Security #MiSSConcepts Ammarit Thongthua, CISSP CISM # Who am I - - PowerPoint PPT Presentation

▶
security missconcepts
SMART_READER_LITE
LIVE PREVIEW

Security #MiSSConcepts Ammarit Thongthua, CISSP CISM # Who am I - - PowerPoint PPT Presentation

Dec 16, 2022 164 likes •753 views

Security #MiSSConcepts Ammarit Thongthua, CISSP CISM # Who am I

slide-1
SLIDE 1

Security #MiSSConcepts

Ammarit Thongthua, CISSP CISM

slide-2
SLIDE 2

# Who am I

slide-3
SLIDE 3

Security #MiSSConcepts

slide-4
SLIDE 4

Security #MiSSConcepts

use use use use understand understand take take

slide-5
SLIDE 5

#Expected

Security Security protection we protection we

#Expected

slide-6
SLIDE 6

#Reality

Security protection we get in

slide-7
SLIDE 7

Security by Obscurity Security by Obscurity Security by Obscurity Security by Obscurity

slide-8
SLIDE 8

Security by Obscurity

Obscurity = make nobody know or make it hard to see

Example:

  • Path hiding
  • Path hiding
  • Hidden field
  • Hidden/Remove object
  • Change service port number
  • Referrer, HTTP special Header
slide-9
SLIDE 9

Security by Obscurity

https://www.somewebsite.com/page/admin/login.aspx admin/login.aspx

Path hiding Path hiding

slide-10
SLIDE 10

Security by Obscurity

https://www.somewebsite.com/abc/123/admin.php /abc/123/admin.php

Path hiding Path hiding

slide-11
SLIDE 11

Security by Obscurity

Path hiding Path hiding

slide-12
SLIDE 12

Security by Obscurity

Path hiding Path hiding -

  • Temp File, Back Up

Temp File, Back Up

slide-13
SLIDE 13

Dirbuster Dirbuster

Security by Obscurity

slide-14
SLIDE 14

Prepare path dictionary

Basic : /admin , /test, /abc, /xyz Well known : /administrator /manager, /wp-admin, /console

  • Security by Obscurity

Dirbuster Dirbuster

Advance : /admin-path, /

Temp File, Back Up

Path + .zip , .rar , .bak Ex; /admin http://testsite.com/admin.zip http://testsite.com/admin.rar http://testsite.com/admin.bak

slide-15
SLIDE 15

Security by Obscurity

Hidden filed Hidden filed

slide-16
SLIDE 16

Security by Obscurity

Hidden filed Hidden filed

slide-17
SLIDE 17

Security by Obscurity

Hidden filed Hidden filed

slide-18
SLIDE 18

Security by Obscurity

Hidden filed Hidden filed

slide-19
SLIDE 19

Security by Obscurity

Disabled Disabled

slide-20
SLIDE 20

Security by Obscurity

Hidden/Remove object Hidden/Remove object

slide-21
SLIDE 21

Security by Obscurity

Hidden/Remove object Hidden/Remove object

slide-22
SLIDE 22

Security by Obscurity

Hidden/Remove object Hidden/Remove object

slide-23
SLIDE 23

Security by Obscurity

Change service port number Change service port number

slide-24
SLIDE 24

Security by Obscurity

Change service port number Change service port number

slide-25
SLIDE 25

Security by Obscurity

HTTP Referrer HTTP Referrer

slide-26
SLIDE 26

Security by Obscurity

HTTP special Header HTTP special Header

slide-27
SLIDE 27

Security by Obscurity

HTTP special Header HTTP special Header

slide-28
SLIDE 28

HTTP special Header HTTP special Header

Security by Obscurity

slide-29
SLIDE 29

Header name What it means

x-forwarded-for Originating IP of a client connection to the server

Security by Obscurity

HTTP special Header Example HTTP special Header Example

x-forwarded-for Originating IP of a client connection to the server x-forwarded-host Origination host name x-forwarded-server Originating server name x-wap-profile A reference to the user-agent profile as specified. x-imsi The imsi number. Identifies the end user. x-msisdn The end users phone number

