New O2 Subscription Model

Just launched at: http://www.o2platform.com/index.php/O2 Subscriptions

------------------------------------------------------------------------------------------

In order to fully support to the companies that commit to using O2 and use it on commercial engagements, the following subscription-based services are now available:

Bronze : 1,000 USD per Quarter

• Certified Monthly Build (with some customization of modules included)
• Monthy Documentation (with some customization of modules included)
• 1x copy of O2 Book(s) (when released)
• 1x shared amazon EC Image (containing latest version of O2 and demo files)
• Private discusion forum
• 1x OWASP Individual Membership
• Officially recognized as 'O2 Platform BRONZE Service Provider'

Silver: 5,000 USD per Quarter

• Certified Monthly Build (with major customization of modules included)
• Monthy Documentation (with major customization of modules included)
• 3x copy of each O2 Book(s) (when released)
• 3x shared amazon EC Images + 1x dedicated amazon EC Image (containing latest or the customized version of O2)
• Private discusion forum (with 10x priority tickets)
• 4h of Personalized Training (remote)
• 2x Tickets to an OWASP Conference
• 5x OWASP Individual Membership
• Officially recognized as 'O2 Platform SILVER Service Provider'

Gold: 15,000 USD per Quarter

• Certified Monthly Build (with customization of modules included and GUI Branding)
• Monthy Documentation (with customization of modules included and GUI Branding)
• 5x copy of each O2 Book(s) (when released)
• 5x dedicated amazon EC Image (containing latest or the customized version of O2)
• Private discusion forum (with 20x priority tickets)
• 2 days of personalized training (either remote or locally (if logistically possible))
• 5x Tickets to an OWASP Conference
• 1x OWASP Corporate Membership (with the 40% of 5000USD membership allocated to the O2 Platform)
• Officially recognized as 'O2 Platform GOLD Service Provider'

These subscription can be started or canceled at any time, and could follow periods of increased activity around O2. 

For custom or focused O2 development see the O2 Pledges

Note that this is NOT a service provided by OWASP and the OWASP foundation has no direct involvement or responsibility in the delivery or fulfillment of these subscriptions

------------------------------------------------------------------------------------------

OWASP/O2 US Tour Aug 9-17 (6 cities in 8 days)

Hi I'm about to embark on a great adventure and I hope you will be able to join me along the way.

For the next 8 days I will be traveling to 6 US cities, visiting the local OWASP chapter and doing OWASP/O2 presentations. This is also a great opportunity to meet a number of local chapter/project leaders and have a number of brainstorming sessions on OWASP.

Here is my itinerary:

• Mon 9th: NYC http://www.owasp.org/index.php/NYNJMetro
• Tue 10th: Minneapolis http://www.owasp.org/index.php/Minneapolis_St_Paul
• Wed 11th: Seatle http://www.owasp.org/index.php/Seattle
• Thu 12th: Atlanta http://www.owasp.org/index.php/Atlanta_Georgia#tab=Chapter_Meetings
• Fri 13th: San Antonio http://www.owasp.org/index.php/San_Antonio
• Sat 14th: San Antonio
• Sun 15th: Washington DC
• Mon 16: Washington DC , Virginia (TBC) http://www.owasp.org/index.php/Virginia
• Tue 17: Washington DC

If you are around this area and want to meet up to talk about OWASP or O2, then ping me directly and lets make it happen

See you on the road......

What is going on with you (Jul 2010) and are you at BlackHat / DefCon?

Since I have a number of similar questions on my Inbox, it will be easier to reply to them here :)

No, I'm at at BlackHat and DefCon (I'm an independent contractor now so I have no company to send the bills to and I was not able to get O2 to generate enough revenue to organize a BH/DC gathering)

Regarding what has been going on, here is a selection of blog posts that cover the last couple months:

O2 Platform, ideas on where to start

If you want to delve deeper into O2's world I would say that your first step is to replicate the BlackBox and WhiteBox examples that I have already created and published with O2 (check out the Demo's Tab in the main GUI).

Some pointers:

• If you are on a 32bit box, I would recommend  that you use the latest version of O2 (which is only available via the ClickOnce install ) since it as a ton of new features
• Install HacmeBank and WebGoat locally
• Write a BlackBox script to exploit an SQL Injection in HacmeBank and an XSS in WebGoat
• From HacmeBank's Source Code, build its MethodStreams and find the SQL Injections on the WebServices, and connect the WebLayer with the WebServices Layer
• Transform the above scripts in Unit tests
• Create a document with your experiments containing tons of screenshots about it
• Create a video with your experiments (and publish it, or send it to me)

If you have any issues, join the O2 Platform mailing list and ask a question.

There is also an Amazon EC2 image that I have with O2 fully configured which I can give you access if you ping me directly

New funding model for O2's Development

This is the first of a series of blog entries that I will write on the topic of "O2 Funding model and the multiple Business Modules that are (in my point of view) 100% compatible with O2's Open Source positioning."

