Developer-centric Application Security Scans Ray Kelly, Practice - PowerPoint PPT Presentation

Developer-centric Application Security Scans Ray Kelly, Practice Principal - Fortify Sherman Monroe, Senior Security Consultant Thomas Ryan, Fortify Solutions Architect #MicroFocusCyberSummit

Session Agenda Mobile Apps – The Bad, The Worse And The Ugly Attacking Web Services using Web Inspect Developer-centric Application Security Scans with Fortify 3

Mobile Apps – The Bad, The Worse And The Ugly Ray Kelly Practice Principal - Fortify #MicroFocusCyberSummit

Agenda Overview of the mobile landscape The mobile threat surface Real world mobile app vulnerabilities Q&A 5

About Me Ray Kelly  Developer for 20 years  Internet Security for 15 years  Lead Developer of WebInspect with SPI Dynamics  Mobile Pen Test Manager 6

Considerations All vulnerabilities discussed in this presentation are either already publicly disclosed or have been anonymized/scrubbed These are developer mistakes that potentially leave users at risk Apps are made by developers with the best of intentions 7

The Mobile Landscape Source: https:// www.statista.com/statistics/274774/forecast-of-mobile-phone-users-worldwide / 8

The Mobile Landscape  Mobile development is the hottest type of development right now. But users may be at risk.  The pressure to release new features on mobile devices may mean that security is not prioritized.  Mobile devices are more vulnerable to threats, so building devices with adequate security and mobile device developers with security training are valuable. 9

Mobile Threat Surface Client Server Network  Credentials in memory  Clear text credentials  Injection flaws  Credentials on file system  Clear text data  Authentication  Data stored on file system  Backdoor data  Session management  Poor certificate management  Data leakage  Access control  Logic flaws 10

Mobile Threat Surface Two key differences: (Compared to traditional apps) Magnified network vulnerability  Your network traffic is more likely to be visible to others with a mobile device than local traffic at work or home Magnified physical vulnerability  As with most other types of hardware, once the attacker has physical access, it’s over 11

Mobile Threat Surface Mobile applications which have at least one critical or high vulnerability 11 89 Source: Micro Focus 2018 Application Security Research Update Report 12

Vulnerabilities Server Side  Vulnerable to all traditional web app vulnerabilities  SQLi, WebDav, XSS etc.  Developers assume APIs are invisible 13

Vulnerabilities Server Side Account enumeration 14

Vulnerabilities Network/Privacy  Privacy/data leakage, clear text data  3 rd party data leakage 15

Vulnerabilities Network/Privacy 16

Vulnerabilities Network/Privacy 17

Vulnerabilities Client Side/Logging Starbucks Mobile App /Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog <input class="field text medium" id="Account_UserName" maxlength="200" name="Account.UserName" tabindex="0" type="text" value="CLEARTEXT" /> <label for="Account_PassWord" class="">Password <span class='req'>*</span></label> <input class="field text medium" id="Account_PassWord" maxlength="200" name="Account.PassWord" tabindex="0" type="password" value="CLEARTEXT" /> “When reached Wednesday, Crashlytics, a Boston-based firm that specializes in crash reporting solutions, couldn’t comment on specific customers but did reiterate that the firm doesn’t recommend developers log sensitive information.” 18 Source: https://threatpost.com/starbucks-app-stores-user-information-passwords-in-clear-text/103649/2/

Vulnerabilities Client Side/Logging 19

Vulnerabilities Client Side/Storage 20

Vulnerabilities Client Side/Debug Screens 21

Vulnerabilities Client Side 22

Fortify on Demand Provides Application Security as a Service Understanding your Comprehensive static, application portfolio is the dynamic/interactive web and mobile first step to securing it testing delivered at the speed of Discover Assess development Integrated workflows to fix Web Continuously monitors vulnerabilities faster and and protects software accelerate a mature AppSec Monitor running in production Remediate program & Protect Mobile Thick-client Leading-edge developer training for Securing DevOps through secure coding best practices and broad Fortify Ecosystem prevent vulnerabilities before integrations and automation check-in Educate Integrate tools 23

