running Chrome Natively in O2 and VisualStudio  

---

I did some research on some alternatives to IE's WebBrowser control and here are some interesting options:

• CefSharp ...Net binding for the Chromium Embedded Framework...
• Berkelium ...provides off-screen browser rendering via Google's open source Chromium web browser... 
• berkelium-sharp ...Managed wrapper for the Berkelium embedded browser library.. 
• open-webkit-sharp ...GTLite Navigator An open-source WebKit web browser...
• Chromium ...open-source projects behind the Google Chrome browser and Google Chrome OS...
• Awesomium - ...Web Browser Framework ... (Commercial and Indie License) 
• Mono WebBrowser

Here are some StackOverflow threads:

• Use chrome as browser in C#? 
• Replacing .NET WebBrowser control with a better browser, like Chrome? 
• Is there an embeddable Webkit component for Windows / C# development?

I really would like to start consuming Chrome and Firefox's engines in O2 :)

Moral behaviour in animals. The privacy of Rewards

This Ted presentation is really interesting, specially the part (close to the end) when the same task is rewarded differently.

This made me think that a job's pay/salary/reward is a privacy issue (whose disclosure has negative effects for a team's overall performance).

Configuring .NET to use IE9 inside O2

If you are using O2's REPL environment to write IE scripts, you really should change your environment to use the latest version of IE inside the C# .NET Control (or else you will be using IE 6 or 7 which is just about unusable in today's web world)

This is the O2 Script that does that: Set .NET WebBrowser Control to use latest version of IE

Once that is executed, you should get IE 9 inside O2:

Code Mirror and TeamMentor's Html Code Editor

Code Mirror (online code editor) is great, I used it on TeamMentor (TM) to create an web editor for server side content (one of the gems hidden inside it :)  ).

Code Mirror was really easy to integrate and you can see it in action below or at: jsbin.com , sourcelair.com or wescheme.org

Yes, I can edit HTML directly from the browser :)

This is a great 'admin' feature and has helped me to solve a lot of problems in real-time on remote deployments. It also has a number of security features/requirements, which I want to cover on later posts.

Btw, I would like to package this module as a separate project, since this HTML/Ashx code editor is already packaged as a stand alone unit inside TM (if anybody wants to do it ping me directly, this would be a great mini-project to do)

At TM, the code is the WebEditor folder and the real action happens inside the WebEditorService.ashx file.

Here it is in action:

Arithmetic, Population and Energy, by Albert A Bartlett

Albert A Bartlett provides a really powerful explanation of the power of the Exponential function.

In fact, on his "Arithmetic, Population and Energy" presentation (see video below) he states: "The greatest shortcoming of the Human Race is our Inability to Understand The Exponential Function" 

I actually think that exponential growth (until it reaches saturation) is one of the more effective, pragmatic, democratic and healthy types of growth.

The examples provided are amazing, and really makes us think about how to measure success and what are the real signs of adoption.

I will really look differently at 2% or 5% growth from now on :)

The presentation is an an eight part video, and here is the first one:

And here are all 8 of them

Light Table - Amazing PoC of IDE

Couple days ago Chris Grangers posted Light Table - a new IDE concept (inspired by Bret Victor - Inventing on Principle presentation) , and its Light Table's numbers follow-up post shows how well his ideas where received by the developer community.

In a way a number of these concepts are already present in the latest version of O2 and its REPL C# environment (note to self: start blogging about O2's scripting environment)

These two videos are well worth the time to see them

Chris Grangers - Light Table
 

Bret Victor - Inventing on Principle

Google BBS - What Google would have looked like in the 80s

Ahh this takes me down the memory lane...

http://www.masswerk.at/googleBBS/ is a javascript demo of "Google BBS - What Google would have looked like in the 80s"

I spent a lot of time on BBS , I even hosted one for a while :)

Adding Gaug.es to Blogger, XSS by design?

I just added Gaug.es monitoring to this blog (hosted by Blogger). That can easily be done by:

• going to the Blogger Layout page (via the admin panel)
• at the bottom click on 'Add a Gadget'
• chose the HTML/Javascript gadget from the 'Basics' list
• add the Guag.es tracking code, that look something like this:

For this to work, Blogger is in essence allowing me to inject Javascript into this blogging site, which is basically persistent XSS :)

In fact , the code sample above (GIST from GitHub) is also an XSS injection, so one can also put script execution on normal posts:


So what are the security implications of this?

• The javascriopt code will be executed under the http://diniscruz.blogspot.com/ domain, so (in principle) any script on it should not be able to affect any other *.blogspot.com domain
• The injection of code via the blog Layout means that any blog admins can take over this blog (so that is OKish)
• But what about Javascript on the blog post? Doesn't that mean that any author of this blog can take over the blog (by putting a payload on a page and waiting for an admin to see it?)
• What about visitors to this blog? Is there a way to 'attack' them? 
• For example: will it be possible to auto-post a comment (or vote) for them? It looks like comments are made from http://www.blogger.com/comment.g?... so that could prevent it

Question: Is there a write-up somewhere on the interweb about the security implications, threads and countermeasures of allowing user Script injection in a user-driven site like blogger?

This question is very relevant to me at the moment, since the 3.1 beta version of TeamMentor allows raw HTML (and Scripts) to be used on TM Articles (this is a feature requested). And I need to figure out the best way to handle it

Gaug.es is Amazing - Just added RealTime website tracking to TeamMentor

If you haven't tried Gaug.es you are missing on a great service. They are now owned by GitHub and it is easy to see why they were bought. Not only you get real-time data, their AirTraffic Live view is just amazing (it's basically world map with a little dot showing a request)

I just added gaug.es support to TeamMentor and I'm really happy with the results. All of TeamMentor's content is dynamic, so it actually making it work required some customizations.

