security in
play

SECURITY IN THE AGE OF FRAMEWORKS LUKA KLADARIC // L@K.HR // @KLL - PowerPoint PPT Presentation

Mar 31, 2023 •98 likes •788 views

SECURITY IN THE AGE OF FRAMEWORKS LUKA KLADARIC // L@K.HR // @KLL 1 FSec 2016 2 FSec 2016 ONCE UPON A TIME... 3 FSec 2016 WE WROTE OUR OWN CODE 4 FSec 2016 ALL OF IT. 5 FSec 2016 so we knew what was in it. we knew every

  1. SECURITY IN THE AGE OF FRAMEWORKS LUKA KLADARIC // L@K.HR // @KLL 1 — FSec 2016

  2. 2 — FSec 2016

  3. ONCE UPON A TIME... 3 — FSec 2016

  4. WE WROTE OUR OWN CODE 4 — FSec 2016

  5. ALL OF IT. 5 — FSec 2016

  6. so we knew what was in it. we knew every little bit. 6 — FSec 2016

  7. WHO IS THIS GUY? 7 — FSec 2016

  8. Luka Kladaric (1985) started doing web stuff around 1997 javascript before jQuery server-side with ASP/VBScript (~1999) ran away to PHP (~2002) ran away to Python (~2013) ran away to devops 8 — FSec 2016

  9. Today we "know better" than to code everything from scratch 9 — FSec 2016

  10. So we rely on frameworks 10 — FSec 2016

  11. and libraries & a bunch of 3rd party code 11 — FSec 2016

  12. we outsource authentication... 12 — FSec 2016

  13. logging... 13 — FSec 2016

  14. database interaction... 14 — FSec 2016

  15. API connectivity... 15 — FSec 2016

  16. everything that isn't strictly unique to the problem we're solving 16 — FSec 2016

  17. this presents a RTFM problem 17 — FSec 2016

  18. How does this problem manifest itself? 18 — FSec 2016

  19. Story time! (Demo 1) 19 — FSec 2016

  20. Example Co builds their first webapp > an internal dashboard at control.example.com > authentication? 20 — FSec 2016

  21. 21 — FSec 2016

  22. 22 — FSec 2016

  23. 23 — FSec 2016

  24. But if the servers only ever see HTTP, how will they know about HTTPS? 24 — FSec 2016

  25. Spoiler: they won't (not by default anyway) 25 — FSec 2016

  26. What we'd like to see 26 — FSec 2016

  27. 27 — FSec 2016

  28. 28 — FSec 2016

  29. Fixes: > respect X-Forwarded-Proto header 29 — FSec 2016

  30. watch out for various components treating security headers differently 30 — FSec 2016

  31. > SSL config change triggers audit 31 — FSec 2016

  32. > remove http from oauth whitelist 32 — FSec 2016

  33. > HSTS headers 1 1 HTTP Strict Transport Security 33 — FSec 2016

  34. difficult to catch, browsers don't report this as bad behavior 34 — FSec 2016

  35. Story time! (Demo 2) 35 — FSec 2016

  36. 36 — FSec 2016

  37. 37 — FSec 2016

  38. if you've ever set up oAuth 38 — FSec 2016

  39. for multiple apps 39 — FSec 2016

  40. against the same provider 40 — FSec 2016

  41. ... did you bother setting up separate oAuth clients? 41 — FSec 2016

  42. yeah. 42 — FSec 2016

  43. 43 — FSec 2016

  44. Story time! (demo 3) 44 — FSec 2016

  45. Cookie: session=.eJxljssKgkAYRl8l_rWJl1ScnW kLC8msaBEik046po7YGF7w3Su3bg7f4vBxR M1Zl-C6g3BpcVqS6M1xWQOSN4ZqKrJqatMX y0NLzg.CrvTRg.5bTUddcAEVMFMth_I uPteZT0OjA; HttpOnly; Path=/ 45 — FSec 2016

