Web Application Attacks and Countermeasures: Case Studies from Financial Systems Dr. Michael Liu, CISSP, Senior Application Security Consultant, HSBC Inc
Overview Information Security Briefing Web Applications in Financial Systems User-Oriented Attacks and Countermeasures General Advices for Secure Internet Surfing
Information Security Briefing Access Control Application Security Business Continuity and Disaster Recovery Planning Cryptography Information Security and Risk Management Legal, Regulations, Compliance and Investigations Operations Security Physical (Environmental) Security Security Architecture and Design Telecommunications and Network Security
Web Applications in Financial Systems Application Level View of A Financial System Web Applications are facing directly external attacks. Customer Browsers Front End Web Applications Web applications understand the most application logic. Messaging Application Back end applications rely on front end web applications to implement many security controls. Back End Business Logic Applications Backend Databases
Web Applications in Financial Systems The Reality of Web Application Implementation: It is common that a web application is found to have unexpected features during security testing phase. Some unexpected behaviour have minor impact on the security posture of the application, others may cause severe damages if exploited. Expected Features Actual Features Functional Testing Focus Security Testing Focus
Understanding Web Applications in Financial Systems The Real World Hack, According to WhiteHat Security Inc. : 83% of websites have at least one serious vulnerability. 2,500 web servers are successfully hacked each day and 70% of these attacks exploit application vulnerabilities. Traditional Network level security solutions (firewalls, network vulnerability scanners) are ineffective in the world of custom web applications.
Understanding Web Applications in Financial Systems HTTPS = Secure? www.microsoft.com = www.mícrosoft.com?
Understanding Web Applications in Financial Systems Web Application Attack Types (From OWASP) CSRF Cache Poisoning Code Injection Command Injection Comment Injection Attack Cross Site Tracing Cross-Site Request Forgery (CSRF) Cross-User Defacement Cross-site Scripting (XSS) Cryptanalysis Custom Special Character Injection Direct Dynamic Code Evaluation Direct Static Code Injection Double Encoding SQL Injection Server-Side Includes (SSI) Injection Session Prediction Session fixation Session hijacking attack Setting Manipulation Special Element Injection Man-in-the-browser attack Man-in-the-middle attack Mobile code: invoking untrusted mobile code Mobile code: non-final public field Mobile code: object hijack
User-Oriented Attacks and Countermeasures Attack Methods to Compromise User Authentication User Credentials Legitimate User 1.1 Eavesdrop on the network traffic 2. Provide Credential Front End Web Server 1.2 Eavesdrop on Computer 1. Send Scam Email 2. Input Credential directly /Replay Captured Data 1. Dictionary Man-in-The-Middle Attack Phishing Eavesdropping Online Guessing Attacker
User-Oriented Attacks and Countermeasures Some Controls to protect user authentication Secure Socket Layer (SSL) Random Password Character Challenge Smart Card One Time Password
User-Oriented Attacks and Countermeasures Digital Stamp for anti-phishing Short Message Service Challenge for anti-impersonating Digital Fingerprinting for antiimpersonating Randomized Virtual Keyboard to counter keylogger
User-Oriented Attacks and Countermeasures Attack Methods to Compromise User Internet Sessions 1: Logon to the web application 5: The malicious action is executed silently Legitimate User Legitimate Web Server 4: Lure the user to visit the malicious page Malicious Web Page 3: Construct a web page that can trigger the crafted URL when visited Attacker 2: Craft a URL that cause an action of the legitimate application
Session Attacks To Prevent Session Hijacking: User s best practises: Logoff immediately after using a web application Do not allow your browser to save username/passwords, and do not allow sites to remember your login Do not use the same browser to access sensitive applications and to surf freely the Internet; if you have to do both things at the same machine, do them with separate browsers.
General Advices for Secure Internet Surfing Deploy a personal firewall and antivirus/antimalware applications Keep up with the software security patches Run non-admin account with Internet surfing Try to read email in plaintext mode Restrict scripting code and any form of mobile code from the Internet Always logoff explicitly from sensitive applications Don t access sensitive applications while surfing the Internet in the same browser window Try not to use mobile banking applications (It is far less secure than you think at this stage!)