Upload
loreen-harrington
View
217
Download
2
Embed Size (px)
Citation preview
Securing Internet Applications
SoBeNet User group meeting08/10/2004
Recent trends in Internet Security
• Key findings for Q1-Q2 2004• Increased Threats to e-Commerce
• Attacks Against Web Application Technologies Are Increasingly Popular
• Short Time Between Vulnerability and Exploit
• Rise in Bot Networks
• Increase in Severe, Easy-to-Exploit vulnerabilities
end user systems are compromised and used to attack the application/server platforms
Attack life cycle
• Step1: Reconnaissance scanning• Port scans, Vulnerability scans
• Asset discovery scans
• Step 2: Exploiting vulnerabilities• Buffer overflows, Backdoors,
• Email attachments, active content,…
• Step 3: Installing backdoors, trojans• Create new and modify existing files, weaken security settings
• Step 4: Go forth and multiply • Mail, web, irc,ftp, file shares
• Step 5: Distributed attack• Delete files, DOS, …
Beyond network attacks …
• hidden field manipulation
• cookie poisoning
• backdoor and debug options
• stealth commanding
• parameter tampering
• SQL injection
• session hijacking
• buffer overflow
Interception at the network layer doesn’t allow enough protection!
• cross-site scripting
• forceful browsing
• denial of service
• data theft
• forged transactions
• ...
application level attacks
Rooting out flaws…
• Discovering vulnerabilities before applications reach production status
No absolute security: secure for how long? from whom?
Source: Infosecurity Magazine
MULTI LAYER approach to Application Security
• Coarse grain interception techniques• Network based interception
• System based interception
Dee
p P
acke
t Ins
pect
ion
Security Context and CoordinationDefense In Depth
1234567
GU
ID
eep
Pac
ket I
nspe
ctio
n
1234567
Pre
sen
tati
on L
ogic
Dee
p P
acke
t Ins
pect
ion
1234567
Bu
sin
ess
Log
ic
Dee
p P
acke
t Ins
pect
ion
1234567
Dat
a A
cces
s
Dee
p P
acke
t Ins
pect
ion
1234567
Dat
a L
ayer
Network based Interception
• Perimeter Security• Packet filter circuit level gateway application gateway
• General trend to incorporate application level security in the perimeter firewalls
• Concentration of security logic, but performance?
• Connection Security• Mutual Authenticated Connection
• Confidentiality
• Integrity
• Symmetric Proxy configuration (client site component)
• IPSEC Tunnel - SSH Tunnel - SSL Tunnel
• (Semi) Transparent solution
general applicable in production environments
Network based Interception (cont’d)
• Application Security• Detection vs. Prevention techniques
• Network Transparent Proxy and Reverse Proxy• Separate system intercepting all requests/responses between client
and server • Isolation of the systems running the application in a secure zone• Authentication and coarse grain authorization, SSO
• Implement application level sanitizing and shielding• Application specific approach
Example 1: Web Application Shielding
Network level
filtering
Application level
filtering
• An application firewall filters the traffic that the network firewall must allow
HTTPallowed
Firewall Server
HTTPvalidation
ApplicationShield
Regular Users
Example 1: Web Application Shielding
Network level
filtering
Application level
filtering
zero latency!
• An application firewall filters the traffic that the network firewall must allow
HTTPallowed
Firewall Server
HTTPvalidation
ApplicationShield
Regular Users
Hacker
How does it work?
sanity check policy check content check
• The Security Shield blocks all traffic that an application does not expect, using a three-layer validation
• is the request well-formed?
• e.g. buffer overflow, cookie poisoning
1
• is the request expected?
• e.g. forceful browsing, stealth commanding
2
• is the content expected?
• e.g. parameter tampering, forged transactions
3
Sanity check
• Translation of URI into canonical form• Empty URI
• Starting /
• Hex decoding
• Ascii control characters (e.g. <32)
• Reserved characters (RFC)-> %xy
• Remove “.” and “..” dirs
• Protocol check• E.g. HTTP1.0/HTTP1.1
• Method check• E.g. HEAD/POST/GET/…
Sanity check (cont’d)
• Path Sanity check• URI length
• Path depth
• Determination of file part in an URLHidden filesE.g. /site/dir/malicious_script.asp/pathinfo/goodlooking.htmlE.g. /site/version2.1/good.html
• Request and Response Header check• Application Defined headers
• RFC defined headers
• Other not-standard headers
• Protect against fingerprinting.
