Denim Group, Ltd. Blog

June 22, 2010 | Permalink | Comments (0) | TrackBack (0)

June 09, 2010

4 Lessons from the AT&T/Apple Data Breach for Smartphone App Developers

The recent AT&T / Apple data breach involving iPad 3G customers echoes some lessons we’ve been discussing with our customers deploying smartphone applications. Based on a read of the info from Goatse Security as reported by Gawker we see similar themes.

This is still breaking news, but it appears AT&T had a publicly-accessible web service deployed that would return information about an Apple iPad 3G user if it were provided with a request containing an iPad User-Agent header and a valid integrated circuit card identifier (ICC-ID for short).

Also, though this specific situation deals with AT&T infrastructure deployed to support Apple iPad devices, the lessons apply to everyone developing smartphone applications and the server infrastructure to support them – regardless of whether the target platform is the Apple iPhone or iPad, Google Android, RIM Blackberry or Microsoft Windows Mobile.

So what has this taught us?

1. Authentication and Authorization Are Crucial for Services Deployed to Support Smartphone Applications – Originally this was a problem with web pages – “hidden” directories or URLs were used to protect sensitive parts of applications. Then when AJAX and RIA rolled around the server endpoints created to support these applications had the same problem. And now smartphone applications need to call home to get to the “good” data. The lesson remains the same – if you expose a server resource that deals with sensitive data you must authenticate the user who makes the request and you must authorize that the authenticated user should have access to the information and functionality requested. We have seen most folks we work with get pretty good about this for web pages and OK about it for AJAX/RIA endpoints, but they are still missing the mark with server endpoints devoted to smartphone applications. And since the OWASP Top 10 2010 still includes it (A3 - Broken Authentication and Session Management, A8: Failure to Restrict URL Access) I guess that means the world-at-large still hasn’t gotten the original message. Protect your endpoints! If bad guys need credentials before they can attack you then you’ve certainly raised the bar. And if they don’t need to authenticate they are going to run all over you.

2. Do Not Authenticate Requests with Values that Look Random But Aren’t – We used to see this a lot with Social Security Numbers (SSNs) and we still see a lot of authentication schemes that rely on semi-public information or reasonably-guessable values. Just because a number is long doesn’t mean that an attacker isn’t going to be able to find another source of data to provide valid values. Nor does it mean they won’t be able to find a way to guess valid values. Freely-available tools like OWASP WebScarab have analysis routines that can be used to identify how much entropy exists in a series of inputs and even moderately-motivated attackers have even more sophisticated tools at their disposal. Design your authentication schemes correctly from the beginning because they can be some of the most expensive parts of systems to remediate once they have been deployed.

3. Never Trust Anything in an Attacker-Controlled Request (Especially User-Agent Headers) – To those of us in the web application security world for a while this seems self-evident, but more developers outside the “web application security bubble” need to understand that you have to assume a malicious user has full control of an HTTP request. Therefore you can’t trust anything in an HTTP header. In this case it appears as though a User-Agent header was checked to “verify” that the requesting party was an iPad which is obviously easy to bypass using freely-available tools like OWASP WebScarab. We also still see similar trust applied to HTTP cookies (which also come from an HTTP header), as well as other headers such as Referer. Making any security-critical decision based on a guessable value in an HTTP request header is a bad idea. Period.

4. Don’t Trust Your Service Providers; Test Them – This is less of a technical lesson and more of a business/risk-management lesson. Gawker makes the point that US-based iPhone/iPad users are currently required to use AT&T as their carrier. So in this case AT&T is a service provider for Apple. In the brave new world of Software as a Service (SaaS) it is easy to forget: even though you didn’t write the software, your customers are going to hold you responsible for it. Organizations selecting service providers need to make sure they are properly addressing risk associated with these providers. Controls can take a variety of forms, from table-top assessments of service provider policies and procedures to technical testing of the software before and after it is brought online. The important point for organizations using service providers is that they need to negotiate this up-front. We have been geared-up to start several assessments before our clients were stonewalled by their service providers who refused to allow testing of their services. Crappy customer service: yes. Legally-defensible for the service provider: unfortunately also yes. The advice for security folks is: keep business units from making unilateral decisions about service providers and inject yourself into the acquisition process. You don’t have to be the person who always says “no,” but you should be the person who says “let us test XYZ and if ABC happens you all have to do DEF.”

