Suspicious Minds

Previously, on Fodder Blog: I mailed a package that was purposely unexpected to see whether someone would open it, thinking that nobody would open suspicious mail. The sender's name was fake, the address was fake, and the package was purposely weirdly shaped. He opened it without even hesitating.

Part of my attempt to conceal who it was from involved having someone else mail the package from near their home, so that the postmark would have a different suburb, and it would be harder to trace it back to me. As I was giving the package to my mule, I explained the whole idea behind the package. We are told as part of our building safety training not to open suspicious packages, and some signs that it's suspicious include:

• excessive packaging
• addressed to the wrong person, misspelled name - or nobody specific at all (e.g. "Security Manager")
• protruding wires
• oil seeping through the packaging
• strange sounds
• the package is unexpected

I didn't want to get arrested, so the closest I could get was to send an unexpected package. My mule said that if he received a package, he would open it, too (after maybe giving it a bit of a shake to see if he could guess what was inside). I told him that I didn't believe him, and said that I'd mail him a package in a few months when he had forgotten the conversation.

As with all of my little projects, this one sat in the back of my mind as I thought about what to give him. Inspiration struck when I remembered that he liked board games, and there's a game called Bang!, and even better than that, there's a dice version of it. Commissioner Gordon was overseas at the time, and I asked him if he would be able to find a copy of the game and mail it to the office. Unfortunately, he wasn't near any board games stores, and by the time I thought to ask him, he was at the end of his big holiday, so he wouldn't have time to get to one. But he did suggest just putting the parcel in the mail holes we have in the office.

That would have saved me in postage, and I could have put whatever ridiculous name / address on the package that I wanted, but because it bypassed the proper office package process, there wouldn't be an official record of it in the parcel log, and my mule would know that it was an inside job (at least I would have thought that if I had received a package internally and there was no log in the mail room of it arriving).

Most of the plan was coming together, I just had to solve the last obstacle - how to get the package to look like it arrived through a proper channel without having to send it through the proper channel? I could have just mailed it like the first one, but I had another brainstorm, and asked one of my co-workers, who receives a lot of packages, if I could re-use the packaging. He gave me a plastic one that had the orange "Fragile" sticker all over it, and in order to cover up his name, I printed out a large dodgy looking sticker and stuck sticky tape all over it.

My last brainstorm was had on the way to the office. There are Christmas decorations everywhere. And what do people do during Christmas? They exchange gifts. So I wrapped the board game up in wrapping paper (but before this, I did a big board game gift no-no and opened it up. I wanted the dice to make a lot of noise when the box was shaken, so I moved them into the main compartment, and stacked the cards on top of each other so the lid didn't sit on it properly. Now, in addition to the weird sound from the dice, the box was also a weird shape, and somewhat unstable, because of the stack of cards holding the lid up.

Wrapped gift in tow, I headed to the mail room, and said that I wanted to give someone a Christmas gift, but I wanted it to be a surprise. I asked if they would pretend this parcel came from a courier. The Spirit of Christmas must have been with me, because I didn't even have to bribe them with cookies - they happily took my package.

Then came the nerve-racking part - the wait. I dropped off the parcel in the morning (after checking that the mule was at his desk, and wouldn't accidentally stumble upon me talking to the mail people). By afternoon, he hadn't said anything. I left a note inside the game, so if he opened it, he would have seen it and known it was from me. I was back from lunch. Still nothing.

Then I receive an email.

Hi Fodder! 

There's a parcel for you in the mail room. Please come and pick it up ASAP. We will hold it for 5 days before returning it to the sender. 

If you are unable to collect it yourself, please organise for one of your colleagues to pick it up for you. 

Cheers,
The mail team

I hadn't ordered anything, and even if I had, I wouldn't get it sent to the office. 

Side note: Aust Post has a parcel locker service: it's free, and they're 24/7, so you don't even have to pick up your parcel during business hours. You get an SMS and an email when it arrives. You go to your designated locker location (there are heaps around the city), enter the provided code, and the locker opens for you to collect your parcel. Easy peasy. I 100% recommend it.

I realised the mule had probably seen the package, the memory of our conversation about suspicious packages was triggered, so he said something to the mail room to convince them that it was for me instead.

