No More Whack-a-Mole: How to Find and Prevent Entire Classes of - - PowerPoint PPT Presentation

▶
no more whack a mole
SMART_READER_LITE
LIVE PREVIEW

No More Whack-a-Mole: How to Find and Prevent Entire Classes of - - PowerPoint PPT Presentation

Mar 10, 2024 36 likes •429 views

No More Whack-a-Mole: How to Find and Prevent Entire Classes of Security Vulnerabilities Sam Lanning @samlanning @samlanning A story of many bugs (CVE-2017-8046) 7 September 2017 22 September 2017 27 September 2017 Mo

slide-1
SLIDE 1

@samlanning @samlanning

No More Whack-a-Mole:

How to Find and Prevent Entire Classes of Security Vulnerabilities

Sam Lanning

slide-2
SLIDE 2

Securing software, together

A story of many bugs (CVE-2017-8046)

7 September 2017 Mo privately discloses vulnerability and exploit in Spring Framework 21 September 2017 Pivotal publish a patch, and make an announcement. 22 September 2017 Mo checks patch, sees it’s incomplete sends updated exploit to Pivotal 27 September 2017 Mo checks patch, sees it’s still incomplete sends updated exploit to Pivotal 26 September 2017 Pivotal sends Mo details of second attempt at fix 25 October 2017 Pivotal publishes a complete refactor

  • f relevant code to hopefully prevent

further occurrences.

https://lgtm.com/blog/spring_data_rest_CVE-2017-8046_ql

slide-3
SLIDE 3

Securing software, together

A story of many bugs 2

27 April 2016 S2-032 / CVE-2016-3081 RCE in Apache Struts 2 via OGNL Nike Zheng 12 May 2016 S2-033 / CVE-2016-3087 RCE in Apache Struts 2 via OGNL Alvaro Munoz 20 June 2016 S2-037 / CVE-2016-4438 RCE in Apache Struts 2 via OGNL Chao Jack, Shinsaku Nomura 22 September 2017 S2-046 / CVE-2017-5638 RCE in Apache Struts 2 via OGNL Chris Frohoff, Nike Zheng, Alvaro Munoz 19 March 2017 S2-045 / CVE-2017-5638 RCE in Apache Struts 2 via OGNL Nike Zheng 24 September 2018 S2-057 / CVE-2018-11776 RCE in Apache Struts 2 via OGNL Man Yue Mo See Also: CVE-2012-0394, CVE-2013-1966, CVE-2012-0391, CVE-2013-2115, CVE-2012-0393

slide-4
SLIDE 4

Securing software, together

https://www.reddit.com/r/gifs/comments/2nyeb1/arcade_game_for_cats/

slide-5
SLIDE 5

Securing software, together

Solution:

When a new mistake is discovered, try and find similar mistakes across your code base

slide-6
SLIDE 6

Securing software, together

Variant Analysis?

“After doing this [root cause analysis], our next step is variant analysis: finding and investigating any variants of the vulnerability. It’s important that we find all such variants and patch them simultaneously, otherwise we bear the risk of these being exploited in the wild.”

  • Steven Hunter, MSRC Vulnerabilities & Mitigations team

https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-7
SLIDE 7

Securing software, together

slide-8
SLIDE 8

Securing software, together

Code Navigation / IDE

slide-9
SLIDE 9

Securing software, together

slide-10
SLIDE 10

Securing software, together

Automating Variant Analysis

Could we describe a mistake in a way that lets us automatically find other instances?

slide-11
SLIDE 11

Securing software, together

An Example: Chakra

https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-12
SLIDE 12

Securing software, together

An Example: Chakra

https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-13
SLIDE 13

Securing software, together

An Example: Chakra

https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-14
SLIDE 14

Securing software, together

An Example: Chakra

https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-15
SLIDE 15

Securing software, together

An Example: Chakra

https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-16
SLIDE 16

Securing software, together

An Example: Chakra

https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-17
SLIDE 17

Securing software, together

An Example: Chakra

*slightly modified query from: https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-18
SLIDE 18

Securing software, together

An Example: Chakra

*slightly modified query from: https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-19
SLIDE 19

Securing software, together

An Example: Chakra

*slightly modified query from: https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-20
SLIDE 20

Securing software, together

An Example: Chakra

*slightly modified query from: https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-21
SLIDE 21

Securing software, together

An Example: Chakra

*slightly modified query from: https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-22
SLIDE 22

Securing software, together

An Example: Chakra

https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-23
SLIDE 23

Securing software, together

An Example: Chakra

*slightly modified query from: https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-24
SLIDE 24

Securing software, together

An Example: Chakra

https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-25
SLIDE 25

Securing software, together

An Example: Chakra

*slightly modified query from: https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-26
SLIDE 26

Securing software, together

An Example: Chakra

https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-27
SLIDE 27

Securing software, together

An Example: Chakra

*slightly modified query from: https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-28
SLIDE 28

Securing software, together

An Example: Chakra

https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-29
SLIDE 29

Securing software, together

An Example: Chakra

*slightly modified query from: https://blogs.technet.microsoft.com/srd/2018/08/16/vulnerability-hunting-with-semmle-ql-part-1/

slide-30
SLIDE 30

Securing software, together

Beyond your own code

➔ Make your (general-purpose) mistake descriptions

  • pen source!

➔ Use external mistake descriptions!

slide-31
SLIDE 31

Securing software, together

ZipSlip

https://snyk.io/research/zip-slip-vulnerability

slide-32
SLIDE 32

Securing software, together

ZipSlip

https://snyk.io/research/zip-slip-vulnerability

../../../.bashrc ../../../../../../../../../etc/crontab

slide-33
SLIDE 33

Securing software, together

ZipSlip

https://snyk.io/research/zip-slip-vulnerability

slide-34
SLIDE 34

Securing software, together

ZipSlip

https://snyk.io/research/zip-slip-vulnerability

slide-35
SLIDE 35

Securing software, together

Fituing in to your workflow

Describe mistake Discover variants Fix variants Monitor continuously

improve description

Discover unreleased variants Fix in code review Security bug Diagnose root-cause Fix original bug

  • Bug Bounty program
  • Pen testing
  • Code review
  • Audit
  • Error logs

publish / make

  • pen-source

use external knowledge deploy Fix deploy Fix

slide-36
SLIDE 36

Securing software, together

No vulnerability response process?

slide-37
SLIDE 37

Securing software, together

What variant analysis is NOT

➔ A replacement for good security architecture, a way to avoid large refactors ➔ A replacement for exploit mitigation ➔ A replacement for other security processes ➔ Something that automatically fixes bugs / vulnerabilities.

slide-38
SLIDE 38

Securing software, together

Recap

➔ You should do variant analysis ➔ Better yet, you should do automated variant analysis ➔ Use and contribute to the shared knowledge / checks ➔ Checks should be run continuously, not once-off! ➔ VA compliments (not replaces) other security practices

slide-39
SLIDE 39

semmle.com @Semmle

Thank You

@samlanning @samlanning

Sam Lanning