Combined C/C++, Java and Web application security CL-CJW. Classroom 4 days

Transcription

1 CL-CJW Combined C/C++, Java and Web application security Classroom 4 days To serve in the best way heterogeneous development groups that are using various platforms simultaneously during their everyday work, we have merged various topics into a combined course that presents diverse secure coding subjects in didactic manner on a single training event. This course combines C/C++ and Java platform security to provide an extensive, cross-platform secure coding expertise. Concerning C/C++, common security vulnerabilities are discussed, backed by practical exercises about the attacking methods that exploit these vulnerabilities, with the focus on the mitigation techniques that can be applied to prevent the occurrences of these dangerous bugs, detect them before market launch or prevent their exploitation. Security components and service of Java are discussed by presenting the different APIs and tools through a number of practical exercises where participants can gain hands-on experience in using them. The course also covers security issues of Web services and the related Java services that can be applied to prevent the most aching threats of the Internet based services. Finally, web- and Java-related security vulnerabilities are demonstrated by easy-to-understand exercises, which not only show the root cause of the problems, but also demonstrate the attack methods along with the recommended mitigation and coding techniques in order to avoid the associated security problems. Audience: C/C++ and Java developers, architects and testers Preparedness: Advanced C/C++, Java and Web Exercises: Hands-on Outline IT security and secure coding Web application vulnerabilities Client-side security Foundations of Java security Practical cryptography Java security services Security relevant C/C++ programming bugs and flaws Buffer overflow Some additional native code-related vulnerabilities Java specific vulnerabilities Using security testing tools Knowledge sources Content Security technologies and services: Java language security solutions, Java Virtual Machine (JVM) and Java Runtime Environment (JRE); ByteCode Verifier and Classloader; Security Manager and Access Controller, managing permissions with the PolicyTool; Java Cryptography Architecture (JCA) and Java Cryptographic Extension (JCE), Java Secure Socket Extension (JSSE), Java Authentication and Authorization Service (JAAS), Java Keystore (JKS) and the KeyTool; SOAP and REST; Transport-layer security, applicationand container-managed authentication, authorization; End-to-end security; Web Services Security (WSS), username/password authentication, signing (XML Signature) and encryption (XML Encryption) Common security vulnerabilities and mitigation techniques: Buffer Overflow (BOF), heap overflow; integer problems: widthness bug, signedness bug, arithmetic overflow, integer mishandling case study Android Stagefright bug; Printf Format String bug (PFS); array indexing problems, unicode bug, side channels: the RSA timing attack, Time-of-Checking-to-Time-of-Usage (TOCTTOU) race conditions, Directory Traversal Vulnerability (DTV); No execute (NX bit) access mode of Virtual Memory Management (VMM); Data Execution Prevention (DEP); Address Space Layout Randomization (ASLR) PaX, ExecShield; Stack Smashing Protection (SSP) /GS, StackGuard, ProPolice; Source Code Analyzers (SCA tools).

2 Java-related vulnerabilities: integer overflows in Java (e.g. the CRC32 bug); Calendar/ZoneInfo deserialization bug (CVE ); unsafe reflection; injection flaws in Java (SQL Injection, Command Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF); unsafe Java Native Interface (JNI); improper error and exception handling; insecure randomness of java.util.random; object hijacking; serialization of sensitive information; dangers of mobile code; Denial-of-Service (DoS) in Java (the e-308 bug ), problem with inner classes, and many more Exercises: exploiting stack overflow executing shell codes; crafting a printf format attack string writewhat-where (WWW) possibilities; understanding integer problems; applying mitigation techniques; circumventing them by return-to-libc attack or argument overwriting; and many spot- and-correct-the-bug exercises. WS Security with username and password; XMLS Signature; XML Encryption; exploiting SQL injection step-by-step; crafting Cross-Site Scripting attacks; uploading and running executable code; crashing through JNI; proof-of-concept exploit of Calendar/ZoneInfo deserialization bug; using reflection to break accessibility modifiers; object hijacking; preventing serialization; exploiting mobile code vulnerabilities; crashing Java with magic double values; exploiting inner classes. Participants attending this course will: Understand basic concepts of security, IT security, cryptography and secure coding Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them Learn client-side vulnerabilities and secure coding practices Learn to use various security features of the Java development environment Be informed about recent vulnerabilities in various platforms, frameworks and libraries Realize the severe consequences of unsecure buffer handling in native code Understand the architectural protection techniques and their weaknesses Learn about typical coding mistakes and how to avoid them Get practical knowledge in using security testing tools Get sources and further reading on secure coding practices Other courses that relate to the topic of this course: CL-CSC - C/C++ secure coding (Classroom, 2 days) CL-JSC - Standard Java security (Classroom, 2 days) CL-JAD - Advanced Java security (Classroom, 3 days) CL-WSC - Web application security (Classroom, 2 days) RT-CVL - Common C/C++ security vulnerabilities (Remote, 2x1.5h) RT-CPR - Protection against common security vulnerabilities (Remote, 2x1.5h) RT-CEX - C/C++ secure coding exercises (Remote, 2x1.5h) RT-JST - Java security technologies (Remote, 2x1.5h) RT-JVL - Java specific vulnerabilities (Remote, 2x1.5h) RT-WVL - Web application vulnerabilities (Remote, 2x1.5h) Note: Our classroom trainings come with a number of easy-to-understand exercises providing live hacking fun. By accomplishing these exercises with the lead of the trainer, participants can analyze vulnerable code snippets and commit attacks against them in order to fully understand the root causes of certain security problems. All exercises are prepared in a plug-and-play manner by using a pre-set desktop virtual machine, which provides a uniform development environment.

