Armorizing applications

Armorizing Applications

Iftach Ian AmitDirector of Services

Friday, October 11, 13

I’m not an application guy :-|

I’m a security guy

Who actually used to do some application stuff

whoami?

uid=501(iamit) gid=20(ioactive) groups=12(hack),33(research),61(dev),79(red_team),80(sexy_defense),81(exil),98(idf),100(dc9723),204(/dev/null)

Attack?

Defense!

So, I’ve been dealing with defense a lot

As in - helping defenders get a head start

Guess what? We are still failing on the basics...

Logs...

Firewall

Logs...

FirewallIDS

Logs...

FirewallIDS

Logs...

FirewallIDS

Network

Logs...

FirewallIDS

Network

Logs...

FirewallIDS

Network

Logs...

FirewallIDS

Network

DBMS DNS

Logs...

FirewallIDS

Network

DBMS DNS

Application?

We still have sucky application logs :-(

I mean, we came a long way since web-app coding in the 90’s

I know. I’ve lived through it :-(

Example:

Uses MVC. Actually very nicely

architected...

Example:

architected...

Example:

architected...Good start. At least

we can haz data.

Example:

we can haz data.

This is pretty much useless*

Example:

we can haz data.

This is pretty much useless*

* from a security perspective.no doubt that when this breaks you’ll need it

Let’s get back to basics for a sec here

time=2013-03-02 23:59:57 action=drop orig=192.168.1.103 i/f_dir=inbound i/f_name=eth1c0 has_accounting=0 product=VPN-1 & FireWall-1 policy_name=INTERNET src=1.2.3.4 s_port=37586 dst=3.4.5.6 service=80 proto=tcp rule=16 xlatesrc=8.9.10.11 xlatesport=57517 xlatedport=0 NAT_rulenum=4 NAT_addtnl_rulenum=internal

but wait,

how about them HTTPD?

193.205.210.42 - - [09/Oct/2013:00:57:17 -0700] "GET /blog/2013/07/mail-encryption-for-android/ HTTP/1.1" 200 32064 "https://www.google.it/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36"193.205.210.42 - - [09/Oct/2013:00:57:19 -0700] "GET /blog/wp-includes/js/comment-reply.min.js?ver=3.6.1 HTTP/1.1" 200 1068 "http://www.iamit.org/blog/2013/07/mail-encryption-for-android/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36"193.205.210.42 - - [09/Oct/2013:00:57:19 -0700] "GET /blog/wp-content/plugins/podpress/js/podpress.js?ver=3.6.1 HTTP/1.1" 200 40786 "http://www.iamit.org/blog/2013/07/mail-encryption-for-android/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36"193.205.210.42 - - [09/Oct/2013:00:57:19 -0700] "GET /blog/wp-content/plugins/jetpack/modules/sharedaddy/sharing.css?ver=2.5 HTTP/1.1" 200 11641 "http://www.iamit.org/blog/2013/07/mail-encryption-for-android/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36"193.205.210.42 - - [09/Oct/2013:00:57:19 -0700] "GET /blog/wp-content/plugins/lightbox-2/lightbox.js?ver=1.8 HTTP/1.1" 200 21623 "http://www.iamit.org/blog/2013/07/mail-encryption-for-android/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36"193.205.210.42 - - [09/Oct/2013:00:57:19 -0700] "GET /blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1 HTTP/1.1" 200 7484 "http://www.iamit.org/blog/2013/07/mail-encryption-for-android/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36"193.205.210.42 - - [09/Oct/2013:00:57:20 -0700] "GET /blog/wp-content/plugins/podpress/players/1pixelout/1pixelout_audio-player.js HTTP/1.1" 200 12305 "http://www.iamit.org/blog/2013/07/mail-encryption-for-android/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36"193.205.210.42 - - [09/Oct/2013:00:57:20 -0700] "GET /blog/wp-content/plugins/jetpack/modules/wpgroho.js?ver=3.6.1 HTTP/1.1" 200 1212 "http://www.iamit.org/blog/2013/07/mail-encryption-for-android/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36"193.205.210.42 - - [09/Oct/2013:00:57:20 -0700] "GET /blog/wp-content/plugins/jetpack/modules/sharedaddy/sharing.js?ver=20121205 HTTP/1.1" 200 39040 "http://www.iamit.org/blog/2013/07/mail-encryption-for-android/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36"193.205.210.42 - - [09/Oct/2013:00:57:21 -0700] "GET /blog/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=3.5.2 HTTP/1.1" 200 8610 "http://www.iamit.org/blog/2013/07/mail-encryption-for-android/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36"193.205.210.42 - - [09/Oct/2013:00:57:21 -0700] "GET /blog/wp-content/plugins/contact-form-7/includes/js/jquery.form.min.js?ver=3.40.0-2013.08.13 HTTP/1.1" 200 14910 "http://www.iamit.org/blog/2013/07/mail-encryption-for-android/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36"193.205.210.42 - - [09/Oct/2013:00:57:23 -0700] "GET /favicon.ico HTTP/1.1" 200 1351 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36"193.205.210.42 - - [09/Oct/2013:00:57:23 -0700] "GET /blog/wp-includes/js/jquery/jquery.js?ver=1.10.2 HTTP/1.1" 200 93371 "http://www.iamit.org/blog/2013/07/mail-encryption-for-android/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36"Friday, October 11, 13

Don’t get me started...

