DEV 312 Building Secure Web Applications Defenses And

DEV 312 Building Secure Web Applications: Defenses And Countermeasures Jeff Prosise Co-founder Wintellect (www. wintellect. com)

Holistic Approach To Security Network Defend the network Host Port blocking Filtering Encryption Spoofed packets, etc. Defend the host Buffer overflows, illicit paths, etc. Defend the application SQL injection, XSS, input tampering, etc. Application Updates Validation Internet Information Server hardening Hashing ACLs Encryption CAS Secrets management Logging Cookie management Least privilege Session management Account Error handling management

Defending The Network Harden firewalls Stay current with patches and updates Block unused ports and protocols Use filtering to reject illicit requests Harden routers and switches Stay current with patches and updates Use ingress/egress filtering to reject spoofed packets Screen ICMP traffic from the internal network Screen directed broadcast requests from the internal network Reject trace routing requests Encrypt sensitive communications http: //msdn. microsoft. com/library/en-us/dnnetsec/html/Sec. Net. HT 16. asp http: //msdn. microsoft. com/library/en-us/dnnetsec/html/Sec. Net. HT 18. asp i http: //msdn. microsoft. com/library/en-us/dnnetsec/html/THCMCh 15. asp

Defending The Host Stay current with service packs and updates Harden Internet Information Server 5 by running IISLockdown Disables FTP, SMTP, and NNTP Removes key script mappings such as. idq, . htr, and. printer. idq, . htr, Removes IISSamples, IISHelp, Scripts, and other virtual directories IISSamples, IISHelp, ACLs system tools and Web content directories to limit access Disables Web. DAV Installs URLScan Harden Internet Information Server 5 and 6 by installing URLScan i Logs failed requests Limits request sizes to mitigate Do. S attacks Masks content headers revealing IIS type and version number Blocks requests with potentially injurious characters (e. g. , dots in path names) Canonicalizes and verifies path names to thwart directory traversal attacks Disables specified verbs (e. g. , "DEBUG") http: //msdn. microsoft. com/library/en-us/dnnetsec/html/THCMCh 16. asp

Defending The Host Harden the Web server’s TCP/IP stack http: //msdn. microsoft. com/library/en-us/dnnetsec/html/HTHard. TCP. asp Run ASP. NET using the principle of least privilege Avoid running as SYSTEM Consider running with partial trust Limit the size of file uploads <configuration> <system. web>  <http. Runtime max. Request. Length="128" /> </system. web> </configuration>

Defending The Host Disable unused shares and services Delete nonessential shares and restrict access to others Disable nonessential services and protocols (e. g. , SMB and Net. BIOS) Remove or secure Remote Data Services (RDS) Harden user accounts Disable the Guest account Use strong passwords on all accounts Rename the administrator account Disallow null sessions (anonymous logons) Restrict remote logons to only those who need it Be aggressive about logging and auditing Log failed logon attempts Log failed actions anywhere in the system Secure IIS log files with NTFS permissions Audit access to Metabase. bin

Defending The Host Use ACLs to limit access to critical resources Restrict access to the %systemroot%System 32 directory Restrict access to %systemroot%Microsoft. NETFramework Restrict write access to %systemroot%System 32Logfiles Restrict write access to Web content directories Restrict access to registry keys where secrets are stored See http: //msdn. microsoft. com/library/en-us/dnnetsec/html/ THCMCh 19. asp? frame=true#c 19618429_025 for information on NTFS permissions required by ASP. NET

Defending The Application Never trust user input (validate!) Access databases securely Avoid vulnerabilities in forms authentication Secure ASP. NET session state Store secrets securely Anticipate errors and handle them appropriately i http: //msdn. microsoft. com/library/en-us/dnnetsec/html/THCMCh 10. asp

Validating Input Filter potentially injurious characters and strings HTML-encode all input echoed to a Web page Use "safe" character encodings <globalization request. Encoding="ISO-8859 -1" response. Encoding="ISO-8859 -1" /> Avoid using file names as input if possible

