Denim Group, Ltd. Blog

Social Networking Security Slide Deck Online

By Dan Cornell

John Dickson gave a presentation on the security implications of social networking to a group of CSOs last week.  The slide deck is now online at SlideShare:

Social Networks and Security: What Your Teenager Likely Won't Tell You

View more documents from Denim Group.

John's main point is that CSOs need to approach social networking as a business issue rather than a security issue if they want to maximize their ability to influence policy and implementation.

--Dan
dan _at_ denimgroup.com
@danielcornell

Denim Group Teams with Rackspace Hosting

By Dan Cornell

I'm thrilled to announce Denim Group working with Rackspace Hosting (NYSE: RAX) customers to help them secure their applications via conducting code reviews, delivering secure software development training, and evaluating software development strategies for Rackspace clients.  We've known folks at Rackspace for years and had the opportunity to work with them in a variety of capacities so this is pretty exciting for us: BusinessWire release: Denim Group Teams with Rackspace Hosting

Whether you're hosting your applications in "the cloud" or on good old-fashioned servers, they're still targets for attack.  We're glad to have the opportunity to work with Rackspace and their clients to help reduce their risks.

John put together a brief video about the release:

This has also been picked up by a bunch of other folks:

• Yahoo Finance
• BusinessWire
• AOL Money
• Reuters
• MSN MoneyCentral

--Dan
dan _at_ denimgroup.com
Twitter: @danielcornell

QASL 1.0 Released!

By Dan Cornell

QASL (Quality Assurance Scripting Language) 1.0 has been officially released.  QASL is a lightweight scripting language that Denim Group uses to do automated functional testing of web applications.  It has a basic syntax that allows a programmer or QA person to control a web browser and run tests on a web application.  These tests can then be bundled together to provide a comprehensive set of functional tests for an application, as well as a robust reporting framework that indicates test failures and provides additional debugging information such as screenshots of unsuccessful test cases.

QASL has been released under an Apache License.  Here are the relevant links:

• Sourceforge site
• Download page

Many thanks to all the Denim Group folks who have been putting in long hours over the past six months to refactor QASL, test it, document it and make it release-ready.  You all have done a hell of a job.

--Dan
dan _at_ denimgroup.com

TRISC Slide Decks Online

By Dan Cornell

John Dickson's slide deck for "The Permanent Campaign: Driving a Software Security Initiative in the Enterprise" from the Texas Regional Infrastructure Security Conference (TRISC) is now online.

Also, my slide deck for "Securing SharePoint" at TRISC is also online.

Last week was a crazy week for Denim Group between TRISC, the DIR Information Security Forum 2009 and TASSCC TEC 2009 Web 2.0 conference as well as an even with WhiteHat.  I will keep posting materials from those events as I can get them online.

--Dan
dan _at_ denimgroup.com

Virtual Application Security Track at TRISC

By Dan Cornell

There isn't a formal application security track at TRISC (yet!), so I thought I would put together a list of the application security-focused talks.

Please be sure to check out John Dickson's talk Tuesday at 1:45 in the Amphitheatre titled "The Permanent Campaign: Driving a Secure Software Initiative" and also check out my talk on "Securing SharePoint" Tuesday at 3:15 in Ballroom B.

Monday:

• 1:00: Ballroom A: Rohyt Belani - Phishing 2.0, Ballroom B: David Lissberger - Hacking Through a Firewall
• 2:00: Ballroom B: Josh Sokol - Using Proxies to Secure Applications and More
• 3:15: Ballroom B: Robert Hansen & Rob MacDougal - Assessing Your Web App Manually Without Hacking It

Tuesday:

• 8:30: Keynote: Johnny Long
• 12:45: Ballroom A: Trey Ford - Top Website Vulnerabilities: Trends, Business Effects, How To Fight Them, Ballroom B: Mano Paul - Web 0wn3d (OWASP Top 10) In Depth & Demonstrated
• 1:45: Amphitheater: John Dickson - The Permanent Campaign: Driving a Secure Software Initiative in the Enterprise, Ballroom B: Matt Tesauro - OWASP Live CD: An Open Environment for Web Application Security
• 3:15: Ballroom B: Dan Cornell - Securing SharePoint
• 4:15: Ballroom A: Joseph Krull - PCI Compliance - Convert Drudgery Into a Powerful Security Framework, Ballroom B: Erhan Kartaltepe & Ravi Ganesan - A New Standard for Establishing Trust in Cross Domain XHR

As I have mentioned before, OWASP members get a $100 discount on TRISC 2009 attendance.  Seeing as how OWASP membership now costs $50 that is a great deal.  Bailout!  Contact me for more specific info.  For OWASP San Antonio we will be treating TRISC as our March meeting (regular meetings to resume in April).

TRISC website: http://www.trisc.org/
OWASP Membership Website: http://www.owasp.org/index.php/Membership

--Dan
dan _at_ denimgroup.com

OWASP EU Summit in Portugal: Tuesday

By Dan Cornell

[Running a little behind, as usual.  Over the course of today I'll be putting up a series of posts to finish out my OWASP EU Summit notes.]

First of all, my favorite part of Tuesday was that I won a t-shirt at the Sensepost training class on offensive web application hacking.  H4x0r skillz!

 

In addition to that, Tuesday was a really productive day.  I had the opportunity to attend a number of sessions where folks presented their Summer of Code projects and OWASP projects in general:

• Jason Li - JSP Testing Tool - This tools tests JSP tag libraries to determine which attributes are properly escaped when they are written out to the HTML stream.  It does this by generating a large number of JSP/HTML examples with various payloads placed into the tags' attributes.  When the page renders, unescaped payloads change colors of parts of the DOM so you can see which attributes are "dangerous"  This is a very cool approach and it would be interesting to see how it applied to ASP.NET web controls as well.
• Paolo Perego - Orizon - Orizon is a framework for code analysis that can apply various rules to look for security defects.  It currently supports Java and there are plans to make it support .NET.  Source code files are broken down into a number of XML representations and then those XML representations are run through a rules engine to identify potential security issues.
• Alex Smolen - ESAPI.NET - This is the .NET version of the ESAPI.  Currently it is basically a word-for-word port of the Java ESAPI into C#, but the plan is to update the .NET version to accomodate existing security capabilities of the .NET platform such as the Membership API and the AntiXSS library.

I also had an opportunity to attend a number of working groups:

• Tools Working Group
• ESAPI Working Group

The energy and enthusiasm at this event was incredible.  As you'll see from the following posts we covered a lot of ground during the week and a lot got accomplished.

--Dan
dan _at_ denimgroup.com

OWASP EU Summit in Portugal: Monday

By Dan Cornell

This week I'm in Portugal at the OWASP EU Summit '08.

Just after I arrived on Monday I had the opportunity to talk about AJAX security and sprajax to a group of students at the 1 day OWASP event at the University of Algarve.  The slide deck was a shortened version of the one from when I presented at OWASP Montgomery.  I always enjoy speaking to University students because you have to work hard to frame the material in the appropriate context.  For example - how do you explain SQL injection to someone who has never written a database application?  How to explain PCI compliance to someone who has never worked inside an enterprise that takes credit cards?

I finally got some sleep Monday night after a day and a half of flights, airport wait time, presentations to University students and the conference kickoff.  This is shaping up to be a great event.  More to come.

--Dan
dan _at_ denimgroup.com

Top 5 Software Security Predictions for 2008

By Dan Cornell

Top 5 Software Security Predictions for 2008

1. More Software Security Vendor Acquisitions

As the industry matures there will be more consolidation.  As larger mainstream vendors buy up software security companies that will give software security tools further distribution, but it will not necessarily result in deeper adoption as adoption up until now has been significantly driven by independent vendor evangelism.