----- (content from the current version of  http://o2platform.com/wiki/O2_Pledges

With the objective to create a funding source for O2's development, the following Pledges have been set-up at Pledgie.com:

O2 Specific

•  O2 Platform - Release 2.0
•  O2 Platform - Support Consumed FOSS

Framework specific

• O2 Platform - 'SharePoint/MOSS' Rule Pack
• O2 Platform - 'ASP.NET MVC' Rule Pack
• O2 Platform - 'J2EE Struts' Rule Pack
• O2 Platform - 'J2EE Spring MVC' Rule Pack

Industry sector specific

• O2 Platform - 'BlackBox / Penetration Testing' RulePack
• O2 Platform - 'WhiteBox / Source Analysis' Rule Pack
• O2 Platform - 'WAF/IDS' Rule Pack

Not an OWASP activity
Please not that the above pledges are NOT OWASP driven activities and OWASP has no responsibility on the allocation of the funds pledged. This is an experiment to see how this model could be used to generate funds for OWASP Projects.

First major release of the OWASP O2 Platform - please download and try it

After 6 months of dedicated development, I'm happy to announce that I finally published a first major release of the OWASP O2 Platform (with an installer, documentation+videos and a number of key/unique capabilities).

There is a brand new GUI which makes a massive difference in finding the available scripts, tools and APIS that exist inside O2 (if you tried the previous versions you will really appreciate this) . You can see the new GUI and access the download link at this page: http://www.o2platform.com/wiki/O2_Release/v1.1_Beta 

This is the moment when I'm asking you to PLEASE TRY IT, and provide feedback on: what you like, what works, what doesn't work, what could be improved, etc... (if you want to file a bug, please use this web interface http://code.google.com/p/o2platform/issues/list)

There is enough functionality + capabilities + power in this version of O2, that I finally have the confidence to make this direct request for you, knowing that no matter what area of Web Application Security you are involved in, there will be an O2 Script/Module/Tool that will make you more productive.

Since the new GUI is very recent, most documentation and videos available start with the previous GUI. But since I can now easily create detailed WIKI documentation pages and/or videos using O2 , my plan is to reply to your questions that way (i.e. with a video or wiki page)

In addition to the new GUI, there are a number of key O2 features and capabilities that I was finally able to piece together last week (for example the creation of a 'complete trace+animation for an HacmeBank vulnerability' packaged as a UnitTest). I will be documenting these in the next days/weeks. I will also be posting soon details about a new funding & commercial-services model for O2 and 3rd party companies.

So, have a go, try it and please post on this list as much details on your 'O2 experience' as possible.

Thanks for the help

I'm looking for work (O2 related work :) ) and O2's Commercial Ecosystem

Now that the OWASP O2 Platform is finally ready for a wider audience, I'm focusing on my next challenge which is to create a vibrant and healthy commercial ecosystem around O2.

Since I'm probably the only guy in the world that today really knows how to get the most power out of O2, and, the one that is able to successfully use it in real-world commercial engagements, if you are looking to hire an O2 expert, the best person for you to hire is me (as you can see below, as the O2 Ecosystem grows, I will also put you in touch with other O2 experts)

Of course that I don't scale, and there is only a small number of security engagements that I can be involved at any given time.

My objective in personalising this request, is so that I can be exposed to new 'O2 related business' opportunities, which I will then push/expose to existing consulting security companies and/or security tool vendors.

Why? Because the higher the 'O2 related revenue streams' that these companies have, the more they will invest in O2 (namely the more time and effort they will put into integrating O2 into their current technology and business practices).

The challenge is how to kickstart this process?

My plan is to:

- Use me (as main O2 developer and reputable (I hope) security consultant) to attract clients that need application security reviews and expertise
- Funnel most of these 'O2 related' engagements to existing 'O2 Platform Accredited Service Providers' and work directly with them in the first couple engagements
- Create a number of 'non services related' revenue streams for O2, which I will then use to build a solid development and support team for O2

So, if you ever wanted to hire me to work on an security engagement or have a problem that you fell O2 can solve, now is the perfect time to talk :)

If you are a security consultancy company and want to be one of these 'O2 Platform Accredited Service Provider', drop me a line or wait for the announcement of how the process will work.

Update on OunceLabs+IBM story and "OWASP O2 Platform is ready for you (after 6 months solid development)"

So what is happening with the OWASP O2 Platform, with me, and why am I only writing this blog post now? (7th of July 2010)

For the past 6 months I have been following an opportunity that I was given by the IBM purchase of OunceLabs and the previous Open Sourcing of my research on static analysis (originally on top of the OunceLabs engine).

