security missconcepts
play

Security #MiSSConcepts Ammarit Thongthua, CISSP CISM # Who am I - PowerPoint PPT Presentation

Dec 16, 2022 •164 likes •750 views

Security #MiSSConcepts Ammarit Thongthua, CISSP CISM # Who am I

  1. Security #MiSSConcepts Ammarit Thongthua, CISSP CISM

  2. # Who am I �������������������������������� �������������������������������� �������������������������������� �������������������������������� ������������������ ������������������ ������������������� �������������������

  3. Security #MiSSConcepts

  4. Security #MiSSConcepts use use use use understand understand take take

  5. Security protection we Security protection we #Expected #Expected

  6. Security protection we get in #Reality

  7. Security by Obscurity Security by Obscurity Security by Obscurity Security by Obscurity

  8. Security by Obscurity Obscurity = make nobody know or make it hard to see � Example: - Path hiding - Path hiding - Hidden field - Hidden/Remove object - Change service port number - Referrer, HTTP special Header

  9. Security by Obscurity Path hiding Path hiding https://www.somewebsite.com/page/admin/login.aspx admin/login.aspx

  10. Security by Obscurity Path hiding Path hiding https://www.somewebsite.com/abc/123/admin.php /abc/123/admin.php

  11. Security by Obscurity Path hiding Path hiding

  12. Security by Obscurity Path hiding Path hiding - -Temp File, Back Up Temp File, Back Up

  13. Security by Obscurity Dirbuster Dirbuster

  14. Security by Obscurity Dirbuster Dirbuster � Prepare path dictionary � Basic : /admin , /test, /abc, /xyz � Well known : /administrator /manager, /wp-admin, /console � � Advance : /admin-path, / � Temp File, Back Up � Path + .zip , .rar , .bak � Ex; /admin � http://testsite.com/admin.zip � http://testsite.com/admin.rar � http://testsite.com/admin.bak

  15. Security by Obscurity Hidden filed Hidden filed

  16. Security by Obscurity Hidden filed Hidden filed

  17. Security by Obscurity Hidden filed Hidden filed

  18. Security by Obscurity Hidden filed Hidden filed

  19. Security by Obscurity Disabled Disabled

  20. Security by Obscurity Hidden/Remove object Hidden/Remove object

  21. Security by Obscurity Hidden/Remove object Hidden/Remove object

  22. Security by Obscurity Hidden/Remove object Hidden/Remove object

  23. Security by Obscurity Change service port number Change service port number

  24. Security by Obscurity Change service port number Change service port number

  25. Security by Obscurity HTTP Referrer HTTP Referrer

  26. Security by Obscurity HTTP special Header HTTP special Header

  27. Security by Obscurity HTTP special Header HTTP special Header ���������������� ��������������� ��������������������� ���������������� ���������

  28. Security by Obscurity HTTP special Header HTTP special Header

  29. Security by Obscurity HTTP special Header Example HTTP special Header Example Header name What it means x-forwarded-for x-forwarded-for Originating IP of a client connection to the server Originating IP of a client connection to the server x-forwarded-host Origination host name x-forwarded-server Originating server name x-wap-profile A reference to the user-agent profile as specified. x-imsi The imsi number. Identifies the end user. x-msisdn The end users phone number Ref: https://mobiforge.com/design-development/useful-x-headers

  30. Encode = Encrypt ? Encode = Encrypt ? Encode = Encrypt ? Encode = Encrypt ?

  31. Encode != Encrypt � BASE 64 password in database

  32. Encode != Encrypt � BASE 64 password Cookie

  33. Encode != Encrypt

  34. Encode != Encrypt � BASE 64 decode by zap proxy

  35. ���� ������������������ �������������� ������������������ !� ������������������ !� ������������������ !� ������������������ !� !�������"���# !�������"���# $%�&����'���( $%�&����'���(

  36. Weak hashing algorithm � Example � Shift-bit + Add letter GD + Fake Pad (==) � Shift-bit + Add letter GD + Fake Pad (==) � Password = QGDbGDtGDtGDxGDpGDsGDe== � Remove GD => Qbttxpse � Shift back => Password

  37. Encrypted password ? Encrypted password ? Encrypted password ? Encrypted password ?

  38. Encrypted Password ? Config file password A03aBe/q54f== Attacker Database Web Server

  39. Password hashing ? Password hashing ? Password hashing ? Password hashing ?

  40. Weak hashing algorithm

  41. Weak hashing algorithm

  42. Encrypt data with secure Encrypt data with secure algorithm is OK. algorithm is OK. No more need to concern

  43. Encryption More things to concern for the encryption - Implementation - Implementation - Key length (bits) - Mode (ECB, CBC, OFB, CFB)