  46. How is cookie signed 46 — FSec 2016

  47. Flask 47 — FSec 2016

  48. Django 48 — FSec 2016

  49. 49 — FSec 2016

  50. 50 — FSec 2016

  51. SECRET_KEY being configured badly is next to impossible to catch 51 — FSec 2016

  52. All of these combined mean: 52 — FSec 2016

  53. spear phishing vector 53 — FSec 2016

  54. privilege escalation 54 — FSec 2016

  55. forced insecure comms 55 — FSec 2016

  56. attacker traffic indistinguishable from regular traffic 56 — FSec 2016

  57. the LB here isn't to blame 57 — FSec 2016

  58. people have ancient bookmarks pointing to http 58 — FSec 2016

  59. ALL THINGS BEING EQUAL BUT RUNNING ON A SINGLE MACHINE THIS WOULD STILL BE A VULNERABLE SETUP 59 — FSec 2016

  60. HSTS IS A MUST 60 — FSec 2016

  61. Story time! (Demo 4) 61 — FSec 2016

  62. CSRF protection disabled yup. found this one too. 62 — FSec 2016

  63. IT COMES WITH THE THING LEAVE CSRF PROTECTION ALONE 63 — FSec 2016

  64. TAKEAWAYS UNDERSTAND THE STUFF YOU USE BETTER. 64 — FSec 2016

  65. BE MORE VIGILANT WITH CODE REVIEWS ON SECURITY-IMPACTING STUFF 65 — FSec 2016

  66. BRING IN A FRESH PAIR OF EYES EVERY ONCE IN A WHILE 66 — FSec 2016

  67. This talk is not an endorsement to roll everything yourself. 67 — FSec 2016

  68. THANK YOU LUKA KLADARIC // L@K.HR // @KLL 68 — FSec 2016

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

Network security Network security Foundations: what is security? cryptography Network Security Network Security authentication message integrity key distribution and certification Security in practice: Srinidhi Varadarajan

332 views • 6 slides
Security Security as term, Possible Security violations Authentication Criteria for

Security Security as term, Possible Security violations Authentication Criteria for

BS1 WS19/20 topic-based slides Security Security as term, Possible Security violations Authentication Criteria for Trust in Computer Systems Three hearts of Windows Security DACLs A Look at Security System is secure if

988 views • 20 slides
CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC 410 / 611 : Operating Systems CPSC410/611: Security Security Security Attacks Security Threats Crypto Authentication Examples SSL Security Threats Breach of confidentiality unauthorized access to

458 views • 18 slides
Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security WS 06/07 Seminar Prof. Dr.-Ing. Jana Dittmann & Dr.-Ing. Claus Vielhauer with support from Tobias Scheidat

419 views • 16 slides
1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

Course Overview Course Requirements EECS 498-7/8 Cryptography and Network Security: www.citi.umich.edu/u/honey/security Principles and Practice (Third Edition) Computer Security Monday & Friday, 9:00 10:30 William Stallings

670 views • 19 slides
A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security Introducing Spring Security View layer security Whats coming in Spring Security 3 E-mail: craig@habuma.com Blog: http://www.springloaded.info

452 views • 19 slides
Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice:

634 views • 36 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CSCE Intro to Computer Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies Security

472 views • 20 slides
SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS Few Security Breaches Date: 2013-14 September 2016, while in negotiations to

404 views • 18 slides
Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in distributed systems arises from the desire to share resources Resources must be protected against unauthorized access, as enemies (attackers)

1.16k views • 67 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CPSC 410/611 Operating Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies

419 views • 19 slides
International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International Security What is security? Freedom from threats to core values? Contestation over referent object: Individual? State? System? How is security achieved?

715 views • 11 slides
Security 101 Definition of Information Security Information security is the protection of

Security 101 Definition of Information Security Information security is the protection of

Computing Services Information Security Office Security 101 Definition of Information Security Information security is the protection of information and systems from unauthorized access, disclosure, modification, destruction or disruption. The

469 views • 22 slides
Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety Sensitive Information Not for public or media release F.S. 119.071. Required by law, rule and regulation: Homeland Security Directive 5 and 8.