O2 Platform support for WebGoat

(just sent to the OWASP WebGoat mailing list)

Hi WebGoat Crowd

I finally started adding support for WebGoat to the OWASP O2 Platform by creating an API for Web Goat and showing how to automate a number of WebGoat's tasks and lessons. I've started to documentat how to use it and how it works, which you can read it (or watch the video) here: http://o2platform.com/wiki/WebGoat/First_Example_of_O2_WebGoat_API 

At the moment there is a first pass at an API for WebGoat (see API_WebGoat.cs) and a number of Unit Tests (see WebGoat_BlackBox_Exploits.cs). Both these files are available locally when you install the O2 Platform and the WebGoat_BlackBox_Exploits.cs can be executed by double-clicking on it or dragging'n'dropping it into a loaded O2 instance (see video for an example)

O2 Platform: MSI download, VB/C# conversion, Amazon S3 Browser and WebGoat API

Couple updates while I prepare for the big launch for HackInTheBox later this week:

• in addition to the ClickOnce install, you can now get an offline install of O2 from http://code.google.com/p/o2platform/downloads/list (note that this version will not try to Auto-Update itself)
• script to convert/create CSharp code to/from VBNet http://o2platform.com/wiki/Languages_and_Frameworks/DotNet/Convert_VBNet_Into_CSharp_and_CSharp_into_VBNet (with video)
• script with a simple PoC of Amazon's Cloud API, namely the S3 file store: http://o2platform.com/wiki/O2_API/Amazon_S3 (with video)
• script with the first pass at creating an O2 API for WebGoat: http://o2platform.com/wiki/WebGoat/First_Example_of_O2_WebGoat_API (with video)

if you are wondering, how I created those videos using O2, check out:

• Util - DiagramDesigner Editor.h2  - Script to create the splash screen: 
• Util - Movie Creator.h2  - Script to take the screenshots and create the movie

O2 now has Javascript AST support (plus XSS PoC builder)

The latest version of O2 contains support for parsing Javascript (and building its AST), which you can see in action in these two scripts:

• Web - Javascript AST Viewer (in O2's wiki)
• Web - JavaScript Stats Viewer (in O2's wiki) 

Also, for the BlackBox crowd, to showcase O2's automation capabilities, I wrote a XSS PoC Builder which allows the quick development, testing and deployment of XSS PoCs

You can read all about it here: Web - XSS PoC Builder  (in O2's wiki)

First pass at try-o2.com Theme

(as emailed to the O2 Platform mailing list)

Humm, I just spent some time installing a number of Drupal Themes at the TRY O2 website, and found a couple themes that are are quite nice.

Check out how http://try-o2.com looks at the moment: (the top banner images rotates on page load):



I also like the way the text I wrote for o2-platform.com's home page, looks really nice when placed in prime time position

I think that this text really encapsulates what I'm trying to do with O2:

"Welcome to OWASP O2 Platform's website. The O2 platform represents a new paradigm for how to perform, document and distribute Web Application security reviews. O2 is designed to Automate Security Consultants Knowledge and Workflows and to Allow non-security experts to access and consume Security Knowledge."

Does this text make sense to you?

try-o2.com, o2-platform.com and OWASP.org

I'm the process of setting up the try-o2.com website and so far it seems that Drupal is a good fit for what I need (using a TurnKeyLinux.org image which was very easy to setup). Btw, any good Drupal power-users out there that can give a hand in building this? So far I've managed to install a new theme and configure it to use OpenID :)

Why Drupal? Well, now that I am in full swing on the efforts to build a community around O2 (from core developers, to users, to clients), I needed to find a web technology which provided strong social-network/community features, such as: Blogs, Forums, Voting/Rating, CMS and even (eventually) an e-commerce engine.

On the other hand, there is also a need to create solid documentation and books around the O2 Platform (which I think the MediaWiki is a much better medium)

Add to the mix the O2 Platform pages at the OWASP website, and we have some mapping to do here :)

So, how are all this different websites going to work together?

My plan is that by having different focus for each one, it will make sense:

* the Drupal-based www.try-o2com website (I also have the use-o2.com domain) will be focused on the community that is trying to 'use O2' (this is where all the 'social-tools' will be hosted)
* the MediaWiki based www.o2-platform.com website will be focused on the core O2 developers (i.e. the ones that are customising or creating APIs). This is where the detailed technical documentation will exist and where (eventually) O2 books will be made from (this tight editorial control will also make sense due to more-and-more support/capability that O2 will have for consuming data from this website (from vulnerability rules, documentation and C# scripts))
* the MediaWiki based O2 pages at the OWASP website will be focused in presenting the most mature O2 modules and also on making the connection with the multiple OWASP projects O2 will be integrated with.

One interesting question is: Why 2 MediaWiki websites.

Well, in addition to the fact that I can be much more experimental with the O2-Platform.com MediaWiki that I can/should with the OWASP's MediaWiki engine (for example in trying extensions and themes), there is also some content that I want to
create/maintain that will be hard to do at OWASP (for example, providing technical details about the multiple 3rd party Commercial Tools that exist and how they integrate with O2).

Also, the discussion of how to handle Commercial services around OWASP tools/projects is still in a very early stage, and there are no clear guidelines on how to present/maintain this 'commercial' information in a way that is compatible with OWASP's mission, values and culture.

