I want to live in an insecure world because an insecure world is a safer world
I.e.the more insecure we are, the safer we are!
The fact that something bad/unexpected CAN happen (what we usually call a vulnerability), doesn't automatically mean that it WILL happen or be exploited (this is something that the business guys understand very well, but usually the security guys don’t).
In fact, usually, the more insecure the system is, the easier it is to do business with it , and the easier it is for its users to interact with.
This is something that the Credit Card industry understands really well, in fact one criticisms that the great geekonomics book (for example see chapter We'll Be Compliant, Later) throws at it, is the fact that they (the Credit Card industry) design insecure systems by design, mainly because they want it to be easy to use. They accept a certain percentage of fraud, which basically means that they are trading security for functionality and ease-of-use (i.e. they are making a risk decision to build insecure systems (or systems not as secure as they could be)).
PCI, from a risk-reduction point of view, is a MASSIVE success. From a making-the-websites-more-secure-and-not-exploitable point of view, PIC is probably not as successful/effective as the PCI-bashing crowd would like it to be.
Coming back to the main idea of this post, the reason I want to live in an insecure world, is because I want to live in a world where I leave my doors unlocked!
I (and my family) am much more secure in a neighborhood where I don’t have to lock my door (and I don’t have to physically protect my assets), versus a neighborhood where I need private security guards with machine guns outside my door to protect myself.
I.e. I want to live in a world where I don’t have to care about security! because that is actually a safer world.
Of course that in the real-world and in normal neighborhoods, one can't leave the doors unlocked all the time. What we do is we adjust our security measures to the current perceived threats (and the probability that the vulnerability (the door not locked) is going to be exploited).
It is ultimately a risk decision (sometimes our 'perceived' threats are grossly over or under estimates (see Bruce for tons on examples on this) but that tends to adjust it self with time) .
I don't have a problem with clients making risk decisions (for example 'choosing NOT to fix a security vulnerability or applying a short-term remediation using a WAF). As long as it doesn't affect me personally, it is their decision to make. After all, it is their businesses.
I DO HAVE a problem when the clients DON'T know about how insecure they might be and how many vulnerabilities exist in their applications/systems. My view of my job (and of OWASP's) is to give clients and users VISIBILITY into the security implications of what they are building, buying or using. What to do with that visibility and knowledge is NOT my job :)
Ultimately, when the market has good understanding of what is going on, it tends to make good decisions. The problems tend to occur when the market DOESN'T understand what is going on (like the recent financial crash as shown us)
Friday, 28 August 2009
Why We Need Breakers ( ... and virus writters ... )
One of the things that OWASP's Jeff Williams usually likes to say is that we need builders versus breakers.
He (and others) basically defend, that we need to have more guys focusing on how to protect systems, versus how to break/exploit them. He uses, as an example: ‘why do we need another example of how to exploit an specific variation of SQL injection instead of spending the resources figuring out how to fix it?’
The reality is that we need both. We actually need to have both researches activities/cultures, because showing us how to break something, is actually a great measurement of the current state of a particular problem (see also Jeremiah's Builders, Breakers, and Malicious Hackers).
The irony of all this, is that Jeff, in his Black Hat's Enterprise Java Rootkits presentation, become a BREAKER himself, and spend considerable resources and time showing in several powerful demos how dangerous is Java code executed outside the Java Security manager (i.e. outside a Sandbox). He is trying to do for Java what I tried (and gave up) on .NET (see Past research on Sandboxing and Code Access Security (CAS))
Today, just about everybody runs Java code outside a sandbox and the awareness that this could be very dangerous has still not reached critical mass. So for the people who are aware of this problem (i.e. Jeff), unless he starts hacking away real world targets to prove his point (not a very good idea in 2009) the only other alternative is to show what can be done and how bad is the current status quo. And by doing so, he is being a breaker.
Due to his past 'Builder vs Breaker positon' Jeff took a bit of slack for it, but basically he is showing / highlighting the problem and helping to raise awareness of its implications.
The main reason we need breakers, is because they actually show us the current state of the problem, since, the easier job the breaker has, the easier the target's can be exploited.
We also need 'non malicious' breakers because they actually show us what’s going on.
For example 'non malicious' (& with no criminal intent) virus writers!
I like to go on record to say that 'non malicious' Virus writers are actually our best friends, because they actually raise our overall level of security.
Although they may create short term havoc (and pain to the guys directly affected), they literally raise the level of security (for example 'forcing' people to patch existing vulns and making the eco-system more resilient)
This is why we need 'non malicious' viruses in the real world as well as the web world; they are actually benign and helpful (in the big scheme of things :) ).
In fact we (the good guys in the web application security world) should be paid to write viruses in order to push security up, but that is very unlikely to happen .... in the short term ... :)
He (and others) basically defend, that we need to have more guys focusing on how to protect systems, versus how to break/exploit them. He uses, as an example: ‘why do we need another example of how to exploit an specific variation of SQL injection instead of spending the resources figuring out how to fix it?’
