Lost in Translation. Joaquim Espinhara & Rodrigo Montoro

Transcription

1 Lost in Translation Joaquim Espinhara & Rodrigo Montoro

2 $ Senior Security Consultant at Trustwave Author of 0 patent pending technologies BJJ enthusiast Triathlete Dad (of dog)

3 $ Senior Security Administrator at Sucuri Security Author of 2 patent pending technologies Researcher Open Source enthusiast Triathlete Dad

4 Motivation ERROR 1045 (28000): Acesso negado para o usuário 'spooker'@'localhost' (senha usada: SIM)

5 Note We are not talking about specific products only, all demos are to prove our idea that probably affects any vendor / product.

6 ages Source:

7 Native English countries Map of nations using English as a de facto or official majority language (dark blue) or an official minority language (light blue) Source:

8 Products

9 How detection works

10 Offensive Tool Prepare Request based on services Send request to device Service process request Tool process response Tool receive response Service send response

11 Defensive Tool Prepare Request based on services Send request to device Service process request Defensive Tool Tool process response Tool receive response Service send response

12 Attack sample

13 What kind of problems?

14 Non-Detection aka False Negatives Offensive Defensive

15 Compliance bypass

16 Stealth backdoors / problems

17 Changes on the fly... mysql> select ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near at line 1 mysql> SET lc_messages = 'pt_br'; Query OK, 0 rows affected (0.00 sec) mysql> ERROR 1064 (42000): Você tem um erro de sintaxe no seu SQL próximo a '@version' na linha 1 mysql>

18 Proof of Concepts (PoC)

19 Offensive Tools Acunetix W3AF Qualys Free online version

20 Acunetix

21 Acunetix Demo

22 w3af

23 Qualys Free Scan

24 Defensive tools Snort / Sourcefire (Cisco) OSSEC (Trend Micro) WAF Parser

25 Snort / Sourcefire (IDS or IPS) alert tcp $SQL_SERVERS > $EXTERNAL_NET any (msg:"et ATTACK_RESPONSE MySQL User Account Enumeration"; flow:from_server,established; content:" 02 "; offset:3; depth:4; content:" Access denied for user"; fast_pattern:only; threshold:type both,track by_dst,count 10,seconds 1; reference:url,seclists.org/fulldisclosure/2012/dec/att-9/; classtype:protocol-command-decode; sid: ; rev:2;) alert tcp $SQL_SERVERS > $EXTERNAL_NET any (msg:"gpl SQL sa brute force failed login attempt"; flow:from_server,established; content:"login failed for user 'sa'"; threshold:type threshold, track by_src, count 5, seconds 2; reference:bugtraq,4797; reference:cve, ; reference:nessus,10673; classtype:unsuccessful-user; sid: ; rev:4;) alert tcp $HOME_NET > $EXTERNAL_NET any (msg:"et SCAN Multiple MySQL Login Failures, Possible Brute Force Attempt"; flow:from_server,established; content:" "; depth:64; content:" Access denied for user 20 "; fast_pattern:only; content:"using password 3A 20 "; threshold: type threshold, track by_src, count 5, seconds 120; reference:url,doc.emergingthreats.net/ ; classtype:attempted-recon; sid: ; rev:3;)

26 Snort / Sourcefire

27 OSSEC (HIDS)

28 Logtest OSSEC

29 WAF Parser

30 Offensive & Defensive

31 Desktops

32 Future / Mitigations

33 Not easy fix, just talking about MySQL By default, mysqld produces error messages in English, but they can also be displayed in any of several other languages : Czech, Danish, Dutch, Estonian, French, German, Greek, Hungarian, Italian, Japanese, Korean, Norwegian, Norwegian-ny, Polish, Portuguese, Romanian, Russian, Slovak, Spanish, or Swedish. 20 languages

34 Improve ASV tests for PCI scanners

35 Work more with code errors (when available) mysql> select ERROR 1064 (42000): Você tem um erro de sintaxe no seu SQL próximo a '@version' na linha 1 mysql> ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '@version' at line 1

36 Possible attack surface Something we couldn t measure yet, need tests and more tests.

37 Engine to detect language (not that easy) 000): Você tem um erro de sintaxe no seu SQL próximo a '@vers

38 Contacts && Thank you!