WHY Capital One Date : March 22 and 23, 2019 Number of - - PowerPoint PPT Presentation

▶
why
SMART_READER_LITE
LIVE PREVIEW

WHY Capital One Date : March 22 and 23, 2019 Number of - - PowerPoint PPT Presentation

Aug 30, 2023 201 likes •1.05k views

WHY Capital One Date : March 22 and 23, 2019 Number of records breached : 106 million Information exposed : Names, addresses, ZIP codes, phone numbers, email addresses, birthdates and self-reported income. Customer credit

slide-1
SLIDE 1
slide-2
SLIDE 2
slide-3
SLIDE 3
slide-4
SLIDE 4

WHY

slide-5
SLIDE 5

Capital One

Date: March 22 and 23, 2019 Number of records breached: 106 million Information exposed: Names, addresses, ZIP codes, phone numbers, email addresses, birthdates and self-reported income. Customer credit scores, credit limits, balances, payment history, and contact information.

American Medical Collection Agency

Date: August 1, 2018, to March 30, 2019 Number of records breached: More than 20 million Information exposed: Social Security numbers, dates of birth, payment card data, and credit card information.

Evite

Date: February 22, 2019 Number of records breached: 100 million Information exposed: Names, email addresses, passwords, and IP addresses of Evite customers. src: https://us.norton.com/internetsecurity-emerging-threats-2019-data-breaches.html
slide-6
SLIDE 6 confidential
slide-7
SLIDE 7

HOW

slide-8
SLIDE 8 src: https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf
slide-9
SLIDE 9 Src: https://owasp.org/www-staff/operating-plan/2020.html
slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12 14 Confidential
slide-13
SLIDE 13
slide-14
SLIDE 14
slide-15
SLIDE 15 src: https://www.hackerone.com/top-10-vulnerabilities
slide-16
SLIDE 16 src: https://www.hackerone.com/top-10-vulnerabilities
slide-17
SLIDE 17
slide-18
SLIDE 18
slide-19
SLIDE 19
slide-20
SLIDE 20
slide-21
SLIDE 21
slide-22
SLIDE 22

WHAT

slide-23
SLIDE 23
slide-24
SLIDE 24
slide-25
SLIDE 25

CNA NAME Base ased (C (Company Le Level)

yourcompanydomain.biz yourcompanyblog.biz

slide-26
SLIDE 26

yourcompanydomain.biz yourcompanyblog.biz

blog.yourcompanydomain.biz blog.yourcompanydomain.biz. 3600 IN CNAME yourcompanyblog.biz.

CNA NAME Base ased (C (Company Le Level)

slide-27
SLIDE 27

yourcompanydomain.biz yourcompanyblog.biz

blog.yourcompanydomain.biz blog.yourcompanydomain.biz. 3600 IN CNAME yourcompanyblog.biz.

CNA NAME Base ased (C (Company Le Level)

slide-28
SLIDE 28
slide-29
SLIDE 29

yourcompanydomain.biz yourcompanyblog.biz

blog.yourcompanydomain.biz blog.yourcompanydomain.biz. 3600 IN CNAME yourcompanyblog.biz.

yourcompanyblog.biz

CNA NAME Base ased (C (Company Le Level)

slide-30
SLIDE 30

yourcompanydomain.biz yourcompanyblog.biz

blog.yourcompanydomain.biz blog.yourcompanydomain.biz. 3600 IN CNAME yourcompanyblog.biz.

blog.yourcompanydomain.biz

CNA NAME Base ased (C (Company Le Level)

slide-31
SLIDE 31

yourcompanydomain.biz

  • pensource.github.io
  • pensource.yourcompanydomain.biz
  • pensource.yourcompanydomain.biz. 3600 IN CNAME opensource.github.io.

CNA NAME Base ased (D (Dev Le Level) l)

slide-32
SLIDE 32

yourcompanydomain.biz

  • pensource.github.io
  • pensource.yourcompanydomain.biz

CNA NAME Base ased (D (Dev Le Level) l)

  • pensource.yourcompanydomain.biz. 3600 IN CNAME opensource.github.io.
slide-33
SLIDE 33
slide-34
SLIDE 34

yourcompanydomain.biz

  • pensource.github.io
  • pensource.yourcompanydomain.biz
  • pensource.github.io

CNA NAME Base ased (D (Dev Le Level) l)

  • pensource.yourcompanydomain.biz. 3600 IN CNAME opensource.github.io.
slide-35
SLIDE 35

yourcompanydomain.biz

  • pensource.github.io
  • pensource.yourcompanydomain.biz
  • pensource.yourcompanydomain.biz

CNA NAME Base ased (D (Dev Le Level) l)

  • pensource.yourcompanydomain.biz. 3600 IN CNAME opensource.github.io.
slide-36
SLIDE 36

Si Simila ilar Behaviour Wit ith

  • Amazon S3
  • Her

Heroku

  • Sho

Shopify fy

  • Mic

icrosoft Azur ure

  • St

Statuspage

  • Tumblr

lr

  • Wor
  • rdpress

ss

  • And mor
  • re…
Src: https://github.com/EdOverflow/can-i-take-over-xyz
slide-37
SLIDE 37