The reality is that we need both. We actually need to have both researches activities/cultures, because showing us how to break something, is actually a great measurement of the current state of a particular problem (see also Jeremiah's Builders, Breakers, and Malicious Hackers).
The irony of all this, is that Jeff, in his Black Hat's Enterprise Java Rootkits presentation, become a BREAKER himself, and spend considerable resources and time showing in several powerful demos how dangerous is Java code executed outside the Java Security manager (i.e. outside a Sandbox). He is trying to do for Java what I tried (and gave up) on .NET (see Past research on Sandboxing and Code Access Security (CAS))
Today, just about everybody runs Java code outside a sandbox and the awareness that this could be very dangerous has still not reached critical mass. So for the people who are aware of this problem (i.e. Jeff), unless he starts hacking away real world targets to prove his point (not a very good idea in 2009) the only other alternative is to show what can be done and how bad is the current status quo. And by doing so, he is being a breaker.
Due to his past 'Builder vs Breaker positon' Jeff took a bit of slack for it, but basically he is showing / highlighting the problem and helping to raise awareness of its implications.
The main reason we need breakers, is because they actually show us the current state of the problem, since, the easier job the breaker has, the easier the target's can be exploited.
We also need 'non malicious' breakers because they actually show us what’s going on.
For example 'non malicious' (& with no criminal intent) virus writers!
I like to go on record to say that 'non malicious' Virus writers are actually our best friends, because they actually raise our overall level of security.
Although they may create short term havoc (and pain to the guys directly affected), they literally raise the level of security (for example 'forcing' people to patch existing vulns and making the eco-system more resilient)
This is why we need 'non malicious' viruses in the real world as well as the web world; they are actually benign and helpful (in the big scheme of things :) ).
In fact we (the good guys in the web application security world) should be paid to write viruses in order to push security up, but that is very unlikely to happen .... in the short term ... :)
Thursday, 20 August 2009
O2 Module presentation - Aug 09
Just uploaded a presentation to O2 Modules Presentation V1.0 which is the first time ALL major O2 modules have been mapped and documented :)
I will be adding this data to the multiple sections of the current O2 website.
Any comments?
Sunday, 16 August 2009
Past research on Sandboxing and Code Access Security (CAS)
Following a recent Twitter (@DinisCruz) thread, I realized that I had no post with links to my (failed) attempts to get Microsoft (and Sun) to allocate serious resources into Sandboxing of managed applications, and (specifically to .NET) into making Code Access Security work in the real world (i.e. figuring out what are the people, process and technologies required, so that it is possible to 'developt & deploy commercial applications & websites that run under a meaningful + effective Partial Trust environment').
If you are interrested in this topic, the best place to start is this PPT presentation (which was the last one I created): Making the case for Sandbox v1.1 - Dinis Cruz - SD Conference.ppt
If you are interrested in this topic, the best place to start is this PPT presentation (which was the last one I created): Making the case for Sandbox v1.1 - Dinis Cruz - SD Conference.ppt
Thursday, 13 August 2009
Links dump - 13 Aug
Here is a list of windows I had opened in Safari & Firefox that I want to keep for later reference:
- Project Trident: A Scientific Workflow Workbench
- Python documentation
- Microsoft Anti-Cross Site Scripting Library V3.0
- Implementation Ideas for the CAT.NET 2.0 Tainted Variable Analysis Algorithm
- Merlin: Improving the Quality of Security Static Analysis Tools
- Microsoft RISE - Static Analysis (Automatically find software defects without running the program using techniques such as deductive verification, model checking, abstract interpretation.)
- Critical .NET Security Vulnerability - technical details of the vulnerability Jeroen discovered last year on the .NET framework (broke type safety)
- Writing Software Security Test Cases
- NEWSPAPERS AND THINKING THE UNTHINKABLE
- THE IMPENDING DEMISE OF THE UNIVERSITY
- Archive for the ‘OWASP’ Category
- Simple Matrix = Real Mess - great post from Gunner on why developers re-invent Authorization systems all the time and don't touch Crypto
- Cross-Site XMLHttpRequest - documentation of the next generation of web vulns :)
- Legalize It (Hacking GOV and MIL website) - a great idea which should be given more support
- Industry Analyst Coverage - If we had more resources at OWASP (and were more organized and focused) we could really make a difference here
Wednesday, 12 August 2009
Update on O2 & Ounce & IBM
As you probably know by now IBM bought Ounce Labs on July 28th.
What does this mean for O2 and all the Open Source research that I have been doing (and publishing) for the last 12 months? The honest answer is that I still don't know (i.e. I'm still not an IBM employee and basically just had my Ounce Labs 'independent contractor' agreement extended to IBM).
I had a great meeting with a number of IBM/AppScan guys last week in Ottawa (Canada) and will be back there next week to do an O2 presentation and talk about the next steps.
There has also been talk (via Jim Manico and Tom B (here and here) to move O2 to OWASP, maybe even calling it O3 (as in "OWASP O2" where O2 could also be used as a reference to Oxygen). As Jim correctly mentions, O2 is released under an Open Source license (Apache 2.0) and there is nothing preventing this move (to an OWASP project). I love the idea to move it to OWASP, but lets see what is IBM's finally position on this (since ideally they should officially support this new OWASP project).
