# Presentation: 009454

## Information Security: The Attacker’s Perspective

**Gary Geisbert**
- Crucial Security, Inc.

## Welcome

- Open Forum
- Audience Participation
- Feel free to interact with questions and comments

## Who am I?

- Security Specialist with Crucial Security
- Over 10 years experience with information security
- Worked with various 3-letter-agencies
- “Information Operations” are part of my daily responsibilities

## What I Will Cover

- How an attacker will attack your web application
- Various techniques one can use
- Ways to defend against these attacks
- Useful information for system/network administrators and programmers

## What I Will Not Cover

- How an attacker will attack your
- Network
- Computers
- Routers, Switches
- Firewalls
- ...
- Social engineering
- Any attack vector that isn't using the web application as the conduit

## Vocabulary

**Vulnerability:** Flaw that can allow unauthorized access if manipulated
**Exploit:** Tool that manipulates a vulnerability to gain access
**0-day (vulnerability):** A vulnerability that the vendor is unaware of

## Best things first...

- The most important slide is next...

## Defense in Depth!

- Can't say it enough
- Security from the ground up
- Multiple layers of security
- The harder you make the attacker's job, the more likely they will fail (or give up)‏
- The more layers of security, the more likely you are to catch an attack

## Defense in Depth: Analogy

- Highly secure buildings
- Multiple security perimeters before getting in
- Getting out is as hard as getting in
- Use the same concepts when securing your web applications
- Don't rely on one firewall or packet filter
- Filter traffic on the way out
- Allow traffic to update sites, and nothing else
- Tune IDS sensors to watch for this

## Defense in Depth: Scenario

- Attacker has exploit for 0-day vulnerability in Oracle
- Finds SQL injection vulnerability in your software
- Although DB compromised, attacker is unable to communicate with compromised server
- Outbound filtering could save you...

## Think like an attacker

- How we do what we do

## Multiple Phases

- Identify mission
- Passive intelligence gathering
- Active intelligence gathering
- Scanning
- Fingerprinting
- Analyze gathered intelligence
- Attack and exploit

## Identify mission

- As an attacker, your job is to determine the most effective method to accomplish the mission
- Not always a “remote root” in a database server
- Consider security posture of target
- Do we care if we get caught?

## Passive Intelligence Gathering

- Search engines
- See “Google Hacking”
- Any information about target
- Newsgroups
- Support forums
- Vendors
- Identify hardware/software used

## Passive Intelligence Gathering

- Identify key employees and their roles
- IT personnel
- Management
- Gather intelligence on employees
- Myspace
- Blogs
- All of this was done without touching target networks/systems

## Active Intelligence Gathering

- Download documents, spreadsheets, diagrams, presentations, etc.
- Analyze the meta-data
- Analyze the actual data
- Ping/Port-scanning
- Operating System and application fingerprinting
- Probe for attack vectors
- Overall goal is to determine attack surface

## Active Intelligence Gathering

- Attackers love a web presence
- Huge attack surface
- Vast amounts of intelligence
- Can usually communicate with databases and other important systems
- Might be able to take advantage of encryption
- A vulnerable web application is almost like an API to your database/back-end servers

## Intelligence Analysis

- Should have very clear picture of target
- People, addresses, phone numbers
- Network diagrams, configuration
- Hardware in use
- Software in use
- Potential targets once inside network perimeter
- Determine most effective attack vector
- Obligatory Robert Morris quote

## Intelligence Analysis

- Exactly 5 minutes of intel gathering
- Names and UNC path to network file-servers
- Mapped network drives
- Around 20 usernames
- Full names of over 30 people
- Versions of MS-word used
- Templates used to create documents
- Everything was in a published document, intended for public distribution
- This is very bad

## Attack and Exploit

- Types of attacks
- Parameter manipulation
- SQL injection
- Cross-site scripting (XSS)‏
- Sometimes the standard buffer overflow stuff works too
- Is the application a compiled CGI or ISAPI dll?
- Stack/heap overflows
- Format string attacks

## Parameter Manipulation

- Changing/modifying data from the user
- GET values
- POST values
- Cookies
- HTTP Headers
- URL path manipulation
**Treat all data from the user as malicious**

## Parameter Manipulation

- Consider a page that displays information on a user
- URL is http://somehost/ex1.php?id=1

## Parameter Manipulation

## Parameter Manipulation

- Notice that “id” is a GET variable we can easily manipulate
- Might display data for another user or whatever “id” is referring to
- Was the mission to simply gather personal information?

