SOFTWARE SECURITY

CH 6 InfoSec Handbook

Now More Technical Stuff …

• We’ve covered a number of Info Security foundational buzzwords, principles, frameworks

​

• Moving forward, we will diver deeper in the technical aspects of those items

​

• This means focus, persistence & time management
• Key elements in our program & the field!

​

​

Software Security: Overview

• Increased use of software and web-based applications over the Internet & now too many consumer devices (IoT)

​

• Most not using best practices on Application Development and Infrastructure Security

​

• What can go wrong with the software applications like medical software and aviation-related software?

​

Common Issues … (just a few!)

• Misconfiguration
• Not validated inputs
• Errors in coding
• Man in the middle attacks
• Man in the browser attacks
• Session hijacking
• Weak encryption keys
• Weak/default/no passwords
• Weak authentication mechanisms
• SQL Injection
• Buffer Overflows

​

Countermeasures

Web Browsers, Servers + Apps

Web Applications

• Misconfiguration
• Non-validated inputs
• Not Patching known vulnerabilities
• Permissions
• Downloads
• Login/logout issues

​

Vulnerabilities in Web Browsers

• Bad configurations
• Unnecessary or Untrusted Add-ons
• Pop-ups
• Scripts
• Malware/executables can run

Vulnerabilities in Web Servers

• Default Users/Permissions not changed

• Sample files / scripts not removed

• Default Configurations not changed

• Directory permissions (defaults & just bad set ups)

• What’s a patch?

• Do we need to download more Firewall?

Other Typical Attacks on web servers & sites �

​

​

SQL Injection Attacks

SQL = Structured Query Language, and very common language for databases.

​

• SELECT ROLE from USERS where login=‘jones’ and password = ‘12345’;

​

• UPDATE USERS SET phone = 1-802-865-645 where LNAME = ‘SMITH’;

​

• DELETE FROM USERS WHERE LNAME = ‘SMITH’;

SELECT * FROM Products where Description == “Water Filters’

SELECT ACCTID FROM CUSTOMERS where email=‘jsmith@gmail.com’ AND password == ‘rover’;

SQL Injection Attacks

Used to:

• Understand database structure/ contents
• Getting data from database
• Adding / modifying / dropping data
• Bypassing authentication
• Executing commands remotely

​

​

SQL Injection & Web Apps

• Most web apps have a form for data entry and are associated with a database.

​

• used retrieve information from a database, update customer record

​

Web Form to Database

• SELECT FNAME, LNAME, ACCTID, BALANCE from CUSTOMER where ACCTID = SELECT ACCTID from CUSTOMER where email = $email and password = $password

​

• Update transaction SET ID=valid

CMD execution attacks

​

​

​

​

• Blah';exec master..xp_cmdshell "dir c:\*.* / s > c:\directorylist.txt"—

​

​

​

Normal Program Operations

• Computer program takes inputs & does computations on them. Modern programs call functions to perform common tasks.

​

• The inputs are stored in a stack.

​

• The return address for function calls is stored in a stack

Stack Buffer Overflow

Buffer Overflow Attacks

• Happens when an Application writes more data to a memory location than what it can hold, thus overwriting (overflowing into) the adjacent memory space (buffer)

​

• Allowed by lack of bound checks or a lack of validation in length of inputs.

Cross Site Scripting (XSS)

• Because inputs are not validated #SoundFamilar?

​

• Attackers can embed a script in a Web Form field

​

• Can be stored by the server and then provided to another unsuspecting user, in whose browser, the script embedded by the earlier user gets executed.

​

• Easy embedding of malicious scripts by an attacker

​

• Intention of getting it executed in browser of other users

XSS

• Javascript was one of the first languages providing interactive web functionality

​

• Security was not a concern at the time…

​

​

<!DOCTYPE html>

<html>

<head>

<script>

function myFunction() {

document.getElementById("demo").innerHTML = "Paragraph changed.";

}

</script>

</head>

​

<body>

​

<h1>JavaScript in Head</h1>

​

<p id="demo">A Paragraph.</p>

​

<button type="button" onclick="myFunction()">Try it</button>

​

</body>

</html>

XSS

• Simple program in javascript might look like
• <script>alert(‘hi’)</script>

​

• This would create a popup with ‘hi’ in it

​

• But what happens if someone enters this instead of regular inputs into a web form

XSS: An overview

Default Browser Settings for cookies and scripts …

Cookies

• What are they & how can they be a security vulnerability?

​

• Cookies are small files stored to maintain data … your data:
• Settings / preferences
• Session utilization
• Authentications

​

​

Cookies and Javascript

• Web applications would be much more secure without Javascript and/or cookies

​

• Do we want that?

​

​

https://www.microsoft.com/security/assets/images/_security/sir/strategy/cross-site-scripting-stored-xss-attack.png

How can we prevent these?

• Validate all inputs: memory bounds checking + acceptable values

​

• Configure Web Applications appropriately

​

• #PatchAllTheThings! 🡪 Web Server, App Server, Database Server, Browsers, …

​

• Do not save your credentials on a Web Browser … just … no

​

• Log off after work on Web Application is over

Authentication + Encryption

• To further protect data, we take steps to ensure the site we connect to is legitimate and data is not readable by people who should not be able to see it

​

How do we achieve this?

• Digital Certificates and TLS

​

Pro Tip: We dig deep into these in a few weeks, so best prepare! >:)