O2 Services: Online Training, Remote Support, Custom development

A key component of the 'O2 Platform Commercial Business Model' is the provision and delivery of commercial services to clients who are using (or planning to use) the O2 Platform.

Two days ago I started this process by launching a couple O2 related training courses (see Forthcoming Commercial O2 Training Courses in London blog entry)

Today I'm launching the 'Online Training, Remote Support, Custom development' services for the O2 Platform:

Here is the Wiki page with service's description Online Training, Remote Support, Custom development and here is the EventBrite page containing the current pricing structure http://o2services.eventbrite.com

In the short-term these services will provided and delivered by me.

In the medium-term, the plan is to build a network of security companies and consultants that provide these services (whereby I'm only involved in selected O2 engagements, most likely as a consultant for those 'O2 Enabled' companies)

Note that these services have nothing to do with OWASP and the OWASP Foundation.

O2 Script: ViewState Decoder for .NET 2.0

I just published to the O2 Platform Wiki a good example of O2's powerful scripting capabilities (including the ability that I have (using O2's MediaWiki editor tool) to quickly create technical articles containing tons of screenshots)

The tool is a ViewState decoder for .Net 2.0 and the article is here: http://o2platform.com/wiki/DotNet/ViewState_Decoder_ASP.NET_2.0

Here are the features of this tool:

* Enter any url or browse to any website, and the list of all values present in the ViewState will be shown on the right (note that the refresh is fired on the browser's OnLoad event (which means that you will get multiple views for urls that load more that one page))
* The list of url's is cached in the ComboBox used to enter the url to load (top left)
* There are two view modes
* the simple mode (by default) which presents a TextBox with all values found in the ViewState
* the 'Show all Details' mode (tick the checkbox) which shows: a TreeView of the ViewState, the ViewState Xml, the ViewState values (same as simple mode) and the same info (TreeView, Xml and Values) for the ControlState values
* All relevant code required to create this tool is being dynamically compiled on the fly (note how the source code included at the end of the post is quite small, and the couple supporting classes (included as File references) are also not that big)
* I wrote this entire tool in couple hours today (using O2's scripting environment). Here was my workflow:
* had the need to decode HacmeBank's viewstate
* found a good code sample of the decoding process (which I got from PluralSight's ViewState Decode example)
* created and tweaked the Tool's GUI
* created a couple supporting 'DotNet ViewState' APIs
* consumed the APIs from the GUI
* created the documentation WikiPage

For me, the power of the O2 Platform, lies not in the fact that I can build tools like this, but the fact that I can do it in a couple hours.

Of course, that now that I have an API for DotNet's ViewState, I will be able to perform much complex vulnerability analysis workflows (for example find data leakage or authorisation issues by analysing the ViewState collected from multiple user's sessions)

New technology needs to be faster and more convenient

Part of the reason why I don't blog more ofter is because I find the current workflow hard and non practical.

From the moment I have an idea on a blog post, I have to:
* Open a browser
* Go to my blog (& remember the address)
* Enter my credentials
* Select the option to write a new blog post
* start writing the post
* deal with blogger UI (which sucks)
* post it
* click again to view it
* (in most cases) realise that the fonts/spacing are all wrong and edit the post
* grab the link to the post
* go to the 'edit posts' page on Blogger, select the recently posted blog entry, and when it loads copy the title (since the Theme that I currently use shows the Blog title as an image)
* open twitter, paste the title, paste the link to the blog post (if too big, first pass via bit.ly)

huff... no wonder I don't blog more offten.

In addition to the number of steps there is another problem which is that the time that it takes for me to start writing the blog is too long (i.e. by the time I get ready to write it the mojo is gone).

I'm now trying something else.

Using my new IPad (Yes I'm trying to find reasons to justify the purchase :) ), I just installed the BlogPress App and am writing this blog post using it.

My first reactions:

* it is much faster to go from blog idea to blog post
* I have a IPad keyboard so I am writing as fast as I do on a computer
* I really like the setup, the size of the IPad looks like the perfect length for a blog post and I like the 'undivided attention' that it forces me
* I also like the 'proof reading' mode where I use the touch screen to follow my reading and to quickly make changes
* I like not having to deal with Blogger HTML formatting and messy UI
* all I need is to find a way to tweet about this blog entry and I'm done :)
--> Correction: Before I wrote this post I added my twitter account details to it, and after I posted this, BlogPress automatically created a bit.ly address and posted a tweet with the title+address on my tweeter account :) Very nicccccceeeeeeee :)

So what is the moral of the story here?

New technology (like the OWASP O2 Platform) regardless of its potential future impact and benefit, if it doesn't add immediate value to the user and makes him/her faster and more efficient from the day one, it will struggle to be adopted.

