Live site culture

Live site culture is the focus of an organization to prioritize the experience and reliability of the live site over everything else. A live-site culture promotes the idea that anything that happens in the production environment takes precedence over anything else. Next, anything that threatens production, is about to go to production, or hinders going to production at any time gets priority. Only when these are all in order is the attention shifted to future work.

• Live site first
• Control exposure through feature flags
• Make vulnerabilities real and personal
• Engineering is more than an ops partner
• Production telemetry is the heartbeat of your service
• Make alerts actionable

FedRAMP containerization security

There are a couple of practices to make containers are secure to pass FedRAMP audit.

• Image Hardening
• CI/CD Pipeline
• Asset Management and Inventory Reporting
• Vulnerability Scanning
• Encryption data-in-transit and data-at-rest
• Network separation
• Authentication and authorization
• Audit logging
• System backups
  

STIR/SHAKEN 101

STIR/SHAKEN is a technology framework designed to reduce fraudulent robocalls and illegal phone number spoofing. STIR stands for Secure Telephony Identity Revisited. SHAKEN stands for Secure Handling of Asserted information using toKENs. Its goal is to prevent fraudsters from scamming consumers and businesses through robocalls and illegal phone number spoofing, while making sure that legitimate calls reach the recipients.

The FCC has adopted rules requiring service providers to deploy a STIR/SHAKEN solution by June 30, 2021.

STIR/SHAKEN is a great tool to help providers restore confidence in the calls they're connecting. It is not a one-stop solution for preventing telecom fraud. In fact, its main use is to verify that a call being made is in fact from the owner of the telephone number.

To verify the ownership of the phone number, there are 3 types of attestation:

1. A (Full) - The service provider knows the customer and their ownership to use the phone number.
2. B (Partial) - The service provider knows the customer, but not the source of the phone number.
3. C (Gateway)  - The service provider has originated the call onto the network but can’t authenticate the call source and phone number. e.g international gateway.

On the terminating end, attestation of A and B are usually considered good calls but not guaranteed from being blocked, because analytic engine and fraud system have other factors considered than attestation result.

Security awareness training notes

The following is the terminologies related to security risk from social engineering.

• Social engineering: the art of manipulating, influencing, or deceiving you into taking some action or divulging confidential information.
• Phishing: Acquire sensitive information such as usernames and passwords
• Spear phishing: specific phishing target using soical media, personalized message
• Vishing: voice phishing, using scam recorded message
• Smishing: phish you using text messages
• Pretexting: the practice of presenting oneself as someone else in order to obtain private information
• Tailgating: trying to gain unauthorized access to physical locations
• Ransomware: malicious software that will allow a hacker to deny access to all of files or network until a ransom is paid.
  
• Spyware: installed software to spy and collect data
  Bot: act as malicious software, running in background, usually causing system slow or crash
• Malicious app: link/attachment to install bad app on mobile phones
  

Three things to remember

• Stop, look, and think before take proper actions
  
• Don't open links or attachment in suspicious emails
• Don't use public wifi
  

Email sender authentication

Speaking of authentication in an email delivery, usually we will talk about SPF, DKIM and DMARC. Put aside these fancy acronyms, authentication is basically to prove the sender is the legit sender and the email is not tampered in transit.

SPF (Sender Policy Framework) verifies the email is coming from an authorized server. An SPF record is a DNS TXT record specifying which IPs or servers are allowed to send email from that domain.

DKIM (DomainKeys Identified Mail) proves the email has not been changed in transit and the sender owns the DKIM domain. DKIM is also a TXT record signature that builds trust between the sender and the receiver.

DMARC (Domain-Based Message Authentication Reporting and Conformance) is an added authentication method that uses both SPF and DKIM to verify whether or not an email was actually sent by the owner "from" domain. In order for DMARC to pass, both SPF and DKIM must pass, and at least one of them must be aligned. Gmail and Microsoft adopt DMARC into their filtering methods for None, Quarantine, or Reject policies.

CSP (Content Security Policy) - Part 2

About 3 years ago, I had a blog to talk about the same topic regarding CSP. Now, I want to revisit this to do a refresh as the security team recently enforced this adoption in products. The following knowledge and information are based on google developer document

CSP defines the Content-Security-Policy HTTP header, which allows you to create a whitelist of sources of trusted content, and instructs the browser to only execute or render resources from those sources.

CSP provides a rich set of policy directives that enable fairly granular control over the resources that a page is allowed to load

By default, directives are wide open. CSP provides a default-src directive to allow you override this default behavior. script-src, style-src, img-src, media-src, font-src, connect-src, object-src, child-src etc *-src directives will take this default as a fallback.

CSP preferred delivery mechanism is an HTTP header. It can be useful, however, to set a policy on a page directly in the html markup.
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; child-src 'none'; object-src 'none'">
Content-Security-Policy-Report-Only header
The policy specified in report-only mode won't block restricted resources, but it will send violation reports to the location you specify.

You can use as many or as few of these directives as makes sense for your specific application, simply listing each in the HTTP header, separating directives with semicolons.

Content-Security-Policy: default-src 'none'; script-src https://cdn.mybank.net; style-src https://cdn.mybank.net; img-src https://cdn.mybank.net; connect-src https://api.mybank.com; child-src 'self'

Content-Security-Policy: default-src https://cdn.example.net; child-src 'none'; object-src 'none'

Technology trends in 2020

Data
Data visualization - Tableau (acquired by salesforce), Qlik, Domo or other BI tools
Big data and data science

Security
data encrypted in transit and at rest.
security by design principle
security automation using AI and machine learning

Cloud
embrace cloud-native mindset
hybrid and multi-cloud solutions for finance, healthcare and defense.

