Segurana em APIs REST Heitor Vital reas de Atuao o Cloud - - PowerPoint PPT Presentation

▶
seguran a em apis rest heitor vital
SMART_READER_LITE
LIVE PREVIEW

Segurana em APIs REST Heitor Vital reas de Atuao o Cloud - - PowerPoint PPT Presentation

Jun 11, 2023 182 likes •412 views

Segurana em APIs REST Heitor Vital reas de Atuao o Cloud Computing twitter.com/heitorvital o Segurana Informao o Jogos slideshare.net/HeitorVital o Dispositivos Mveis o labs.siteblindado.com

slide-1
SLIDE 1

Segurança em APIs REST

slide-2
SLIDE 2

Heitor Vital

  • Áreas de Atuação
  • Cloud Computing
  • Segurança Informação
  • Jogos
  • Dispositivos Móveis
  • …
  • Acadêmico
  • MBA FGV
  • Mestrado UFPE
  • Graduação UFPE

twitter.com/heitorvital slideshare.net/HeitorVital labs.siteblindado.com Kadu

sec@siteblindado.com.br

slide-3
SLIDE 3

More info: 2014 Global Report on the Cost of Cyber Crime

Stop Looking for the Silver Bullet: Start Thinking Like a Bad Guy

2014 Global Report on the Cost of Cyber Crime

257 Empresas 2.081 Entrevistas 1.717 Incidentes $7.6M Média prejuízo 10.4% Crescimento Incidentes

slide-4
SLIDE 4
slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7

Fonte: http://cloudtweaks.com/2013/10/cloud-infographic-2013-cyber-security-intelligence-index/

slide-8
SLIDE 8

Attack Vector by Organizational Size

TOPs

  • 1. Web-based attacks
  • 2. Denial of services
  • 3. Malicious insiders
slide-9
SLIDE 9

Site vs Plataforma

slide-10
SLIDE 10

Let’s [try to] attack ...

slide-11
SLIDE 11

Search Surface Detection

  • Metadata/Doc
  • Swagger
  • RAML
  • API-Blueprint
  • I/O Docs
  • Discovery
  • Brute Force
  • Invalid data

Exemplo: http://petstore.swagger.io/#!/pet/updatePet

(type, size, length, null, HTTP header, XML bomb, upload file...)

slide-12
SLIDE 12

Protocolo - HTTP

slide-13
SLIDE 13

Protocolo - HTTPS

https://example.com/controller/<id>/action?apiKey=a53f435643de32

Resolve ??

slide-14
SLIDE 14

Authentication/Authorization

API Keys

Abstract OAuth 2.0 flow

slide-15
SLIDE 15

Assessments

slide-16
SLIDE 16

Injection

Normal

http://petstore.com/api/v1/pet/123 “SELECT ¡* ¡FROM ¡pets ¡WHERE ¡petID='” ¡+ ¡petId ¡+”‘”; ¡ “SELECT ¡* ¡FROM ¡pets ¡WHERE ¡petID ¡= ¡‘123’” ¡

Injection

http://petstore.com/api/v1/pet/’%20or%20’1’=’1 ¡ “SELECT ¡* ¡FROM ¡pets ¡WHERE ¡petID='” ¡+ ¡petId ¡+”‘”; ¡ SELECT ¡* ¡FROM ¡pets ¡WHERE ¡petID ¡= ¡‘’ ¡or ¡‘1’ ¡= ¡‘1’

slide-17
SLIDE 17

XSS (cross site scripting)

Solução Header response com

  • Content-type: application/json
  • x-content-type-options: nosniff

Referencias: http://www.w2spconf.com/2013/papers/s3p1.pdf http://stackoverflow.com/questions/3146324/is-it-possible-to-xss-exploit-json-responses-with-proper-javascript-string-escap http://security.stackexchange.com/questions/42093/xss-prevention-for-restful-services

slide-18
SLIDE 18

CSRF (cross site request forgery)

Referências: http://www.twobotechnologies.com/blog/2014/02/importance-of-state-in-oauth2.html e http://hasselba.ch/blog/?p=1854

Solução OAuth state

slide-19
SLIDE 19

DoS/DDoS

WAF

  • Package Analysis
  • IP Blacklist
  • Region Blacklist

API Gateway

  • Call quotas
  • Calendar Period
  • Rolling Window
  • Invalid Inputs
  • XML Schema
  • Blacklist Keywords
  • Blacklist patterns
  • Malformed messages
slide-20
SLIDE 20
slide-21
SLIDE 21

Plataforma Separation of Concerns

  • Authentication /

Authorization

  • Logging
  • Analytics
  • Audit
  • Rate Limit
  • Payload
  • Address Restrictions
  • Invalid Inputs
  • XML Schema
  • Blacklist Keywords
  • Blacklist patterns
  • Malformed messages
slide-22
SLIDE 22

Heitor Vital

OBRIGADO !!!

twitter.com/heitorvital slideshare.net/HeitorVital labs.siteblindado.com Kadu

sec@siteblindado.com.br