View
0
Download
0
Category
Preview:
Citation preview
The OWASP Foundation
AppSec DC
http://www.owasp.org
Techniques in Attacking and Defending XML/Web Services
Jason Macy CTO Forum Systemsjmacy@forumsys.com
OWASP2
Agenda
1. Introduction to XML/Web Services Threats
2. Techniques for Defending XML Threats
3. XML Attack Examples and Classification• SQL Injection• Denial of Service• XSD Mutation
4. Review Attack Examples by:• Attack Definition: Scenario Setup• Attack Vectors: Building Penetration Tests• Post-Attack Analysis: XML Vulnerability Detection• Countermeasures: XML Gateway
OWASP
VectorsVectors
SOAP, XML, REST
Introduction to XML Threats
1..N source IP
SQL Injection
XSD Mutation
Virus
Malware
Identity Discovery
Denial of Service
Vectors
Explicit AttacksForced Disruption Bring Down or Limit Enterprise Service AvailabilityInformation Theft Gain Access to Enterprise ResourcesVendor Discovery Expose Known Traditional Attacks
Implicit VulnerabilityPerimeter Breach Embedded Virus, MalwareInfrastructure Malfunction Parser and Data Processing Failures
OWASP
New Attack Vectors
Protocol Firewalls are Blind to XML Malware and Virus delivered via SOAP Attachments WSDL Exposes Schema and Message Structure Injection Attacks Exposed VIA XML Parameters Data Replay Attacks
SOAP/XML SOAP/XML
Web Service
Client
OWASP5
Security Testing - Base Requirements
Security FrameworkSign, Encrypt, Decrypt, SSL
Identity FrameworkBasic Auth, SSL Auth, WS-Security Token Auth
Parameter InjectionDatabase or File DrivenPermutations for Security, Identity, and SOAP/XML
Concurrent Client Simultaneous LoadingDenial of Service Testing
SOAP with AttachmentsMalware and Virus testing
Dynamic XSD MutationDerive SOAP Vulnerability profile from WSDL Schema
OWASP6
XML Security Gateway - Base Requirements
Transaction Privacy• Encryption, Decryption, SSL
Transaction Integrity • Digital Signature, Signature Verification, Schema Validation
Transaction Accountability• Archiving, Logging, Reporting, and Monitoring
Transaction Threat Mitigation• Intrusion Detection and Prevention • Rate-based rules, Size-based rules, AntiVirus detection, Pattern recognition• Structural integrity, Protocol adherence, Authorization Attempts
Certified PKI Infrastructure (DOD PKI)• X509 Path Validation• Sign/Verify, SSL Initiation, SSL Termination
Certified Security Architecture (FIPS)• Key Management and Storage• Physical Device Security
OWASP7
XML Attack Examples and Classification
1. SQL Injection Attack• Classification: Injection, Data Excavation
2. Denial of Service Attack• Classification: Resource Depletion
3. XSD Mutation Attack• Classification: Data Structure Attacks, Resource Manipulation
CAPEC: Common Attack Pattern Enumeration and ClassificationNational Cyber Crime Division of DHS
http://capec.mitre.orghttp://nvd.nist.gov/
OWASP8
XML Web Services based
SQL Injection Attack
OWASP9
SQL InjectionUnsecured
How to AttackConstruct SQL Escape SequencesConstruct SQL 1=1 Query Inject into XML Node values
Discovered ExposureSensitive Data LossDatabase Corruption
MySQL
o PHPo NuSOAP
Apache
OWASP10
SQL Injection1. What is it?
• SQL injection is a technique that exploits a vulnerability that occurs in the database layer of an application.
• Application incorrectly filters for a string literal escape characters embedded in SQL statements.