In practice, these IBM presentations means that you will see (when compared with what exists today) a HUGE amount of O2 documentation being published to the O2 website.
As with most of you, the first question that the IBMers are asking is "I've heard about O2, but WHAT is it, and what does it do?" :)
I'm also going to extend the O2 Module that shows how to map "Ounce's scan results with HP WebInspect scan results" to IBM's AppScan and Rational. This should be an interesting (and powerful) demonstration of O2 capabilities (and btw, AppScan Standard Edition is an .NET Application :) :) : ) :) ... 'nuff said :) )
The good news is there is lots of excitement and energy to make the O2 + Ounce + AppScan + IBM integration work (in a way that keeps O2 Open Source and makes business sense for IBM). Several Ounce guys are being really supporting and helping to spread the word. See for example this post from Ian Spiro (Ounce / IBM and Ounce Open - O2 User Inside Track ) who had a 'major O2 epiphany' last week (I really like his "Open source + Knowledge = Control" idea).
So expect to see a lot of activity over the next week, and if you have specific questions to ask about O2, now is probably the best time to ask :)
What does this mean for O2 and all the Open Source research that I have been doing (and publishing) for the last 12 months? The honest answer is that I still don't know (i.e. I'm still not an IBM employee and basically just had my Ounce Labs 'independent contractor' agreement extended to IBM).
I had a great meeting with a number of IBM/AppScan guys last week in Ottawa (Canada) and will be back there next week to do an O2 presentation and talk about the next steps.
There has also been talk (via Jim Manico and Tom B (here and here) to move O2 to OWASP, maybe even calling it O3 (as in "OWASP O2" where O2 could also be used as a reference to Oxygen). As Jim correctly mentions, O2 is released under an Open Source license (Apache 2.0) and there is nothing preventing this move (to an OWASP project). I love the idea to move it to OWASP, but lets see what is IBM's finally position on this (since ideally they should officially support this new OWASP project).
In practice, these IBM presentations means that you will see (when compared with what exists today) a HUGE amount of O2 documentation being published to the O2 website.
As with most of you, the first question that the IBMers are asking is "I've heard about O2, but WHAT is it, and what does it do?" :)
I'm also going to extend the O2 Module that shows how to map "Ounce's scan results with HP WebInspect scan results" to IBM's AppScan and Rational. This should be an interesting (and powerful) demonstration of O2 capabilities (and btw, AppScan Standard Edition is an .NET Application :) :) : ) :) ... 'nuff said :) )
The good news is there is lots of excitement and energy to make the O2 + Ounce + AppScan + IBM integration work (in a way that keeps O2 Open Source and makes business sense for IBM). Several Ounce guys are being really supporting and helping to spread the word. See for example this post from Ian Spiro (Ounce / IBM and Ounce Open - O2 User Inside Track ) who had a 'major O2 epiphany' last week (I really like his "Open source + Knowledge = Control" idea).
So expect to see a lot of activity over the next week, and if you have specific questions to ask about O2, now is probably the best time to ask :)
Wednesday, 8 July 2009
Latest version of O2 (Ounce Open) - 6th July 09
You can get them from the main O2 Website or download the latest versions form:
- Binaries: _Bin_(O2_Binaries) - 07-Jul-09.zip
- Installers: _O2_Installers - 07-Jul-09.zip
- Source Code: _SourceCode_O2 - 07-Jul-09.zip
..or install the most commonly used O2 Modules directly from the web using Click Once:
- O2_Tool_CirViewer
- O2_Tool_CSharpScripts
- O2_Tool_DotNetCallbacksMaker
- O2_Tool_FindingsQuery
- O2_Tool_FindingsViewer
- O2_Tool_JoinTraces
- O2_Tool_RulesManager
- O2_Tool_SearchEngine
- O2_WebInspect (PoC of Integrating Ounce's & WebInspect's assessment data)
Thursday, 4 June 2009
JSP EL , Spring MVC and XSS
I'm trying to find the exact behavior of JSPs EL on Spring MVC apps (also posted on the java-project@lists.owasp.org mailing list)
Here a sample code that shows the workflow:
-------------
on a controller class (marked with the @Controller attribute)
@RequestMapping(value = "/externalUrl.html", method = RequestMethod.GET)
public String doSomething(HttpServletRequest request, Map model) {
model.put("putPayloadHere", request.getParameter("putPayloadHere"));
return "viewThatShowsPayload";
}
on the JSP (for example /jsps/viewThatShowsPayload.jsp)
payload: ${putPayloadHere}
-------------
for reference the above code will be compiled (in the viewThatShowsPayload_jsp.java) into something that looks like this:
out.write("");
out.write((java.lang.String) org.apache.jasper.runtime.PageContextImpl.proprietaryEvaluate("${putPayloadHere}", java.lang.String.class, (PageContext)_jspx_page_context, NULL, false));
out.write("");
My question is: In the above example will the request http://xxx/externalUrl.htm?putPayloadHere= ALWAYS result in XSS?
