The DevCentral Chronicles Volume 1, Issue 4

If you missed our initial issues of the DC Chronicles, you can catch up with the links at the bottom. The Chronicles are intended to keep you updated on DevCentral happenings and highlight some of the cool content you may have missed since the last issue. Welcome!

Like last month, we’re digging the OWASP Top 10 #Lightboard series from @JohnWagnon. He wrapped it up this month with numbers 9 & 10 - Using Components With Known Vulnerabilities and Insufficient Logging and Monitoring. To give you a sense of how these have been received, YouTube viewer Sanket Kamath says, ‘Thank you for the excellent overview for all of the OWASP Top 10 2017! John made it really easy to understand each of the 10 attacks with his explanation!’ Check out the entire playlist!

Speaking of LightBoard Lessons, we had a few fantastic ones this past month. John took on lighting up the GitHub DDoS Attack and Explaining the Spectre and Meltdown Vulnerabilities while Jason gave us the OSI and TCP/IP Models and What Are Containers? I added SAML IdP and SP on One BIG-IP to round out our videos.

On the Security front, we had a bunch of great articles covering a mess, and I mean a mess of stuff. The mess was some new vulnerabilities and our Security Researchers had the mitigations for many including Spring Framework Spring-Messaging Remote Code Execution (CVE-2018-1270), Drupal Core SA-CORE-2018-002 Remote Code Execution Vulnerability and Jackson-Databind - A Story of Blacklisting Java Deserialization Gadgets.

We also learned how to Protect your AWS API Gateway with F5 BIG-IP WAF, how to configure F5 BIG-IP as an Explicit Forward Web Proxy Using Secure Web Gateway (SWG) and how to set up ADFS Proxy Replacement on F5 BIG-IP.

The Cloud folks will love Lori’s Three Types of Load Balancing You Meet in the Cloud, DNS Admins will dig Eric’s Unbreaking the Internet and Converting Protocols and Coders will enjoy Jason’s Debugging API calls with the python sdk and Satoshi’s iControl REST Fine-Grained Role Based Access Control.

And, we couldn’t let this Chronicle pass without mentioning an awesome @haveibeenpwned #Pwned Passwords Check #CodeShare from MVP Niels van Sluis. This snippet makes it possible to use @troyhunt ‘Pwned Passwords’ API to check if the password has been exposed. See it here: http://bit.ly/2GOhi1y
And wrapping up, a wonderful contributor Daniel Varela is DevCentral's Featured Member for April and F5 Agility is coming to Boston, MA this August!

As always, You can stay engaged with @DevCentral by following us on Twitter, joining our LinkedIn Group or subscribing to our YouTube Channel. Look forward to hearing about your BIG-IP adventures.

ps

Previous

• Volume 1, Issue 1
• Volume 1, Issue 2
• Volume 1, Issue 3

The OWASP Top 10 - 2017 vs. BIG-IP ASM

With the release of the new 2017 Edition of the OWASP Top 10, we wanted to give a quick rundown of how BIG-IP ASM can mitigate these vulnerabilities.

First, here's how the 2013 edition compares to 2017.

And how BIG-IP ASM mitigates the vulnerabilities.

	Vulnerability	BIG-IP ASM Controls
A1	Injection Flaws	Attack signatures Meta character restrictions Parameter value length restrictions
A2	Broken Authentication and Session Management	Brute Force protection Session tracking HTTP cookie protection
A3	Sensitive Data Exposure	Data Guard
A4	XML External Entities (XXE)	Attack signatures (see below)
A5	Broken Access Control	File types URL URL flows Session tracking URL flows Attack signatures (Directory traversal)
A6	Security Misconfiguration	Attack Signatures
A7	Cross-site Scripting (XSS)	Attack signatures Parameter meta characters Parameter value length restrictions Parameter type definitions (such as integer)
A8	Insecure Deserialization	Attack Signatures (see below)
A9	Using components with known vulnerabilities	Attack Signatures integration
A10	Insufficient Logging and Monitoring	BIG-IP ASM can help with the monitoring process to detect, alarm and deter attacks

Specifically, we have attack signatures for “A4:2017-XML External Entities (XXE)”:

• 200018018           External entity injection attempt

• 200018030           XML External Entity (XXE) injection attempt (Content)