Tools For Validating Input Tool Regex Validation controls Http. Utility. Html. Encode Request. Map. Path ASP. NET 1. 1 request validation Description Class in System. Text. Regular. Expressions namespace that wraps. NET Framework's regular expression engine Set of six controls that validate input on both client and server: Required. Field. Validator, Regular. Expression-Validator, Range. Validator, etc. HTML-encodes input, converting potentially dangerous characters such as "<" into harmless escape sequences Resolves path names and optionally checks for path names that violate application boundaries Feature of ASP. NET 1. 1 that automatically rejects requests containing certain characters and character sequences (e. g. , "<script")

Input Validation

Accessing Data Securely Use stored procedures or parameterized commands Never use sa to access Web databases Store connection strings securely Apply administrative protections to SQL Server http: //www. microsoft. com/sql/techinfo/administration/2000/security/ securingsqlserver. asp Optionally use SSL/TLS or IPSec to secure the connection to the database server http: //msdn. microsoft. com/library/enus/dnnetsec/html/Sec. Net. HT 18. asp http: //msdn. microsoft. com/library/en-us/dnnetsec/html/Sec. Net. HT 19. asp

Dynamic SQL Commands Vulnerable to SQL injection attacks // DANGER! User input used to generate database query string sql = String. Format ("select count (*) " + "from users where username='{0}' and cast " + "(password as varbinary)=cast ('{1}' as " + varbinary)", username, password); Sql. Command command = new Sql. Command (sql, connection); int count = (int) command. Execute. Scalar ();

Parameterized Commands Less vulnerable to SQL injection attacks // BETTER: Input passed to parameterized command Sql. Command command = new Sql. Command ("select count (*) from users where " + "username=@username and cast (password as " + "varbinary)=cast (@password as varbinary)", connection); command. Parameters. Add ("@username", Sql. Db. Type. Var. Char). Value = username; command. Parameters. Add ("@password", Sql. Db. Type. Var. Char). Value = password; int count = (int) command. Execute. Scalar ();

Stored Procedures Less vulnerable to SQL injection attacks Added security via EXECUTE permission // BEST: Input passed to stored procedure Sql. Command command = new Sql. Command ("proc_Is. User. Valid", connection); command. Command. Type = Command. Type. Stored. Procedure; command. Parameters. Add ("@username", Sql. Db. Type. Var. Char). Value = username; command. Parameters. Add ("@password", Sql. Db. Type. Var. Char). Value = password; command. Parameters. Add ("@return", Sql. Db. Type. Int). Direction = Parameter. Direction. Return. Value; int count = (int) command. Execute. Scalar ();

The sa Account For administration only; never use it to access a database programmatically Instead, use one or more accounts that have limited database permissions For queries, use SELECT-only account Better yet, use stored procs and grant account EXECUTE permission for the stored procs Reduces an attacker's ability to execute harmful commands

Creating A Limited Account USE Login GO -- Add account named webuser to Login database EXEC sp_addlogin 'webuser', 'm 1 x 2 y 3 z 4 p 5 t 6 l 7 k 8', 'Login' -- Grant webuser access to the database EXEC sp_grantdbaccess 'webuser' -- Limit webuser to calling proc_Is. User. Valid GRANT EXECUTE ON proc_Is. User. Valid TO webuser

Secure Data Access

Storing Data Securely Sensitive data stored persistently should be encrypted or hashed Credit card numbers Login passwords, etc. For maximum security, connection strings should also be encrypted Encryption is easy System. Security. Cryptography classes Windows Data Protection API (DPAPI) Securing decryption keys is not

Data Protection API (DPAPI) Present in Windows 2000 and higher Provides strong encryption, automatic key generation, and secure key storage Triple-DES encryption PKCS #5 key generation Two “stores” User store Machine store Great tool for ASP. NET programmers! Operating system manages keys

Building A DPAPI Library The. NET Framework Class Library 1. x doesn’t wrap DPAPI See “How to Create a DPAPI Library” for instructions on creating your own http: //msdn. microsoft. com/library/default. asp? url=/lib rary/en-us/dnnetsec/html/-Sec. Net. HT 07. asp Managed wrapper around DPAPI Handles interop and marshaling for you Features Data. Protector class with simple methods named Encrypt and Decrypt Supports machine store and user stores

