OWASP AppSensor and O2 Platform at Security B-Sides London

(reblogging Colin’s post about this event :) )

Next week me and Colin Watson will be running an OWASP AppSensor and OWASP O2 Platform workshop at Security B-Sides London 2013.

We will be demonstrating and helping attendees of the workshop specify, define and implement application-specific attack detection and real-time response. Our agenda is:

• OWASP AppSensor concept
• Attack detection exercise
• Real world implementation (using O2 Platform and TeamMentor)
• Alternative deployment models

We'll be using paper-based materials and real code demonstrations (in .Net, Java and PHP), so just bring your brains along.

The workshop is being run from 14:00 to 15:30 hrs on Wednesday April 24th 2013 and can be booked on arrival at the event. It is available on a first come, first served basis.

Security B-Sides London is a community-driven free event but requires registration, but due to overwhelming demand there is a waiting list.

We hope to see you there.

O2 Platform 5.1.1 version with all dll references included

A common issue that happens when running the default O2 Platform default exe/gui from an corporate network is that some ‘on-demand dependency downloads’ fail due to restrictions imposed by the network’s web proxy.

So if you have this issue, try downloading the O2_Platform v5.1.1 [with extra References].zip which is 23Mbs

WinForms WebBrowser running inside a WPF Host (controlled by a WinForms TreeView)

Here is an example of how to use FluentSharp’s WPF/WinForms Extension Methods to host the WinForms WebBrowser Control (IE based) inside the WPF Graph element.

Using CSharpRepl to batch change TeamMentor’s users email and settings

While deploying the 3.3. version of TeamMentor into the multiple servers we maintain, there are a number of edge cases that are usually a pain to deal with, but now that TM has the ability to run C# scripts directly on a server, I can codify the transformations required :)

The two problems I’m going to deal here are:

• Batch setting the email based on the username
• Batch setting the Account expiry date (based on a search)

Note that on both cases I’m going to first do the changes into a locally hosted version of TM that is consuming the respective UserData GitHub repo (and if anything goes wrong, I’m a git stash or git reset away from a clean start)

Why doesn't Waterstones (UK BookStore) also upsell kindle books?

Today I bought a book for my Mum in an local Waterstones and they didn’t even have the option or service to upsell a digital copy of that book!

If they had an offer like “25% extra and you also get a kindle version” I would had bought, because I also want to read that book (and they sell Kindle’s in that store!!!).

No wonder they are struggling (see Waterstones boss pledges to revive company's fortunes after a £37m loss  ), and although Waterstone’s management wants to blame Amazon (see Amazon is 'destroying Britain's book industry', claims Waterstones chief), they keep failing to adapt to the new digital world.

Is Google+ a step too far? Why Google should care about our Privacy (not try to erode it) and SAST to the rescue!

On the issue of Google+ being a step-to-far in its 'connecting the dots capabilities' and 'exposure of personal information', I wrote the text below in an amazing (internal to SI) thread about this topic (again it pains me that such great wisdom is going to be lost forever in the email's black hole)

If you ever doubt that OWASP needs more Project Managers/Resources

Like Samantha Groves  :

The problem with SSL is not performance, its management

In a chat with Michael Hidalgo about SSL, he mentioned the posts Overclocking SSL (from Google), Dispelling the New SSL Myth (from F5) and Still not computationally expensive (Google guy responding to F5).

Is Git a Single point of failure for TeamMentor?

Danny is getting into Git and just asked-me this:

“is it possible for Git to be a single point of failure for TM? If Git went down or offline, wouldn’t that be a problem?”

The short answer is “NO, in fact Git is a distributed point of success for TM”

Let's start with the differences between Git and GitHub.

Think of Git as a ‘file-based database of multiple versions of a particular file, with one version shown in the file system’, i.e. ‘Git’ is the .git folder and a checkout version of the files (in the file system)

Think of GitHub as a ‘web based location to store and share the .git folder’

What the move from HTML to WikiText looks like (in GitHub)

Copy and paste of HTML is such a mess (even today in 2013).

I just converted a couple (converted from Word doc) TM articles from HTML into WikiText and it is shocking the difference in the amount of code (and complexity)

Linus gift to the world will be Git not Linux (and what about an OS built on top of an hash-driven file system?)

I know it is a big claim, but I think that Linus Torvalds will be more famous for creating Git than for this work on Linux

Linux is a great example of OpenSource development and a good OS. Its impact is mainly technical and behind the scenes.

Git is a hashed-based file system with built-it version control. Its impact is not only technical but social.

The more I use Git, the more I appreciate its beauty, simplicity and ability to scale while handling complex workflows.

Changing a User’s ExpiryDate from GitHub hosted file

For the cases where TeamMentor UserData is loaded from a GitHub repository, it is possible to change/manage user data directly from GitHub’s web GUI (or from a local clone of that repository).