Details are still developing about this AT&T / Apple data breach, but the initial information underscores several points we have already seen with our clients developing and deploying smartphone applications. If your organization is developing applications for iPhone, iPad, Android, Blackberry or Windows Mobile please make sure your development and security teams are taking the time up front to consider the associated risks. It will save you a lot of heartache, hassle and money down the road.

[Update: Gizmodo's John Herrman posted an article discussing the true impact of the breach. This is a very balanced analysis of the impact of this current breach, but doesn't mean that smartphone developers shouldn't take note.]

--Dan

dan _at_ denimgroup.com

June 09, 2010 | Permalink | Comments (2) | TrackBack (0)

June 08, 2010

OWASP San Antonio June Meeting: Securing Software Applications Using Dynamic Dataflow Analysis

The June meeting of OWASP San Antonio will be held June 16^th, 2010. Steve Cook from Southwest Research Institute will be presenting on Securing Software Applications Using Dynamic Dataflow Analysis. More information below.

Sponsored by:

San Antonio OWASP Chapter: Wed June 16, 2010

Topic: Securing Software Applications Using Dynamic Dataflow Analysis

Presenter: Steve Cook, Senior Research Analyst, SwRI

Date: Wednesday June 16, 2010 11:30am – 1:00pm

Location:

San Antonio Technology Center (Web Room)

3463 Magic Drive

San Antonio, TX 78229

View Larger Map

Abstract:

In this presentation, we present an ongoing research effort that ensures that a wide variety of user-defined security policies are enforced on executing C programs while keeping runtime overhead low and with little disruption to the development process by leveraging Dynamic Dataflow Analysis (DDFA). The DDFA system is built upon the Broadway static data flow analysis and error checking system, which is a source-to-source translator for C developed by the computer sciences department at the University of Texas at Austin (UT-Austin). UT-Austin and the Southwest Research Institute (SwRI) recently collaborated to further enhance the system through a government research project funded by Intelligence Advanced Research Projects Activity (IARPA) and a SwRI internal research project.

The system works by automatically instrumenting the original source, guided by the security policy, with DDFA runtime library calls. The modified program is then compiled for the platform of choice so that its security policy can be enforced at runtime through the DDFA runtime library.

The runtime overhead is kept low by leveraging the semantic information provided by the security policy and a sophisticated dependence analysis to enable optimizations beyond standard compiler techniques. This results in a program that is instrumented with additional code only where provably necessary, so innocuous flows of data are not tracked at runtime.

Disruption to the development process is minimized through the security policy specification. The security policy is defined once by a security expert using a simple language, which has a direct mapping to the application programming interface to which the program is written. The policy, once defined, can be applied to many different programs. The DDFA approach is easily integrated into the development workflow, adding only an additional compilation step before application deployment.

The system does not require any modification to the original source code by the programmer, and does not require hardware or operating system changes. In the future, our system can be extended to handle multiple languages and complement new security solutions.

Presenter Bio:

Steve Cook is a senior research analyst in the System Security and High Reliability Software section at the SwRI. His background and expertise are in distributed and parallel computing, compilers, as well as object-oriented and generic programming. He received his master’s degree in computer science from Texas A&M University. While at Texas A&M, he worked as a research assistant for Dr. Bjarne Stroustrup, creator of the C++ Programming Language, where he helped develop a new approach to writing concurrent programs that allows programmers to quickly turn a sequential C++ program into a parallel one that is race and deadlock free.