3 Detailed table of contents Day 1 IT security and secure coding Nature of security IT security related terms Definition of risk Different aspects of IT security Requirements of different application areas IT security vs. secure coding From vulnerabilities to botnets and cyber crime Nature of security flaws Reasons of difficulty From an infected computer to targeted attacks Classification of security flaws Landwehr s taxonomy The Fortify taxonomy The Seven Pernicious Kingdoms OWASP Top Ten 2013 Web application vulnerabilities SQL Injection Exercise cars.com SQL Injection SQL Injection exercise Typical SQL Injection attack methods Blind and time-based SQL injection SQL Injection protection methods Other injection flaws Command injection Exercise Command injection Cross-Site Scripting (XSS) Persistent / Reflected XSS exercise XSS prevention XSS prevention tools in Java Broken authentication and session management Exercise cars.com Authentication bypass Cross Site Request Forgery (CSRF) Exercise cars.com Cross Site Request Forgery (CSRF) CSRF prevention Insecure direct object reference Unvalidated file upload Security misconfiguration Failure to restrict URL access Transport layer security issues

4 Unvalidated redirects and forwards Client-side security JavaScript security Same Origin Policy Exercise Client-side authentication Client-side authentication and password management Protecting JavaScript code Exercise JavaScript obfuscation Clickjacking Exercise Do you Like me? Protection against Clickjacking Anti frame-busting dismissing protection scripts Protection against busting frame busting AJAX security XSS in AJAX Script injection attack in AJAX Exercise XSS in AJAX Exercise CSRF in AJAX JavaScript hijacking CSRF protection in AJAX HTML5 Security HTML5 clickjacking attack text field injection HTML5 clickjacking content extraction Form tampering Exercise Form tampering Cross-origin requests Exercise Client side include Day 2 Foundations of Java security The Java environment Java security Low-level security the Java language Java language security Access modifiers Type safety Automatic memory management Java execution overview Bytecode Verifier Class Loader Protecting Java code High-level security access control Protection domains Security Manager and Access Controller Permission checking Effects of doprivileged

5 Exercise Applet Security policy for applets Exercise Applet Policy Tool Practical cryptography Cryptosystems Elements of a cryptosystem Symmetric-key cryptography Providing confidentiality encrypted communication Symmetric encryption algorithms Block cipher modes of operation Comparing the modes of operation Hash or message digest Hash algorithms Message Authentication Code (MAC) Providing integrity and authenticity with a symmetric key Asymmetric (public-key) cryptography Public-key encryption Rule of thumb possession of private key The RSA algorithm Introduction to RSA algorithm Encrypting with RSA Digital signing with RSA Blind signature Public Key Infrastructure (PKI) Man-in-the-Middle (MiM) attack Digital certificates against MiM attack Certificate Authorities in Public Key Infrastructure X.509 digital certificate Exercise Jars Granting permission to signed code Java security services Java security services architecture Authentication and authorization Java Authentication and Authorization Service (JAAS) JAAS architecture Typical ways of gathering authentication information Exercise JAAS Using JAAS for authentication and authorization Cryptographic services Java Cryptography Architecture / Extension (JCA/JCE) Using Cryptographic Service Providers Engine classes and algorithms Exercise Sign Generating and verifying signatures Exercise Sign Using alternative providers The Bouncy Castle (BC) provider Installing the Bouncy Castle Using the Bouncy Castle services Secure communication Security services

6 Message structure SSL/TLS handshake Java Secure Socket Extension (JSSE) Exercise Https Switching from HTTP to HTTPS Day 3 Security relevant C/C++ programming bugs and flaws x86 machine code, memory layout, stack operations Intel 80x86 Processors main registers Intel 80x86 Processors most important instructions Intel 80x86 Processors flags Intel 80x86 Processors control instructions Intel 80x86 Processors stack handling and flow control The memory address layout The function calling mechanism in C/C++ on x86 Calling conventions The local variables and the stack frame Function calls prologue and epilogue of a function Stack frame of nested calls Stack frame of recursive functions Buffer overflow Stack overflow Buffer overflow on the stack Overwriting the return address Exercise BOFIntro Exercise BOFShellcode Protection principles Specific protection methods Protection methods at different layers The PreDeCo matrix of software security Stack overflow Prevention (during development) Stack overflow Detection (during execution) Stack smashing protection Stack smashing protection variants Stack smashing protection in GCC Exercise BOFShellcode Stack smashing protection Effects of stack smashing protection Bypassing stack smashing protection an example Stack overflow Anti-exploit techniques Address Space Layout Randomization (ASLR) Stack randomization with ASLR Using ASLR Circumventing ASLR: NOP sledding Exercise BOFASLR Circumventing ASLR with NOP sledging Non executable memory areas the NX bit

