Knock Knock Understanding Who is Using Your Web Applications Aaron - - PowerPoint PPT Presentation

▶
knock knock
SMART_READER_LITE
LIVE PREVIEW

Knock Knock Understanding Who is Using Your Web Applications Aaron - - PowerPoint PPT Presentation

Feb 11, 2024 525 likes •1.96k views

Knock Knock Understanding Who is Using Your Web Applications Aaron Bedra Application Security Lead Braintree Payments Tuesday, April 23, 13 Right now, your web applications are being attacked Tuesday, April 23, 13 And it will happen

slide-1
SLIDE 1

Knock Knock

Understanding Who is Using Your Web Applications

Aaron Bedra Application Security Lead Braintree Payments

Tuesday, April 23, 13

slide-2
SLIDE 2

Right now, your web applications are being attacked

Tuesday, April 23, 13

slide-3
SLIDE 3

And it will happen again, and again, and again

Tuesday, April 23, 13

slide-4
SLIDE 4

But not always in the way you think

Tuesday, April 23, 13

slide-5
SLIDE 5

Let’s take a look at typical application security measures

Tuesday, April 23, 13

slide-6
SLIDE 6

User Requests Web Server Application Environment

Tuesday, April 23, 13

slide-7
SLIDE 7

Tuesday, April 23, 13

slide-8
SLIDE 8

roland : 12345

Tuesday, April 23, 13

slide-9
SLIDE 9

roland : 12345

Tuesday, April 23, 13

slide-10
SLIDE 10

And we go on with our day

Tuesday, April 23, 13

slide-11
SLIDE 11

How many of you stop there?

Tuesday, April 23, 13

slide-12
SLIDE 12

It’s time to start asking more questions

Tuesday, April 23, 13

slide-13
SLIDE 13

But remember…

Tuesday, April 23, 13

slide-14
SLIDE 14

Don’t impact user experience!

Tuesday, April 23, 13

slide-15
SLIDE 15

???

Tuesday, April 23, 13

slide-16
SLIDE 16
  • Signature based detection
  • Anomaly detection
  • Reputational intelligence
  • Action
  • Repsheet

Tuesday, April 23, 13

slide-17
SLIDE 17

Signatures

Tuesday, April 23, 13

slide-18
SLIDE 18

Mod Security

Tuesday, April 23, 13

slide-19
SLIDE 19

Web Application Firewall

Tuesday, April 23, 13

slide-20
SLIDE 20

Rule based detection

Tuesday, April 23, 13

slide-21
SLIDE 21

Allows you to block or alert if traffic matches a signature

Tuesday, April 23, 13

slide-22
SLIDE 22

Improved by the OWASP Core Rule Set

Tuesday, April 23, 13

slide-23
SLIDE 23

A great tool to add to your stack

Tuesday, April 23, 13

slide-24
SLIDE 24

Works with Apache, nginx, and IIS

Tuesday, April 23, 13

slide-25
SLIDE 25

Works well with Apache

Tuesday, April 23, 13

slide-26
SLIDE 26

Like most signature based tools it requires tuning

Tuesday, April 23, 13

slide-27
SLIDE 27

And has a high possibility of false positives

Tuesday, April 23, 13

slide-28
SLIDE 28

Great for helping with 0-day attacks

Tuesday, April 23, 13

slide-29
SLIDE 29

Favor alerting over blocking in most scenarios

Tuesday, April 23, 13

slide-30
SLIDE 30

User Requests Web Server ModSecurity Application Environment

Tuesday, April 23, 13

slide-31
SLIDE 31

Anomalies

Tuesday, April 23, 13

slide-32
SLIDE 32

10.20.253.8 - - [23/Apr/2013:14:20:21 +0000] "POST /login HTTP/1.1" 200 267"-" "Mozilla/ 5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/ 20100101 Firefox/8.0" "77.77.165.233"

Tuesday, April 23, 13

slide-33
SLIDE 33

10.20.253.8 - - [23/Apr/2013:14:20:22 +0000] "POST /users/king-roland/cc_records HTTP/1.1" 302 2085 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0" "77.77.165.233"

Tuesday, April 23, 13

slide-34
SLIDE 34

10.20.253.8 - - [23/Apr/2013:14:20:23 +0000] "POST /users/king-roland/cc_records HTTP/1.1" 302 2083 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0" "77.77.165.233"

Tuesday, April 23, 13

slide-35
SLIDE 35

10.20.253.8 - - [23/Apr/2013:14:20:24 +0000] "POST /users/king-roland/cc_records HTTP/1.1" 302 2085 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0" "77.77.165.233"

Tuesday, April 23, 13

slide-36
SLIDE 36

What do you see?