2. Cross Site Scripting is the New Buffer Overflow

Buffer overflows used to allow attackers to run arbitrary code on servers, where valuable data lived.  Now that most new server side applications are being written in safer languages such as .NET and Java buffer overflows are on the decline (See the changes between the OWASP Top 10 2004 and Top 10 2007).  With Web 2.0 and other trends moving more data onto the client side, hosted in browsers, the ability to run malicious code in client browsers (XSS) will become paramount for attackers.  Also cross site scripting as a class of problem encompasses many subtle variations that will persist even when obvious XSS flaws have been addressed - just like we saw with buffer overflows at attackers moved from stack overflows to heap overflows to format string attacks.

3. More Combined Attacks on the Horizon

General awareness of software security issues has improved in recent years.  Most developers these days have at least heard of SQL injection attacks, and tool adoption by large organizations has started to stem the tide of SQL injection and other simple vulnerabilities from high-profile and critical applications.  As these individual pieces become more secure, attackers will start to look for more subtle attacks.  These will involve combining different attack vectors such as SQL injection and Cross Site Scripting (XSS) The recent mass SQL injection attack that injected malicious HTML and JavaScript into databases is a good example and is a harbinger of things to come.  Also, using Cross Site Request Forgery (CSRF) attacks to weave attacks across separate applications will continue to gain steam.  As the components become more mature, more vulnerabilities will come from the interactions between these components.

4. Academia Will Start to Get In On the Act

Up to this point there has been comparatively limited work done in academia that was specifically focused on software security.  In 2008 I suspect several prominent institutions will announce software security-specific efforts.  This is great because it will hopefully start the long road toward security being taught throughout the computer science curriculum rather than as specialized add-on coursework.

5. Social Networking is Going to Have a Rough Year

With so many people becoming involved in multiple Social Networking sites, so much valuable personal data being stored in those sites and with increased programmability being made available, vulnerabilities will skyrocket as threats and countermeasures in this environment are not well understood.

2007 was a tremendously exciting year for application security and I think 2008 is going to blow it away.  Tremendous strides have been made in education, testing and countermeasures but equal if not more progress has been made by attackers as they evolve their methods and - even more importantly - their goals.

--Dan

PS - Picture is another I took in Costa Rica.  It has been LOLGuana-ed up solely to aggravate Sheridan Chambers, who hates LOLCats more than anyone I know.  Even I'm getting annoyed so I guess I ought to lay off for a while.

Google's Christmas Gift to Total Information Awareness: Everyone's Google Reader Feed Data

By Dan Cornell

As if unpaid Government informants on Facebook weren't enough, now Google has decided to make your shared RSS feeds on Google Reader available to anyone in your GMail contacts.  Or something like that.  Google says that your "friends" should only be folks in your contacts who you have chatted with via Google Talk but other users disagree and say that isn't how it is behaving.  The important thing is that Google made a decision to "social network" up its hosted Reader product, and they didn't have to check with anyone but themselves to see if that was all right.

There are lots of interesting things at play here:

• Google tried to "after-the-fact" develop an automated authorization policy for how users should share their information.  Therefore it isn't terribly surprising that this auto-authZ-policy doesn't meet the needs of all their users.
• Many users had already developed their own "applications" with specific functionality using the sharing features as they previously behaved.  These weren't application they coded, but ways they leveraged the existing functionality of the application to accomplish some purpose.  If you read through some aggregated Google user feedback in the Slashdot Journal of Felipe Hoffa you can see several examples of how users had created their own new aggregation and discussion areas where they were sharing selected links with selected groups of people (often based on the security-through-obscurity of the URL).  When Google introduced these new features, all the previous business rules about who got to see what went out the window.
• We can see the danger of pollinating functionality and data across multiple applications.  The current hubbub is based on Google creating definitions of relationships based on data being tagged in Google Reader, users existing in GMail, and users having performed actions in Google Talk.  There is tremendous potential to create cool new features from these interactions.  But there are also tremendous, unexplored risks for privacy and security.  The current issues have come up because one provider decided to link up several applications in their portfolio.  Imagine the chaos as these social networking APIs (expecially the ones that operate cross-platform like Google's) start to gain more adoption.
• At the end of the day, this is another reminder that when you put data online in someone else's data center, you have no control over what they do with it.  This has huge implications for Software as a Service (SaaS) businesses and the organizations and individuals who come to rely on them.