7 Protection through Virtual Memory Management Access Control on memory segments The Never execute (NX) bit Exercise BOFShellcode Enforcing NX memory segments Return-to-libc attack Circumventing the NX bit Arc injection / Return-to-libc attack Exercise BOFShellcode The Return-to-libc attack Multiple function calls with return-to-libc Return oriented programming (ROP) Exploiting with ROP ROP gadgets Combining the ROP gadgets Exercise BOFROP Heap overflow Memory allocation managed by a doubly-linked list Buffer overflow on the heap Steps of freeing and joining memory blocks Freeing allocated memory blocks TLS Heartbeat Extension Heartbleed a simple explanation Heartbleed fix in v1.0.1g Protection against heap overflow Some additional native code-related vulnerabilities Array indexing spot the bug! The Unicode bug Directory Traversal Vulnerability Type mismatch Spot the bug! Exercise TypeMismatch Serialization errors (TOCTTOU) Attacks with symbolic links Exercise TOCTTOU Shellshock bash vulnerability Shellshock basics of using functions in bash Shellshock vulnerability in bash Exercise - Shellshock Shellshock fix and counterattacks Exercise Command override with environment variables Day 4 Java specific vulnerabilities Input validation Input validation concepts Unsafe JNI Exercise Java JNI Unsafe JNI

8 Integer overflow in Java Integer problems Representation of negative integers Integer ranges Integer representation by using the two s complement The integer promotion rule in C/C++ Arithmetic overflow spot the bug! So why ABS(INT_MIN)==INT_MIN? Signedness bug spot the bug! Widthness integer overflow spot the bug! A case study Android Stagefright Stagefright a quick introduction Some Stagefright code examples spot the bugs! Integer problem mitigation Avoiding arithmetic overflow addition Avoiding arithmetic overflow multiplication Dealing with signed/unsigned integer promotion Safe integer handling in C The SafeInt class for C++ A real-world integer overflow vulnerability The actual mistake in java.utils.zip.crc32 Deserialization in Java A real-world deserialization vulnerability The most exploited flaw in Java The actual mistake in java.util.calendar spot the bug! Java Calendar object deserialization Exploiting the Java Calendar object deserialization Patch for Java Calendar object deserialization problem Exercise CVE poc Deserialization Exercise Deserialization Implementation of a command dispatcher Unsafe reflection spot the bug! Improper use of security features Problems related to the use of security features Insecure randomness Week PRNGs in C Stronger PRNGs in C and Linux Week PRNGs in Java Hardware-based RNGs Exercise RandomTest Using random numbers in Java spot the bug! Password management Exercise Google cracking Password management and storage Special purpose hash algorithms for password storage BDKDF2 and bcrypt implementations in C/C++ Some other typical password management problems Exercise Hard coded passwords Accessing private fields with reflection in Java Exercise Reflection Accessing private fields with reflection Improper error and exception handling Typical problems with error and exception handling Empty catch block Overly broad throws

9 Overly broad catch Using multi-catch in Java Returning from finally block in Java spot the bug! Catching NullPointerException Exception handling spot the bug! Exercise Information leakage through error reporting CVE vulnerability Vulnerability in ClassFinder.findClass() Calling ClassFinder.findClass() Exploiting the CVE vulnerability Time and state problems Time and state related problems Concurrency spot the bug! Calling Thread.run() Exercise ThreadRun Calling Thread.run() Race condition in servlets spot the bug! Race condition spot the bug! ArrayList vs Vector Code quality problems Dangers arising from poor code quality Poor code quality spot the bug! Unreleased resources Exercise Object Hijack Immutable String spot the bug! Exercise Immutable Strings Serializable sensitive spot the bug! Exercise Serializable Sensitive A generic Denial of Service attack against the Java environment The e-308 bug The double bug in Tomcat The vulnerable code of DoubleValue() in FloatingDecimal.java Triggering the infinite loop Exercise Double Bug Mobile code Risks associated with mobile code Private arrays spot the bug! Private arrays typed field returned from a public method Critical public spot the bug! Exercise Critical Public Possible attack scheme Inner classes spot the bug! Problem with inner classes The decompiled class file containing an inner class Exercise Inner Class Using security testing tools Web vulnerability scanners

10 Exercise Using a vulnerability scanner SQL injection tools Exercise Using SQL injection tools Static code analysis Exercise Using static code analysis tools Knowledge sources Secure coding sources a starter kit Vulnerability databases Java secure coding sources Recommended books C/C++ Recommended books Java