I messaged him:

Me: you're funny
Mule: ?
Me: what did you say?
Mule:

Me: you're funny
Mule: ?

Me: ....

(I had meant to ask "what did you say to the mail room staff?", but just in case he hadn't received the package yet, I was trying to be vague. I guess I was too vague.)

Not wanting the game to be shipped back to the fake sender that I wrote on the back (which was a badly disguised Niklaus Pyhimys, from 25 Pohjoisnapa St, Tampere, NSW), I went to the mail room to collect it. Except instead of receiving the small plastic parcel I had dropped off in the morning, I received a large brown box.

It looked like a real parcel. It had tracking stickers on it, and even an invoice taped to the side in a plastic pocket thing (though I couldn't see who it was addressed to, that part was covered by a sticker, but I could see that it was from Saks Fifth Avenue). I could see the items listed, and I looked them up online. They were a couple of dresses worth about $1000. Not something I would order, and not something anybody I know would send to me.

I asked Jal if he sent it and he said no. I said I wasn't sure what to do with it. Jal re-iterated his stance that the chance of receiving a bomb was so low that it wasn't even worth considering. He even offered to open it for me. I remained unconvinced. Saks Fifth Avenue also didn't seem to be the kind of place the mule would shop at, but maybe he got the box from someone on his team who happened to receive a package that day. Then I looked closer at the name. It was almost my name, but it actually wasn't. There was one letter different. Misspelled name? Very tricky. Very suspicious.

I stormed over to the mule's desk and set the package down.

Mule: Hi.
Me: Hi.
Mule: (looks at me confused)
Me: So. I got an email saying there was a package for me today.
(No reaction from the mule.)
Me: I wasn't expecting this package.
(Still no reaction.)
Mule: So are you going to open it?
Me: No!... Well, I'm curious what's inside.
Mule: So open it. (He seems to have remembered the other package) Or are you afraid this is from that guy you sent the other parcel to?
Me: I asked him already, it's not.
(Still no reaction.)
Me: Did you send it?
Mule: (holds his hand to his chest) I swear it wasn't me who sent this.

I looked around for the wrapping from my parcel, but didn't see anything. I also didn't see Bang! anywhere. Jal messaged me to say that there was someone in the company who had the name on the package, and because of her middle name, it makes it look like my name. I returned the package unopened to the mail room and explained that it was probably for the other Fodder.

I still didn't find out whether the mule got the package or not.

The next day, I ended up confessing the whole story about the package, because I explained everything to another co-worker, who said I should confess just in case the police do get called. I spent most of the night thinking about all the horrible things that could have happened. What if someone in the mail room did want to plant a bomb, and thought this would be the perfect way to do it, as I was caught on camera handing over the parcel? What if he was randomly searched on the way home while carrying the parcel, and they thought he was a terrorist (he really does look like one)? What if someone thought it was valuable, because it was weirdly shaped and covered in lots of wrapping and they mugged him?

As soon as I saw him online I asked the mule if he opened the package, and he said:

It was really suspicious looking, he didn't know the sender, it had an abnormal amount of wrapping, and once he removed all the stickers, he saw it was addressed to someone else. He wasn't expecting anything so he chucked it in the bin.

I experienced the weird feeling of horror and relief. Horief? I was relieved that nothing bad happened to him (or me), but horrified that the game was going to rot away in a bin somewhere.

After a few minutes of me staring at my computer screen in stunned silence, he added:

Thank you for the gift. My daughter enjoyed playing with the dice.

I barraged him with a heap of questions, trying to find out how he knew, when he knew, etc. I feel like the experiment backfired entirely. I was more stressed by the entire situation than he was - mostly because of the coincidental package that was wrongly assigned to me.

Today, I found the above pictured package on my desk, left my the mule. Treachery, Corporate, Missing. It looked suspicious to me. He said he wanted to get me a gift in return, and Robinson's bookshop has a "book blind date". I guess the three words on the package hint at what kind of book is inside. Now I'm wondering what made him pick that book out of all the others. Was it because it's something a paranoid person would pick?

I feel kinda bad now, as Bang! wasn't really a gift for him, it was more a gift for me, to prove him wrong (which failed dismally). Also, I'm still suspicious, so it's currently sitting there unopened. I need to see someone for my problems.