Ref: https://mobiforge.com/design-development/useful-x-headers

slide-30
SLIDE 30

Encode = Encrypt ? Encode = Encrypt ? Encode = Encrypt ? Encode = Encrypt ?

slide-31
SLIDE 31

BASE 64 password in database

Encode != Encrypt

slide-32
SLIDE 32

BASE 64 password Cookie

Encode != Encrypt

slide-33
SLIDE 33

Encode != Encrypt

slide-34
SLIDE 34

BASE 64 decode by zap proxy

Encode != Encrypt

slide-35
SLIDE 35
  • !

! ! ! !"# !"# $%&'( $%&'(

slide-36
SLIDE 36

Example

Shift-bit + Add letter GD + Fake Pad (==)

Weak hashing algorithm

Shift-bit + Add letter GD + Fake Pad (==) Password = QGDbGDtGDtGDxGDpGDsGDe==

Remove GD => Qbttxpse Shift back => Password

slide-37
SLIDE 37

Encrypted password ? Encrypted password ? Encrypted password ? Encrypted password ?

slide-38
SLIDE 38

Encrypted Password ?

password A03aBe/q54f== Config file Database Web Server Attacker

slide-39
SLIDE 39

Password hashing ? Password hashing ? Password hashing ? Password hashing ?

slide-40
SLIDE 40

Weak hashing algorithm

slide-41
SLIDE 41

Weak hashing algorithm

slide-42
SLIDE 42

Encrypt data with secure algorithm is OK. Encrypt data with secure algorithm is OK. No more need to concern

slide-43
SLIDE 43

More things to concern for the encryption

  • Implementation

Encryption

  • Implementation
  • Key length (bits)
  • Mode (ECB, CBC, OFB, CFB)
slide-44
SLIDE 44
slide-45
SLIDE 45

ECB mode weakness in real case ? ECB mode weakness in real case ?

slide-46
SLIDE 46
  • ! !"" ##$#$#

ECB block shuffler

! !"" ##$#$# ##### ! !""##!!$"" "!# ######## #!!#$" $ " "##!!$"" "!#

slide-47
SLIDE 47
  • ! !"" ##$#$#

#####

ECB block shuffler

##### ! !""##!!$"" "!# ######## #!!#$" $ " "##!!$"" "!# ###% #!!#$" $ " " ##$#$#

slide-48
SLIDE 48

https://fitnessxx.com/cutomer.php?

ECB block shuffler

###%

https://fitnessxx.com/cutomer.php? data= #!!#$" $ " " ##$#$#

slide-49
SLIDE 49

ECB block shuffler

slide-50
SLIDE 50

Is encrypted data secured when secure algorithm and Is encrypted data secured when secure algorithm and Mode?

slide-51
SLIDE 51

Yes, But Yes, But

slide-52
SLIDE 52

Replay Attack

slide-53
SLIDE 53

Replay Attack

slide-54
SLIDE 54

Authentication Check at on load 


  • Tamper Data and reject


Cookie Expired date is work

  • Cookie Editor

Other Security #MiSSConcepts

  • Cookie Editor

Protection by WAF is sufficient


  • Evasion (Ex; admin';--)
  • Unsupported SSL cipher suite
  • Pollution technique

  • WAFW00F
Input validate

HTTPS is sufficient

slide-55
SLIDE 55
slide-56
SLIDE 56

Other Security #MiSSConcepts No vulnerability found in VA/Pentest = Secured

slide-57
SLIDE 57

Secure by design Put the right solutions to the right jobs

Conclusion

Put the right solutions to the right jobs Security Source code review Perform regular vulnerability assessment /

penetration test

slide-58
SLIDE 58