This means that:

"It must be faster to 'do it' using the new tool for the first time than it takes to 'do it' manually"

Only then will the user take the risk in trying something new

Location:A315,Hounslow,United Kingdom

Forthcoming Commercial O2 Training Courses

Just published 4 new training courses at the O2 external website: http://www.o2platform.com/

These courses are a good place to start if you want to learn about how to use O2:

• Thu 10th Jun, London: Introduction to the OWASP O2 Platform
• Fri 11th Jun, London: Black-Box & White-Box ASP.NET Security Reviews using the OWASP O2 Platform
• Thu 17th Jun, London: Introduction to the OWASP O2 Platform
• Fri 18th Jun, London: Black-Box & White-Box ASP.NET Security Reviews using the OWASP O2 Platform

The courses are going to be delivered by me and cost £200.00 (for 1 day  training)
Note that this is not an OWASP delivered course and it not related to the OWASP Foundation (I'm organizing this independently)

The beginning of O2's Documentation

(ss emailed to the O2 Platform mailing list)

After a week of solid O2 use (and a bunch of new features), I am finally staring to document how O2 works and its main features

One of the many web APIs now supported by O2 is the MediaWiki engine, so I have been using it on the http://o2platform.com website to create O2 documentation (for example the 'O2-Sceenshot-to-Clipboard-Tool + Paste + Auto-Upload-to-MediaWiki' workflow is really powerful and explains why there are so many images/screenshots in there :) ).  

From http://o2platform.com home page, here are the main links to O2's documentation:

Documentation

• Help
  
  
  • Installing O2 (using .NET ClickOnce)
  • XRules Database - Taking Screenshots
• O2 AST .NET Scanner
  
  
  • O2 .NET AST Scanner - HacmeBank - SQL Injection PoC
  • O2 .NET AST Scanner - HacmeBank Example
  • O2 Ast CodeScanner - Creating Method Streams
  • O2 .NET AST Engine/Call Graph Script Examples
• Web
  
  
  • O2_Script/Using_WatiN_to_create_a_GMail_account (with video)
  • O2 Script - Quick HtmlCode Viewer
  • O2 Script - Quick HtmlCode Viewer - Version 2
  • O2 Script/View Details of current Internet Explorer instances
  • O2_Scripts/WatiN/Open_page_and_show_html_elements_in_new_window
  • Script Library/Web Examples
• APIs
  
  
  • O2 API/Blogger API (writing a new blog post) (with video)
  • O2 API/BT Open Zone (with video)
• O2 misc
  
  
  • O2 Script/Ask user for security credentials (Username and Password)
  • Script Library/Wiki Examples
  • O2 Scripts - Code Samples
  • O2 Script/Running Unit Tests

• O2 development
  
  
  • O2 Script/Compiling all O2 Scripts (with results in DataGridView)
  • O2 Source Code/Requested API changes
  • O2 Source Code/Requested API changes/30-May-2010
  • O2 Development/Using an O2 Script to check the O2 Scripts
  • O2 Scripting Environment/Features/File:Ref

Last friday I did an O2 presentation at the OWASP London Training Event and there was great reaction from the attendees (I also was able for the first time to do my presentation mainly using previously created scripts and videos, most executed from Paulo Coimbra's laptop (which is a great sign of O2's maturity :) ))

There is a fresh new version of O2 at the web based O2 Installer, so give it a test-drive and post here your feedback. 

Thanks

This is another test blog, now created while recording a video

Hello from inside O2 :)
(note: the preview feature is very cool :)  )

This is a test Blog (posted via the new O2 platform Blogger API)

If this works I will follow it up with more details :)

Major O2 Milestone: 'Complete Vulnerability Trace' for an HacmeBank Sql Injection vulnerability

(As emailed to the O2 Platform mailing list)

Finally, after tons and tons of features, I was able to create a 'Complete Vulnerability Trace' for an HacmeBank Sql Injection vulnerability.

And by 'Complete Vulnerability Traces' I mean a trace that:

• starts on the Exploit Layer (i.e. the browser entry point), 
• then goes through the Web Layer code, 
• then does a jump over the 'internet' into the Web Services layer,
• and ends up in the vulnerable .NET System.Data method :)

Using O2's MediaWiki API, I created the following 'draft with tons of screenshots' wiki page (containing details of what this trace looks like): http://o2platform.com/wiki/O2_.NET_AST_Scanner_-_HacmeBank_-_SQL_Injection_PoC

The example is shown in the "O2 .NET Ast Engine" module,  and tomorrow I will post details on how to consume (most of) it from the "O2 .NET Ast Scanner" module (which will be easier to use)

Major new version, O2 .NET Ast Scanner and first batch of videos

(As emailed to the O2 Platform mailing list)

Hi, I just pushed a new version of the O2 XRules Database (which you can install from here).

As usual there are tons of new features and bug fixes, but probably the most important one is the inclusion of the first working prototype of the O2 .NET Ast Scanner (which is an Open Source taint flow analysis engine which is able to create the code-paths for HacmeBank's Sql Injection)

In my efforts to try to document O2, I've started to create a number of webpages and videos (current hosted at the http://o2platform.com website).