Encrypting Connection Strings Web. config <configuration> <app. Settings> <add key="Connection. String" value="AQNCMnd 8 BFd. ERj. Ho. Aw. E/Cl+s. BAAAA. . . " /> </app. Settings> </configuration> Page Data. Protector dp = new Data. Protector (Data. Protector. Store. USE_MACHINE_STORE); string val = Configuration. Settings. App. Settings ["Connection. String"]; byte[] data = Convert. From. Base 64 String (val); string connect = Encoding. ASCII. Get. String (dp. Decrypt (data, null));

Encrypting And ACLing Connection Strings Registry Admins: Full SYSTEM: Full ASP. NET: Read Page Data. Protector dp = new Data. Protector (Data. Protector. Store. USE_MACHINE_STORE); Registry. Key key = Registry. Local. Machine. Open. Sub. Key ("SOFTWARE\My. Web. App"); string val = (string) key. Get. Value ("Connection. String"); byte[] data = Convert. From. Base 64 String (val); string connect = Encoding. ASCII. Get. String (dp. Decrypt (data, null));

Encrypting Connection Strings

Windows Authentication Microsoft SQL Server supports two types of authentication Authentication using SQL Server logins Authentication using Windows identities Windows authentication reduces threat surface area by eliminating user names and passwords from connection strings server=localhost; database=pubs; Trusted_Connection=yes

Forms Authentication Protect login credentials with SSL/TLS http: //msdn. microsoft. com/library/en-us/dnnetsec/html/Sec. Net. HT 16. asp Don't store passwords; store password hashes Limit authentication cookie lifetimes to minimize windows for replay attacks Assume authentication cookies are spoofed or stolen when performing sensitive operations Don't rely on forms authentication to protect resources not owned by ASP. NET

Protecting Logins Place login forms in directories protected by SSL/TLS to guard against eavesdropping <authentication mode="Forms"> <forms login. Url="https: //. . . /Login. Page. aspx" /> </authentication> Encrypted connection

Storing Login Passwords Don’t store plaintext passwords Store encrypted passwords or password hashes for added security Format Plaintext passwords Encrypted passwords 1 -way password hashes Salted password hashes Comments Exposes entire application if database is compromised Better than plaintext, but still vulnerable if decryption key is compromised Better than encrypted passwords, but still vulnerable to dictionary attacks Less vulnerable to dictionary attacks

Password Hashes Forms. Authentication. Hash. Password. For. Storing. In. Config. File makes hashing easy SHA-1 hashes MD 5 hashes string hash = Forms. Authentication. Hash. Password. For. Storing. In. Config. File (password, "SHA 1"));

Generating Salted Hashes string Create. Salted. Password. Hash (string password) { // Generate random salt string RNGCrypto. Service. Provider csp = new RNGCrypto. Service. Provider (); byte[] salt. Bytes = new byte[16]; csp. Get. Non. Zero. Bytes (salt. Bytes); string salt. String = Convert. To. Base 64 String (salt. Bytes); // Append the salt string to the password string salted. Password = password + salt. String; // Hash the salted password string hash = Forms. Authentication. Hash. Password. For. Storing. In. Config. File (salted. Password, "SHA 1"); // Append the salt to the hash string salted. Hash = hash + salt. String; return salted. Hash; }

Validating Salted Hashes bool Validate. Password (string password, string salted. Hash) { // Extract hash and salt string salt. String = salted. Hash. Substring (salted. Hash. Length - 24); string hash 1 = salted. Hash. Substring (0, salted. Hash. Length - 24); // Append the salt string to the password string salted. Password = password + salt. String; // Hash the salted password string hash 2 = Forms. Authentication. Hash. Password. For. Storing. In. Config. File (salted. Password, "SHA 1"); // Compare the hashes return (hash 1. Compare. To (hash 2) == 0); }

Authentication Cookies Forms authentication cookies are encrypted and validated by default Prevents reading and alteration Doesn’t prevent theft and replay Preventative measures are required to defend against unauthorized access Defense Restrict cookies to SSL Limit cookie lifetime Disable sliding renewal Comments Prevents cookie theft (strongest defense) Mitigates replay attacks by limiting attack window