2. Example: • Good: ‘select * from accounts where username="' . $username . '"' . 'AND
password="' . $password . ’";
• Evil: select * from accounts where username="" or 1=1 #"AND password="””;
3. Attack Vector:• Old: User input from a browser-based application
• New: XML Web Services – WSDL defined Interface
OWASP11
Component Details – MySQL Database
oTest MySQL Database o phpMyAdmin UIo Accounts Table Data
OWASP12
Component Details – PHP Application
1. Function: getAccounts()
2. Connect to Database
3. Construct SQL Query:Great Vulnerability Point
4. Execute Query
5. Parse Query Results
6. Register function as a Web Service
OWASP
SQL Injection over SOAP Message – Unsecured
13
• SQL Injection over XML/SOAP
• Full Table Returned in SOAP Response: 34 Records
• Pointed to Service Endpoint• Advertises use of PHP
OWASP14
SQL InjectionXML Gateway Secured
o Inbound Pattern Detectiono Prevent Outbound Leaks
XML GatewayClient
How to DefendDeploy XML Gateway Enable Pattern Scanning IDP RulesConfigure Response Message Size and Complexity Limits
AdvantagesPrevent Data LossAlert and Quarantine Attempted Breaches
MySQL
o PHPo NuSOAP
Apache
OWASP
SQL Injection over XML/SOAP – Sentry Protection Policy
15
o Pre-built Pattern Matching for SQL Injection Detectiono Extensible for Business Specific Requirements
OWASP
SQL Injection over SOAP Message – Secured
16
• SQL Injection over XML/SOAP
• SOAP Request Stopped by XML Gateway
• Pointed through XML Gateway• Endpoint Technology Obfuscated
OWASP17
XML Web Services based
Denial of Service Attack
OWASP18
Denial of ServiceUnsecured
Web Service
Client
How to AttackLoading Client with Concurrent Simultaneous ThreadsCoercive Parsing Attack
Discovered ExposureUnlimited message flowUnfair Service SLA distributionBack-end CPU and I/O Saturation
OWASP
Denial of Service – Unsecured
19
• Capable of ~700 TPS• No restrictions on Client
• Multiply Service running on IIS
OWASP20
Denial of ServiceXML Gateway Secured
o Enforce Transaction Rate
XML Gateway
Web Service
Client
How to DefendDeploy XML Gateway Set Allowed Transaction Rates (Group, User, or IP)
AdvantagesMessage Flow Limited to Specified RateService Throughput Fairly Distributed Back-end mitigated from CPU and I/O Saturation
OWASP
Denial of Service – Sentry Protection Rule
21
• 20 TPS Restriction Policy
• Granular Enforceability
• Configure Action• Custom Message
OWASP
Denial of Service – Sentry Protection Action
22
• Action: Abort Processing
• Additional Options: Throttle, Block• Stealth Mode to suppress data leaks via responses
• Prevent log flooding
•Quarantine Messages for further analysis
OWASP
Denial of Service – Secured
23
• Request: Multiply a x b sent through XML Gateway
• 20 TPS Restriction triggered• Client cannot invoke a DoS• ~ 680 TPS service capacity remains
OWASP 24
Echo Request: s= test All responses are successful well-formed XML Min 1.20 ms Max 3.50 ms Ave 1.60 ms
Echo Request: s= test All responses fail XML not well-formed Min 2.10 ms Max 5.0 ms Ave 2.73 ms
<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:s0="http://microsoft.com/webservices/"><soap:Body>
<s0:Echo><s0:s>test</s0:s>
</s0:Echo></soap:Body>
</soap:Envelope>
<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:s0="http://microsoft.com/webservices/"><soap:Body>
<s0:Echo><s0:s>test</s0:s>
</s0:Echo></soap:Body>
</soap:EnvelopeMissing “>”
> 70% Degradation by removing one character
Another Example: Denial of Service through Coercive Parsing
OWASP25
XML Web Services Based
XSD Mutation Attack
OWASP26
XSD Mutation AttackUnsecured
Client
How to AttackObtain WSDL Derive Message Structure and Types from WSDL SchemaSend SOAP Message Mutations based on Schema
Discovered ExposureCode Paths not Handled for ExceptionsStack Traces Returned with Implementation DetailsApplication Failure
Web Service
OWASP
XSD Mutation Attack – Lifecycle
27
Author Attack Vectors
Run Attack
AnalyzeResults
Add New DetectionLibraries
Vulnerability Report
OWASP
XSD Mutation: Building Attack Vectors
28
• Service Loaded from endpoint
• Mutant Messages generated based on WSDL – XSD• Data type, structure, size mutations
OWASP
XSD Mutation: Analyze Attack
29
• Test generated based on WSDL complexity
• Sample Data Value Mutation
• username contains string value mutation
• response reveals backend components and method calls
OWASP
XSD Mutation: Extend Detection Libraries
30
• Vulnerability Detection Libraries• Application/Platform Specific• Business Specific – SSN, Credit Card
• Look for nusoap.php• High Severity – Open source Parser
OWASP31
XSD Mutation AttackXML Gateway Secured
o Enforce Inbound Schema Validationo Prevent Outbound Data Leaks
XML GatewayClient
How to DefendDeploy XML Gateway Enforce Inbound Message Structure and Type ValidationCleanse Outbound Data (Stack Traces, Sensitive Data)
AdvantagesReduce Parser Impact on Web ServiceRemove Vendor and Implementation Details in ResponseProtect Application Layer Code Paths on Web Service
Web Service
OWASP
XSD Mutation – Sentry Protection Policy
32
• XML Gateway provides Policies to protect against XML specific attacks
OWASP
XSD Mutation – Secured
33
1. Deploy Specialized XML Gateways – Packet Firewalls and HTML Application Firewalls are insufficient
2. Validate XML against a robust schema
3. Tighten Schema: e.g., string string 2048
4. Enforce XML specific detection rules e.g., node depth, recursive payloads
OWASP34
Best Practices for Countermeasures
Information Control – Outbound Restrict SOAP Faults Protect Sensitive Information Audit Transaction Flows
Use Web Services Penetration Testing Product Out of the box Vulnerability Discovery Simplified Testing and Diagnostics of Service Endpoint Validation of Security Gateway Policies
Deploy XML Web Services Gateway Forum Systems Sentry XML Gateway Barracuda Radware AppXML
Deploy Centralized XML Security Enforce Policy Independent of Application Servers and OS Platforms Audit and Filter Sensitive Information Separate Security from Application Code
Information Control – Inbound Tighten Payloads Enforce SLA Disallow SQL, Virus, Malicious Code
OWASP35
Learn more @
www.forumsys.com
Recommended