And that’s AFTER taking into account “log analyzers”

“But you security guys have all these fancy SIEM stuff, right?”

Yes, we have fancy dashboardsand graphs

and sometimes synchronized logs from multiple sources

But it’s still a pain in the tuches

The application has ALL THE CONTEXT

Yet you keep it to yourself

This made me cry in joy:

Firewall Web Server

Client XClient XClient YClient XClient YClient YClient XClient XClient XClient YClient Y

indexitemsindexitems+aitemsitems+ccheckoutloginconfirmcheckoutconfirm

Firewall Web ServerApplication

Client XClient XClient YClient XClient YClient YClient XClient XClient XClient YClient Y

indexitemsindexitems+aitemsitems+ccheckoutloginconfirmcheckoutconfirm

- John, from X, justbought A and shippedit paying with CC

- Client from Y tried tobypass app logic and avoidpayment/auth

Rinse, Lather,Repeat

Everywhere!

DB AccessSession ManagementState ManagementUser Management

Be a dot connector!

Counter Intelligence use-case

Problemdormant accounts used

for fraud (and/or money laundering)

Account

>1yr dormant

Account

>1yr dormant

laundering

Account

>1yr dormant

laundering

Intl. transfers

Account

>1yr dormant

laundering

Intl. transfersInternal/External???

Account

AccountAccountAccountAccountAccount

Marketing

Accounting

Branch mgmt.List

Marketing

Accounting

Branch mgmt.

Marketing

Accounting

Branch mgmt.

Marketing

Accounting

Branch mgmt.

AccountAccountAccountAccountAccountList

Marketing

Accounting

Branch mgmt.

Internaluser

Marketing

Accounting

Branch mgmt.

Internaluser

Marketing

Accounting

Branch mgmt.

Internaluser

PC Trojan

Internaluser

PC Trojan

Internaluser

PC Trojan

Internaluser

PC Trojan

Internaluser

PC Trojan

C&CBad Guys(tm)

Log on context

Weird state changes

Repeatable expectable actions

Who, what, why

Help me get the story right!

Questions? Comments!

Ian Amit@iiamit

ian.amit@ioactive.com

Armorizing applications

Technology

Google Applications - rdi.ku.ac.th · Applications for Home & Office – Forms การใช้งาน Google Application: Applications for Home & Office . Applications for Home

Applications - B30 and B90 Applications

Theory Simulations Applications Theory Simulations Applications

Applications Using standard Bioinformatics applications

· Web viewSpreadsheet Applications, Word-Processing Applications, Presentation Applications, Internet Browsers, Reference Management, and Image Processing Applications. Computer

content.alfred.com · Drumset Exercises for Rock and Jazz Fills Rudimental Applications Rock Applications , Jazz Applications Funk Applications Afro-Cuban Applications . …

APPLICATIONS AND DECISIONS - assets.publishing.service.gov.uk · 2.1 New applications granted 2.2 New applications refused 2.3 Variation applications granted 2.4 Variation applications

IpLDK Range Applications. ezAttendant Applications

Applications of Computer Graphics. Business applications Maps Industrial applications Consumer applications Entertainment Education

APPLICATIONS AND DECISIONS - gov.uk · 3 LIST OF CONTENTS Section 1 – Applications Received 1.1 New applications 1.2 Variation applications Section 2 – Applications Decided (Without

Anwendung ApplicAtions ApplicAtions

Multimedia Applications Internet Technologies and Applications

APPLICATIONS Dry & Bulk Powder Applications

APPLICATIONS OF MATHEMATICS IN ENGINEERING AND SCIENCEfirst.math.aau.dk/dan/ressources/applications/?file=applications... · APPLICATIONS OF MATHEMATICS IN ENGINEERING AND SCIENCE

Applications performance Management For Enterprise Applications

Linear Programming Applications in Marketing, Finance and Operations Marketing Applications Marketing Applications Financial Applications Financial Applications

Applications for relief - ASIC Home · 2014-09-09 · There are three types of applications for relief—standard applications, minor and technical applications and new policy applications:

The WACE/TISC/TAFE process€¦ · TAFE Applications Semester 1, 2016 APPLICATIONS –Applications completed online 31 August 201 Applications open. 2 December 2015 (Round 1 –Applications

Applications of Molecular Applications of Molecular ... · Applications of Molecular Applications of Molecular Biotechnology: Biotechnology: Ethanol Production from Cellulosic Biomass

LUBRICANTS GUIDE - John Deere · 2 Lubricants Guide Applications Applications Applications Applications – For use in heavy-duty off-road applications, on-road trucks, marine engines,