  45. ECB mode weakness in real case ? ECB mode weakness in real case ?

  46. ECB block shuffler �������������������� ������������������������������� ����� � !� ����� ����������!��"����"� #�����#�$�#�$����#���� ��� ����� � !� ����� ����������!��"����"� #�����#�$�#�$����#���� ��� ����������������#####����������� ����� � !� ����� ����������!��"���"##!!$��"���"��� "������!��#�� �������������########����������� ��� #!������!#�$��"�� ���$� " ����"##!!$��"���"��� "������!��#��

  47. ECB block shuffler �������������������� ��������������������� ����� � !� ����� ����������!��"����"� #�����#�$�#�$����#���� ��� ����������������##### ����������������##### ����� � !� ����� ����������!��"���"##!!$��"���"��� "������!��#�� �������������######## ��� #!������!#�$��"�� ���$� " ����"##!!$��"���"��� "������!��#�� �������������###������������%� ��� #!������!#�$��"�� ���$� " �����"� #�����#�$�#�$����#���� ���

  48. ECB block shuffler �������������###������������%� https://fitnessxx.com/cutomer.php? https://fitnessxx.com/cutomer.php? data= ��� #!������!#�$��"�� ���$� " �����"� #�����#�$�#�$����#���� ���

  49. ECB block shuffler

  50. Is encrypted data secured Is encrypted data secured when secure algorithm and when secure algorithm and Mode?

  51. Yes, But Yes, But

  52. Replay Attack

  53. Replay Attack

  54. Other Security #MiSSConcepts Authentication Check at on load 
 - Tamper Data and reject 
 Cookie Expired date is work - Cookie Editor - Cookie Editor Protection by WAF is sufficient 
 - Evasion (Ex; admin';--) - Unsupported SSL cipher suite - Pollution technique 
 - WAFW00F 
 Input validate HTTPS is sufficient

  56. Other Security #MiSSConcepts No vulnerability found in VA/Pentest = Secured

  57. Conclusion � Secure by design � Put the right solutions to the right jobs � Put the right solutions to the right jobs � Security Source code review � Perform regular vulnerability assessment / penetration test

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

What is network security? Friends and enemies: Alice, Bob, Trudy What is network security?

Network security Network security Foundations: what is security? cryptography Network Security Network Security authentication message integrity key distribution and certification Security in practice: Srinidhi Varadarajan

332 views • 6 slides
Security Security as term, Possible Security violations Authentication Criteria for

Security Security as term, Possible Security violations Authentication Criteria for

BS1 WS19/20 topic-based slides Security Security as term, Possible Security violations Authentication Criteria for Trust in Computer Systems Three hearts of Windows Security DACLs A Look at Security System is secure if

988 views • 20 slides
CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC410/611: Security Security Security Attacks Security Threats Crypto

CPSC 410 / 611 : Operating Systems CPSC410/611: Security Security Security Attacks Security Threats Crypto Authentication Examples SSL Security Threats Breach of confidentiality unauthorized access to

458 views • 18 slides
Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security

Biometrics and Security Biometrics and Security Biometrics and Security Biometrics and Security WS 06/07 Seminar Prof. Dr.-Ing. Jana Dittmann & Dr.-Ing. Claus Vielhauer with support from Tobias Scheidat

419 views • 16 slides
1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

1 X.800 Security Services X.800 Security Services X.800 Security Services Data integrity

Course Overview Course Requirements EECS 498-7/8 Cryptography and Network Security: www.citi.umich.edu/u/honey/security Principles and Practice (Third Edition) Computer Security Monday & Friday, 9:00 10:30 William Stallings

670 views • 19 slides
A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security

A (re)introduction to Spring Security Agenda Before Spring Security: Acegi security Introducing Spring Security View layer security Whats coming in Spring Security 3 E-mail: craig@habuma.com Blog: http://www.springloaded.info

452 views • 19 slides
Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security

Network Security Network Security Srinidhi Varadarajan Network security Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice:

634 views • 36 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CSCE Intro to Computer Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies Security

472 views • 20 slides
SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY

SECURITY TESTING Towards a safer web world AGENDA 1. 3 WS OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS Few Security Breaches Date: 2013-14 September 2016, while in negotiations to

404 views • 18 slides
Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in distributed systems arises from the desire to share resources Resources must be protected against unauthorized access, as enemies (attackers)

1.16k views • 67 slides
International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International

International and Global Security 1 Peer Discussion What is security? 2 International Security What is security? Freedom from threats to core values? Contestation over referent object: Individual? State? System? How is security achieved?