• Videos: http://o2platform.com/wiki/O2_Videos_on_YouTube
• Using the O2 .NET Ast Engine
• Using O2 to Write a tweet
• Updating O2 XRules Database
• WikiPages:
• http://o2platform.com/wiki/O2 Help - Installing
• http://o2platform.com/wiki/O2 .NET AST Scanner - HacmeBank Example
• http://o2platform.com/wiki/O2 Ast CodeScanner - Creating Method Streams  (not finished but good example of how I write O2 scripts inside O2)
• http://o2platform.com/wiki/O2 Documentation - Twitter Client
• http://o2platform.com/wiki/O2 Scripting - Graph Development Gui
• http://o2platform.com/wiki/XRules Database - Taking Screenshots
• http://o2platform.com/wiki/O2 Scripts - Check for ClickOnce updates
• http://o2platform.com/wiki/XScript Example - Media Wiki Editor
• http://o2platform.com/wiki/XScript Example - Twitter Client

I think finally O2 is a position to really add value to the work you do, so please have a go and let me know how I can help

Dinis Cruz

Blog: http://diniscruz.blogspot.com
Twitter: http://twitter.com/DinisCruz
Web: http://www.owasp.org/index.php/O2

(circa 2006) Why Novell should take on the 'type-safe platform' challenge

Following a recent twitter thread with Miguel de Icaza, I (successfully) googled up a older post to the SC-L list written in 2006,where I tried to make the business case for Novell to invest in CAS (Code Access Security). After reading and realizing that (sadly) most of it is still relevant today, I'm reposting it here (to make it easier for later relinking)

(for more CAS and Sandboxing related ideas see this PPT 'Making the case for Sandbox v1.1 - Dinis Cruz - SD Conference.ppt ' and this blog post 'Past research of Sandboxing and Code Access Security (CAS)')

Here is the SC-L post that I wrote in 10 May 2006 (link to original which was a reply to Gary's Microsoft's Missed Opportunity Dark Reading post):

Dinis Cruz wrote:

> The ones that I wish were listening are Novell and the Mono project.
> The path to a type-safe platform could start there.

Following this comment made on the previous thread, here are the reasons why I wished Novell and the Mono project where listening to that conversation (note: an edited version of this post was sent directly to several Novell contacts who asked me 'What is it you wish we would listen to?' :

---------------------------------

Dear Novell

What I meant by my comment, is that there is an opportunity today (2006) for somebody (namely a company + community) to really grab the 'type-safe' + 'sandboxing' flag and run with it.

Here is a quick analysis of where we stand today:

    - Vista failed to deliver a OS based on a type-safe platform
    - 99% (or close) of the .Net Framework and Java code is executed in an environment with no sandbox (i.e. executed: a) in Full Trust, or b) with the Security manager disabled, or c) with no verification). Given the amount of code deployed out there, there is no chance that a real change will occur any time soon. Currently there is no interest from Microsoft or Sun to address this issue and invest the time, energy and resources required to solve it.
    - Microsoft failed to make the paradigm shift from Full Trust to Partial Trust when they released v2.0 of the .Net Framework (which would had been the perfect time to do it)
    - There is good grass roots support for type-safety
    - There is a growing need to create secure and trustworthy applications (with growing support from Governments, Large Corporations and ultimately the end users)
    - Sandboxing at the OS level, like the one in Vista's 'Integrity Level / Privilege Isolation' and in Suse's AppArmour (sorry Crispin for not replying to your posts on the previous SC discussion about Sandboxing (it is on my to-do-list)) will NOT prevent exploitation of the user's assets (like for example the user's email). These techniques are designed to 'control' and 'Sandbox' unmanaged code, which is something that I don't believe can be done today. A short term solution (before we get to type-safe OS) would be to have environments like these (which do add some security protection to the OS) supported by a managed/verifiable environment responsible for executing the managed/verifiable  (potentially malicious) code.
    - Apple has an amazing OS (which I am using at the moment) but doesn't seem to be focused on type-safe / sandboxing issues too. Apple also seems to (like most of the Open Source community) think that it is immune to security vulnerabilities (just look at the way they handle security patches at the moment)
    - Novell has gained a huge amount of respect for its support for the Mono-Project and for its support for Open Source
    - Basically, Microsoft has lost the plot on Security and (as Gary McGraw says) is too focused on bugs and not on architecture. They (Microsoft) will have tough times ahead when Vista proves to be as secure as XP SP2 was.
    - IBM has seen the future and is re-organizing itself around the concept of 'delivering enterprise solutions on top of Open Systems and Open Architectures'

So, like I said above, there is a big opportunity for an Open Source project, lead by a major company and based on a solid platform, to lead the way in the move from unmanaged/unsafe code (where I am including Full Trust .Net code in this category) to managed, verifiable and type-safe code (which can be safely executed in Sandboxes and malicious activity easily detected / mitigated)

Novell and Mono fits this bill perfectly.

And it would also give mono an unique point of sell, since at the moment it is still a 'pour cousin of the .Net Framework'.

Ultimately the goal would be to build an OS on of top of a type-safe platform. But before that the user-land world needs to be conquered.