The Human Element

I did have a photo for today's post, but the person I met requested they be kept anonymous, so this will be today's photo instead. Today's post will probably be quite short, as I'm trying to keep things vague in order to avoid accidentally giving away their identity.

One of the frustrating things about being a software engineer is that software isn't tangible. When you look at a building being built, you can roughly guess how much progress has been made by how much of the building looks finished. Most people have seen buildings of various types before, and have a pretty good idea what a finished building should look like. It's also possible for you to talk a walk through a building and see whether it has the things you would expect it to have, like stairs, doors, windows, walls.

Not so easy with software. There's a lot of stuff you can see, like the UI, but there's also a lot of stuff that goes on behind the scenes that's not nearly as visible, and you only see the affect it has on the UI. (Though I guess that's kinda true of buildings as well, because they will often have wiring and pipes going through the walls, and you can't tell whether they're working or not until you try to turn a light on or flush the toilet.)

A similar thing applies to cybersecurity. If someone breaks into your house and steals stuff, you're pretty likely to notice: the window might be smashed in, your electronics are missing, and if you catch them in the act, they'll be right there in front of you. If someone breaks into your software system, they might be there for years before anybody even notices, and even if their presence is detected, they're likely halfway across the world, and all they need to do to get away is to disconnect from your server. Who knows how much stuff they stole in the meantime? As far as you can tell, your data is still there. Or even worse, what else have they left behind that shouldn't be there?

The person I met works in cybersecurity (that explains the paranoia, right?), and we talked about the industry as a whole. They said that one of the challenges in the field is to stop people from being reactive. Most companies will have a team that deals with the fallout of a breach, but will often neglect to have a team that tries to look for the early warning signs that a breach is about to take place. Part of the reason is that it's really hard to quantify the monetary benefit of prevention, and part of the reason is that the whole industry is still new, and finding the people with these skills is hard.

Something they said that really hit me is that cybersecurity isn't just about keeping up-to-date with patches, and making sure you have strong network protections, it's also about understanding people. How do they behave? What kinds of people are likely to attack you? Why are they attacking you? Sure, there are people who attack with the thought of profit in mind, but hacktivism (a portmanteau of hack and activism) is becoming a larger field. Are they angry that you released a AAA game and then made it pay-to-win? Do they disagree with the idea that you are against BSDM? The kind of resources available to state-sponsored hackers is going to be wildly different to the kind of resources available to the average script-kiddie, so having an idea of who your attackers might be will also help you work out what your vulnerability is, and how far you need to go in order to protect yourself.

Depending on who you are, it's not unlike having an intelligence agency put out feelers and try to work out where an attack might be coming from. Obviously, the person I met is speaking from the point of view of a large organisation, and many people are unlikely to need this kind of service in their day-to-day life. But I've always loved spy movies / books, and hearing about this stuff is as close as I'll ever get in real life.

It's funny, I thought my psychology degree was going to be completely wasted in the software field, but it seems to be becoming more and more relevant as time goes by.

And that's about all I can report that doesn't give away their identity. I felt like I learned a lot, and I'm sorry that I can't share that with you, but I want to respect their desire for privacy.

Password Management

The thing that was repeated the most during OWASP was the importance of not re-using passwords. I don't know about you, but my ability to remember more than 5 things is woeful, and I definitely have more than 5 accounts, so for a long time, I had two categories for passwords: passwords for important things (bank accounts, gaming accounts), and then the same password (or a variant) for everything else that I don't care about people stealing.

Well, there's a better way: password managers. Instead of remembering a host of passwords, you just need to remember one - the master password for your vault.

Personally, I use LastPass, but there are lots of different password managers out there, so pick one that suits your needs. The free version of LastPass is more than enough for what I need it to do. You can sign up for a free account on their website (https://www.lastpass.com/). I have their Chrome plugin, which can auto-fill passwords for you, but you can use it through their web interface, you'll just need to copy+paste your password.


