Defending Against Web App A0acks Using ModSecurity. Jason Wood Principal Security Consultant Secure Ideas

Transcription

1 Defending Against Web App A0acks Using ModSecurity Jason Wood Principal Security Consultant Secure Ideas

2 Background Info! Penetra?on Tester, Security Engineer & Systems Administrator!!!! Web environments for over 11 years Infrastructure Windows, Linux, UNIX Moved to Security in 2006! CyberPatriot Mentor

3 Secure Ideas! Established in 2009! Penetra?on Tes?ng, Architecture Reviews and Educa?on! Highly experienced consultants in technology opera?ons and development! Professionally Evil! 2013 Secure Ideas LLC 3

4 Outline! ModSecurity 101! Audit Logging! Prepara?on and Configura?on! Iden?fying A0ackers! Custom Rules! Analysis

5 ModSecurity 101! Web applica?on firewall engine! Runs on Apache, IIS7 and Nginx! Tradi?onal and Anomaly Scoring! Inspect request and response data! Greatly increased informa?on logged! OWASP ModSecurity Core Rule Set (CRS)! h0ps:// Category:OWASP_ModSecurity_Core_Rule_Set_Project! Commercial rules also available from Trustwave

6 Processing Phases h0p://?nyurl.com/modsecphases

7 Example OWASP ModSecurity CRS Rule SecRule RESPONSE_BODY "<h2>site Error<\/h2>.{0,20} <p>an error was encountered while publishing this resource\." \ "phase: 4,rev:'2.2.0',t:none,capture,ctl:auditLogParts= +E,block,msg:'Zope Information Leakage',id:'970007',tag:'LEAKAGE/ ERRORS_ZOPE',tag:'WASCTC/WASC-13',tag:'OWASP_TOP_10/ A6',tag:'PCI/6.5.6',severity:'3',setvar:'tx.msg=% {rule.msg}',setvar:tx.outbound_anomaly_score=+% {tx.error_anomaly_score},setvar:tx.anomaly_score=+% {tx.error_anomaly_score},setvar:tx.%{rule.id}- LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}"

8 Tradi?onal vs Anomaly Processing! Tradi?onal! Rule match - > Take the ac?on configured in the rule! Easy to understand! No sharing of informa?on between rules! SecDefaultAc?on "phase:2,deny,log"! Anomaly! Rule match - > Increase an anomaly score! If anomaly score exceeds a threshold, then take an ac?on! More difficult to understand! Provides increased flexibility in response! SecDefaultAc?on "phase:2,pass,log"

9 Audit Logging! Two different logging types! Serial! Concurrent! NOT line separated log files! Events are broken up into blocks of text! Block Separators! - - <unique_hexidecimal_boundary>- <sec?on_id>- -! - - 7d H- -

10 Log Sec?on Defini?ons! A Audit log header! B Request headers! C Request body! E Intermediary response body! F Final response headers! H Audit log trailer! J Informa?on about uploaded files! K Every rule matched by an event, in order of match! Z Final boundary! h0ps://github.com/spiderlabs/modsecurity/wiki/reference- Manual#wiki- SecAuditLogParts

11 Log Event Example

12 Avoid Logging Sensi?ve Data! ModSecurity log tons of data, which could include.! Credit card numbers! Social Security numbers! Passwords! Implement ModSecurity s data sani?za?on! CRS op?onal rules

13 Audit Log Sani?za?on! sani?searg remove any data parameters by name! Sec?onAc?on phase:5,nolog,pass,sani%searg:password! sani?serequestheader remove any HTTP headers by name! Sec?onAc?on phase:5,nolog,pass, \ sani%serequestheader:authoriza%on! sani?sematched remove any data parameters whose name you don t know yet! SecRule \d{13,16} phase: 5,nolog,pass, \ sani%sematched! ModSecurity Handbook, page 69

14 Prepara?on and Configura?on! Harden the web server! Configure ModSecurity! Use Detec?onOnly (to start)! Increase log verbosity! Tes?ng as a good user and a bad guy! Determine the processing mode! Tuning! Custom rules! Going for bonus points! Implement honey traps! Track bad guys across the applica?on

15 Iden?fying A0ackers! Ac?ve vs Passive Defense! Ac?ve defense doesn t necessarily mean hacking back! Configure ModSecurity to en?ce bad guys to iden?fying themselves! Techniques for making bad guys stand out! HTML comments! <!- - - shorten to /e/t/applogic to get error >! robots.txt entries! /admin/remotecontrol.aspx! Hidden parameters! Bogus cookies! Use honey traps to take specific ac?ons based on someone taking the bait

16 Custom Rules! Why write custom rules?! Every web applica?on is a bit different! Need to put in a patch while development works on a fix! Need to mask data that shouldn t be logged! Want to lay traps for the bad guys to fall into! Don t mix custom rules with distributed rules!

17 Example Custom Rule SecRule REQUEST_URI REQUEST_BODY REQUEST_HEADERS_NAMES REQUEST_HEADERS "history.pushstate history.replacestate" "phase:4,deny,log,msg:'sh5ark historybased attacks detected'

18 Analysis! Manually analyzing the ModSecurity audit log may be hazardous to your mental health! Decide what to look for, then find some tools

19 What Are We Looking For?! Recent ModSecurity Alerts! SQL Injec?on! Cross Site Scrip?ng (XSS)! Command Injec?on! Cookie Tampering, etc! Any interac?on with our honey traps! Changes in the volume of applica?on errors! Changes in the volume of login a0empts! Applica?on ac?vity in odd?me frames! What data did an a0acker send and what did he receive?

20 Audit Console! Java applica?on wri0en for ModSecurity log analysis! Creates a sensor which receives informa?on via RPC interface! Configure mlogc in Apache and ModSecurity to send events to the Audit Console listener

21 Audit Console Dashboard

22 Audit Console Event Viewer

23 Splunk! Takes pre0y much any data and makes it searchable! Very flexible query language! Easily combine your Apache and ModSecurity logs! Build your own applica?ons to monitor and search ModSecurity! h0p://kura2gurun.blogspot.com/2011/11/mod- security2- apps- for- splunk.html! Regex for source type:! - - [a- f0-9]+- [A B C I J D E F H Z]- -

24 ModSecurity Resources! Reference Manual! h0ps://github.com/spiderlabs/modsecurity/wiki/ Reference- Manual! Data Formats! h0ps://github.com/spiderlabs/modsecurity/wiki/ ModSecurity- 2- Data- Formats! Presenta?ons! h0p://vimeo.com/search?q=ryan+barne0+modsecurity! Books! ModSecurity Handbook! Web Applica?on Defender s Cookbook

25 Thank You! Jason Wood