PowerPoint Presentation

Big Security for Big Data

Ari Elias-BachrachDefensium llc

March 2014

About Me

Ari Elias-Bachrach

Application Security nerd, OWASP fanboy

Help Development understand security

Help security understand development

Often get calls from developers that start with help!

Your Data Is Important

This Talk Will Cover Some Important Security Controls

Beyond SQL Injection

Cross-Site Scripting

Access Control

//code...

For Years People Have Been Warned About SQL Injection

String id = Request.QueryString("SomeID")string sql = "SELECT Product FROM myTable WHERE id = '" + id + "'";

5'; drop table myTable; #

SELECT Product FROM myTable WHERE id = '5'; drop table myTable; #'

The Solution Is To Use Prepared Statements

String id = Request.QueryString("SomeID")string sql = "SELECT Product FROM myTable WHERE id = ?";

Statement = connection.prepareStatement(sql)

Statement.setString(1, id)

Many New RDBMS' Do Not Use SQL

Mongo does not use SQL, so it's not vulnerable to SQL Injection.... right?

Many New RDBMS' Do Not Use SQL

The fundamental problem that led to SQL injection is the lack of separation between commands and variables

VariablesCommandTextInstructionsNot parsedParsed

Mongo Can Still be Vulnerable With PHP

$collection->find(array( "username" => $_GET['username'], "passwd" => $_GET['passwd']));

username=user&passwd[$ne]=foo

Mongo Can Still be Vulnerable With PHP

$collection->find(array( "username" => user, "passwd" => array("$ne" => foo)));

username=user&passwd[$ne]=foo

Separate Variables and Commands

Return to the fundamental rule:Separate Variables and Commands Strong typing can be one way to do this

$collection->find(array( "username" => (string)$_GET['username'], "passwd" => (string)$_GET['passwd']));

Separate Variables and Commands

Whatever system you may be working on in the future, remember this law:Separate Variables and Commands

Separate Variables and Commands

--http://us.php.net/manual/en/mongodb.execute.php

Separate Variables and Commands

Cross-Site Scripting (XSS) Occurs When An Attacker Can Execute Code on Your User's Systems

Attacker can make your users execute arbitrary code as if it was sent from your website

Client side attack

//code...

Cross-Site Scripting (XSS) Occurs When An Attacker Can Execute Code on Your User's Systems

Bob

Hi Bob

Hi Request.QueryString("name")

Cross-Site Scripting (XSS) Occurs When An Attacker Can Execute Code on Your User's Systems

name=...

Hi ...

Http://server/page.jsp?name=...

This code is now executed in the domain of the website that sent it, and it can access that page's DOM

Cross-Site Scripting (XSS) Occurs When An Attacker Can Execute Code on Your User's Systems

So What?

Change page contents

Steal Cookies

Redirect to another page

Change form actions

The Solution is To Properly Encode All Untrusted Outputs

&&''"//

The Solution is To Properly Encode All Untrusted Outputs

Hi

http://server/page.asp?name=alert(document.cookie)

Encoding is Context Dependent

"&&//

Can you execute code here without using the six characters encoded as part of HTML encoding?

foo onmouseover=alert(document.cookie)

Encoding is Context Dependent

Different contexts call for different encoding rules

hereHTML context

Attribute context

x='here'JavaScript context