Sodas and snacks will be provided. Feel free to bring a brown-bag lunch.

Please RSVP: E-mail owasprsvp@denimgroup.com or call (210) 572-4400.

--Dan

dan _at_ denimgroup.com

June 08, 2010 | Permalink | Comments (0) | TrackBack (0)

June 07, 2010

2010 OWASP FROC Wrap Up

· John Dickson: - The Permanent Campaign: Driving a Secure Software Initiative in the Enterprise

The OWASP FROC 2010 last week was a great conference. Or so I heard, because I, unfortunately, couldn’t make it due to some scheduling issues.

Denim Group’s Bryan Beverly and John Dickson were both there to present and their slides are now online:

· Bryan Beverly - Application Security Program Management with Vulnerability Manager

Here are John Dickson’s comments on FROC 2010:

One again the FROC event hosted by local OWASP leaders in Colorado lived up to its billing. For those not familiar with the FROC (“Front Range OWASP Conference”), it is an annual conference hosted in Denver by web app security practitioners where appsec deep thinkers congregate to speak, exchange ideas, and drink the occasional beer. Over the past three years, conference organizers have put together the right mix of technical leaders and general industry types involved with application security market. Although most attendees are from Colorado, speakers were from nationally recognized appsec firms across the country. This year, over 200 attendees heard from the likes of Jeremiah Grossman, Brian Chess, and Tom Brennan, from the International OWASP Board.

Like last year’s FROC, the conference had an informal feel to it, which was appreciated by all. FROC, and other smaller regional conferences, are a breath of fresh air compares to the RSA and Black Hat conferences, which are really big and very corporate. I had the opportunity to speak twice this year, first in a one-hour track session, then as a moderator for the conference wrap-up panel discussion. My session, titled “The Permanent Campaign: How to Build a Successful Software Security Initiative” was attended by a spirited group of security pros and managers interested in pushing successful software security efforts. I tried to make the session lively - it was immediately after lunch and I feared the worse. The session attendees had a ton of great questions for me and kept me on my toes. Questions focusing on security metrics and ROI were the most prevalent.

As I emphasized during my session, building software is HARD. Building secure software is HARDER. Building a secure security software initiative may be the most daunting task of all. I hope those in attendance enjoyed my presentation and stay in touch. Some of the best war stories I hear are from folks in the crowd at conferences like this. The slide deck from the session can be downloaded here. For the companion white paper, e-mail me at john at denimgroup.com

Perhaps the highlight for many was the closing panel discussion. Jeremiah Grossman from WhiteHat Security, Andy Lewis from OWASP, Randy Barr from Qualys, and Chris Nickerson from Lares Consulting were panelists who answered questions, traded barbs with audience members, and generally had fun in one of the most free flowing security discussions to date. To characterize the FROC closing session as a “panel discussion” is probably a mistake from the start. At points the session was a more like a Jerry Springer show than an industry panel, but I doubt anyone really was too upset by that. As panel moderator, there were moments of sheer terror when I thought things might get truly out of hands. They didn’t. Did I mention that beer flowed freely throughoutDave Campbell and organizers: we need to deputize Brian Martin and have him as a fixture on next year’s panel. He’s smart, knows the history, plus others will be able to ask questions if he’s on stage ;-)

In the end, everyone had a blast. The back and forth was healthy, even if one or two folks might have got more animated than they had planned. We need more events like this… Plan to come in 2011 when I hope we do it again.

That must have been some panel because I also saw WhiteHat Security’s Jeremiah Grossman tweet “Best panel I've ever been on. OWASP FROC audience is very lively and totally rocks! What a great event!” Scheduling conflicts kept me from the conference this year, but after everyone else’s comments you can bet that I will find a way to make it next year. Hope to see folks there.