A lot of research and effort must be placed on how to create powerful, feature-rich and fast GUI applications built on type-safe code. This is something that can only be done by a large community focused on a powerful goal: creating secure applications for execution on secure/sandboxed environments.

Imagine if this idea could be developed to such a state where (on Windows) it would be safer to execute C# applications on Mono than on the .Net Framework itself! (another area where mono could do really well is in Hosting of Asp.Net applications (for example based on a Linux distribution of a LAMM environment, hosted by a VirtualServer or VMware host))

I believe that we are watching today the limitations, of both Open Source world (with its 'many eyeballs') and Proprietary Code (with its Secure Development Lifecycle) to create code that doesn't contain critical security vulnerabilities (i.e. both can't do it (with maybe some notable exceptions)).

What is needed is a new paradigm (well not that new if you ask Gary McGraw) that creates a financial-model that rewards the companies that are able to create secure applications that can be executed on secure environments(the idea is not to prevent bugs/vulnerabilities from existing, but to prevent the damage caused by their exploitation).

Ultimately all source-code will have to be released and made public (not necessarily on an Open Source format, but at least available to peer review and external (i.e. independent) analysis) , and again here Novell and the other Open Source development companies have an advantage.

The other major asset which the Open Source distributions have (and one which will be crucial in the future) is the centralized distribution of Software (i.e. packages). In the future we will need entities that certify the security of Software applications, which in an unmanaged-code world (for example: C++ & Full Trust .Net ) is almost impossible to do (i.e. say for sure that Application XYZ does not contain a keyboard hook and direct access to the Internet), but quite possible in a managed, type-safe and verifiable world.

Of course that more CLRs (with custom GC, Security managers, Class loaders, verifiers, etc...) will need to be build, since the requirements of a powerful Windows Application, are very different from an Asp.Net Form, which are very different from a Device Driver.

Looking forward to your comments,

Best regards,

Dinis Cruz

OWASP for Charities: Haiti relief effort

There are days that I am really proud of being part of the OWASP community, today is one of those days :)

The email below was just sent to all subscribers of an OWASP mailing list or has an @owasp.org address (about 10,000)

OWASP Members and Supporters,

OWASP was founded, and is supported as a non-profit organization, by a group of dedicated volunteers who believe that all applications should be secure and trusted.  As our organization matures we have taken those beliefs broader, and have started setting up ways for our members to donate to the global community.  Among these initiatives are:

• OWASP has an active Kiva lending team who have donated $9,125.00 to date.  http://www.kiva.org/community/viewTeam?team_id=522
• OWASP in response to the need in Haiti has set up a secure and trusted way for those within the OWASP community to donate funds to help the people of Haiti. This allows our OWASP community to help another with a single global voice.  100% of the collected donations will be transferred directly to victims for disaster relief such as food and medical requirements.  Please visit www.owasp.org and click the link for G33k-4-HAITI.  In a time of crisis, OWASP can help those who are in great need. The OWASP community can help organize, support , and promote efforts outside of application security.

OWASP is well aware there is a movement for phishers to utilize this tragedy to get unsuspecting people to donate to a “cause” without having a legitimate business back end and ultimately funneling all the money directly into their own pockets.  The OWASP community is uniquely qualified to help protect from this type of attack and educate about attacks as well.

As the world becomes more dependent on technology and particularly web applications, there are many who need protection who simply have no options to protect themselves.  These include small companies, individuals, charities, and others.  The OWASP community can help by connecting qualified, trusted resources willing to volunteer their time to those organizations which qualify. OWASP is setting up an outreach program, which will be under the name project name of OWASP for Charities.

We hope you will support OWASPs efforts to make a difference  in any of the above ways. We are also open to suggestions in regards to where you feel the OWASP Community can be of service.

Regards,

Your OWASP Board

Kate Hartmann

OWASP Operations Director

9175 Guilford Road

Suite 300

Columbia, MD  21046

A couple more comments on ESAPI and ESTAPI

Following my recommending ESAPI? post, there has been some great answers and comments (on both SC-L and esapi-user list). Here is a great recent blog post on EASPI : What is the ESAPI?

To help to clarify why I asked those questions (and my chain of thought) here are two extra entries with my personal opinion. The first one is a post that that I started writing a couple days ago, and the 2nd one,  is a response I just posted on the SC-L and esapi-user mailing lists: 



1st one (note that some of the questions asked here are already answered in some of the comments to the original post)

My position is that ESAPI is a great example of what an enterprise security API should look like. But we have to be very careful when we say 'use ESAPI', because we risk that people actually use ESAPI on their applications (i.e. download the jar and copy it into their application, and use it)

I think we need to be careful to do this recommendation for several reasons.  The first one is that when we say 'use EASPI', we are basically positioning ESAPI in competition with all the other frameworks (including J2EE in this case, for the Java side of things).

The second one is we have to provide much more visibility to the bits of ESAPI that are ready to be used in production.  My understanding is that there are a lot of modules in ESAPI and not all of them have the same level or quality or readiness.