Prediction: After a couple more incidents like this, some pseudo-tech-savvy Congressman is going to make some noise pushing for regulation of SaaS businesses - privacy, security, etc.  This will result in Google, Microsoft, social networking sites, etc all pushing to move datacenters offshore to jurisdictions where such pesky legislators don't exist.  We have already seen hints of this a number of times at Denim Group for applications we build.  Clients say "Well, we want to comply in spirit with [Insert regulation X here], but since this will be hosted in [Insert country Y here] we don't really have to worry about that."  Too bad those HavenCo folks seem to have jumped the shark...

Merry Christmas and Happy Holidays to everyone.  Travel safe.

--Dan
dan _at_ denimgroup.com

PS Many thanks to the Wikipedia folks and AZAdam for the base cat image I LOL-Cat'd up.

OWASP AppSec 2007 San Jose: Day 1

By Dan Cornell

As mentioned before, John Dickson and I are up at the OWASP AppSec 2007 San Jose conference this week.  I had a chance to attend some great sessions and talk witha  bunch of great folks today.  Here are some notes:

• The keynote speakers were Dave Cullinane and Michael Barrett from eBay and PayPal.  Michael had to run off to catch a plane, but Dave gave a great overview of the scale of the problem eBay faces trying to build a trusted platform for commerce.
• Chris Wysopal's talk about finding backdoors in software was fantastic.  It had some great analysis of backdoors discovered in software in the past and great discussion of possible signatures for static analysis tools that can help identify potential backdoors.  It is hard enough to find security vulnerabilities introduced into software accidentally - looking for backdoors intentionally crafted and inserted is just that much harder.
• Eric Sheridan's talk about Cross Site Request Forgery was very informative and I am looking forward to trying out his two new CSRF tools.
• I caught up with IBM Watchfire's Ory Segal. He gave me a demo of some of the new AppScan 7.7 features.  I have been slacking off but I finally got a copy of the beta and will be looking at it through the end of this week.  So far it looks to be pretty impressive.  I'm looking forward to the new "state inducer" feature that allows you to record more complicated workflows to get an application into a state where you can actually test it.  Think of an application with a three step process - you need to go through steps one and two before you can test the functionality at step three.  This has been a problem with scanners we have used in the past when we are testing more complicated web applications implementing multi-step processes.
• Amichai Shulman's talk about defeating Web 2.0 vulnerabilities was basically a web application firewall commercial - but I suppose that is to be expected.  He did have an excellent point that given the number of CSRF vulnerabilities that exist in existing code it is a daunting task to try to eliminate them all in code.  From that standpoint WAFs certainly do have a place in any serious application security infrastructure.
• I caught the tail-end of Robert "RSnake" Hansen's talk about browser insecurities.  OWASP is launching a Working Group to deal with browser insecurity issues and I look forward to seeing what the come up with.
• The "Building and Effective Application Security Assurance Program" panel did a good job of laying out what does and does not work when creating such programs.  Hint: don't pick a tool and think that your problems are solved.
• The OWASP Leaders meeting was a good chance to put some names with faces.  It also made me realize that the Texas chapters - San Antonio, Austin, Houston - need to do a better job of attending the OWASP national conferences.
• As always the OWASP Dinner was a great chance to relax after an day packed with great information.

So that is a wrap up of Day 1.  More info to come on Day 2.

--Dan
dan _at_ denimgroup.com