Auth Cookie Lifetime Temporary authentication cookies Lifetime limited (by default) to 30 minutes Controlled by <forms> timeout attribute Subject to sliding renewal in ASP. NET 1. 0 Sliding renewal disabled by default in 1. 1 Controlled by <forms> sliding. Expiration attribute Persistent authentication cookies Default lifetime = 50 years! Longer lifetime = Greater vulnerability to replay attacks

Limiting The Lifetimes Of Persistent Authentication Cookies if (Authenticate (name, password)) { string url = Forms. Authentication. Get. Redirect. Url (name, true); Forms. Authentication. Set. Auth. Cookie (name, true); Http. Cookie cookie = Response. Cookies [Forms. Authentication. Forms. Cookie. Name]; // Set the cookie to expire 7 days from now cookie. Expires = Date. Time. Now. Add. Days (7); Response. Redirect (url); }

Securing Session State Limit session time-outs as much as possible Avoid using cookieless session state if possible Close port 42424 in firewall if using state service Disable ASP. NET state service if you're not using it Close ports 1433 and 1434 if using SQL Server Encrypt connection string if using SQL Server http: //support. microsoft. com/default. aspx? scid=kb; en-us; 329290

Session State Don’t store potentially injurious data (such as credit card numbers) in session state Optionally use SSL/TLS to protect session ID cookies http: //msdn. microsoft. com/library/en-us/dnnetsec/html/Sec. Net. HT 16. asp Optionally use SSL/TLS or IPSec to secure the connection to the database server http: //msdn. microsoft. com/library/en-us/dnnetsec/html/Sec. Net. HT 18. asp http: //msdn. microsoft. com/library/en-us/dnnetsec/html/Sec. Net. HT 19. asp

Error Handling Anticipate errors and handle them sensibly Use <custom. Errors> to display custom error pages Don't reveal too much information in error pages Beware mode="off" and debug="true" Log unhandled exceptions Be aggressive about logging failures

$Logging Unhandled Exceptions Global. asax void Application_Error (Object sender, Event. Args e) { //$

Logging Unhandled Exceptions Global. asax void Application_Error (Object sender, Event. Args e) { // Formulate message to write to event log string msg = "Error accessing " + Request. Path + "n" + Server. Get. Last. Error (). To. String (); // Write the message to Windows event log Event. Log log = new Event. Log (); log. Source = "My ASP. NET Application"; log. Write. Entry (msg, Event. Log. Entry. Type. Error); }

Why Is This Code Insecure? Input is neither validated nor constrained; user can type anything! <html> <body> <form runat="server"> <asp: Text. Box ID="Input" runat="server" /> <asp: Button Text="Click Me" On. Click="On. Submit" runat="server" /> <asp: Label ID="Output" runat="server" /> </form> </body> </html> <script language="C#" runat="server"> void On. Submit (Object sender, Event. Args e) { Output. Text = "Hello, " + Input. Text; } </script> Input is echoed to page without HTML encoding

Microsoft Products And Services For Lifelong Learning www. microsoft. com/learning Microsoft Products and Services for Lifelong Learning Assessments Courses Books l www. microsoft. com/assessment l 2310: Developing Microsoft ASP. NET Web Applications Using Visual Studio. NET l 2640: Upgrading Web Development Skills from ASP to Microsoft ASP. NET l 1905: Building XML-Based Web Applications l 2311: Advanced ASP. NET (scheduled release July 04) l Designing ASP. NET Applications, ISBN: 0 -7356 -1348 -6 l Programming Microsoft ASP. NET, ISBN: 0 -7356 -1903 -4 l Microsoft ASP. NET Coding Strategies with the Microsoft ASP. NET Team, ISBN: 0 -7356 -1900 -X l Developing Microsoft® ASP. NET Server Controls and Components, ISBN: 0 -7356 -1582 -9 l Building Secure Microsoft ASP. NET Applications, ISBN: 0 -7356 -1890 -9 l Building Microsoft ASP. NET Applications for Mobile Devices (Second Edition), ISBN: 0 -7356 -1914 -X l MCAD/MCSD Self-Paced Training Kit: Developing Web Applications with Microsoft Visual Basic. NET and Microsoft Visual C#. NET (Second Edition), ISBN 0 -7356 -1927 -1

DEV 312 Building Secure Web Applications: Defenses And Countermeasures Jeff Prosise Co-founder Wintellect (www. wintellect. com)