715 views • 11 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CPSC 410/611 Operating Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies

419 views • 19 slides
Security 101 Definition of Information Security Information security is the protection of

Security 101 Definition of Information Security Information security is the protection of

Computing Services Information Security Office Security 101 Definition of Information Security Information security is the protection of information and systems from unauthorized access, disclosure, modification, destruction or disruption. The

469 views • 22 slides
Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety

Security Update Security Plans Our Security plans are For Official Use Only, Safety Sensitive Information Not for public or media release F.S. 119.071. Required by law, rule and regulation: Homeland Security Directive 5 and 8.

393 views • 11 slides
Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the

Com puter Security Part One Security as a subject Security is an old problem in the computing world, and are parallel to even older problems outside computing Required level of security is always related to what you protect

237 views • 23 slides
Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn

ITS335 Intro. to Security Concepts Threats, Attacks, Assets Introduction to Security Comm. Security Strategy Summary ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 2

965 views • 34 slides
USING SCL TO SIMPLIFY SYSLOG-NG CONFIGURATION Libre Software Meeting 2017 Peter Czanik / Balabit

USING SCL TO SIMPLIFY SYSLOG-NG CONFIGURATION Libre Software Meeting 2017 Peter Czanik / Balabit

USING SCL TO SIMPLIFY SYSLOG-NG CONFIGURATION Libre Software Meeting 2017 Peter Czanik / Balabit SCL syslog-ng configuration library Reusable configuration blocks Hide away complexity of configuration 2 apache-accesslog-parser()

341 views • 7 slides
Drupal and Logstash: centralised logging Marji Cermak Marji Cermak Systems Engineer at Morpht

Drupal and Logstash: centralised logging Marji Cermak Marji Cermak Systems Engineer at Morpht

Drupal and Logstash: centralised logging Marji Cermak Marji Cermak Systems Engineer at Morpht @cermakm The BELK stack Marji Cermak @cermakm To get you an idea Customer says they get randomly redirected while browsing their website

1k views • 81 slides
dra$-ie(-cdni-logging Open Discussion Non-Real-Time vs

dra$-ie(-cdni-logging Open Discussion Non-Real-Time vs

dra$-ie(-cdni-logging Open Discussion Non-Real-Time vs Real-Time Observa:ons: Different understanding of what real-:me means

453 views • 12 slides
RHIP COUNCIL No November 17, 17, 2020 2020 Meeting Objectives Det eter ermine n e next

RHIP COUNCIL No November 17, 17, 2020 2020 Meeting Objectives Det eter ermine n e next

RHIP COUNCIL No November 17, 17, 2020 2020 Meeting Objectives Det eter ermine n e next s steps eps f for r equ equity wo work rk He Hear ar key ey upd pdates es r rel elated t to He Heal althConnect an and Trueblo

791 views • 47 slides
Survival analysis techniques for studying cybercrime Tyler Moore Computer Science &

Survival analysis techniques for studying cybercrime Tyler Moore Computer Science &

Notes Survival analysis techniques for studying cybercrime Tyler Moore Computer Science & Engineering Department, SMU, Dallas, TX November 1, 2012 Case-control studies for analyzing data Survival analysis Notes Outline Case-control

401 views • 6 slides
CS261N: Internet/Network Security Surveillance Who am I? Computer Science PhD Candidate at UC

CS261N: Internet/Network Security Surveillance Who am I? Computer Science PhD Candidate at UC

CS261N: Internet/Network Security Surveillance Who am I? Computer Science PhD Candidate at UC Berkeley Co-Founder of Bahrain Watch Senior Researcher at Citizen Lab Value Description 0 Not targeted , e.g. spam or financially motivated

1.06k views • 38 slides
Web Search UiO - 2014-04-27 Torgeir Hovden @thovden torgeir@mozilla.com About @thovden

Web Search UiO - 2014-04-27 Torgeir Hovden @thovden torgeir@mozilla.com About @thovden

Web Search UiO - 2014-04-27 Torgeir Hovden @thovden torgeir@mozilla.com About @thovden torgeir@eritreum.com torgeir@mozilla.com Static Rank Machine Learning Supervised What is the best URL for a Query Q? Source : Cornell Eye Tracking

739 views • 37 slides
Exploring Subjective Perceptions of Burden Robin Kaplan and Jessica Holzberg Office of Survey

Exploring Subjective Perceptions of Burden Robin Kaplan and Jessica Holzberg Office of Survey

What Does it Mean to be Burdened?: Exploring Subjective Perceptions of Burden Robin Kaplan and Jessica Holzberg Office of Survey Methods Research U.S. Bureau of Labor Statistics DC-AAPOR Workshop - 10/21/19 Disclaimer: This presentation is

507 views • 40 slides

More recommend