Say I want to create a reddit account. When I go to the sign-in page, after typing in a username, I can hit the circle-arrow-clock button thing to open the password generation dialogue. Clicking more options brings up the option to vary what kind of password is generated, including how long it is, and whether it includes uppercase, lowercase, numbers and special characters - because even though security standards now say that forcing users to pick complex passwords makes them more likely to pick some weak, common password like p@ssw0rd!, it is a lot of effort to upgrade legacy systems.

So adjust the options until you get a password that the site allows and click fill.

reddit thinks this is a very strong password - hooray!

If you have the Chrome plugin, it'll pop-up asking if you want to save the password to your vault.

Next time you're on the login page, you'll see the LastPass icon in the bottom right, and how many sites match this particular site (it says 3 for me, because I now have 3 reddit accounts).

Clicking that will show all the matching accounts and selecting one will populate the login with your username and password.

Alternatively, if you don't want LastPass doing this for you, you can opt to copy the password to your clipboard and paste it in instead.

If you're using this from the web interface, you can open up the site, and copy the password.

Hahahaha, and because I'm a dope, while trying to demo something for this blog post, I managed to change my password without updating it in LastPass - reddit doesn't change the page once the password has been updated, and LastPass didn't detect it.

So..... one thing I like to do when generating passwords is to copy it before I fill it (you'll notice that there's a small "copy" button just above "Fill" in the password generation prompt), just in case this happens. But I didn't do it that time, because it's way past my bedtime. Anyway, with my new new reddit account:

You can see there's a "show password history" button.

And it brings up a prompt where you can look at your old passwords.

I kinda wish I had this around when I was in high school, so I can see all my tryhard-passwords like, "randomIzAwsome!!1!!!!"

There's also a Security Challenge feature, that looks at the overall security level of all of your passwords.

It has an option to check whether your email address has been included in any breaches, but I showed you how to do that on https://haveibeenpwned.com/ a couple of posts ago.

I still have a few weak passwords hanging around from those crappy throwaway accounts I mentioned earlier. Some of the blank ones are from when the chrome plugin seems to have picked up some credentials that aren't really credentials, and when it tried to import my credentials that I had saved to my computer. I should get around to cleaning it up some day.

LastPass has an automatic password change feature that's in beta, where it'll try and change your password for you, but it doesn't seem to work on reddit. I will get around to changing those weak passwords as well (great security role model I am!).

There's also a LastPass app for iPhone / Android, which you can use to check your passwords when you're away from the computer. Keeping the password vault updated while on your phone requires an internet connection, but I had no problems accessing an offline copy when we were travelling around in Japan. It did require manually typing in a password from the phone to the laptop (as I don't have it on the laptop as it's shared), but that's the only real struggle I've had with it. As you aren't typing in passwords, it makes it less likely that someone can steal your credentials with a keylogger.

It does take a bit of setting up initially, as you have to get all of your passwords into the vault, but once you've put in that bit of effort, I've found managing passwords is a breeze. I've long since retired my throwaway password, as LastPass makes it so easy to generate random passwords even for throwaway accounts. (I was going to make a demo using Ashley Madison instead, but I couldn't work out how to make an account (or so I claim. (No, really, I couldn't. The only thing I could see was a login button, and something asking for my relationship status and sexual orientation. Oh, I guess that might have brought up the registration screen. I was too scared to click it and find out. Oh well!))).

OWASP AppSec Day - Lessons From a Billion Breached Records

My last talk for the conference, it was pretty tough choosing between this talk and one given by Brendan Scarvell, who claims to be able to cook 2 minute noodles in 1 minute and 57 seconds. However, I've been following Troy Hunt's blog for a while now, so in the end, I decided to see him in the flesh for the first time.

If you haven't heard of him, he's an internet security specialist, probably most famous for his website https://haveibeenpwned.com/, where you can enter your email address, and find out if it has been included in a data breach. At first, I thought this website was spawned from this XKCD comic about password reuse, but Mr Hunt is very well respected in the security community and he doesn't ask for a password or anything other than your email address. You don't even need to sign up to see if your email address has been included in a hack, but if you do sign up, you will be emailed if your address is found in a new hack.

I did get a picture of him, but it wasn't very good.

He started by talking about hacker perception in the media. As you can see in the background of that image, they always seem to be portrayed as a shadowy, hoodie wearing figure with green text (usually binary, or the matrix rain) in the background. Which is ironic given the speaker wouldn't look out of place in the air force. Or it's blamed on Russia, North Korea, or China.

