Compliance : One Step at a Time

When I was a teenage a Gym instructor told me that if I workout 1hour everyday for 3 months I can certainly build a healthy and well shaped body. However, he also warned me not to overdo exercises. He clearly warned me that if I start doing workout for 5-6 hours per day for (say) 15 days it’s only going to harm my body.

Point taken and I am sure most of us will agree with this piece of advice.

I wish management executives understand this wisdom and start applying the same in IT Security and risk management projects, more specifically in compliance projects.

Time has come when at least large organizations are under pressure to meet the compliance & regulatory requirements. Certainly it’s a long awaited milestone and will have significant impact in developing a positive security posture. However conventional style of project execution involving pushing your team members hard to reach targets ASAP may easily lead to frequent failures and finally loss of this long awaited opportunity.

Reaching compliance levels is not a 2-3 months job (unless and until organization/team is very small). We may have such short duration projects for planning and preparation of external certifications such as ISO27001 or PCI (Though not recommended). Still to have a sustainable and secure environment we will have to have a plan extending in years not just months. Not to forget that, even if you have received external certifications in 2-3 months you are bound to go for regular reviews which will require a sustainable security posture.

To succeed in forthcoming reviews and become really resilient to IT Security Risks, your employees and process owners must dissolve the policy, process and procedures in their day to day working. Just attending security awareness trainings and then signing attendance sheet will not solve the purpose. I have seen many cases where employees have gone through a lot of security trainings or quizzes but still they don’t understand the basics of their company’s security procedures.

Organizations will have to realize that attaining a sustainable security posture is a gradual process and may easily take years and multiple reviews. Have patience and work with your employees. Let it become part of your organization’s work culture and gradually cost of security projects will start coming down system administrators as well as end users will become proactive. Reporting of security incidents will not be considered as a time wastage activity and Information Security Managers will no more be considered as police man.

Tamper Data: Firefox Add-On for Web-Application Security Testing

(Images have been used for html tags and scripts as tags are not permitted in some of blogspot fields and scripts may get executed in readers' browser)

Tamper Data is a very powerful, free add-on for Mozilla Firefox. Truly speaking, I never expected an 80 KB plugin to have so many functionalities.
You can tamper (As the name suggests) HTTP/HTTPS requests by traping browser responses, manipulating HTTP parameters like content-type and length (useful in HTTP Splitting), Cookies and POST data, you can add or delete elements/fields and last but not the least, you have a good number of in-built test cases which you can try during web-application security testing.

Lets have a quick look of the product and parallaly leran some hacking....;-)

Tablet Super Store is an Online PC Shop (http://www.bayden.com/sandbox/shop/), intentionally designed with a vulnerability so that wanna be penetration testers can test their metal.






We will also try to hack it, but in a while...

First, some home-work with Tamper Data (TD). If you have downloaded and installed the tool from Mozilla Firefox' addon site (https://addons.mozilla.org/en-US/firefox/addon/966) you will find it under Tools>Tamper Data.

Next, Select Start Tamper option from TD menu to trap every Web request/response. As you can see in the image below, the moment a request/response is generated it gets trapped in between your browser and the web-server. You get 3 options:

1. Tamper (To manipulate)
2. Submit (Accept the request/response AS-IS)
3. Abort Request (stop the data flow before it reaches web-server)

Additionally, it asks Continue Tampering? (no need for explanation)

While shopping at the PC Mall, I selected the quantity of PCs I wanted to purchase and clicked ORDER and I got a pop-up with three options mentioned above. lets Tamper....

Wow..All HTTP request/response fields are available in an easy to understand format (I hope you also prefer tabuler view of HTTP data over raw view, and in case you dont understand raw view at the moment, forget it).

Here comes the best part of TD. As you can see in the image below, you get a good number of options to try on trapped data. Add/delete fields, play with encoding/decoding, try some Input Validation, Cross-Site Scripting or otherwise SQL Injection.

Lets see what do we have for Input validation....

A variety of data formats which you can try for Input validation, Client-Side Validation and sometime for Buffer overflow tests.

Next comes, XSS or Cross-Site scripting.

You have a good variety of scripting tests. You may start with Alert test which works well in most of the XSS vulnerable sites. (Hint: Try it in someone's guestbook or feedback form. In case the site is XSS vulnerable she will get a nice pop-up with hello message written over it.)

Next in the row is SQL (Mother of all Database hacks)

Try these tests for authentication, authrization testing i.e. to get the whole list of accounts when you are supposed to have access to only yours, or may be none :-)

Now back to online PC shop. So how many to buy......oh u can buy only upto 3 PCs in a shot :-(

Lets tamper...Hmmmmm so there lies the hidden cost field. How about 5 dollers per PC? and yes lets buy 30 PCs in one shot....

Bingo!!!!!!!! 30 PCs for 150$.....not bad for the first hands-on of Web-Applications penetration testing :-)

Similar to TD you have TamperIE for Internet Explorer. However, TamperIE is not as powerful as TD.

For the geeks.....their are more powerful tools, but everything comes at a cost. Either they are commercial tools (Appscan, webinspect, Acunetix) or else man-in-the-middle Proxies (Paros, WebScarab, both free) which require a lil better understanding of pen-testing concepts and proxy configuration.

For beginners..TD is worth a try....

Penetration Testing: Web-Applications Test-Cases (Chapter 1)

(Images have been used for html tags and scripts as tags are not permitted in some of blogspot fields and scripts may get executed in readers' browser)





Broken Authentication and Session Management:


•For well known applications try a Google search for default usernames and password. Try those first.

•If there is no lock out policy in place, try brute force or dictionary attack (You may try Brutus tool which supports both, basic Authentication and Frame based Authentication)

•Basic Authentication: Basic authentication uses 'Authorization' as the cookie name to store the user's credentials. Use WebScarab -> Tools -> Transcoder to Base64 decode the the value in the Authorization cookie.

•Server may skip authentication if you send the right cookie. Intercept the cookies using a Proxy (Paros or WebScarab, both are free) and try to replay the cookie.

•Try guessing cookie values and manipulate cookie value while transfer through Paros or WebScarab.

Buffer Overflows:

Make an http request to application with long query string . Request should be denied and the application should not crash.

You may try long Character string //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

or

2652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652652 (You may try TamperIE tool for Internet Explorer, it’s a free tool and has few inbuilt cases)

Improper Error Handling:

You can change length, existence, or values of authentication parameters. Try deleting a parameter ENTIRELY with browser plug-in or proxy. Apart from interesting error messages, there is a high probability that you may get authenticated also.
Insecure Storage:

Primarily you test week encoding methods used for session ids, cookies, basic authentication etc. you may try Cain & Abel Tool (Free) or online ASCII converters.

Denial of Service:

Access 2 applications/services hosted on the same server. Bombard one of the applications/service with load of request. Now try to make request to other application. Request should be denied.
In case account lockout is configured, Try high number of invalid logons to lock-down. You may try automated tools.

Insecure Configuration Management:

Try to guess the URL for the admin page
Try directory traversal
Try OS command injection


To be continued…………with Chapter 2

Cost-Cutting, Compliance and Security

My curiosity propelled me into the world of computer security. Beginning of the journey was quite tough as the bean counters of corporate world were busy with cost cutting (really? Or the cost cutting doesn’t apply to boss’ female secretary and other cronies ;-) )
However, things have started improving for security consultants as organizations have started acting for the sake of standards compliance (typically a Whitewash).

Hopefully, things will improve further and Chief Security Officers/Managers will also get a promotion from the role of scapegoat to some active role in the organizations. Till that time, live with cost cutting and compliance…..