Ramping up Security at an open-source startup Lukas Reschke whois - PowerPoint PPT Presentation

Ramping up Security at an open-source startup Lukas Reschke

whois lukas@cloud.wtf owncloud.org 2

whois lukas@owncloud.com 1/31/16 3

Not much other hobbies Fixed a lot of stuff Employed since 2014 Contributor since 2012 1/31/16 4

The good and bad of the cloud

Awesomeness of the cloud • Accessible everywhere • Back up online • Easy sharing and collaboration • All free!!! (or super cheap … at least the licenses) owncloud.org 6

Take back your data owncloud.org 8

Introducing ownCloud • Sync and share • Open Source • Easy to use • Easy to install • Easy to extend • > 8 million users owncloud.org 9

Web / Desktop / Mobile owncloud.org 10

But that‘s not how we started… 1/31/16 11

ownCloud 1.0

… the project grew

… and companies started to use it owncloud.org 14

… market leader in education + research owncloud.org 15

Security at the start • Everybody could push directly • No formal code review process • No static source code analysis • No manual security testing • No dedicated security personnel (i.e. the same as still today in many companies ;-)) 16 owncloud.org

Ensuring ownCloud Security • Pull Request reviews owncloud.org 17

Ensuring ownCloud Security • Pull Request reviews owncloud.org 18

Ensuring ownCloud Security • Pull Request reviews Source: https://twitter.com/paulmgower/status/674411209836351488 owncloud.org 19

Ensuring ownCloud Security • Pull Request reviews • Regular code reviews for security issues owncloud.org 20

Ensuring ownCloud Security owncloud.org 21

Ensuring ownCloud Security • Pull Request reviews • Regular code reviews for security issues • Automated static analysis owncloud.org 22

owncloud.org 23

Ensuring ownCloud Security • Pull Request reviews • Regular code reviews for security issues • Automated static analysis • Customers do perform security tests • Following industry best practice for security handling (oriented towards ISO 29147, 30111 and 27304) owncloud.org 24

Title Risk Common Weakness Enumeration Vulnerability description Affected software + patches + CVE What we did to fix it Credits owncloud.org 25

Lots and lots of hardenings… owncloud.org 26

And yet… owncloud.org 27

And yet… owncloud.org 28

How are we doing? owncloud.org 29

How are we doing? owncloud.org 30

How are we doing? owncloud.org 31

How are we doing? owncloud.org 32

How are we doing? owncloud.org 33

How are we doing? owncloud.org 34

How are we doing? owncloud.org 35

Security: Secure by Default! • Security checks have to be disabled by the developer (e.g. CSRF + authentication) owncloud.org 36

Security: Secure by Default! • Sicherheitschecks müssen von Entwicklern bewusst deaktiviert werden. 1/31/16 37

Security: Secure by Default! • Security checks have to be disabled by the developer (e.g. CSRF + Authentication) • Internal file system not vulnerable against directory traversal owncloud.org 38

Security: Secure by Default! 1/31/16 39

Security: Secure by Default! • Security checks have to be disabled by the developer (e.g. CSRF + Authentication) • Internal file system not vulnerable against directory traversal • Security functionalities are enabled by default in ownCloud server (e.g. Content-Security-Policy) • … owncloud.org 40

Potential dangerous PHP functions are blacklisted owncloud.org 41

Security is hard owncloud.org 42

HackerOne owncloud.org 43

Why HackerOne? • Used by other major vendors • Great triaging tools and support • Payments processed by HackerOne owncloud.org 44

The platform owncloud.org 45

The platform owncloud.org 46

New Reports 50 45 40 35 30 25 20 15 10 5 0 owncloud.org 47

… and? Type of reported bugs Resolved reports • 3 bugs in scope ($700) Resolved Not • 43 bugs out of scope 14% applicable 18% Informative 32% Duplicate 36% owncloud.org 48

Lessons learned from a bug bounty program • Protect infrastructure against automated testing tools in advance – Don’t forget the contacts form • Quality of reports differs hugely depending on the reporter • Likely no low hanging fruits owncloud.org 49

What went wrong? What could have been better?

Pull Request Reviews • Added at a late stage. • Prevents a lot of pitfalls • … ensure they actually get reviewed … owncloud.org 51

Cryptography owncloud.org 52

Openness • In retrospective: Consider publishing advisories first after you consider your project secure enough. 53 owncloud.org

External reviews • Reviews will come anyways. • Best to be pro-active and have stuff fixed before. • Bug bounty a good addition to external reviews. – … consider starting with higher rewards though. Do not trust reviews without checking them in detail. 54 owncloud.org

Don’t fix single bugs … fix the categories of bugs and do root cause analysis. 55 owncloud.org

Thanks! github.com/owncloud hackerone.com/owncloud