Not all hackers are like that, in fact, the hack on TalkTalk, costing £42 million, was reportedly attributed to Islamic cyber Jihadists (whatever they are), but turned out to be a couple of people in their 20s.

The media does need something to use for pictures depicting hackers that's sensationalist though, because hacking can do a lot of damage, but actual hacking looks quite boring. (Side note: I love the way the TV show Limitless handles it. Whenever Brian needs to hack something, he'll say that rather than showing footage of him hacking, he'll show videos of cute kittens and puppies instead.)

Since people know about viruses, this seems like a good way to do it, right?

(Note: not what hacking looks like.)

And what happens when the hackers are Russian? How can you tell that the shadowy figure in the hoodie is Russian and not the same as some other generic hacker?

With bears, of course.

And what do you do when the website that was hacked was full of data on anal-fisters....?

(It's OK, it's SFW.)

Or the more creative version:

On to the meat of his talk.

How does he get access to the hacked data?
80% of the data from data breaches ends up on mega.nz. Hackers also seem to like to hoard and trade breached data, kinda like the IRC days where you would share movies / music.

Some of them even contact him directly when they get access to something he doesn't already have. As I said, he's well-respected, and he said a lot of people support his project! When asked if he has ever been required to name his source by law enforcement, he said that he's fortunate that they've ever asked. I guess it's one of those things where they'd rather he remained someone hackers can contact without the fear of repercussions, and the benefits of him being able to access this kind of data makes up for the cost of not being able to get closer to the hackers through him.

Verifying the data
Forgot your password links are a great way to verify if the email address that is said to be in the data actually exists on that website. How can he do that without knowing the password, too? Well, some websites will actually reveal if an email address has an account on the site by the different way it shows the response when you try to retrieve a forgotten password. Some will actually say, "Invalid email", so you know that account doesn't exist.

Others will be more clever, and the response will be "The account and / or password isn't valid." So you can't tell if the password was wrong, or whether the account doesn't exist at all. However, some websites will respond slower when trying to verify a password for an account that exists, versus one that doesn't.

For instance, the difference in response time for a login attempt for an account that exists versus one that doesn't on the Ashley Madison website is quite different - probably because if the account does exist, it has to run the password hashing algorithm on it to check the password, but for accounts that don't exist, it just returns an invalid response, so it's much faster.

(If you didn't understand that comment on password hashing, quick primer: It's considered bad security practice to store passwords in plain text. Mostly because if your data is hacked, the attacker can just read all the credentials easily. A better solution is to hash the password (usually with a salt (some random codeword) and store that instead. So if my password was "password", they would do "password" and add the salt (e.g. "dragon") to get "passworddragon", and then run the hashing algorithm on that, getting something like "3d768d226b9245a68e3668c94ce3af79" which is what they store. The attacker doesn't know the salt is "dragon", so it's not easy for them to work out that the original password was "password". But the great thing is that you never even have to reverse it. When it comes to password verification, all you need to do is take the password the user entered, add your salt and hash it. Since the hash returns the same value each time for the same input, and each hash is unique for a given input (for that given hashing algorithm), if you get the same result as "3d768d226b9245a68e3668c94ce3af79", then you know the password is correct.)

The other thing you can check is whether the account gets locked out. In order to stop someone from trying to access your account by trying to login a million times with different passwords, most services will lock you out after X attempts (usually between 3 and 5). If you try to login with junk passwords for a given email address, and you don't get locked out, then it's likely that the account doesn't exist. You can sign up for a fake account yourself to see how many failed attempts it takes to get locked out.

Mailinator is a great website for these throwaway accounts. You can create any email address you want, and it has an inbox you can check, for registering for accounts you don't care about. The don't care about part is important, because the account has no password, so anyone who knows which name you picked will be able to login and view any emails that get sent there. If any mailinator accounts are listed in a breach, it's pretty easy to check that they are valid accounts and they have a registration email in their inbox. (Note: some websites purposely block mailinator, but it seems you can just use "notmailinator" as the domain, and the address will still work - at least that's the case at the time of writing.