Tuesday, April 23, 13

slide-37
SLIDE 37

I see a website getting carded

Tuesday, April 23, 13

slide-38
SLIDE 38

???

Tuesday, April 23, 13

slide-39
SLIDE 39

Play by play

Tuesday, April 23, 13

slide-40
SLIDE 40

10.20.253.8 - - [23/Apr/2013:14:20:21 +0000] "POST /login HTTP/1.1" 200 267"-" "Mozilla/ 5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/ 20100101 Firefox/8.0" "77.77.165.233"

Login Request

Tuesday, April 23, 13

slide-41
SLIDE 41

10.20.253.8 - - [23/Apr/2013:14:20:22 +0000] "POST /users/king-roland/cc_records HTTP/1.1" 302 2085 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0" "77.77.165.233"

Add credit card to account #1 1 sec delay

Tuesday, April 23, 13

slide-42
SLIDE 42

10.20.253.8 - - [23/Apr/2013:14:20:23 +0000] "POST /users/king-roland/cc_records HTTP/1.1" 302 2083 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0" "77.77.165.233"

1 sec delay Add credit card to account #2 FF 8 on Windows 7

  • r Bot?

Tuesday, April 23, 13

slide-43
SLIDE 43

10.20.253.8 - - [23/Apr/2013:14:20:24 +0000] "POST /users/king-roland/cc_records HTTP/1.1" 302 2085 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0" "77.77.165.233"

1 sec delay Add credit card to account #3 FF 8 on Windows 7

  • r Bot?

Plovdiv Bulgaria

Tuesday, April 23, 13

slide-44
SLIDE 44

And this continues…

Tuesday, April 23, 13

slide-45
SLIDE 45

10,000 more times

Tuesday, April 23, 13

slide-46
SLIDE 46

Those were the only requests that IP address made

Tuesday, April 23, 13

slide-47
SLIDE 47

Aside from the number

  • f requests what else

gave it away?

Tuesday, April 23, 13

slide-48
SLIDE 48

5% 5% 4% 27% 59%

GET POST HEAD PUT DELETE

Tuesday, April 23, 13

slide-49
SLIDE 49

HTTP method distribution is important

Tuesday, April 23, 13

slide-50
SLIDE 50

When an actor deviates significantly, there must be a reason!

Tuesday, April 23, 13

slide-51
SLIDE 51

Let’s talk GeoIP

Tuesday, April 23, 13

slide-52
SLIDE 52

Adding GeoIP information is generically useful

Tuesday, April 23, 13

slide-53
SLIDE 53

But it also helps in the face of an attack

Tuesday, April 23, 13

slide-54
SLIDE 54

It can help protect you and your users

Tuesday, April 23, 13

slide-55
SLIDE 55

Scenario

Tuesday, April 23, 13

slide-56
SLIDE 56

King Roland gets his GMail account hacked

Tuesday, April 23, 13

slide-57
SLIDE 57

Hacker sends a password reset request to your server

Tuesday, April 23, 13

slide-58
SLIDE 58

Normally, you would email the reset

Tuesday, April 23, 13

slide-59
SLIDE 59

Unless...

Tuesday, April 23, 13

slide-60
SLIDE 60

You realize that King Roland always logs in from Druidia

Tuesday, April 23, 13

slide-61
SLIDE 61

But the hacker is requesting the reset from Spaceball City

Tuesday, April 23, 13

slide-62
SLIDE 62

Instead of sending the reset, you now ask some questions

Tuesday, April 23, 13

slide-63
SLIDE 63

And hopefully protect King Roland from further bad actions

Tuesday, April 23, 13

slide-64
SLIDE 64

GeoIP detection also helps you block traffic from unwanted countries

Tuesday, April 23, 13

slide-65
SLIDE 65

User Requests Web Server ModSecurity Application Environment GeoIP

Tuesday, April 23, 13

slide-66
SLIDE 66

Other Anomalies

  • Request Rate
  • TCP Fingerprint vs. User Agent
  • Account Create/Delete/Subscribe
  • Anything you can imagine

Tuesday, April 23, 13

slide-67
SLIDE 67

What do they have in common?