The key part of the question is the always bit, since:
a) By default (according my google searches) ${xxx} in JSP doesn't perform HTML Encoding (the sugested alternative is (which does HTML Encode by default (see http://www.sleberknight.com/blog/sleberkn/entry/20060721 (2006 post) )
b) in Spring MVC there is the DefaultHtmlEncode option (http://static.springframework.org/spring/docs/2.5.x/reference/spring.tld.html#spring.tld.htmlEscape), but this only seems to affect the Spring Tags. I belive this is now enabled by default, but couldn't find any documentation to support that (http://shh.thathost.com/secadv/spring-form-xss/)
c) Are there other valid alternatives to make ${xxx} encode its result by default? For example Matt Raible in http://raibledesigns.com/rd/entry/java_web_frameworks_and_xss mentions this: "The good news is #2 doesn't seem to be that hard. I pulled down commons-el yesterday, added a hack to escape XML, re-jarred and put it in Tomcat 5.0.25's classpath. This actually worked and I was impressed it was so easy. However, when I looked at Tomcat 6, commons-el is no longer used and now there's a "jasper-el.jar" in the lib directory. I don't mind modifying another library, but what's the difference between jasper-el and commons-el? " , have anybody seen this solution work on an enterprise app?
d) Matt also triggered this request http://raibledesigns.com/rd/entry/proposed_tomcat_enhancement_add_flag which doesn't seem to have gone anywhere, should this be something that the ISWG should be persuing?
e) Finally, is there an equivalent for J2EE of the Microsoft Anti-XSS (the latest version) which is able to add output encoding without touching the code?
(note: I also looked at http://www.owasp.org/index.php/JSP_JSTL and http://www.owasp.org/index.php/J2EE_Bad_Practices:_JSP_Expressions and once I've clarify this, will update these pages with the results)
Here a sample code that shows the workflow:
-------------
on a controller class (marked with the @Controller attribute)
@RequestMapping(value = "/externalUrl.html", method = RequestMethod.GET)
public String doSomething(HttpServletRequest request, Map
model.put("putPayloadHere", request.getParameter("putPayloadHere"));
return "viewThatShowsPayload";
}
on the JSP (for example /jsps/viewThatShowsPayload.jsp)
payload: ${putPayloadHere}
-------------
for reference the above code will be compiled (in the viewThatShowsPayload_jsp.java) into something that looks like this:
out.write("");
out.write((java.lang.String) org.apache.jasper.runtime.PageContextImpl.proprietaryEvaluate("${putPayloadHere}", java.lang.String.class, (PageContext)_jspx_page_context, NULL, false));
out.write("");
My question is: In the above example will the request http://xxx/externalUrl.htm?putPayloadHere= ALWAYS result in XSS?
The key part of the question is the always bit, since:
a) By default (according my google searches) ${xxx} in JSP doesn't perform HTML Encoding (the sugested alternative is
b) in Spring MVC there is the DefaultHtmlEncode option (http://static.springframework.org/spring/docs/2.5.x/reference/spring.tld.html#spring.tld.htmlEscape), but this only seems to affect the Spring Tags. I belive this is now enabled by default, but couldn't find any documentation to support that (http://shh.thathost.com/secadv/spring-form-xss/)
c) Are there other valid alternatives to make ${xxx} encode its result by default? For example Matt Raible in http://raibledesigns.com/rd/entry/java_web_frameworks_and_xss mentions this: "The good news is #2 doesn't seem to be that hard. I pulled down commons-el yesterday, added a hack to escape XML, re-jarred and put it in Tomcat 5.0.25's classpath. This actually worked and I was impressed it was so easy. However, when I looked at Tomcat 6, commons-el is no longer used and now there's a "jasper-el.jar" in the lib directory. I don't mind modifying another library, but what's the difference between jasper-el and commons-el? " , have anybody seen this solution work on an enterprise app?
d) Matt also triggered this request http://raibledesigns.com/rd/entry/proposed_tomcat_enhancement_add_flag which doesn't seem to have gone anywhere, should this be something that the ISWG should be persuing?
e) Finally, is there an equivalent for J2EE of the Microsoft Anti-XSS (the latest version) which is able to add output encoding without touching the code?
(note: I also looked at http://www.owasp.org/index.php/JSP_JSTL and http://www.owasp.org/index.php/J2EE_Bad_Practices:_JSP_Expressions and once I've clarify this, will update these pages with the results)
Tuesday, 2 June 2009
OWASP: Proposed change for SoC: Use budget to pay for project related expenses
Just posted this to the owasp-leaders list, and would also like to hear your opinion on it:
Hello OWASP leaders,
Since its creation at the OWASP Summit, the OWASP Global Projects Committee has been meeting every week (see agenda of past meetings here) to try to improve the organization and structure of OWASP Projects.
Hello OWASP leaders,
Since its creation at the OWASP Summit, the OWASP Global Projects Committee has been meeting every week (see agenda of past meetings here) to try to improve the organization and structure of OWASP Projects.