If all of these fail, Mr Hunt tends to try and contact some of the people who are listed in the breach, and will ask if they mind helping him with verification. Usually, some of them will respond and help him out.

If you do find that your credentials have been included in a hack, it's not just the account for that website that matters - it also means that any places in which you've used the same username / password combination is also compromised. Again, I'll stress the importance of using a password store / generator, and I'll write up a guide for it on Tuesday.

I really enjoyed the talk, and although I'm sad I missed the 1 minute 57 second noodle guy, I'm glad I went to this one.

OWASP AppSec Day - Wrangling Security & Identity

The second last talk I attended at the conference was on the topic of managing multiple AWS accounts while still keeping secure. The speaker was Andrew Bienert, a security architect at SEEK.

Andrew started by saying that the median time between intrusion of a system and detection is 81 days. That's nearly 3 months that someone is in your system, poking around, trying to spread the scope of their access. 81% of hackers who were interviewed said that once they were inside a system, they could infiltrate and export data within 12 hours. Keeping your perimeter safe is important, but it's also important to make sure that access within your systems is controlled so that a compromise in one system doesn't result in all of your other systems being compromised, too.

Sharing prod AWS accounts within an organisation is tough once you have too many applications. You tend to hit a bunch of limits, such as running out of IP space, or having too many instances of a particular service. What tends to happen at this point is that you start to split your services across multiple AWS accounts. He mentioned Conway's law, which states that "organisations which design systems... are constrained to produce designs which are copies of the communication structures of these organisations." The problem with having so many accounts is that these services will need to be able to share information between them, but in a way that prevents an attacker from also gaining access to that information. It's fairly easy when you have two systems A and B, and you just need to be sure that A can access B and B can access A.

Once you start to get to what SEEK has, which is over 99 systems, it becomes far more complex. System Q might need to talk to Systems D and J, F needs to talk to C and W. How do you keep track and make sure the systems have only what they need to? Add to that the fact that systems will become obsolete, and you also need to make sure the permissions it had are also revoked, as we learned in a previous talk that being able to guess the role name of someone who has access is one step towards gaining access yourself.

To be honest, some of this went over my head, as I'm not that familiar with AWS, so I'll try to note as much as I think I managed to understand.

It's important to log everything, this can help you track intrusions.

Ensure all S3 buckets are private, unless whitelisted. You can use Cloud Custodian (https://github.com/capitalone/cloud-custodian)to help with this.

You can also create a honeypot resource with monitoring (e.g. CloudTrail). None of your systems will use it, so you know if someone has accessed it, then you have an intruder.

And.... that's all I managed to get from the talk. It was a bit tough, as it was right after lunch, so the food coma feeling hit pretty hard. :(

OWASP AppSec Day - Dev Guide to XSS

Next stop on the security conference trip is XSS - Cross-site scripting. The speaker was Felix Shi, another security expert from New Zealand. He was also really funny and I think this was my favourite talk out of all the talks I attended. His talk was quite easy to follow, and since I only have a basic understanding of XSS, all the examples he gave were great.

Have you ever tried to enter something in a text field, only to find that they're really strict about what kind of characters you can enter? It's probably a good thing that most people don't know how to use semi-colons anymore, because they'll probably find that their input ruined by some websites. Now you'll see one of the reasons why!

What is XSS?
XSS is when someone manages to run their own code on your site. This happens because when you allow users to enter stuff into a field, it's very hard to control what they enter. Most users will follow the instructions and enter their name as labelled, but there's nothing to stop someone from entering anything, including code, like in this xkcd comic: https://xkcd.com/327/ (the exploit in this is SQL injection, not XSS, but the idea is the same).

For instance, someone might have a textbox for you to enter your name, and then they take that input, and wrap it in some tags to display on the page.

e.g. html = "Hello " + name + "!
;

Which if you enter a proper thing, will result in Hello Anna!
.

However, if you put something malicious in there, like
Hello


In this video, you can see that the page takes one of the values in the URL and  displays that as the title. So when he modifies the value, he's able to change the way the title on the page is displayed.