393 views • 11 slides
Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the computing world, and are parallel to even older problems outside computing Required level of security is always related to what you protect

237 views • 23 slides
Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

ITS335 Intro. to Security Concepts Threats, Attacks, Assets Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 2

965 views • 34 slides
Connectivity Corollary. GRAPH CONNECTIVITY is not FO definable Connectivity Corollary. GRAPH

Connectivity Corollary. GRAPH CONNECTIVITY is not FO definable Connectivity Corollary. GRAPH

Connectivity Corollary. GRAPH CONNECTIVITY is not FO definable Connectivity Corollary. GRAPH CONNECTIVITY is not FO definable If A is a linear order of size n, let G( A ) be the graph with edges { i, i+2 mod n } for all a A Connectivity

905 views • 55 slides
Infinite and Finite Model Theory Part II Anuj Dawar Computer Laboratory University of Cambridge

Infinite and Finite Model Theory Part II Anuj Dawar Computer Laboratory University of Cambridge

Infinite and Finite Model Theory Part II Anuj Dawar Computer Laboratory University of Cambridge Lent 2002 3/2002 0 Finite Model Theory Finite Model Theory motivated by computational issues; relationship between language and

693 views • 67 slides
Counterterrorism/ Counterinsurgency Class 8 - August 27 How can governments stop insurgents or

Counterterrorism/ Counterinsurgency Class 8 - August 27 How can governments stop insurgents or

Counterterrorism/ Counterinsurgency Class 8 - August 27 How can governments stop insurgents or terrorists? How can governments stop insurgents or terrorists? Use force Punitive military tactics Repression Police measures

564 views • 31 slides
Exam Q&A I&E Basics/IBICT 2019 December 18th 2019 IBICT Attending 15 marks

Exam Q&A I&E Basics/IBICT 2019 December 18th 2019 IBICT Attending 15 marks

Exam Q&A I&E Basics/IBICT 2019 December 18th 2019 IBICT Attending 15 marks Battle report (group essay of ~12 pages) Deliver by beginning of January 3 marks Battle class performance (+1 for winner) 15 marks

391 views • 9 slides
Absorber Introduction & Overview Jim Hylen LBNE Hadron Absorber Core Advanced Conceptual

Absorber Introduction & Overview Jim Hylen LBNE Hadron Absorber Core Advanced Conceptual

Absorber Introduction & Overview Jim Hylen LBNE Hadron Absorber Core Advanced Conceptual Design Review 20 January 2015 Outline Summary of Requirements Brief description of absorber design Details of radiation & energy

1.99k views • 51 slides
Bounding Data Races in Space and Time KC Sivaramakrishnan University of Darwin College, 1851

Bounding Data Races in Space and Time KC Sivaramakrishnan University of Darwin College, 1851

Bounding Data Races in Space and Time KC Sivaramakrishnan University of Darwin College, 1851 Royal OCaml Labs Cambridge Cambridge Commission 1 Multicore OCaml 2 Multicore OCaml OCaml is an industrial-strength, functional

1.2k views • 99 slides
Exploiting Microarchitectural Flaws in the Heart of the Memory Subsystem Daniel Moghimi,

Exploiting Microarchitectural Flaws in the Heart of the Memory Subsystem Daniel Moghimi,

Exploiting Microarchitectural Flaws in the Heart of the Memory Subsystem Daniel Moghimi, Worcester Polytechnic University Feb 20, 2020 Columbia University Spoiler!! 2 CPU Memory Subsystem Allocation Queue Front End CPU Memory Subsystem

1.59k views • 127 slides
172 Plan 1. Space Complexity in Resolution 2. Space lower bounds for Random Formulas 3.

172 Plan 1. Space Complexity in Resolution 2. Space lower bounds for Random Formulas 3.

172 Plan 1. Space Complexity in Resolution 2. Space lower bounds for Random Formulas 3. Combinatorial Characterization of width 4. Width vs Space 5. Feasible Interpolation for Resolution and size lower bounds 6. Proof Search,

1.52k views • 83 slides

More recommend