Module X - Importance of Security

Why Security Matters
in Development
Security starts with development
and architecture
Module Agenda
• Why security matters in development
• Attack vectors most targeted
• SQLi
• Insecure Data Storage
• XSS
• Logic Errors
• Server vs client-side vulnerabilities
• Case studies
Why Security Matters in
Development
• Developers are on the front lines of security
• The choices they make regarding application
architecture, frameworks, etc. underpin the
security of the application as a whole
• Insecure architectural choices are extremely
difficult (and costly) to resolve once an application
goes to production
• An architectural change may impact many
components of the application
Common Attack Vectors
• Although there are numerous attack vectors, many
are typically favored due to ease of discoverability,
frequency of exposure, and exploit reliability:
• SQL Injection (SQLi)
• XSS (Cross Site Scripting)
• Insecure Data Storage
• Logic Errors
• We'll examine each of these in this section
Common Themes
• Two common themes will emerge in our discussion of
the most prolific vulnerabilities:
• Trusting user input without sanitizing it
• Failure to threat model
• Unsanitized user input is much easier to test for using
automated frameworks
• Failure to threat model usually involves:
• "Nobody will be clever enough to notice this"
• An assumption that end users will only use the application
through the intended workflow
SQL Injection (SQLi)
• SQLi is a vulnerability that allows attackers to change
the logic of SQL queries in applications
• This is usually used to obtain data not intended by
the developer, but may also be used to obtain shell
access on the hosting server
• Through UNION statements, data may be obtained
from tables other than those being queried by the
logic of the application
SQL Injection (2)
• Blind SQL injection allows attackers to obtain the
results of a manipulated SQL query even when those
results are not displayed to the end user though
Boolean logic
• Is the first letter of the field > ASCII value 0x40?
• Is the first letter of the field < ASCII value 0x60?
• …
• 2nd order SQLi occurs when attackers insert data into
the database that is later treated as trusted input,
triggering a SQL injection
Insecure Data Storage
• Because HTTP is stateless, data must be stored
between requests
• Data can either be stored server side or returned to
the client for temporary storage
• Data passed back to the client must:
• Not be sensitive
• Be treated as untrusted when returned
• Users can (and do) modify data elements on the
client side, resulting in potential injection issues
Insecure Data Storage (2)
• Sensitive data is seen stored in:
• Hidden form fields
• URL parameters
• Cookies
• Browser Web Storage
• HTML comments (yes, seriously)
• Consider whether data is better stored server-side
or whether users need it at all
• Storing server-side may require additional database
retrieval calls
Cross Site Scripting (XSS)
• Rather than attacking the server, XSS attacks the
browser, allowing the execution of arbitrary
JavaScript
• Some think of XSS as just used to perform cookie
stealing, but as we'll examine later, it can be used
for so much more
• Developers should be aware that XSS attacks can
rewrite any DOM components, potentially leading
to reputational loss
Cross Site Scripting (2)
• In 2014, a Twitter account showcased many XSS
vulnerabilities by injecting images of kittens into
vulnerable websites
• Before being shut down by for ToS violations…
• Many website owners failed to realize the images
could have been of anything, leading to serious
reputational loss
• Imagine a competitor sending links to your site appearing
to host illicit images through the use of XSS vulns
Cross Site Scripting (3)
• Zeus and other so-called banking trojans operate by
injecting HTML and JavaScript into banking websites
directly in the browser
• Typically these "web injects" are simply forms that ask
users for additional sensitive information, such as SSN,
DOB, etc.
• Everything these trojans inject to steal client data
can be accomplished with XSS
• The damage to end-users is probably worse considering
the much larger impacted population
Logic Errors
• Logic errors are simply conditions that evaluate the
website logic in ways other than intended by the
developer
• Because discovering logic errors requires
understanding the intended flow of the application,
these are rarely discovered by automated scanners
• Good news: attackers must also study the intended
application flow to find these vulns
Logic Errors (2)
• Logic errors often occur in state transitions
• For instance, assume the dev intends:
• A -> B -> C -> D -> E
• But the attacker performs the following:
• A -> C -> E
• What impact does that have on the integrity of
transactions?
• Did B and D set critical state variables?
Server vs. Client Vulnerabilities
• Many developers focus mostly
on server-side vulnerabilities, often
to the neglect of client-side vulns
• While client side vulns typically only compromise a single

user at a time (rather than the application) the impact of
client side vulns is often higher
• Consider a SQL injection in a database that stores no
sensitive data vs. an XSS vuln that allows for the theft of
authenticated sessions
Case Study #1: XSS
• In a recent The firm penetration test, an XSS
vulnerability was discovered
• This allowed crafted links that changed the login

form submit action to send usernames and
passwords to an attacker-controlled server
• The impacts of a flaw like this in any regulated data

application are obvious
Case Study #2: Sensitive Data Storage
• The firm discovered that an e-commerce site was
tracking discounts applied to some items in a hidden
form field
• Developers later confirmed this was due to the

difficulty of franchisees being able to set custom
discount codes
• By manipulating the field, attackers could purchase

most items for an arbitrarily low value
• The minimum credit card authorization amount
Questions?
Any questions?

Module X - Importance of Security

Uploaded by

Copyright:

Available Formats

Module X - Importance of Security

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Module X - Importance of Security

Uploaded by

Copyright:

Available Formats

Why Security Matters

• While client side vulns typically only compromise a single

• This allowed crafted links that changed the login

• The impacts of a flaw like this in any regulated data

• Developers later confirmed this was due to the

• By manipulating the field, attackers could purchase

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.