COMP 3371 Cyber Security Week 10 Richard Henson

COMP 3371 Cyber Security Week 10 Richard Henson University of Worcester December 2017

Learning Objectives… Ø Explain the different ways external hackers can find their way into an organisation via its website Ø Use vulnerability testing software within the law to check access to the organisation’s network (and information about it!) from outside Ø Explain the difference between vulnerability scanning and penetration testing and advise on appropriateness of each

Software and System Vulnerabilities n As previously stated: Ø unpatched software is manna from heaven for hackers Ø Anyone can assess fairly quickly whether operating systems, applications, or development environments are up-to-date n In this final session, we’ll look a little closer at how “ethical hacking” can help keep organisations free of exploitable software

Ethical Hacking Principles n As already stated, but worth re-stating!!! n hacking is a criminal offence in the UK n covered through The Computer Misuse Act (1990) & additions in 2006 n Entering someone else’s computer system can only legally be done by a trained (or trainee) professional

Asking Permission… n This is the crucial factor in UK law Øno one should ever penetrate a computer system without permission n A computing student would be considered in this context under the law Øand if they didn’t ask permission, they would be acting illegally!

Ethical Hacking principles n Even if a practice is currently legal, doesn’t mean it is ethical! n even passive scanning without permission could be categorised as “snooping” (i. e. unethical) n Hacking without permission… is a job for professionals… n given police/home secretary permission n only if there is reason to believe a law is being broken

Vulnerability Testing & Penetration Testing n There is a difference! Øa vulnerability test will use software to scan around the organisation boundary » many potential vulnerabilities… » report could be lengthy! Øa penetration test seeks to exploit the vulnerability/ies revealed by the scan » actual report <10 pages!

CE and CE+ n CE is obtained by correctly answering questions in a self-assessment test Øsome regard it as of limited value because the organisation may answer wrongly Øhowever, if/when they get hacked and are shown to have lied they are unlikely to get another certificate for some time! n CE+ requires real evidence Øregarded as more rigorous… Øbut much more expensive!

Cyber Essentials Plus and Vulnerability Scanning n The requirement is for a scan report… that shows no obvious vulnerabilities n Many tools available ØTitania’s RAT is a very simple example Ølots of free tools on the Internet to test organisational defences » permission is needed for use (!)

Active Scanning & Passive Scanning Both types of vulnerability scanning n Only active scanning crosses the barrier into potential penetration and therefore misuse n Passive scanning organisation Active Scanning

Application-Transport Layer n Vulnerabilities through the web… especially http but also through poor web app programming HTTP ports X Myapp/ http X HTTPS X TCP NFS DNS X X UDP IP SNMP X

Use of a Quality Standard to justify spending on security n Whatever the business… Ø any new work will have a cost Ø cost needs to be qualified n More cost means less profit… Ø what is the ROI of achieving a high level of information security Ø At least with information assurance (assuming they get certified) there is a positive outcome…

Potential Financial Benefits of Information Assurance n Need to be sold to senior mgt… Ø less risk of losing valuable (even strategically important…) data » less likely to get embarrassing leaks, which could even get to the media (!) » less likely to fall foul of the law (!) Ø an ever growing set of examples of businesses who have done both of the above » evidence that they lost customers and share price dropped…

Real costs of CE (level 1) £ 300 self-assessment test n Cost of GAP analysis… n Ø what’s missing? n Cost of correction of “gaps” Ø update software Ø reconfigure software Ø update policy and documentation n Offered for Worcs B 2 B SMEs Ø Be Cyber Secure assistance… worth £ 1500

Real costs of CE+ (level 2) Cost of qualifying for CE n Plus… n Øtotal cost of external vulnerability report » £ 500 -1000 Øcost of implementing report » usually reconfiguration of software e. g. firewall n Advantage: industry-recognised IA (!)

Testing Software n Final version tested for vulnerabilities… Øwith typical input data » known as “run-time” or “blackbox” testing Øaccording to coding expectations (e. g. branching and looping) » known as whitebox testing n If all tests passed… Øsoftware ready for rollout? Øcould be “risk assessed” first?

Further Testing for Websites n Two more types of testing… Øhistorically more emphasis on “accessibility” of content (W 3 C) » website had to be available to all users to meet requirements of 2004 Legislation » testing tended to focus on this aspect Øonly later did testing for “security” become mainstream… Østill some confusion Øneed to test for both!!!