Fortify On Demand Mobile Assessments include : Vulnerability analysis of mobile binary Network Endpoint reputation analysis Client Services Security expert review of prioritized results Why Fortify on Demand MAST?  iOS applications Mobile + Assessments include :  Android applications  50+ unique vulnerability categories Manual testing of binary, network and services  Designed for mobile app developers WebInspect analysis of backend services  Manual testing performed on-device 24

#MicroFocusCyberSummit Visit Fortify On Demand at http://microfocus.com/fod Thank You. Follow us on Twitter @MicroFocusSec Ray Kelly Follow me on Twitter: @vbisbest

Attacking Web Services using Web Inspect Sherman Monroe #MicroFocusCyberSummit

Overview Overview of Web Service Scanning SOAP scan setup Manual RESTful Scan setup Automated RESTful Scan setup 27

How does Automated Scanning work? Today employ Crawl Determining Historically only JavaScript attack surface link-based emulation to get dynamic requests Audit Sending known Fuzzing Session-based attack vectors parameters 28

What to look for in a scanner? Understanding Understanding request session generation management (i.e. links) Understanding parameters 29

Discoverability  Endpoints not always explicit in dynamic code  Complex payloads not exposed  URL parameters (e.g. empl/ 38482 /profile)

Demo – Proxies & Web Macros

Identifying Parameters Non-standard parameter specs Patterns in URL segments  As part of URL (e.g. path parameters)  Highly random path nodes  Headers  Numerical values, dates, etc.  Request body Component Values  Upload file content (Content-Type:  Look for structure in parameter values multipart/form-data)  Look for delimiters

Identifying Parameters: Component Values POST /acme/geo/get_feature?uid=68e4cf6a8077912a02b250b230b8abe73265753b HTTP/1.1 Host: acme.com Connection: keep-alive X-CUST-SESSIONID: h57768d18hfr883xc36b53100jeew99sb2b320eb User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: */* Accept-Encoding: gzip, deflate, sdch Accept-Language: ja,en-US;q=0.8,en;q=0.6 {“location":" 48.854325 ",“feature_area_id":”tag=3hks83n3j;name= sector_north ”} HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Date: Mon, 05 May 2017 03:03:56 GMT Content-Length: 138 Connection: keep-alive {“ feature_id":"\u30a4\u30d9\u30f3\u30c8\u3000\u5341\ u4e00",“sz":532,“wght":0.32,"last_photo":"",“resp_code":0} GML Feature Spatial JSON Response Service DBMS Desktop Web SOAP Request Manager Server REST Request Image JPEG Service JPEG

Identifying Parameters: Component Values POST /acme/geo/get_feature?uid= 68e4cf6a8077912a02b250b230b8abe73265753b HTTP/1.1 Host: acme.com Connection: keep-alive X-CUST-SESSIONID: h57768d18hfr883xc36b53100jeew99sb2b320eb User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: */* Accept-Encoding: gzip, deflate, sdch Accept-Language: ja,en-US;q=0.8,en;q=0.6 {“location":" 48.854325 ",“feature_area_id":”tag=3hks83n3j;name= sector_north ”} HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Date: Mon, 05 May 2017 03:03:56 GMT Content-Length: 138 Connection: keep-alive {“ feature_id ":"\u30a4\u30d9\u30f3\u30c8\u3000\u5341\ u4e00",“sz":532,“wght":0.32," last_photo ":"",“resp_code":0} GML Feature Spatial JSON Response Service DBMS Desktop Web SOAP Request Manager Server REST Request Image JPEG Service JPEG

Identifying Parameters  Refer to documentation or use heuristics to determine the parameter data types  Hex strings are typically used as tokens or userids  Tokens and other sensitive data in URL  /acme/profile/set_photo/ 2015/11/20 ?token= fa423b369272e7e19b2a5fa4eeba560e74c0d457  Look for high variance in URL paths of proxied traffic  Examine response codes of parent paths to find start of parameters

Demo – Custom Parameters

Automation: Importing Data  Proxy –  undocumented APIs (e.g. RESTful)  Non web applications (e.g. mobile applications)  Dynamically generated requests (e.g. Web 2.0, AJAX)  Automated (WSDL, WADL, Swagger)  WISwag.exe

Importing Data 38

Importing Data 39

Demo – Service Definition Import