Tuesday, 19 May 2009
Microsoft SDL Process Template.
This latest release from Microsoft is REALLY interesting since it should allow for a more intuitive and practical implementation of security activities on an applications SDL.
http://blogs.msdn.com/sdl/archive/2009/05/19/making-secure-code-easier.aspx
I need to try to apply this to O2 and see how practical it is.
Now, what I would to know, is which Microsoft applications have been developed using these templates? and will Microsoft publish the data created by those teams?
http://blogs.msdn.com/sdl/archive/2009/05/19/making-secure-code-easier.aspx
I need to try to apply this to O2 and see how practical it is.
Now, what I would to know, is which Microsoft applications have been developed using these templates? and will Microsoft publish the data created by those teams?
Sunday, 25 January 2009
Training Course: Real World WAST (Web Application Security Testing)
Next week I will be delivering a 2-day training course in Central London which is a preview of the courses I want to start delivering regularly in London/UK.
Ping me if you are interested in attending the next one(s).
--------------------------------------------------------------------------------------------
Title: Real World WAST (Web Application Security Testing)
Course description: Two day hands-on training course focused on how to test web applications in a fast, efficient and
comprehensive way.
The course will show how a mixture of external assessment techniques (aka BlackBox) with source code analysis (aka White Box) creates the perfect environment to evaluate the security risk profile of the targeted application.
In addition to showing how to find vulnerabilities and write exploits for them, the course will also show how to:
Technologies covered: ASP.Net and J2EE
Pre-Requesits: Laptop to connect to remote virtual image
Instructor: Dinis Cruz
Dates: 27 & 28 January
Location: Thistle Westminster Hotel, 49 Buckingham Palace Road, London, SW1W 0QT (http://www.thistle.com/hotels/westminster/ )
Agenda:
Ping me if you are interested in attending the next one(s).
--------------------------------------------------------------------------------------------
Title: Real World WAST (Web Application Security Testing)
Course description: Two day hands-on training course focused on how to test web applications in a fast, efficient and
comprehensive way.
The course will show how a mixture of external assessment techniques (aka BlackBox) with source code analysis (aka White Box) creates the perfect environment to evaluate the security risk profile of the targeted application.
In addition to showing how to find vulnerabilities and write exploits for them, the course will also show how to:
- use threat modeling to identify the attack surface,
- use WAFs (Web Application Firewalls) to 'patch' & mitigate the vulnerabilities discovered, and
- package the findings into 'insecurity patterns' which can be easily 'consumed' by C-level execs, project managers, product architects and developers.
Technologies covered: ASP.Net and J2EE
Pre-Requesits: Laptop to connect to remote virtual image
Instructor: Dinis Cruz
Dates: 27 & 28 January
Location: Thistle Westminster Hotel, 49 Buckingham Palace Road, London, SW1W 0QT (http://www.thistle.com/
Agenda:
- Part I: Tools and Security Principles
- Creating the assessment environment
- Threat Modeling
- Tools of the the trade (from open source to commercial tools)
- Case study: "What are the threats of an Airline's web infrastructure?"
- Case study: Spring Framework and its security implications
- What can OWASP do for you (from books, to documents, to tools, to community)
- Part 2 : Exploiting Web Apps
- Exploiting the test applications: HacmeBank, WebGoat, Open Source App A , Open Source Web Part B
- Finding vulnerabilities using automated tools
- Finding vulnerabilities manually
- Writing exploits
- Part 3: Root Causes and Insecurity patterns
- Find the root causes of the issues discovered and package your findings into 'insecurity patterns'
- How to present your findings to C-level execs, project managers, product architects and developers.
- Part 4: Fix and Patching vulnerabilities
- How WAFs can save the day (when used for 'Virtual Patching')
- Case study: Using HacmeBank's Validator.NET
- Case study: Using Microsoft's IAG (Intelligent Application Gateway)
Thursday, 22 January 2009
O2 related post to WebAppSec mailing list
(just posted the message below to the WebAppSec mailing list)
....I would like to call your attention to a research project I have been working on for the past 12 months, which recently have been released under an Open Source license.
As some of you know, I have been contracting for a while at Ounce Labs as a security consultant to perform advanced security analysis/reviews of real-world applications. Well, as it is also widely known in the web app sec security industry, tools like Ounce, Fortify, Cat.Net (& others) don't always provide the answers and visibility required by knowledgeable security consultants.
Although the Ounce GUI has some of those limitations, its core engine is REALLY powerful, so what I did, was to build a number of tools that allow power users to REALLY gain visibility into what is going on. Basically I wrote these modules to answer the questions that I had during those engagements. And while buliding those tools, I found a way to 'automate my brain' :)
I called this toolkit O2 (for Ounce Open) and I really credit Ounce Labs for: a) paying me to develop it, and b) release it under an Open Source license. The main O2 website is at http://ounceopen.squarespace.com and the source code is hosted at CodePlex (http://www.codeplex.com/o2)
Now, at the moment, these tools are still in a very 'early beta' state, and they are really customized to the way I (Dinis) like to work. So that the rest of the community can use it, I'm working hard at the moment to break part a lot of the O2 modules and on documenting how it works.
