Basic housekeeping Plugging obvious security holes in web sites. - - PowerPoint PPT Presentation

▶
basic housekeeping
SMART_READER_LITE
LIVE PREVIEW

Basic housekeeping Plugging obvious security holes in web sites. - - PowerPoint PPT Presentation

Aug 04, 2023 172 likes •1.08k views

Basic housekeeping Plugging obvious security holes in web sites. Chris9an Heilmann, Paris Web, Paris, October 2009 A few things to remember about basic web security. A bit of pimping... Grer la scurit de vos applica9ons web (Salle 1)

slide-1
SLIDE 1

Basic housekeeping

Plugging obvious security holes in web sites.

Chris9an Heilmann, Paris Web, Paris, October 2009

slide-2
SLIDE 2
slide-3
SLIDE 3
slide-4
SLIDE 4

A few things to remember about basic web security.

slide-5
SLIDE 5

A bit of pimping...

Gérer la sécurité de vos applica9ons web (Salle 1) Présenté par : Sébas9en Pauchet (WS Interac9ve), Frank Taillandier (Académie de Toulouse)

a.k.a. Dirty Tricks with @DirtyF

slide-6
SLIDE 6

The most annoying thing is that the dangers on the web are underes9mated.

slide-7
SLIDE 7
slide-8
SLIDE 8

Reasons for aRacks:

Spam injec9on. Iden9ty theT. Data mining. Botnet / Zombies / DOS

slide-9
SLIDE 9

A lot of clever terms are used in security. SQL injec9on XSS CSRF ClickJacking Phishing

slide-10
SLIDE 10

In the end, a lot is about keeping your web products clean.

slide-11
SLIDE 11

This very much starts on the server side.

slide-12
SLIDE 12

Think about your folders.

slide-13
SLIDE 13
slide-14
SLIDE 14
slide-15
SLIDE 15
slide-16
SLIDE 16
slide-17
SLIDE 17

Telling the world too much.

slide-18
SLIDE 18

You don’t want the admin folders of your app to be indexed by Google Search Engines.

slide-19
SLIDE 19

Your system might tell more about your site than you are aware of.

slide-20
SLIDE 20

Error messages are only needed in produc9on ‐ on live servers they can tell more than you want to.

slide-21
SLIDE 21

Keep your server setup secure.

slide-22
SLIDE 22

hRp://yoursite.com/index.php?admin=true

hRp://phpsec.org/projects/phpsecinfo/

slide-23
SLIDE 23

hRp://phpsec.org/projects/phpsecinfo/

slide-24
SLIDE 24

Basic server measures:

Turn off folder browsing. Stop bot indexing (robots.txt). Secure your setup. Turn off error messaging. Disallow remote file inclusion. Delete old and orphan files.

slide-25
SLIDE 25

The next danger is blindly relying on soTware.

slide-26
SLIDE 26

Predefined backdoors and passwords.

slide-27
SLIDE 27

admin/admin admin/password default/default user/user preset/preset buil9n/buil9n

slide-28
SLIDE 28

Plugins

slide-29
SLIDE 29

Basic soTware measures:

Change every password. Check for presets. RTFM. Keep Plugins up‐to‐date. Check for security holes. Don’t trust “easy setup”. Upgrade.

slide-30
SLIDE 30

Front end security issues.

slide-31
SLIDE 31

This is not hard.

Don’t trust any user data. HTML is not a database. JavaScript is not a secure data container. Do not rely on JavaScript.

slide-32
SLIDE 32

Frontend is public.

If you comment, comment on the backend, do not “comment out” func9onality.

slide-33
SLIDE 33

Frontend is insecure.

Anything in the frontend is executed and can be used to steal all your cookies.