## Parameter Manipulation

## Parameter Manipulation: What to do?

- Filter all input from the user
- Anything sent by the web-browser
- Be careful to filter *everything*
*HTTP Server Variables*
*“**Host:” header*
*“**User-Agent:” header*
*Cookies*
*GET/POST of course*

## SQL Injection

- Structured Query Language is the language that your web (or application) servers use to communicate with your database servers
- SQL injection is a class of vulnerabilities that exist when the web application is appending unfiltered user data into a SQL statement
- Allows an attacker to “inject” malicious SQL code in a query

## SQL Injection

- SQL is a powerful language, not limited to manipulating the data in your database
- Can potentially
- Open/append/overwrite files
- Execute commands
- Upload/download files
- Allowing an attacker to execute arbitrary SQL commands is very bad

## SQL Injection

- Some vulnerable PHP code
- $sql = “SELECT name,author FROM books WHERE type=“ . $_GET[“type”];
- Queries table “books” for the type specified in the querystring variable “type”
- I chose the arbitrary value “5” to be the type we are looking for

## SQL Injection

## SQL Injection

- By manipulating the “type” variable, we can execute arbitrary SQL statements
- type=5; INSERT INTO ...
- type=5; DROP TABLE ...
- type=5; EXEC ...
- type=5 UNION SELECT ...
- Let’s use UNION to view the contents of another table
- http://somehost/ex2.php?type=5 UNION SELECT name,password FROM users
- This takes the same data from before, and concatenates the list of users and password hashes to the list

## SQL Injection

## SQL Injection

- Previous example only worked with data in the database
- Using the same vulnerability, we could have
- Modified data in the database
- Viewed/modified files on the file system
- Downloaded and installed a backdoor
- This is why outbound filtering is effective

## SQL Injection: What to do?

- Similar to parameter manipulation, filter data from the user
- Filter it correctly
- Strings and integers handled differently
- Escape all characters, not just single quotes
- Watch for encoding issues, different character sets
- Consider using a layer of abstraction
- Single piece of code to handle ingress/egress of data

## SQL Injection: MySQL and PHP

- Multiple ways to escape strings
- Your own method...
- addslashes()   no
- addcslashes()  no
- mysql_escape_string()  close, but still no
- mysql_real_escape_string()  yes!
- Make sure to escape strings, and type-cast numbers
- sprintf() is very helpful for this
- Never use gpc_magic_quotes

## SQL Injection: MySQL and PHP

- Consider the following
- $sql = “SELECT something FROM table WHERE name=‘$foo’ AND age > $bar”;
- $foo can be secured with mysql_real_escape_string()
- $bar can still be manipulated with mysql_real_escape_string()
- To secure numbers, you must type-cast them
- The right way:
- $sql = sprintf(“SELECT something FROM table WHERE name=‘%s’ AND age>%d”, mysql_real_escape_string($foo), $bar)

## Cross-Site Scripting (XSS)‏

- “... is a type of computer security exploit where information from one context, where it is not trusted, can be inserted into another context, where it is.  From the trusted context, an attack can be launched.” --Wikipedia
- “Forcing Javascript to run where it doesn't belong.” --Gary G.

## Cross-Site Scripting (XSS)‏

- Understand what Javascript is
- What about VBScript?
- Javascript is code that runs on the client side (the web browser)‏
- Has access to things like cookies
- Can make arbitrary HTTP requests
- Very powerful feature-set

## Cross-Site Scripting (XSS)‏

- A typical attack scenario
- Page is displayed with information from the database
- Data in database came from unfiltered user input and contains malicious Javascript
- When page is displayed to user, malicious Javascript executes
- Could transmit session cookies to attacker
- Attacker then re-uses session cookie

## Cross-Site Scripting (XSS)

- Guestbook example
- Mallory has posted an entry containing:
- <script>alert(“owned”);</script>

## Cross-Site Scripting (XSS)

## Cross-Site Scripting (XSS): What to do?

- XSS can be prevented by escaping special HTML characters when displayed
- Always do this, no exceptions
- In PHP there is:
- htmlentities()
- Make sure to use ENT_QUOTES to fix both single and double quotes
- For example:
- <?=htmlentities($foo, ENT_QUOTES);?>

## What to do?

- Reduce your footprint
- Remove as much information as possible from your sites (Names, places, etc)‏
- Strip metadata from public documents
- Have a formal public disclosure policy to address this
- Educate users about risks of posting information to forums, support groups, newsgroups, etc

## What to do?

- Audit your systems and applications
- A “new set of eyes” can shed a lot of light
- Because you never know, until you know...
- Training
- Both developers and engineers will benefit from security training
- Thinking like an attacker will change the way they design systems

## What to do?

- “Security is a requirement not a feature”
- Woven throughout your systems from the ground up
- Defense in depth!
- Upkeep
- Make sure everyone stays on top of the latest technology
- Security industry moves *very fast*

## The End.

- Questions, comments?

## Links

**Crucial Security** - http://www.crucialsecurity.com
**Google Hacking** - http://johnny.ihackstuff.com
**OWASP** - http://www.owasp.org

## ggeisbert@crucialsecurity.com

- 703-961-9456 x139