Policy check
• Default Deny Policy• If the URI doesn’t match a known pattern reject request
• Attack patterns• Predefined list of well-known attack patterns
• Filtering Patterns• File name pattern
• directory string and flag indicating if the pattern is valid for all subdirectories of that directory as well
• set of allowed request methods for the pattern
• switch indicating if parameters are allowed or not and if there is a maximum length specified
Content check
• Parameter Check• Name
• Maximum length
• Type : "nocheck“, "alpha“, "numeric“, "alphanumeric“, "ip“, "enumeration“, "pattern“, "empty“, "novalue“
• Allowed/required
• Encoding (multi-part, url-encoding)
• Maximum Occurrences
• Parameter Groups• Manageable configuration
• Contains a list of individual parameter check definitions
• If exhaustive switch set no other parameters allowed
Other checks
• Cookie protection• Integrity check for detecting cookie poisoning and tampering
• confidentiality for cookies in transit or persistent cookies
Introduction of security state in the application session
• Hidden field Protection• Mapping of response of the server to request of the client
Requires a state full system
• Request – Response Mapping• Validation of response codes
• Validation of mime-type response corresponds to original requests
• Pattern matching in response content
• Audit log• Secure trace of all traffic for forensic analyses
• Logs a stored on secure system
Problems related to http reverse proxy architecture
• E.g. HTTP protocol contains references to information of lower level layers
• Relocation stage• Request header Host:• Response header Location:• Response header Content-Location: reverse mapping:
• Forwarder stage• SSL authentication bridging
Pro’s and con’s related to http reverse proxy architecture
• Pro’s• Centrally managed, secured and accelerated SSL
• Ideal place for Web Caching and Content Compression
• Con’s• Inline point of failure
• Increased latency
System based Interception
• Operating System Level• Plug-able services of the OS (e.g. network or file io)
• Loadable kernel module for system call interception are well known in the research community for more than 5 years
• Very effective technique for protection against Step 3,4 and 5
Since recent general applicable in production environments Considerable effort is spent on tools for defining a system baseline for common platforms and to make the technology manageable
• Library Level• Invasiveness scale
• Not invasive: Dynamic Linking against other libraries• Medium invasive: Recompilation with f.e. compiler supporting addition
of code to dynamically check stack frames• Highly invasive: Modifying program code to interact with new api’s• See a.o. work of DistriNet in the context of the SoBeNet project
System based Interception (cont’d)
• Data Privacy• Encrypted File systems
• Encrypted databases• Generic Interception technique via Views and Triggers to transparently add encrypted
information in tables
Key management
• Language Runtime Support• E.g. Load time modification of binary code
• Techniques are well known and promising for supporting composition and component frameworks but not general applicable for legacy software
Allows very fine-grained modifications and as such too intrusive to apply on production applications
• Application Platform Suite• J2EE container services and components
• Microsoft .NET services and components Under investigation
Example 2: Securing System Endpoints
Network
Host Operating System
Application
Network Traffic Interceptor Network Shield (FW)
System Call Interceptor LKM
File IOProcess ExecutionMemory Access
Registry AccessCOM Object Access
DiskSystem
IP level-Syn Flood-Malicious IP headers-ICMP requests-…Service level- ip ranges (in/out)- services
• A host intrusion prevention system filters all access to the system
How does it work?
• Policy based on access rules
• Policy based on heuristic rules• Correlation of system call events
• Cross Correlation of events of different systems
Resource
Operation
Application
Allow/Disallow
Rule
RuleRule
Example rules
Operation
Read, Write
File Access Control Rule
ActionDeny, Allow, QueryApp
Class$MS_Offic
e
FilesC:\winnt\*.exe
Connection Direction
Client, Server
Network Access Control Rule
ActionDeny, Allow, Query
App Class$MS_Office
Network Address128.66.2.10-20
Network Servicetcp/80
Pre defined system baselines
• Network Applications
• Processes created by Network Apps
• Processes that read downloaded content
• Processes created by servers (TCP and UDP)
• Remote clients
• Microsoft Office Applications
• Web Browser Applications
• Email Applications
• . . .
Current and future work
• Study and evaluation of point solutions
• Additional research on interaction of interceptors• For exchanging information not accessible in a particular
interception point (e.g. authentication information for access control module or database access)
• For attack correlation reduction of false positives while preserving security level
• Applying interception framework to case studies using industry technology (J2EE, .NET)
www.ubizen.com