Tuesday, April 23, 13

slide-68
SLIDE 68

Does the behavior fit an equation?

Tuesday, April 23, 13

slide-69
SLIDE 69

If so, your detection is simple

Tuesday, April 23, 13

slide-70
SLIDE 70

Request rate > Threshold

Tuesday, April 23, 13

slide-71
SLIDE 71

TCP fingerprint != User Agent

Tuesday, April 23, 13

slide-72
SLIDE 72

But the HTTP method deviation is harder

Tuesday, April 23, 13

slide-73
SLIDE 73

100% GET requests with a known UA (e.g. Google) is ok

Tuesday, April 23, 13

slide-74
SLIDE 74

100% POST requests is not

Tuesday, April 23, 13

slide-75
SLIDE 75

But it’s not always that simple

Tuesday, April 23, 13

slide-76
SLIDE 76

Scenario

Tuesday, April 23, 13

slide-77
SLIDE 77

A high rate of account create requests are coming from a single address

Tuesday, April 23, 13

slide-78
SLIDE 78

Is it a NATted IP or a fraud/spam bot?

Tuesday, April 23, 13

slide-79
SLIDE 79

We have patterns and data…

Tuesday, April 23, 13

slide-80
SLIDE 80

What’s the next step?

Tuesday, April 23, 13

slide-81
SLIDE 81

Quantitative Analysis

Tuesday, April 23, 13

slide-82
SLIDE 82

Quantitative Analysis

Tuesday, April 23, 13

slide-83
SLIDE 83

Quantitative Analysis Security as a Data Science Probelm

Tuesday, April 23, 13

slide-84
SLIDE 84

We can apply some machine learning to the data in an attempt to classify it

Tuesday, April 23, 13

slide-85
SLIDE 85

Classifier

???

User Requests Web Server ModSecurity Application Environment GeoIP

Tuesday, April 23, 13

slide-86
SLIDE 86

This is where a lot of the value comes from

Tuesday, April 23, 13

slide-87
SLIDE 87

And combined with signature detection helps correlate attack events

Tuesday, April 23, 13

slide-88
SLIDE 88

But you still need a way to keep track of it all

Tuesday, April 23, 13

slide-89
SLIDE 89

Reputational Intelligence

Tuesday, April 23, 13

slide-90
SLIDE 90

Who’s naughty and who’s really naughty

Tuesday, April 23, 13

slide-91
SLIDE 91

Built up from the tools/ techniques mentioned previously

Tuesday, April 23, 13

slide-92
SLIDE 92

Provides local reputation

Tuesday, April 23, 13

slide-93
SLIDE 93

You can also purchase external reputation feeds

Tuesday, April 23, 13

slide-94
SLIDE 94

The combination gives you solid awareness of bad actors

Tuesday, April 23, 13

slide-95
SLIDE 95

Reputational Intelligence External Reputation Classifier

???

User Requests Web Server ModSecurity Application Environment GeoIP

???

Tuesday, April 23, 13

slide-96
SLIDE 96

Action

Tuesday, April 23, 13

slide-97
SLIDE 97

So now you have a ton

  • f new information

Tuesday, April 23, 13

slide-98
SLIDE 98

What do you do with it?

Tuesday, April 23, 13

slide-99
SLIDE 99

Options

  • Block the traffic
  • Honeypot the attacker
  • Attack back
  • Contact the authorities

Tuesday, April 23, 13

slide-100
SLIDE 100

Blocking the traffic is straight forward

Tuesday, April 23, 13

slide-101
SLIDE 101

Block at the web server level (403)

Tuesday, April 23, 13

slide-102
SLIDE 102

Block at the firewall level

Tuesday, April 23, 13

slide-103
SLIDE 103

Both have advantages/ disadvantages

Tuesday, April 23, 13

slide-104
SLIDE 104

Honeypots are much more interesting

Tuesday, April 23, 13

slide-105
SLIDE 105

LB LB LB Engine Fake Real

DB DB

Partial Replication

Tuesday, April 23, 13

slide-106
SLIDE 106

When you honeypot, the attacker doesn’t know they’ve been caught

Tuesday, April 23, 13

slide-107
SLIDE 107

And it allows you to study their behavior

Tuesday, April 23, 13

slide-108
SLIDE 108

And update your approach to preventing attacks

Tuesday, April 23, 13

slide-109
SLIDE 109

But all of this requires a way to manage state and act on bad behavior

Tuesday, April 23, 13

slide-110
SLIDE 110

Reputational Intelligence External Reputation Classifier

???