(frames, images, scripts, links...)

slide-34
SLIDE 34

hRp://us2.php.net/manual/en/book.filter.php

Filtering

slide-35
SLIDE 35

Whitelis9ng

slide-36
SLIDE 36

Clickjacking.

slide-37
SLIDE 37
slide-38
SLIDE 38

Basic frontend measures:

Break frames. Filter inputs. Whitelist inputs. Avoid hacks (expression()). Avoid URL assembling.

slide-39
SLIDE 39

Our users

slide-40
SLIDE 40

Social engineering.

slide-41
SLIDE 41

SocEng basics:

Show authority. Create fake need of urgency. Take over responsibility.

slide-42
SLIDE 42

Condi9oning helps. :‐(

slide-43
SLIDE 43

I approve

  • f this!
slide-44
SLIDE 44

Social networks

slide-45
SLIDE 45
slide-46
SLIDE 46
slide-47
SLIDE 47
slide-48
SLIDE 48

Step 1: Log in yourself

slide-49
SLIDE 49

Step 2: Get list of followers

slide-50
SLIDE 50
slide-51
SLIDE 51

Step 3: Set the trap

slide-52
SLIDE 52

http://twitter.com/statuses/ user_timeline/codepo8.xml? count=200

slide-53
SLIDE 53
slide-54
SLIDE 54

Step 4: Lure his followers

slide-55
SLIDE 55

None

  • f this!
slide-56
SLIDE 56

Predictability

slide-57
SLIDE 57

Basic people measures:

Don’t allow for auto log‐in. Share security responsibility with the users. Avoid stressful interfaces. Be very open about your communica9on.

slide-58
SLIDE 58

Bot aRacks.

slide-59
SLIDE 59

hRp://caca.zoy.org/wiki/PWNtcha

Captchas to the rescue?

slide-60
SLIDE 60

Bot aRack measures.

Honeyponng. Timed interfaces. Cookie check / Crumbing. Spike detec9on. OpenID / third party logins.

slide-61
SLIDE 61

Nothing beats being up‐ to‐date!

slide-62
SLIDE 62
slide-63
SLIDE 63

None

  • f this!
slide-64
SLIDE 64

I approve

  • f this!
slide-65
SLIDE 65

You learn a lot from logs.

slide-66
SLIDE 66
slide-67
SLIDE 67

No strength in numbers.

slide-68
SLIDE 68

Check your posts.

slide-69
SLIDE 69

And query terms.

slide-70
SLIDE 70

Some not‐so sci‐fi ideas...

slide-71
SLIDE 71

Guest passes.

slide-72
SLIDE 72
  • Auth
slide-73
SLIDE 73

OpenID

slide-74
SLIDE 74

Caja/ADsafe

slide-75
SLIDE 75

Caja limits and secures web standards.

slide-76
SLIDE 76

★ Custom aRributes ★ Custom tags ★ Unclosed tags ★ <embed> ★ <iframe> ★ <link rel=‘… ★ javascript:void(0) ★ Radio buRons in IE ★ Rela9ve url’s

Caja vs. “HTML”

slide-77
SLIDE 77

★ eval() ★ new Func9on() ★ Strings as event handlers (node.onclick = '...';) ★ Names ending with double / triple underscores ★ with func9on (with (obj) { ... }) ★ Implicit global variables (specify var variable) ★ Calling a method as a func9on ★ document.write ★ window.event ★ .onclick ★ OpenSocial gadgets.io.makeRequest return JS

Caja vs “JavaScript”

slide-78
SLIDE 78

★ * hacks ★ _ hacks ★ IE condi9onals ★ Insert‐aTer clear fix ★ expression() ★ @import ★ Background images in IE

Caja vs “CSS”

slide-79
SLIDE 79

Throwaway logins.

slide-80
SLIDE 80

New challenges.

slide-81
SLIDE 81

Social Network aRacks

slide-82
SLIDE 82

The mobile web.

slide-83
SLIDE 83

Camera access.

slide-84
SLIDE 84

Loca9on based services.

slide-85
SLIDE 85

Biometric recogni9on.

slide-86
SLIDE 86

Right now things are not safe.

slide-87
SLIDE 87

But you can help making the web safer.

slide-88
SLIDE 88

Keep it clean, keep it up‐ to‐date and be alert.

slide-89
SLIDE 89

Chris9an Heilmann hRp://wait‐9ll‐i.com hRp://developer‐evangelism.com hRp://twiRer.com/codepo8

MERCI!