Some of our target audience is going to be developers without a lot of experience in application security, but who want to implement their security controls/features right, So we have to be very, very clear, whether we are providing them with the right advice on ESAPI, namely on which modules are actually enterprise-ready. (for ex: Is it just the encoding module or the logging module?  Or is the authentication module also ready for enterprise or application use?)


For me, part of the solution is to explicitly break ESAPI into three parts.  


The first one is the interfaces.  Basically, the security controls that an ESAPI API or ESAPI compliant framework should have.  

The second one should be a reference implementation(s), which is what we have today (and is the one that should be commercially supported by third parties).

The third one, are unit tests for the interfaces.  This is a bit where I'm actually quite interested, and I call these the ESTAPI, which is the Enterprise Security Testing API.  


I think that is a really valuable asset that we need to implement asap (staring by extracting what is already inside the ESAPI implementations). With ESTAPI , we will have a particular set of tests for a particular 'security sensitive behaviour', for example: "...If you are doing encoding for HTML, this is what you should do.  If you are doing encoding for Javascript, this is what you should do.  If you are doing encoding for HTML attributes, this is what you do.  If you are doing encoding for exec inside a Javascript block...., if your are doing authentication...., if you are doing authorization, ... if you are implementing a password reset... ,..etc., etc.  ..."

With the ESTAPI,  I'll be able to run these tests against all supported frameworks, whereby for each framework, all I need are little connecters between the ESAPI interface and the particular framework functionality/behaviour. Then we will be able to test the frameworks for their security capabilities.  I think this will actually provide a much more pragmatic and much more objective analysis of the framework,   allow the mapping of the supported security controls & behaviour, and allow the framework's clients to have much more visibility into what's happening on those frameworks.  

Again, I don't want to put ESAPI down.  I think ESAPI is a great project.  I think it's one of the most successful and powerful projects for OWASP and we just need to clarify it a little bit.  In fact, I think the more successful ESAPI is, the more this becomes a problem.  I don't think ESAPI  has blown up yet because ESAPI hasn't reached a wide level of adoption by software developers or commercial applications.  


Remember that one day we will have to deal with the problems of applications built on top of ESAPI that have security vulnerabilities or that are being successfully compromised by malicious hackers.

2nd one (posted on on mailing lists)

My view is that the key to make this work is to create the ESTAPI, which is the Enterprise Security Testing API

This way we would have (for every language):

• ESAPI Interfaces - which describe the functionality that each security control should have
• ESTAPI - Unit Tests that check the behaviour of the security controls
• ESAPI Reference Implementation(s) - Which are (wherever possible) 'production ready' versions of those security controls (and  in most cases a one-to-one mapping to the ESAPI Interfaces)
• Framework XYZ ESAPI 'connectors' - Which wrap (or expose) the security controls defined in the ESAPI Interfaces in Framework XYZ

What I really like about this world, is that we (Application Security Consultants) we start to create standards for how Security Controls should behave. and (as important) are able to work with the Framework developers without they felling that ESAPI is a 'competitor' to they Framework. After all, the way we will really change the market is when the Frameworks used by the majority of developers adopt ESAPI (or its principles)

Of course that the Framework developers are more than welcomed to grab large parts (or even all) of the code provided by the ESAPI reference implementation(s). But the key is that they (the framework developers) must: a) take ownership of the code and b) respect the ESAPI Interfaces.

And hey, if the Framework developers decide NOT to implement a particular security control, that is fine too. 

BUT! 

I would at least expect them to provide detailed information why they made that decision and why they chose NOT to implement or support it (which would allow us (Security community) to respectably agree or disagree with their choices (hey for some Frameworks, being insecure is a feature :) )

Finally, In addition to all the advantages that we will have when frameworks adopt these security controls, there is one that for me is probably the MOST important one: An 'ESAPI compliant app' (which btw is a term we still have to agree what exactly means),is an app that is providing explicit information about where they (the developers) think their (the app) security controls are located.

In another works, via the ESAPI Interfaces (and the ESTAPI tests) the developers are actually telling us (the security consultants): 

  a) what they think their application's attack surface is and  

  b) what is the security behaviour that they have already tested for

Of course that they can game the system, which is why we (Security Consultants) will still be needed (we will also need to make sure that they implemented the security controls properly). But compare that to today's (2009) world, were we are lucky to get an up-to-date application diagram and a reasonable accurate description of how the application was actually coded and behaves. 

This would also (finally) give the application security tools (white, black, glass, gray, pink, blue) a fighting change to automatically, or operator-driven, understand what is going on and report back: 

  - what it knows (security vulnerabilities) and (as important) 

  - what it doesn't know / understand
(ok there is a lot more that these tools will provide us (for example ESTAPI tests) but that is a topic for another post)

So, for me, the key added value of the ESAPI Interfaces, is that it will provide us (Security Consultants) a way to understand how the app works (from a security point of view) and to be able to finally be able to give the clients what they want: Visibility, Assurance and the ability to make 'knowledgeable Risk-based decisions'.