You can see it in action in the TM Documentation site (build using TeamMentor):

• http://docs.teammentor.net - main page which loads dynamically the documentation 
• http://docs.teammentor.net/html_pages/Gui/TeamMentor.html - base TeamMentor GUI, which also loads the TM Articles dynamically in the preview window
• http://docs.teammentor.net/xsl/TeamMentor_Technology - This is the wiki-inspired version of TeamMentort, which I'm using to document how TeamMentor works. A server-side XML+XSL = HTML page which also loads the content dynamically.
• http://docs.teammentor.net/xml/Eval and   http://docs.teammentor.net/xml/Customer - Client-side XML+XSL = HTML where the article's content is edited directly via XML (checkout the source code of this page)

As you can see in all cases, I needed to be able to feed gaug.es normalized traffic so that the data collected is a good reflection of what actually happened (what pages where opened, etc...).

To do this, I modified the default https://secure.gaug.es/track.js they provide and  added a couple extra features ( I also host this file from the TM server which is a good security practice)

You can see the final version in this GitHub file Gauges_Tracking_Code.js with the key changes shown  in the source code snippet included below. Once this is set, I can feed data to gaug.es by just calling my_Gauge.track("Action", "Page"):

Checkmarx database export, VistaDB in O2, Opening up Checkmark's rules, and more....

I just posted on the O2 Blog and TM Documentation the scripts I wrote during the PoC of integrating TeamMentor with Checkmarx:

• VistaDB API and GUI (as used by Checkmarx SAST engine) - O2 Blog
• Exporting Checkmarx SAST Database into XML files - O2 Blog
• Case Study – Creating a CWE Library from CheckMarx data - TM Documentation

Earlier today I had a call with Checkmarx to follow up the idea I talked with Maty (Checkmarx CTO) about the release of Checkmarx 'C# based rules' under an Open Source/CC license on GitHub.

I have to say that the Checkmarx camp seems really motivated to do this, and if they do it, it could be a big game changer (I offer to put those rules in GitHub since I already have the Query.xml file :), so lets see what happens next ).

Btw, if you are a Checkmarx customer (or are evaluating it - which if you are looking at SAST you should), drop them a line saying that it is a good idea :)

Video on TeamMentor Install/Execution

As you can see it is pretty easy to install/execute TeamMentor from a local server (Cassini) or IIS :)

If you want to repeat the steps from the video, the GitHub repository you need to fork is: https://github.com/TeamMentor/TeamMentor-Documentation

Leaking TeamMentor's Pricing model

Last week I was with Ed Adams (Security Innovation CEO) while he was in the UK to meet some TeamMentor customers, and I commented how it really sucks when a tool vendor doesn't give you a strait answer when you ask them the simple question: '...so... how much does your tool costs?' 

And they usually reply '...well, that depends on this, ... and on that,  ... and on how many users, .. blah ... blah... blah...  and if it is yellow, .. and on how much support is needed , blah.. blah... blah .. and if it needs to sign in tune ... blah... blah...blah...and if it actually needs to work ... blah ... blah...blah...'  (and after 5 minutes you still have no idea how much it costs)

I'm sure you have heard those lines before :)

It basically means that they trying to figure out before they give you a price: a) how big you are, and b)  how much money you have to spend

This is just wrong!

Customers need to be treated with respect, and pricing must be clear, consistent and easy to understand.

So as Ed was agreeing with me, I gently noted that we didn't put our current pricing model for TeamMentor (TM) on the Security Innovation (SI) website :)

And please note, the SI team is really good ! The politics level is very low, and they are a pleasure to work with. But when everybody is doing it (not disclosing prices) it is hard to be the first one.

So let me see if I can help :)

And the end of our conversation, I said "... you know Ed ...  I really want to leak TeamMentor pricing model  ... and once it is out there ... it is out there ...."  :)

And (actually not to my surprise, since Ed is really relax in these things), Ed just said "...ok, do it.."

So, here it is: (get ready for an anti-climax moment)    

TeamMentor pricing model is:

• 40k USD  - Unlimited (per business unit) TM Server Installs + SI Library (with 4000 Articles) +  dedicated GitHub Fork (which we will maintain) , 
• 10k USD  - 1x  TM  Server Licence + SI Library + dedicated GitHub Fork
• 0k USD    - 1x  TM  Server License + OWASP Library + shared GitHub download (this is our 'evaluation' version and comes with a 'not for commercial use' license)

There are a couple TeamMentor related Services that we will be providing ( 'Policy document to TeamMentor Library' conversion, 'TeamMentor in the Cloud', TeamMentor customizations, etc...), and there is also a reseller agreement, with a 20% to 40% commission.

In a way, one of the value propositions of TeamMentor, is that it is more expensive to pay somebody to write 'specialized application security' content, than it is to buy TeamMentor's Library.

And that' it :)

Disclamer: I did forward this email internally at SI (as a sign of respect and to made sure that I didn't get any details massively wrong), and apart for the strike-through 'a 20% to' (just above) there were no further changes. One comment that Adam (VP of sales) made  was "... well I do wish that they contact me directly if they want to talk about pricing..", so to make Adam happy, here are his contact details: ahoffman@securityinnovation.com  +1 (978)337-1810