Deciphering Web Services Security Dick Mackey System Experts

Deciphering Web Services Security Dick Mackey System. Experts Corporation

Agenda l Introduction to Web Services l Web Services threats l Web Services security standards l What’s here today l What you can do to secure your Web Services

Why Web services? Display information meant for Web browsers and humans Traditional Web Services: SOAP Programmatic Access Remote Procedures (e. g. , Get_Schedule (person, month, sched);

The good and the bad l Web services are growing in popularity for B 2 B applications l The good: • Interoperable across platforms and implementations • Can be written in many languages – Perl, Java, C… • Standard / non-proprietary • Building blocks for larger systems l The bad: convenience leads to security issues

What are Web services? l Remote Procedure Call (RPC) services (mostly) l Offered through web servers / app servers l Designed to build modular distributed systems l Extensible (not as “brittle” as previous systems) l Provide well-defined, language-independent interfaces l Support standard wire protocols (XML/SOAP) l Services define interfaces (WSDL) l Services advertise (UDDI)

Web services model Server Client get. Todo. By. Day. Request(day) Soap Messages get. Todo. By. Day. Response(day) TTDo. Service

WSDL and SOAP l Web Services Definition Language (WSDL) • XML definitions of interfaces • Describes SOAP operations or documents to exchange § § Types Parameters Messages RPCs l Simple to build both clients and servers • Can generate stubs or just look at the definition and code accordingly l Tools support dynamic invocation of operations based on interface definition

UDDI l Universal Description, Discovery and Integration l Provides a place to register and find interfaces/services l UDDI is a Web service itself l Allows services to advertise l Provides info about your services

SOAP message anatomy HTTP Request SOAP Message SOAP Header SOAP Body

SOAP request <? xml version='1. 0' ? > <env: Envelope xmlns: env="http: //www. w 3. org/2003/05/soapenvelope" > <env: Header> <t: transaction xmlns: t="http: //thirdparty. example. org/transaction" env: encoding. Style="http: //example. com/encoding" env: must. Understand="true" >5</t: transaction> </env: Header> <env: Body> <m: charge. Reservation env: encoding. Style="http: //www. w 3. org/2003/05/soap-encoding" xmlns: m="http: //travelcompany. example. org/"> <m: reservation xmlns: m="http: //travelcompany. example. org/reservation"> <m: code>FT 35 ZBQ</m: code> </m: reservation> <o: credit. Card xmlns: o="http: //mycompany. example. com/financial"> <n: name xmlns: n="http: //mycompany. example. com/employees"> Åke Jógvan Øyvind </n: name> <o: number>123456789099999</o: number> <o: expiration>2005 -02</o: expiration></o: credit. Card> </m: charge. Reservation> </env: Body></env: Envelope>

SOAP response <? xml version='1. 0' ? > <env: Envelope xmlns: env="http: //www. w 3. org/2003/05/soapenvelope" > <env: Header> <t: transaction xmlns: t="http: //thirdparty. example. org/transaction" env: encoding. Style="http: //example. com/encoding" env: must. Understand="true">5</t: transaction></env: Header> <env: Body> <m: charge. Reservation. Response env: encoding. Style="http: //www. w 3. org/2003/05/soap-encoding" xmlns: m="http: //travelcompany. example. org/"> <m: code>FT 35 ZBQ</m: code> <m: view. At> http: //travelcompany. example. org/reservations? code=FT 35 ZBQ </m: view. At> </m: charge. Reservation. Response> </env: Body> </env: Envelope>

Why are Web services dangerous? l They use Web servers and their protocols are allowed through firewalls l They are flexible and powerful • Messages can include attachments (selectively processed) • • Messages can include attacks at internal weaknesses They are sooo easy to implement they tempt developers to deploy indiscriminately l They typically do not get the scrutiny Web sites do

Web services implementation Web Server App Server Client get. Todo. By. Day. Request(day) Soap Messages Axis RPCs get. Todo. By. Day. Response(day) Web services run inside servlets in an App Server

How to make WS safer l Be aware of threats l Authenticate connections/methods l Encrypt sensitive data l Separate sensitive Web services from others l Take Web services seriously: code carefully and avoid mistakes

WS security l Defines how authentication and crypto information is carried by SOAP l Provides authorization support • • Claims can be signed Authorization can be specific to a domain l Supports multiple authentication methods l Supports multi-party transactions

WS security (2) l WS-Security defines how security tokens can be included in SOAP messages • XML elements appear in SOAP headers • Elements define tokens like username, signature l Supports tokens for various authentication mechanisms • Kerberos • Username and password • Public key l Supports confidentiality, authenticity and integrity of SOAP messages • Message digest • Digital signature

Related security specifications l Secure conversation • Builds on WS-Security to support SSL-like negotiation of conversations l WS-Trust • Establishes framework to process security tokens • Which tokens should a party trust? l WS-Federation • Establishes a framework for supporting multiple security domains • Example: Healthcare, physician, insurance company, pharmacy

How are WS used today? l Companies like Google and Amazon support search interfaces l Travel agencies use WS for pricing l Financial organizations use it to support security operations (single sign-on) and partner interactions

What organizations do today l Most offer unauthenticated services l When security is necessary, SSL is the mechanism of choice l Application authentication • Usernames and passwords over SSL • Client side certificates with SSL

What can you do? l Consider building security into the application • Implementations of WS-Security are popping up from Sun, Apache, and IBM l Firewall and border products can be useful too • Firewall vendors are building products to look inside SOAP messages to find large attachments and other information • Netegrity’s Transaction. Minder supports security at the boundry • Other products are surely on their way

In Closing l Web Services offer powerful tools to build applications for both the intranet and Internet l They also offer flexibility, convenience, and power that can lead to vulnerabilities l It’s inevitable that this model will grow in popularity so we had better get used to the security challenges l Be careful what you export to the masses • Web services require the same or greater scrutiny as other web interfaces l Be ready to adopt more closely coupled security mechanisms as they become available.