I have to admit that analyzing applications with O2 is VERY addictive and empowering, since finally I am able to 'script my brain' and really gain visibility what is going on.
See this screen shoot for a good example of 'O2 goodness' http://ounceopen.squarespace.com/storage/images/blog-posts/o2-presentation-slide-efforts_are_worth_it.gif
This screenshot represents what I call a 'complete trace' , i.e. a trace that goes from the 'begining of the attack surface' all the way to the' exit point' of the application (in ths example, the trace starts on the web layer (with an Asp.Net page load event) goes though the web services invocation (note how I 'glued two traces together': the web layer invoke with the web services [webmethod]) and ends up on an SQL execute.
That screen shot is from the O2 presentation I posted here: http://ounceopen.squarespace.com/technical-info/2009/1/20/o2-presentation-jan-09.html
To test O2, just open the following links to install (via .NET's Click-Once technology) the main O2 modules:
For more background info on O2's history and what it can do, please read:
I am also working with Paolo and Stephen from OWASP's Orizon project to be able to used O2's modules on top of Orizon's results (there is also a 'secret' project to find a way to convert Fortify's XML results into Ounce's XML format)
So yes, in the short term, the plan is that you will be able to use to use O2 on top of Ounce's, Cat.Net, OWASP's Orizon or even Fortify's scanning engine :)
So please give O2 a test drive and give me feedback on what you would like it do to.
If you are not a current Ounce customer, you can use the demo files I posted on the O2 website or, if you want to take Ounce 6.x for a test-drive, please create an account on the O2 website and make a request here https://ounceopen.squarespace.com/request-ounce-6x-evaluation/ (the requests from this form go directly to me, so that I can trigger the eval process for you at Ounce)
Looking forward to your comments
Best regards
....I would like to call your attention to a research project I have been working on for the past 12 months, which recently have been released under an Open Source license.
As some of you know, I have been contracting for a while at Ounce Labs as a security consultant to perform advanced security analysis/reviews of real-world applications. Well, as it is also widely known in the web app sec security industry, tools like Ounce, Fortify, Cat.Net (& others) don't always provide the answers and visibility required by knowledgeable security consultants.
Although the Ounce GUI has some of those limitations, its core engine is REALLY powerful, so what I did, was to build a number of tools that allow power users to REALLY gain visibility into what is going on. Basically I wrote these modules to answer the questions that I had during those engagements. And while buliding those tools, I found a way to 'automate my brain' :)
I called this toolkit O2 (for Ounce Open) and I really credit Ounce Labs for: a) paying me to develop it, and b) release it under an Open Source license. The main O2 website is at http://ounceopen.squarespace.
Now, at the moment, these tools are still in a very 'early beta' state, and they are really customized to the way I (Dinis) like to work. So that the rest of the community can use it, I'm working hard at the moment to break part a lot of the O2 modules and on documenting how it works.
I have to admit that analyzing applications with O2 is VERY addictive and empowering, since finally I am able to 'script my brain' and really gain visibility what is going on.
See this screen shoot for a good example of 'O2 goodness' http://ounceopen.squarespace.
This screenshot represents what I call a 'complete trace' , i.e. a trace that goes from the 'begining of the attack surface' all the way to the' exit point' of the application (in ths example, the trace starts on the web layer (with an Asp.Net page load event) goes though the web services invocation (note how I 'glued two traces together': the web layer invoke with the web services [webmethod]) and ends up on an SQL execute.
That screen shot is from the O2 presentation I posted here: http://ounceopen.squarespace.
To test O2, just open the following links to install (via .NET's Click-Once technology) the main O2 modules:
- SAR (Search Assessment Run) - Installer on http://76.12.247.164/O2_
SearchAssessmentRun - O2_CirAnalysis - Installer on http://76.12.247.164/O2_
CirAnalysis - O2_CSharpScripts - Installer on http://76.12.247.164/O2_
CSharpScripts - O2_WillItScan - Installer on http://76.12.247.164/O2_
WillItScan
For more background info on O2's history and what it can do, please read:
- O2 presentation (Jan 09) (the O2 presentation also linked above)
- OunceLabs releases my research tools under an Open Source license (it's called O2 and is hosted at CodePlex (from my personal blog)
- So what can I do with O2? (from my personal blog)
- http://ounceopen.squarespace.
com/technical-info/ - O2 main tech blog - http://ounceopen.squarespace.
com/o2-challenges-can-you- - Blog with challenges for the O2 communitysolve/
I am also working with Paolo and Stephen from OWASP's Orizon project to be able to used O2's modules on top of Orizon's results (there is also a 'secret' project to find a way to convert Fortify's XML results into Ounce's XML format)
So yes, in the short term, the plan is that you will be able to use to use O2 on top of Ounce's, Cat.Net, OWASP's Orizon or even Fortify's scanning engine :)
So please give O2 a test drive and give me feedback on what you would like it do to.