--Dan

dan _at_ denimgroup.com

June 07, 2010 | Permalink | Comments (0) | TrackBack (0)

Java User Group ESAPI Slides Online

Jarret Raim’s presentation on the OWASP Enterprise Security API (ESAPI) to the San Antonio Java User Group is now up online here:

ESAPI is a really exciting project and I’m really thankful to Jarret for taking the time to present to the SAT JUG folks. We use it for a number of new development and software security remediation projects and organiztions interested in securing their applications at the source should take a look at it.

--Dan

dan _at_ denimgroup.com

June 07, 2010 | Permalink | Comments (0) | TrackBack (0)

FROC 2010: Slides Online for "The Permanent Campaign: Driving a Secure Software Initiative in the Enterprise"

John Dickson’s slides for his OWASP FROC 2010 talk “The Permanent Campaign: Driving a Secure Software Initiative in the Enterprise” are now online here:

Also there was lots of great discussion in the presentation on tracking metrics for software security programs. We will have to get some of those notes pulled together and posted online.

--Dan

dan _at_ denimgroup.com

June 07, 2010 | Permalink | Comments (0) | TrackBack (0)

June 03, 2010

FROC 2010: Slides Online for "Application Security Program Management with Vulnerability Manager"

The slides from Bryan Beverly’s OWASP FROC 2010 presentation “Application Security Program Management with Vulnerability Manager” are now online:

More information about Vulnerability Manager, including a video demo and download links, can be found on the Vulnerability Manager website.

--Dan

dan _at_ denimgroup.com

June 03, 2010 in Application Security Remediation | Permalink | Comments (0) | TrackBack (0)

June 02, 2010

Dan Cornell on Cloud Security Panel for June 2010 Meeting of San Antonio ISSA

I will be on a panel at the next San Antonio ISSA Meeting discussing cloud security.

The meeting is at Dave and Buster’s at 440 Crossroads Blvd, San Antonio, TX 78201 on June 15^th at 11:30am. Attendance costs between $15.00 and $20.00 depending on whether or not you are an ISSA member and/or whether or not you pre-register.

View Larger Map

The title of the panel is: Securing the Cloud: Demystifying the Threats That Exist With Cloud Computing and How to Protect Against Them

The panel abstract is:

The benefits of cloud computing have created a lot of buzz over the past couple of years, but does sharing infrastructure mean sharing increased risk? Agility and lower costs have many business and technology leaders scrambling to figure out how to shift as many resources as they can into the cloud. As security professionals, we have to understand the unique risks introduced by public, private and community clouds and be prepared to ask the right questions before and after we start handing over our data.

Join our expert panel as we discuss the real world security challenges the cloud presents and why not all clouds are created the same. We will explore the impact this has on our applications and infrastructure, and break down some of the latest threat research from the Cloud Security Alliance. Discover why location matters, and the role San Antonio is playing with Rackspace, Microsoft, the Federal Government and a number of other organizations making huge investments in cloud facilities right here. At the end of the session you will be able to better articulate the threats of cloud computing to your organization's management team, and understand how to mitigate them.

Right now the confirmed panelsists are myself and Josh Zachry from the UTSA Institute for Cyber Security and I know they are looking to add one or two more folks.

--Dan

dan _at_ denimgroup.com

June 02, 2010 | Permalink | Comments (0) | TrackBack (0)

Denim Group's Jarret Raim Speaking on ESAPI at June 2010 Meeting of San Antonio Java User Group

Denim Group’s Jarret Raim will be speaking on the OWASP Enterprise Security API (ESAPI) at the San Antonio Java User Group meeting Thursday June 3^rd, 2010 at 6:00pm at New Horizons Learning Center:

View Larger Map

He will be discussing the background of the ESAPI project, how it can be used as well as some of his experiences using it for software security remediation projects.

Contact us for information about creating secure applications with OWASP ESAPI and remediating security vulnerabilities in your application portfolio.

--Dan

dan _at_ denimgroup.com