OWASP (Open Web Applications Security Project) n Core purpose: Ø“Be thriving global community that drives visibility and evolution in the safety and security of the world’s software. ”

OWASP’s top 3 vulnerabilities n A 1 Injection Ø Through: SQL, OS, XXE, LDAP Ø Untrusted data is sent to an interpreter as part of a command or query. Ø Hostile data can trick the interpreter into » executing unintended commands » accessing data without proper authorization. n A 2 Broken Authentication Ø Authentication/session management implemented incorrectly Ø Allows attackers to » compromise passwords, keys, or session tokens, » or to exploit other implementation flaws to assume other users’ identities n A 3 Sensitive Data Exposure Ø XSS allows attackers to execute scripts in the victim’s browser » which can hijack user sessions, deface web sites, » or redirect the user to malicious sites. Ø XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, » or updates an existing web page with user supplied data » using a browser API that can create Java. Script.

OWASP: Next 3 n A 4 XML External Entities (XXE) Ø Ø n Restrictions on what authenticated users allowed to do not properly enforced. Attackers exploit these flaws to access unauthorized functionality and/or data, (e. g. access other users accounts, view sensitive files, modify other users data, change access rights, etc. ) A 5 Broken Access Control Ø Secure configuration should be defined/deployed for the application, frameworks, application server, web server, database server, platform, etc. Ø Secure settings should be defined, implemented & maintained (defaults often insecure). Software should be kept up to date n A 6 Security Misconfiguration Ø Many web applications and APIs do not properly protect sensitive (financial, healthcare, PII) data » such data stolen/modified to conduct credit card fraud, identity theft, or other crimes. Sensitive data needs encryption at rest or in transit, as well as special precautions when exchanged with the browser.

OWASP: Next 2 n A 7 Cross-Site Scripting (XSS) Ø Many applications/APIs lack the basic ability to detect, prevent, and respond to both manual and automated attacks Ø attack protection goes far beyond basic input validation and involves automatically detecting, logging, responding, even blocking exploit attempts Ø application owners need to deploy patches quickly to protect against attacks n A 8 Insecure Deserialization Ø A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request - including the victim’s session cookie & any other automatically included authentication information - to a vulnerable web application Ø Such an attack allows the attacker to force a victim’s browser to generate requests the vulnerable application thinks are legitimate

OWASP: Final 2 n A 9 Using Components with Known Vulnerabilities Ø components, such as libraries, frameworks, and other software modules, run with the same privileges as the application Ø vulnerable component exploited. . can result in serious data loss , even server takeover Ø applications and APIs using components with known vulnerabilities may undermine application defences and enable various attacks and impacts n A 10 Insufficient_Logging & Monitoring Ø Modern applications may have rich client applications and APIs » e. g. Java. Script & mobile apps Ø These connect to an API (SOAP/XML, REST/JSON, RPC, GWT, etc. ) Ø Apps often unprotected and contain numerous vulnerabilities.

Vulnerability Testing Tools n Many Website tools… Ømany free to download (!? ) Øbest to use one recommended by a professional (!) n OWASP (Open Web Applications Security Project) ØWorldwide… make security “visible” ØVulnerability testing tool called ZAP

OWASP/ZAP n ZAP has evolved over many years, thanks to the efforts of enthusiastic experts wishing to put their expertise to good use Ømostly used for passive scanning but also active components ØAll that is needed is the URL of the website… » results of scan need careful interpretation

Using ZAP n Open source & versions for all major platforms Øneeds Java Environment to run Ødescribed as a “man-in-the-middle proxy” n Stands between the tester’s browser and the web application Øcan intercept and inspect messages sent between browser and web application. . » modify the contents if needed » forward packets on to the destination

Output from ZAP n I tried it on a site… four vulnerabilities detected: ØProne to “clickjacking” » Solution: use the X-frames-options http header ØAUTOCOMPLETE attribute not disabled » ngood practice for password fields ØCould allow proxies to cache content » Cache-control and pragma http header not set correctly ØProne to XXS » Protection not fully engaged

Now over to you… ZAP may not run on university machines n If not, download and try on your own machine n The application you will test is quite old, but demonstrates various principles of (not…) secure web applications n Øit is harmless but modern browsers offer protection against all unsigned. exe files

That’s all for 2017! Have a Great Christmas! See you in the New Year