Also, XXE attack could be mitigated by XML profile, by disabling DTDs (and of course enabling the “Malformed XML data” violation):

For “A8:2017-Insecure Deserialization” we have many signatures, which usually include the name “serialization” or “serialized object”, like:

• 200004188           PHP object serialization injection attempt (Parameter)
• 200003425           Java Base64 serialized object - java/lang/Runtime (Parameter)
• 200004282           Node.js Serialized Object Remote Code Execution (Parameter)

A quick run-down thanks to some of our security folks.

ps

Related:

• What’s New In The OWASP Top 10 And How TO Use It
• BIG-IP ASM Operations Guide

Internet of Things OWASP Top 10

The Open Web Application Security Project (OWASP) is focused on improving the security of software. Their mission is to make software security visible, so that individuals and organizations worldwide can make informed decisions about true software security risks and their OWASP Top 10 provides a list of the 10 Most Critical Security Risks. For each risk it provides a description, example vulnerabilities, example attacks, guidance on how to avoid and references to OWASP and other related resources. Many of you are familiar with their Top 10 Most Critical Web Application Security Risks. They provide the list for awareness and guidance on some of the critical web applications security areas to address. It is a great list and many security vendors point to it to show the types of attacks that can be mitigated.

Now the Internet of Things (IoT) has its own OWASP Top 10.

If you've lived under a rock for the past year, IoT or as I like to call it, the Internet of Nouns, is this era where everyday objects - refrigerators, toasters, thermostats, cars, sensors, etc - are connected to the internet and can send and receive data. There have been tons of articles covering IoT over the last 6 months or so, including some of my own.

The OWASP Internet of Things (IoT) Top 10 is a project designed to help vendors who are interested in making common appliances and gadgets network/Internet accessible. The project walks through the top ten security problems that are seen with IoT devices, and how to prevent them.

The OWASP Internet of Things Top 10 - 2014 is as follows:

• 1 Insecure Web Interface
• 2 Insufficient Authentication/Authorization
• 3 Insecure Network Services
• 4 Lack of Transport Encryption
• 5 Privacy Concerns
• 6 Insecure Cloud Interface
• 7 Insecure Mobile Interface
• 8 Insufficient Security Configurability
• 9 Insecure Software/Firmware
• 10 Poor Physical Security

You can click on each to get a detailed view on the threat agents, attack vectors, security weaknesses, along with the technical and business impacts. They also list any privacy concerns along with example attack scenarios. Good stuff!

ps

Related:

• The Icebox Cometh
• The Applications of Our Lives
• Standards for 'Things'
• Securing the Internet of Things: is the web already breaking up?
• 4 things that will happen in the Internet of Things space in 2014
• Tech's brightest unconvinced by internet of things
• OWASP Internet of Things Top 10

 

Technorati Tags: iot,things,owasp,security,top10,privacy,silva,f5,nouns

 

Connect with Peter:	Connect with F5:

Is 2013 Half Empty or Half Full?

It certainly has been a wild ride thus far for 2013 as we head into the second half.  Breaches, hacks, exposures, leaks, along with things like BYOD and SDN should make the next 6 months interesting.  From the many headlines in 2012, you'd think organizations would be locked down tight but alas, intruders are still kicking a$$ and taking names...literally.

Media and news organizations, like the New York Times and Wall Street Journal, experienced data breaches due to spear fishing and malware.  According to various news articles, certain journalists were targeted based on their story coverage but more interesting to me is the fact that the anti-virus along with the IPS/IDS in place failed to catch the malware.  Unless there is a signature in place for a known piece of evil code, that demon will make it's way through.

Financial institutions up to and including the Federal Reserve were breached.  While many bank hacks are driven by monetary gain, sometimes they are the targets of political activists.  Humans are very passionate about their beliefs and like to express those feelings.  There have always been protesters and activists - some write letters, some picket on the sidewalk, some throw rocks and with the advent of the internet, now you can protest by creating digital havoc.  Instead of hoping that people boycott a particular entity, you can simply take it out yourself so no one can get to the site. 

Social media networks continue to feel the heat from breaches.  Many social media sites are now deploying two-factor authentication to help reduce password exposures and increase verification checks.  Many news stories have talked about password usage and it's good that two factor is being deployed...but,in many cases, it is only after the bad news hits the media.  Why wait?