Lets take for example Danny’s account, which is expired at the moment (today is 4/10/2013):

AppSscan Enterprise & Selenium (can you help?)

Early today I received this question:

"I've been looking for a way to integrate Appscan Enterprise with Selenium and noted some blog posts of yours that show integration with Appscan for various purposes.

I would like to know if you have any ideas on how it may be possible to glue together Selenium & Appscan.  I'm wishing there was a way to port Selenium to Manual Explore."

to which I replied:

O2 Platform Fork of ManagedSpy

A while back I was trying O2Platform’s process hooking techniques and created a fork of the ManagedSpy tool which you can find at https://github.com/o2platform/O2_Fork_ManagedSpy

Here are a number of PDFs that show the changes I made to the original code and how I used the FluentSharp APIs to simplify its code:

• ManagedSpy - Adding new features to ManagedSpy.exe (part 1).pdf
• ManagedSpy - Adding new features to ManagedSpy.exe (part 2).pdf
• ManagedSpy - Adding new features to ManagedSpy.exe (part 3).pdf
• ManagedSpy - How ManagedSpyLib hooking works.pdf
• ManagedSpy - Moving Original code (and some changes) to GitHub.pdf
• ManagedSpy - Using and coding the ManagedSpyLib APIs.pdf
• ManagedSpy - Using O2 VS Extension to create ManagedSpy UserControls or Forms inside VisualStudio.pdf

OWASP Executive Director Role (Not yet)

Following the announcement sent today to the owasp-leaders list (see below), I replied with my view that OWASP doesn't need this role today:

I think it is great that a decision to add another resource to OWASP super OpsTeam (the employees) was made, but as I said many times before I don't think that OWASP needs a CEO/ Executive-Director today.

For the record, I DO think that one day OWASP will need such position, but not today. At the moment, my view is that we should be adding resources to help our Projects or in managing the owasp.org website content.

Using SendGrid to send emails (with TM email logging and offline detection)

Roman just opened up the Emails are not sent consistently when they should be sent issue which I believe is caused by the fact that his test box went offline in the middle of his QA tests.

At the moment, before TeamMentor sends an email there is a check to see if we current server is offline (as shown below, the offline check is done after adding the email message to a temp Sent_EmailMessages variable, which is the one used in the TBot's View Email Messages page):

Creating QA versions of TeamMentor UserData repository, and using branches to show/test the multiple config options

Now that a number of TeamMentor settings can be configured from the UserData repositories, we need a way to test and document what can be done.

Let’s start by creating  a public GitHub repository (https://github.com/TeamMentor/UserData_Customizations) to hold the multiple examples/tests:

Running Customized C# code loaded from TeamMentor’s UserData repository

A really powerful feature of TeamMentor 3.3. is its ability to run CSharp Scripts included in the mapped UserData repository (script execution is powered by O2 Platform's FluentSharp APIs).

This blog post shows how it works

No SSL on Azure WebSites (maybe in May 2013?), and shy SSL deployments are so hard

As with the dozen comments in the SSL and Windows Azure Web Sites thread, at SI we are also in the same situation, where we want to host a couple TeamMentor sites on Azure, but can’t do it properly without SSL.

Git pulling a TeamMentor Library and renaming it

Here is an example of how to use the new TM 3.3 capabilities to load libraries from GitHub and to rename them.

Let’s start with a version of TM that looks like this:

To Read: A Server- and Browser-Transparent CSRF Defense for Web 2.0 Applications

This looks like a promising way to deal with CSRF:

A Server- and Browser-Transparent CSRF Defense for Web 2.0 Applications (PDF)

Proposal: Remove all commercial/non-OWASP logos from OWASP.org

Following the recent threads about the commercialization of OWASP, I think the time as come for a simple move, that will be a little bit painful, but will clear the water and send a nice big message of what OWASP stands for.

Remove all commercial/non-owasp-projects logos from OWASP.org

Hubspot current.js code includes JQuery on it

Although I’m using Angular.js on the HubSpot TBot page (see Submitting TM users to HubSpot via TBOT interface (using Angular JS) ) I’m still more comfortable/knowledgeable in jQuery, so I decided to use it to populate the HubSpot fields.

So my first action was to load jQuery at the top of the TBot page:

Pushing TBot RazorSharp page change into to GitHub and Live QA server

Now that the some of TeamMentor’s TBot pages are controlled via the user data repository, this post shows how a change to one of the TBot RazorSharp scripts is propagated from the local dev box into a live qa server.

Submitting TM users to HubSpot via TBOT interface (using Angular JS)

Following the need to submit TM new users to HubSpot, I just created an TBot razor page (TM admin script) that uses Angular JS to get data about a particular user and populates a form that can then be submitted to HubSpot.

Here is what the Form looks like for the admin user (value provided on the url):