If you are not a current Ounce customer, you can use the demo files I posted on the O2 website or, if you want to take Ounce 6.x for a test-drive, please create an account on the O2 website and make a request here https://ounceopen.squarespace.
Looking forward to your comments
Best regards
Monday, 8 December 2008
Report: Manual vs. Automated Vulnerability Assessment
Here is a very interesting research paper published on October 26, 2008 called Manual vs. Automated Vulnerability Assessment (by James A. Kupsch and Barton P. Miller who are part of the University of Wisconsi Vulnerability Assessment project) .
In this paper they use the Condor application (version Condor 6.7.12 which doesn't seem to be available for download on http://www.cs.wisc.edu/condor/downloads-v2/download.pl) and used the Commercial Source Code scanners Fortify and Coverity to perform an analysis of the security vulnerabilities that they discovered on Condon (see http://www.cs.wisc.edu/condor/security/vulnerabilities/ for the list of the 14 vulnerabilities they discovered and http://www.cs.wisc.edu/condor/security/vulnerabilities/CONDOR-2005-0001.html for a detailed description of one).
I really like this concept and I'm very happy that they were able to publish their results. Basically what they did was to say: "Ok here are a number of security vulnerabilities that we discovered ([probably manually]), so let's see what the Source Code Scanning tools can find?"
Of course that I am bias on my interest on this research, since one of my current contracts is with Ounce Labs which is a direct competitor of Fortify and Coverity, and I've developed a number of Open Source tools (called O2) that augment Ounce Labs technology capabilities (more comments about that in a bit).
So here is what I think it is relevant about this paper:
- This is the a public release of Source Code Scanning analysis data, mapped to real vulnerabilities. This will allow us to perform public benchmarking of different tools and understand how those tools can be used (of course that I will bring OunceLabs to the mix here)
- It is pretty obvious by the results that: a) out-of-the box the tools perform very poorly, and b) a security consultant needs to be involved to triage those findings.
- In fact, even Fortify, who had the best results, did not discover those 6 issues immediately (they only had 3 issues identified as Critical ( and 2301 marked as Hot, 8101 marked as Warning, 5061 marked as Info)
- What I would like to know (and this is where the discussion becomes relevant to O2), is how much work and triage was needed to find those 6 (Fortify) and 1 (Coverity) issues? And how much manual work was needed to find the original set of vulnerabilities?
- I also would like to know what was the criteria needed to mark scanning results as a successful discovery? (do you just need to point to a dangerous function, or do you need to have a complete trace?).
- Other interesting questions are "How many of the findings (15466 on Fortify and 2686 on Coverity) where False Positives?" and "Where there any new vulnerabilities discovered by the tools?"
- One annoying thing is that the authors of this paper did not publish a link to the changes they made to Condor: "...with 13 small patches to compile with newer gcc; ... built as a "clipped" version, i.e., no standard universe, and no Kerberos and Quill as these would not build without extensive work on the new platform and tool chain ...". So I will contact them to see if we can replicate their test/scanning environment
- Just for the record, I don't know (yet) what are Ounce Labs 'out of the box' results in this case (and will publish them once I can replicate their scans). But I think they would be (before further analysis) similar to Fortify's results.
Next I will write up a O2 Challenge for this [UPDATE: here it is O2 Challenge #2) Find the 14 Vulns in Condor 6.7.12]. The plan (over the next couple months) is to use this application as a C++ case-study for how O2 can be used on the discovery of these type of issues (remember that ultimately, O2 is designed to ''automate the security consultants brain", so if a security consultant can find it, so should O2 :) . The only 'issue' should be how much custom rules/scripts will need to be added/created.
In fact, my view is that ultimately ALL tools should be able to find these issues. The competitive advantage of Tool A vs Tool B (commercial or Open Source) should be:
- the amount of time and customization that were required to find those issues (including set-up of scanning environment)
- the ability to replicate those 'insecure patterns' on the entire code base
- the reporting (namely finding's consolidation and automatic creation of Unit Tests)
- the risk rating and thread model capabilities
- the integration with the SDL
- the ability to model 'positive security' (i.e. map the security controls and 'prove' that they were correctly implemented
new O2 content, Hacmebank and 1st challenge
Here is an update of the latest content added to the O2 website at http://ounceopen.squarespace.com:
- The latest version of O2 can be downloaded from here: Binaries , Source Code
- For demo files and applications see Files for O2 Demos/Tests
- Video of the O2 module that provides a web interface to upload zip files for scannig: Using the O2 Web Scanner website Module
- Updated version of HacmeBank including a number of videos and a PoC tool for SQL Injection
- For the more advanced O2 users, here is a challenge: O2 Challenge #1) Viewstate data leak of non-visible data
- And finally Stephen Evens posted two entries showing How to compile O2 source if using VS2005 & .NET 2.0 and giving his Progress report - trying to wed Orizon with O2's CIR format
One question I had is on the file format for the videos. Which one should I use: Mp4 or WMF?