In the second video, he changed his message to be some garbage, then adds a script so that when the page loads with an error, it redirects to another page. The brilliant thing about this, which is an example of persisted XSS, is that the page loads all the old messages, so every time the page loads (for anyone), the error is thrown and the person gets redirected to another page. This is how you can deface a website, but if you are a particularly bad baddie, you can redirect someone to a phishing page and steal their credentials, or combine with another exploit to get them to download malware.

Defense against XSS
Don't allow user input (he was joking)

Validate, encode / escape user provided data: this may involve replacing special characters that tend to be in scripts, like the angle-brackets < >, quote marks ' ". Modern web frameworks do this by default, and this feature tends to be opt out, which is great as it stops people who don't really know what they're doing from leaving huge holes in their websites. If you're wondering why would you want to turn it off at all? Mostly it's because of having to deal with legacy systems, that were written before this stuff was the norm.

Be wary of user attributes being used in other parts of the page, e.g. gravatar / alt-text. This can be another way to allow someone to add a script.

Having multiple security mechanisms make it hard for attackers to use XSS on your site. Along with what I've already mentioned, enable content security policy (inline javascript can't be run unless unsafe-inline is enabled and it also blocks things like eval - however, support for it is inconsistent across browswers), tag sensitive cookies with security tags (HttpOnly: can't be read by javascript, Secure: cookies can only be sent via HTTPS).

He went on to describe certain input validation techniques.

Do people really need < or > in their name? You can't block out apostrophes, or a large part of Ireland will hate you - not to mention if you force people to enter alphanumeric characters, what happens if someone wants to enter their name in Chinese or Hindi?

Don't attempt to cleanse the data and save it, just outright reject it, it's safer that way.

-----------------------

Hopefully you have a better idea of XSS. I think it's fascinating that talks like these make you feel good about thinking like a criminal - it's all for the sake of being secure, right?!

OWASP AppSec Day, 2017

Attended the OWASP AppSec Day again this year (only for the single day, even though they had a course that ran for 2 days), since I had so much fun last year. It was really hard to choose between talks, there were so many interesting sounding ones.

I'l break break some of the talks down into their own posts, because otherwise this post will get too long, but I'll cove the panel at the end of the day. They did it last year, and it was really funny and interesting, so they decided to do it again this year.

The panelists (from the right):
Frenchie (MC): who works at Culture Amp (and doesn't sound French, though maybe he is)
Serge: who is an application security professional, currently working at Coles, and one of the founders of Bugcrowd.
Julian (the event organiser): an application security engineer at Seek
Bec (I think that was her name, she wasn't listed in the schedule): a pen tester (I wrote at Assurance, but I thought I remembered her saying CultureAmp as well). She is also one of the creators of Hackers Helping Hackers.
Pamela: pen tester who used to work for the London stock exchange. I went to her talk last year on software defined radio, which was amazing.

What is application security?
Among other things, it includes:

• pen testing: web and mobile
• defensive techniques: protecting against attackers

The development world is shifting, and it's hard to keep up. Having lots of deployments per day is quite common now, and it's really difficult to keep on top of application security.

How can developers secure their systems?

• start using security tools (might not be the greatest leap, but it's about making small, incremental changes)
• talk about security
• there doesn't seem to be a security culture among developers anymore
• the focus for developers seems to be just ship as much as they can - which the speakers acknowledge isn't the fault of developers, as they have to do what they have to do
• take the time to understand how frameworks can be used to protect you
• trying to build security around culture is harder than trying to build culture around security
• when it comes to getting people involved in security, shifting the frame might help
• don't call it a security audit, call it a "health check"
• bribe people with snacks to convince them to do a health check
• make sure your security team is approachable
• rather than trying to get application teams to make security changes when your team is ready, try and schedule changes around their deployment lifecycle
• don't be alarmist - if you treat everything as though it's on fire and SUPER URGENT!!!!! people will stop caring
• shifting the accountability to product owners / delivery managers can also help. The security team can raise all the issues it likes, but it may just be cheaper to get hacked than fix a vulnerability - and if that's the way the business decides to accept risk, then so be it.

How do you measure application security success? What are some potential KPIs?

Have you been in the news recently? If no, then great success!

Note: that was tongue-in-cheek.

It's a bit difficult to measure success, and it's quite unfortunate that it seems to happen reactively, i.e., companies will only focus on security once they've been hacked.