User Requests Web Server ModSecurity Application Environment GeoIP

???

State State Where do you act? Here?

Tuesday, April 23, 13

slide-111
SLIDE 111

Repsheet

Tuesday, April 23, 13

slide-112
SLIDE 112

Reputation Engine

Tuesday, April 23, 13

slide-113
SLIDE 113

Redis

Repsheet Backend External Reputation Feeds User Requests Web Server ModSecurity Application Environment GeoIP Repsheet

Tuesday, April 23, 13

slide-114
SLIDE 114

Redis

Repsheet Backend External Reputation Feeds User Requests Web Server ModSecurity Application Environment GeoIP Repsheet

Tuesday, April 23, 13

slide-115
SLIDE 115

Redis

Repsheet Backend External Reputation Feeds User Requests Web Server ModSecurity Application Environment GeoIP Repsheet

Recorder

Tuesday, April 23, 13

slide-116
SLIDE 116

Redis

Repsheet Backend External Reputation Feeds User Requests Web Server ModSecurity Application Environment GeoIP Repsheet

Managed State Recorder

Tuesday, April 23, 13

slide-117
SLIDE 117

Redis

Repsheet Backend External Reputation Feeds User Requests Web Server ModSecurity Application Environment GeoIP Repsheet

Managed State Actor Recorder

Tuesday, April 23, 13

slide-118
SLIDE 118

Redis

Repsheet Backend External Reputation Feeds User Requests Web Server ModSecurity Application Environment GeoIP Repsheet

Managed State

Classifier, Feed Integration, Learning Models

Actor Recorder

Tuesday, April 23, 13

slide-119
SLIDE 119

Repsheet helps put everything together

Tuesday, April 23, 13

slide-120
SLIDE 120

Web server module records activity and looks for offenders in the cache

Tuesday, April 23, 13

slide-121
SLIDE 121

It listens to ModSecurity and adds

  • ffending IPs to it’s list

Tuesday, April 23, 13

slide-122
SLIDE 122

It provides notification and/or blocking of

  • ffenders

Tuesday, April 23, 13

slide-123
SLIDE 123

Blocking happens at the web server level

Tuesday, April 23, 13

slide-124
SLIDE 124

But you can send the Repsheet data to your firewall for TCP level blocking

Tuesday, April 23, 13

slide-125
SLIDE 125

Notification sends headers to the downstream application

Tuesday, April 23, 13

slide-126
SLIDE 126

Which allows each app to chose how it is going to respond

Tuesday, April 23, 13

slide-127
SLIDE 127

For instance, show a captcha on signup if Repsheet alerts

Tuesday, April 23, 13

slide-128
SLIDE 128

Back end looks at the recorded data for bad behavior

Tuesday, April 23, 13

slide-129
SLIDE 129

And updates the cache when it finds offenders

Tuesday, April 23, 13

slide-130
SLIDE 130

You can supply your

  • wn learning models

for the data

Tuesday, April 23, 13

slide-131
SLIDE 131

Repsheet will soon provide some defaults

Tuesday, April 23, 13

slide-132
SLIDE 132

github.com/abedra/ repsheet

Tuesday, April 23, 13

slide-133
SLIDE 133

Still in early stage development

Tuesday, April 23, 13

slide-134
SLIDE 134

But already in production for a few projects

Tuesday, April 23, 13

slide-135
SLIDE 135

Summary

Tuesday, April 23, 13

slide-136
SLIDE 136

There are lots of indicators of attack in your traffic

Tuesday, April 23, 13

slide-137
SLIDE 137

Build up a system that can capture the data and sort good from bad

Tuesday, April 23, 13

slide-138
SLIDE 138

Tools

  • ModSecurity
  • GeoIP
  • Custom rules (velocity triggers,

fingerprinting, device id, etc)

  • Custom behavioral classification
  • Repsheet

Tuesday, April 23, 13

slide-139
SLIDE 139

And Remember…

Tuesday, April 23, 13

slide-140
SLIDE 140

Tuesday, April 23, 13

slide-141
SLIDE 141

Questions?

Tuesday, April 23, 13