Don’t get Stung (An introduction to the OWASP Top Ten Project) Barry Dorrans Microsoft Information Security Tools NEW AND IMPROVED!

Contents OWASP Top Ten A worldwide free and open community focused on improving the security of application software

Introduction Do not try this at home. Or at work. These are not just ASP.NET vulnerabilities If you don’t want to ask public questions... /

10 – Unvalidated Redirects and Forwards

Unvalidated Redirect and Forwards Users don’t check the address bar MVC authentication (pre-3.0) is vulnerable. Check the ReturnUrl parameter – 1/01/25/preventing-open-redirection-attacks- in-asp-net-mvc.aspx

9 – Insufficient Transport Layer Protection

Insufficient Transport Layer Protection Use SSL Protection communications between web server and backend systems (SSL, IPSEC etc.) Replay attacks – use time limited tokens

8 – Failure to restrict URI access

Failure to restrict URI access Security by obscurity is useless Restrict via ASP.NET – no rolling your own! Integrated pipeline restricts everything Use [PrincipalPermission] to protect yourself IIS7 replaces file ACLs with a web.config based authorization list.

7 – Insecure Cryptographic Storage

Insecure Cryptographic Storage Symmetric – same key Asymmetric – public/private keys Use safe algorithms – Hashing : SHA256 Symmetric: AES Asymmetric:CMS/PKCS#7 Encrypt then sign

Insecure Cryptographic Storage Use symmetric when – All systems are under your control – No need to identify who did the encryption Use asymmetric when – Talking/accepting from external systems – Non-repudiation on who encrypted/signed (X509) – All in memory – so no large plain tex! Combine the two for speed and security

Insecure Cryptographic Storage Do not reuse keys for different purposes Store keys outside the main database Use CryptGenRandom for random numbers Use & rotate salts Use unique IVs DAPI can provide a key store

6 – Security Misconfiguration

Security Misconfiguration PATCH PATCH PATCH IIS7 App Pool Isolation – security-isolation-for-web-sites/ URLScan Security Runtime Engine (CTP) Disable unused modules, accounts etc.

Security Misconfiguration

Security Misconfiguration NB: Some modules depend on others Forms auth needs caching. There’s no easy way to tell!

5 – Cross Site Request Forgery

Cross Site Request Forgery WebForms – Lock ViewState using ViewStateUserKey Needs a way to identify user Set in Page_Init – Use a CSRF token – MVC - in form [ValidateAntiForgeryToken] – on action method Encourage users to log out When is a postback not a postback?

4 – Insecure Direct Object Reference

Insecure Direct Object Reference Use indirect object references Always check access permissions For MVC don’t allow binding to your ID field [Bind(Exclude="id")]

3 - Broken Authentication/Sessions

Broken Authentication/Sessions Don’t roll your own! If you must validate sessions on every request check the browser string, not the IP

2 – Cross Site Scripting

XSS

XSS All input is evil Work from white-lists not black-lists. Store un-encoded data in your database Use HttpOnly cookies AntiXSS project – Better HTML/URL Encoding – Adds HTML Attribute, Javascript, VBScript XSS Cheat Sheet

1 – Injection Flaws

Injection Flaws SQL – Use SQL parameters – Remove direct SQL table access – When building SQL strings within SPs parameterise those too! Xpath – Use XsltContext –

Injection Flaws 'SELECT * FROM Customer WHERE FirstName OR LastName @last

Changes from 2007 Malicious File Execution Information Leakage / Improper Error Handling Security Misconfiguration Un-validated Redirects and Forwards

The OWASP Top Ten A1-Injection A2-Cross Site Scripting (XSS) A3-Broken Authentication and Session Management A4-Insecure Direct Object References A5-Cross Site Request Forgery (CSRF) A6-Security Misconfiguration A7-Insecure Cryptographic Storage A8-Failure to Restrict URL Access A9-Insufficient Transport Layer Protection A10-Unvalidated Redirects and Forwards

Mandatory Book Pimping

Questions