The above is just a small sample of the content that I am planning to upload over the next couple weeks. So if there is an area that you really want me to cover, let me know and I will write a post about it.
Wednesday, 26 November 2008
New community website for O2
We've just created a new website for O2 users and developers: http://ounceopen.squarespace.com
In there you will find the latest source code drops, demo files and technical articles/videos.
Dinis Cruz
In there you will find the latest source code drops, demo files and technical articles/videos.
Dinis Cruz
Sunday, 28 September 2008
ASP.NET MVC – XSS and AutoBind vulns in MVC Example
A while back (while in the middle of the research that lead to the publishing of the Security Vulnerabilities in the Spring Framework Model View Controller) I decided to check out if the (still in beta) ASP.NET MVC framework was vulnerable to it.
At first quick analysis it looks vulnerable to the AutoBinding issue (and also to XSS), so here is my draft research notes as download file ASP.NET MVC - XSS and AutoBind vulns in MVC).
Please let me know if I am missing something obvious, or maybe there is something on the new version that prevents this:
Some MVC related links:
At first quick analysis it looks vulnerable to the AutoBinding issue (and also to XSS), so here is my draft research notes as download file ASP.NET MVC - XSS and AutoBind vulns in MVC).
Please let me know if I am missing something obvious, or maybe there is something on the new version that prevents this:
Some MVC related links:
- latest blog post from Scott G http://weblogs.asp.net/scottgu/archive/2008/09/02/asp-net-mvc-preview-5-and-form-posting-scenarios.aspx
- Download latest version: http://www.codeplex.com/aspnet/Release/ProjectReleases.aspx?ReleaseId=16775
- http://blog.codeville.net/2007/12/19/aspnet-mvc-prevent-xss-with-automatic-html-encoding/
- http://www.asp.net/mvc/
Saturday, 27 September 2008
OWASP NYC Conference 2008
Just returned to London from the OWASP NYC Conference and as always it was a great experience (this was the biggest OWASP conference so far)
In addition to participating on the keynote speech, I delivered two presentations: OWASP Summit 2008 and 'Building a tool for Security consultants: A story of a customized source code'.
This last presentation was a variation of my previous two posts (OunceLabs releases my research tools under an Open Source License... , So what can I do with O2) and the questions I had after the presentation plus the multiple positive comments/conversations, tell me that the message that I wanted to pass was well understood and received (here is a blog post with a outline of the presentation and here is blog post that provide a good description of what wanted to say: OWASP NYC AppSec 2008 and NYSec Recap )
This last presentation was a variation of my previous two posts (OunceLabs releases my research tools under an Open Source License... , So what can I do with O2) and the questions I had after the presentation plus the multiple positive comments/conversations, tell me that the message that I wanted to pass was well understood and received (here is a blog post with a outline of the presentation and here is blog post that provide a good description of what wanted to say: OWASP NYC AppSec 2008 and NYSec Recap )
Wednesday, 24 September 2008
So what can I do with O2?
In my first post (http://diniscruz.blogspot.com/2008/09/ouncelabs-releases-my-research-tools.html) I explained why I created O2 and how it fits in Ounce’s world. In this post I will delve into what O2 allows me to do and how it revolutionized the way I perform source code security assessments.
It is probably better if I first explain how I approach these types of projects so that I can them show how O2 first perfectly into it.
This is the way I view these security assessments: There is a client who is paying me to review their web application for issues that might have business impact, where I am also expected to help to identify the underlying root causes of the issues discovered and provide assistance with the possible remediation paths. The client usually looks at me for guidance on what I need to do my job, and expects in return objective answers.
It is probably better if I first explain how I approach these types of projects so that I can them show how O2 first perfectly into it.
This is the way I view these security assessments: There is a client who is paying me to review their web application for issues that might have business impact, where I am also expected to help to identify the underlying root causes of the issues discovered and provide assistance with the possible remediation paths. The client usually looks at me for guidance on what I need to do my job, and expects in return objective answers.
OunceLabs releases my research tools under an Open Source license (it’s called O2 and is hosted at CodePlex
Hello, as you probably know I have been consulting with OunceLabs (http://www.ouncelabs.com) for the past 18 Months, and on the last 9 months I have been deeply involved on an internal project which I am very excited about and is now going to be released under an Open Source license (go Ounce!!!)
One of my tasks at OunceLabs was to make their technology 'Work' from the point of view of an advanced security consultant (like me). By 'Work' I mean create a model that uses (sorry for the cliché) People + Process + Ounce Technology whereby the later (Ounce Technology) is used throughout an entire engagement (versus the current model where it is mainly used at the beginning of the engagement or to perform specific analysis).
One of my tasks at OunceLabs was to make their technology 'Work' from the point of view of an advanced security consultant (like me). By 'Work' I mean create a model that uses (sorry for the cliché) People + Process + Ounce Technology whereby the later (Ounce Technology) is used throughout an entire engagement (versus the current model where it is mainly used at the beginning of the engagement or to perform specific analysis).
Subscribe to:
Posts (Atom)