Bug bounty programs are great and SEEK has had a lot of success with it.

Seeing how much of your codebase gets flagged on static analysis tools. Counting how many security reviews the code has had.

How to prevent phishing?

Run phishing campaigns against your own company, with educational links for the "clickers" explaining what kind of warning signs to look out for. Could also send them on a a training program.

Why are developers not security conscious?

Generally, it seems to be lack of time. Project managers don't want to delay projects to have to deal with potential security issues, as it's not something that the customer sees directly.

But there are also just some developers who don't care, and just want to build cool stuff.

How do you get people to fix vulnerabilities?

Check back with the application teams to make sure they are working on the issues.

It may also be because they don't understand what the issue is, or how they can fix it. If the security team isn't great at communicating problems, or the developers just don't have the required education to know how to fix problems, then all the issues will just remain giant question marks in the backlog.

Don't leave the application as the only line of defense. Put in other controls so that even if the application gets compromised, your entire company doesn't just fall over.

Security education - how do I get it?

Very few universities are tailored towards security. Some will have courses, but they will just be the basics, and not go into any topics in detail. Getting certifications is also quite expensive, especially for recent university graduates - the one that was mentioned cost $1k, just for the exam.

Going to conferences and meet-ups is a great way to pick up knowledge. There are a heap of meet-ups all over the country. Here's the OWASP Melbourne meetup: https://www.meetup.com/en-AU/Application-Security-OWASP-Melbourne

On the other side, it is important for companies to invest in junior people. The industry is growing, and if companies expect to only hire experienced application security experts, the pool of people is going to dry up pretty quickly.

If you have a limited budget, is it better to pay for security tools for your developers, or hire external security experts to come in?

Tools are great... if the people using them know what the output means. Giving tools to developers who haven't had any security training at all will not help them very much - they need the time to learn how to use them.

Plus, they're not designed for developers (one of them quipped that only developers are good enough to make usable tools - security experts write tools to get whatever they need to do done, not to win awards for being beautiful).

But once that education is there, then it'll be helpful for the rest of the project lifecycle. So the earlier you can introduce security tools, the better. Otherwise it might be better just to hire external people who already know what they're looking for / how to fix it.

What can we do to minimise non-technical attack vectors, e.g. fraud, phishing, account takeovers?

Look at the behaviour of your users, are they logging in at unusual times or spending excessively / on unusual things?

(This was the topic of one of the talks I went to, so I'll write more about that later.)

How trustworthy are 3rd party vendors - in particular the ones who claim they can monitor for breaches?

(This question is referring to having another company perform some service with your data, e.g. a company might do credit card processing for you.)

If possible, look at their reputation. Have they had any breaches themselves in the recent past?

If they allow it, try pen testing them. If you can break into their systems, how much can you trust your data with them?

Do they have a security team?

Send them a questionnaire. Not a completely reliable measure, but exact answers don't matter. Look for dodgy sounding marketing-speak-type answers like, "We're 100% secure!" "We've never been hacked!"

Are attacks still the same, or are there more and more cutting-edge attacks being developed?

Most of the attacks follow a standard pattern. A lot of vulnerabilities can be found in the OWASP top 10. Attackers don't always use some super fancy zero-day vulnerability - why bother when the website left its help box unsecured? 95% of the bugs reported to SEEK are in the OWASP top 10.

A big mistake a lot of teams make is bringing in the pen testers too early. If developers checked for the common errors, and pen testers were brought in later in the cycle, the results would be more effective.

Breadth vs depth of knowledge?

Accept that you know nothing!

Learn the OWASP top 10.

With experience, you'll learn "smells"

Know how to research and develop exploits

Dabble in niches only if it's something that interests you - it's a lot easier than forcing yourself to learn something just because you think a security expert should know about it. A couple of the panelists admitted to not knowing much about networks, which makes me incredibly relieved, as that stuff really puts me to sleep.

Go to meet-ups, conferences, and take part in CTFs (Capture the Flag events). There are some online CTFs that you can participate in, for practice.

If you're a developer, try our hand at building a security tool.


-----------------

I really enjoyed this year's event. They did a great job incorporating feedback from last year, and it was easy to get an idea of how technically complex a particular topic would be. I hope they do it again next year.