Be aware that this als lso works wit ith NS and MX DNS entries

slide-38
SLIDE 38
slide-39
SLIDE 39

Paid Service

slide-40
SLIDE 40
slide-41
SLIDE 41

Self lf-Serv rvice

slide-42
SLIDE 42
slide-43
SLIDE 43
slide-44
SLIDE 44
slide-45
SLIDE 45

GCP AZURE AWS PORT 80,443 ALLOWED

slide-46
SLIDE 46

GCP AZURE AWS PORT 80,443 ALLOWED

slide-47
SLIDE 47

GCP AZURE AWS SSRF PORT 80,443 ALLOWED

slide-48
SLIDE 48

Examples: : AWS

http://169.254.169.254/latest/user-data http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME] http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME] http://169.254.169.254/latest/meta-data/ami-id http://169.254.169.254/latest/meta-data/reservation-id http://169.254.169.254/latest/meta-data/hostname http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key http://169.254.169.254/latest/meta-data/public-keys/[ID]/openssh-key

GCP

Requires the header "Metadata-Flavor: Google" or "X-Google-Metadata- Request: True" http://169.254.169.254/computeMetadata/v1/ http://metadata.google.internal/computeMetadata/v1/ http://metadata/computeMetadata/v1/ http://metadata.google.internal/computeMetadata/v1/instance/hostname http://metadata.google.internal/computeMetadata/v1/instance/id http://metadata.google.internal/computeMetadata/v1/project/project-id

Digital Ocean

http://169.254.169.254/metadata/v1.json http://169.254.169.254/metadata/v1/ http://169.254.169.254/metadata/v1/id http://169.254.169.254/metadata/v1/user-data http://169.254.169.254/metadata/v1/hostname http://169.254.169.254/metadata/v1/region http://169.254.169.254/metadata/v1/interfaces/public/0/ipv6/address

Oracle Cloud

http://192.0.0.192/latest/ http://192.0.0.192/latest/user-data/ http://192.0.0.192/latest/meta-data/ http://192.0.0.192/latest/attributes/ Src: https://gist.github.com/jhaddix/78cece26c91c6263653f31ba453e273b

Ex Examples:

slide-49
SLIDE 49

Demo

slide-50
SLIDE 50
slide-51
SLIDE 51
slide-52
SLIDE 52

GCP AZURE AWS SSRF PORT 80,443 ALLOWED

Whiteli list IP IP Ra Ranges s / / DN DNS Na Names

e.g. 192.168.0.1/24 range

slide-53
SLIDE 53

GCP AZURE AWS SSRF PORT 80,443 ALLOWED

Use se Authentic ication Als lso for In Internal l Se Services

slide-54
SLIDE 54

GCP AZURE AWS SSRF PORT 80,443 ALLOWED

Di Disable le Unnecessary URL Sc Schemes

file: file:// dict dict:// ftp ftp:/ :// go gophe pher://

slide-55
SLIDE 55

GCP AZURE AWS SSRF PORT 80,443 ALLOWED

Mon

  • nitor Response Se

Sent Bac ack to

  • th

the Use ser

slide-56
SLIDE 56
slide-57
SLIDE 57

HTTP Requests Proxy / LB

Backend Server 1 Backend Server 2 Backend Server 3 User 1 User 2

1 1 1 1 2 2 2

slide-58
SLIDE 58

HTTP Requests

User 1 User 2

POST /sec4devBenign HTTP/1.1 Host: sec4dev.io Content-Length: 19 testparam=testvalue

slide-59
SLIDE 59

HTTP Requests

User 1 User 2

POST /sec4devBenign HTTP/1.1 Host: sec4dev.io Transfer-Encoding: chunked 13 testparam=testvalue

slide-60
SLIDE 60

HTTP Requests

User 1 User 2

POST /sec4devDesync HTTP/1.1 Host: sec4dev.io Content-Length: 17 Transfer-Encoding: chunked SEC4DEVROCKS

slide-61
SLIDE 61

HTTP Requests Proxy / LB

Backend Server 1 Backend Server 2 Backend Server 3 User 1 User 2

1 1 1 x 2 2 2 2 2 2 1 1 1 x

Coming from user 2 Coming from user 1

1 1 x2 2 2 x1 1

slide-62
SLIDE 62

Demo

slide-63
SLIDE 63
slide-64
SLIDE 64
slide-65
SLIDE 65

HTTP Requests Proxy / LB

Backend Server 1 Backend Server 2 Backend Server 3 User 1 User 2

1 2

Use se Se Separate Ne Network Con

  • nnections For Eac

ach Request

slide-66
SLIDE 66

HTTP Requests

User 1 User 2

POST /sec4devBenign HT HTTP/2 Host: sec4dev.io Content-Length: 19 testparam=testvalue

Use se HTTP/2 For

  • r Bac

ackend Con

  • nnections
slide-67
SLIDE 67

HTTP Requests Proxy / LB

Backend Server 1 Backend Server 2 Backend Server 3 User 1 User 2

1 1 1 1 2 2 2

Use se Exact Sa Same So Software for Fr Frontend / / Bac ackend

slide-68
SLIDE 68
slide-69
SLIDE 69 confidential
slide-70
SLIDE 70
slide-71
SLIDE 71

Build Awareness Enable Employees

slide-72
SLIDE 72

Use Secrets Vault / Manager

slide-73
SLIDE 73
slide-74
SLIDE 74
slide-75
SLIDE 75

pre-commit hooks

slide-76
SLIDE 76
slide-77
SLIDE 77

Git ithub Token Scanning Service

slide-78
SLIDE 78
slide-79
SLIDE 79
slide-80
SLIDE 80
slide-81
SLIDE 81
slide-82
SLIDE 82
slide-83
SLIDE 83
slide-84
SLIDE 84