To help organizations understand the various web threats, OWASP has released their Top 10 for 2013 (with changes from 2010 Edition):

• A1 Injection
• A2 Broken Authentication and Session Management (was formerly 2010-A3)
• A3 Cross-Site Scripting (XSS) (was formerly 2010-A2)
• A4 Insecure Direct Object References
• A5 Security Misconfiguration (was formerly 2010-A6)
• A6 Sensitive Data Exposure (2010-A7 Insecure Cryptographic Storage and 2010-A9 Insufficient Transport Layer Protection were merged to form 2013-A6)
• A7 Missing Function Level Access Control (renamed/broadened from 2010-A8 Failure to Restrict URL Access)
• A8 Cross-Site Request Forgery (CSRF) (was formerly 2010-A5)
• A9 Using Components with Known Vulnerabilities (new but was part of 2010-A6 – Security Misconfiguration)
• A10 Unvalidated Redirects and Forwards

Along with their Top 10 Mobile Risks:

• M1: Insecure Data Storage
• M2: Weak Server Side Controls
• M3: Insufficient Transport Layer Protection
• M4: Client Side Injection
• M5: Poor Authorization and Authentication
• M6: Improper Session Handling
• M7: Security Decisions Via Untrusted Inputs
• M8: Side Channel Data Leakage
• M9: Broken Cryptography
• M10: Sensitive Information Disclosure

These are guides to help organizations understand the threats but always make sure you understand you own risks and focus on mitigating those first whether they are on the OWASP Top 10 or not.  Then make sure you're covered on the rest.

So far, 2013 has been full of breaches that empties an organization's information.

ps

Related:

• Following New York Times Breach, Wall Street Journal Says China Hacked It, Too
• US Federal Reserve confirms it was hacked during the Super Bowl
• Does Lax Network Security Lead To Cyber Attacks: 2013’s Top Hacks
• Twitter introduces 'two-factor authentication' to stop password hacking
• Motorola shows off tattoo and swallowable password hardware
• OWASP Top 10 2013 - PDF
• OWASP Mobile Security Project

Technorati Tags: 2013,breach,owasp,hacks,vulnerabilities,threats,security,risk,malware,f5,silva,exposure,authentication,2fa,web security

Connect with Peter:	Connect with F5:

IPS or WAF Dilemma

As they endeavor to secure their systems from malicious intrusion attempts, many companies face the same decision: whether to use a web application firewall (WAF) or an intrusion detection or prevention system (IDS/IPS).  But this notion that only one or the other is the solution is faulty.  Attacks occur at different layers of the OSI model and they often penetrate multiple layers of either the stack or the actual system infrastructure.  Attacks are also evolving—what once was only a network layer attack has shifted into a multi-layer network and application attack.  For example, malicious intruders may start with a network-based attack, like denial of service (DoS), and once that takes hold, quickly launch another wave of attacks targeted at layer 7 (the application).
Ultimately, this should not be an either/or discussion.  Sound security means not only providing the best security at one layer, but at all layers.  Otherwise organizations have a closed gate with no fence around it.
Often, IDS and IPS devices are deployed as perimeter defense mechanisms, with an IPS placed in line to monitor network traffic as packets pass through.  The IPS tries to match data in the packets to data in a signature database, and it may look for anomalies in the traffic. IPSs can also take action based on what it has detected, for instance by blocking or stopping the traffic. IPSs are designed to block the types of traffic that they identify as threatening, but they do not understand web application protocol logic and cannot decipher if a web application request is normal or malicious.  So if the IPS does not have a signature for a new attack type, it could let that attack through without detection or prevention.  With millions of websites and innumerable exploitable vulnerabilities available to attackers, IPSs fail when web application protection is required.  They may identify false positives, which can delay response to actual attacks. And actual attacks might also be accepted as normal traffic if they happen frequently enough since an analyst may not be able to review every anomaly.
WAFs have greatly matured since the early days.  They can create a highly customized security policy for a specific web application. WAFs can not only reference signature databases, but use rules that describe what good traffic should look like with generic attack signatures to give web application firewalls the strongest mitigation possible.  WAFs are designed to protect web applications and block the majority of the most common and dangerous web application attacks.  They are deployed inline as a proxy, bridge, or a mirror port out of band and can even be deployed on the web server itself, where they can audit traffic to and from the web servers and applications, and analyze web application logic.  They can also manipulate responses and requests and hide the TCP stack of the web server. Instead of matching traffic against a signature or anomaly file, they watch the behavior of the web requests and responses.  IPSs and WAFs are similar in that they analyze traffic; but WAFs can protect against web-based threats like SQL injections, session hijacking, XSS, parameter tampering, and other threats identified in the OWASP Top 10.  Some WAFs may contain signatures to block well-known attacks, but they also understand the web application logic.  In addition to protecting the web application from known attacks, WAFs can also detect and potentially prevent unknown attacks.  For instance, a WAF may observe an unusually large amount of traffic coming from the web application. The WAF can flag it as unusual or unexpected traffic, and can block that data.
A signature-based IPS has very little understanding of the underlying application.  It cannot protect URLs or parameters. It does not know if an attacker is web-scraping, and it cannot mask sensitive information like credit cards and Social Security numbers.  It could protect against specific SQL injections, but it would have to match the signatures perfectly to trigger a response, and it does not normalize or decode obfuscated traffic.  One advantage of IPSs is that they can protect the most commonly used Internet protocols, such as DNS, SMTP, SSH, Telnet, and FTP.  The best security implementation will likely involve both an IPS and a WAF, but organizations should also consider which attack vectors are getting traction in the malicious hacking community.  An IDS or IPS has only one solution to those problems: signatures. Signatures alone can’t protect against zero-day attacks for example; proactive URLs, parameters, allowed methods, and deep application knowledge are essential to this task. And if a zero-day attack does occur, an IPS’s signatures can’t offer any protection.  However if a zero-day attack occurs that a WAF doesn’t detect, it can still be virtually patched using F5’s iRules until a there’s a permanent fix.
A security conversation should be about how to provide the best layered defense.  Web application firewalls like BIG-IP ASM protects traffic at multiple levels, using several techniques and mechanisms.  IPS just reads the stream of data, hoping that traffic matches its one technique: signatures.  
Web application firewalls are unique in that they can detect and prevent attacks against a web application.  They provide an in-depth inspection of web traffic and can protect against many of the same vulnerabilities that IPSs look for.  They are not designed, however, to purely inspect network traffic like an IPS.  If an organization already has an IPS as part of the infrastructure, the ideal secure infrastructure would include a WAF to enhance the capabilities offered with an IPS.  This is a best practice of layered defenses. The WAF provides yet another layer of protection within an organization’s infrastructure and can protect against many attacks that would sail through an IPS.  If an organization has neither, the WAF would provide the best application protection overall.


ps


Related:

• 3 reasons you need a WAF even if your code is (you think) secure
• Web App Attacks Rise, Disclosed Bugs Decline
• Next-Gen Firewalls Make Old Arguments New Again
• Why Developers Should Demand Web App Firewalls.
• Too Dangerous to Enter?
• Asian IT security study finds enterprises revising strategy to accommodate new IT trends
• Protecting the navigation layer from cyber attacks
• OWASP Top Ten Project
• F5 Case Study: WhiteHat Security

Technorati Tags: F5, PCI DSS, waf, owasp, Pete Silva, security, ips, vulnerabilities, compliance, web, internet, cybercrime, web application, identity theft

Connect with Peter:	Connect with F5:

Audio White Paper - Manageable Application Security

Information security personnel suffer from information overload on a nearly daily basis, but need to sift through myriad articles, reports, blogs, logs, and scans to do their jobs. Information is vital to successful web application security strategies, whether it be information about a new attack, a new twist on an existing attack, or identifying weak points in web applications. Investments in security solutions have to provide a clear value, which equals additional time spent collecting and documenting proof of this value. The latest version of F5 BIG-IP Application Security Manager(tm) (ASM), v10.1, addresses information overload and the need for agility in implementation. Read full whitepaper here.  And click here for more F5 Audio.

 
Download now or listen on posterous

AudioWP_-_Manageable_Application_Security.mp3 (19092 KB)

ps
twitter: @psilvas
Technorati Tags: F5, infrastructure 2.0, integration, cloud connect, Pete Silva, security, business, education, technology, application delivery, intercloud, cloud, context-aware, infrastructure 2.0, automation, web, internet

Posted via web from psilva's prophecies