AI
more widespread uptake of machine learning skills and abilities
NLP (natural language processing)

Operation (DevOps)
Kubernetes, an orchestration layer to get those docker containers to work together
tools for automation, testing and monitoring
focus more on the observability and resilience of the systems
invest more in your current talent

Web Security Issues (Cont.)

The focus is on the Top 10 Web Vulnerabilities identified by the Open Web Application Security Project (OWASP)

#1: Injection flaws (SQL injection, Command injection, LDAP injection)
#2: Broken Authentication
#3: Cross Site Scripting (XSS)
#4: Insecure Direct Object References
#5: Security misconfiguration
#6: Sensitive data exposure (Sensitive data should be encrypted in transit and at rest)
#7: Missing function level access control
#8: Cross Site Request Forgery (CSRF)
#9: Using components with known vulnerabilities
#10: Unvalidated redirects and forwards

Web Security Issues

No Authentication & Authorization

Authentication is knowing who an entity is, while authorization is knowing what a given entity can do. APIs should have proper authentication and authorization in place.

What is the solution?

1. We added authentication and authorization for most APIs.

XSS (Cross-site scripting)

Qualys scan result can help on XSS detection.

With that being side, any sensitive data in HTML body or Javascript is not allowed.

What is the solution?

1. Always encode customer input to avoid display direct HTML/JS
2. Move the data from visible JS object to browser memory
3. Use a framework which takes care of XSS.

CSV Injection

CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program such as Microsoft Excel or LibreOffice Calc is used to open a CSV, any cells starting with '=' will be interpreted by the software as a formula.

What is the solution?

To remediate it, ensure that no cells begin with any of the following characters:

Equals to ("=")
Plus ("+")
Minus ("-")
At ("@")

This should apply to all download CSV files.

No Input Validation

Input validation on backend APIs is so critical to application security.

What is the solution?

Anything that our application receives from untrusted sources must be filtered, preferably according to a whitelist.
Input validation
Input filtering
Input encoding

Sensitive data exposure

Sensitive data should be encrypted at all times, including in transit and at rest. Also, the logging file should not print any sensitive data.

What is the solution?

1. In transit: Use HTTPS. Do not accept anything over non-HTTPS connections. Have the secure and HttpOnly flag on cookies.
2. In storage: if you have sensitive data that you actually do need, store it encrypted and make sure all passwords are hashed.

Security misconfiguration

Do not widely open your environments to the internet access, which gives Hacker chance to explore vulnerabilities.

What is the solution?

1. Do NOT widely open environment to outside. Use IP whitelist for access control
2. Perform regular host/container vulnerability scan
3. Perform regular web application vulnerability scan using Qualys alike tool

DoS or DDoS

Denial of service attack is crucial.

What is the solution?

1. Add rate limit control to the application 

CORS (cross-origin resource sharing)

The most common and problematic security issue when implementing CORS is the failure to validate/whitelist requestors. Too often developers set the value for Access-Control-Allow-Origin to ‘*’. Unfortunately, this is the default. This allows any domain on the web to access that site’s resources.

What is the solution?

1. Should we Set Access-Control-Allow-Origin to * ?
2. What About Access-Control-Allow-Methods?

SSL Certificate Uses Weak Signature

The integrity of the signature hash algorithm used in signing a certificate is a critical element in the security of the certificate. Weaknesses in hash algorithms can lead to situations in which attackers can obtain fraudulent certificates. The MD5 signature has long been considered outdated by cryptographic specialists. SHA-1 is outdated and has been phased out by several sources - including Microsoft, Google, and Mozilla as of January 1, 2016.

What is the solution?

1. Use SHA256 algorithm

Zip with password on Mac OSX

To compress a file with password:
zip -e example.zip example.txt

To compress a folder with password:zip -er zippedFile.zip FolderToZip/

To preview a zip file
zipinfo example.zip

To unzip a zip file
unzip example.zip

UCaaS security framework

Cloud UCaaS (Unified Communications as a Service) needs a security framework to make it secure and reliable in the cloud for Meetings, Phone and Chat.

1) Secure data center
UCaaS provider (vendor) needs facilities with strong physical protections, redundant power, and tested disaster recovery procedures.

2) Robust network security
UCaaS vendor must add unique protections designed to prevent attacks on the infrastructure, preventing service disruption, data breaches, fraud, and service high-jacking. Also needs to resolve firewall traversal problems in VoIP systems with network address translation (NAT) support for static IP configuration and “Keep-Alive” SIP signaling.

3) Secure voice
All voice traffic within cloud phone system should be encrypted to prevent eavesdropping on voice calls.  Provide additional security for IP phone calls using SIP over TLS and SRTP encryption.

4) Data encryption
All data should be encrypted in transit and at rest, with audit-able record-keeping and reporting. It includes everything from physical protections at data centers to encrypted storage to comprehensive digital tracking with clear audit trails.

5) Fraud prevention
The service provider should have protections built in to the service layer and should conduct continuous monitoring for dangerous anomalies or other indicators of toll fraud and service abuse.

6) User access controls
To ensure only authorized users access cloud communications accounts and services, the vendor should implement at a minimum strong password policies and ideally two-factor authentication as well as single sign-on (SSO).

7) Account management and administration
Administrators can instantly revoke the remote user’s access to the cloud network—and thereby to customer contacts, CRM info, and other corporate information—and almost no data resides on the device itself.

RingCentral Phone provisioning is unsecure

Recently I provisioned a Cisco SPA-525G2 Desk Phone to my RingCentral Free Trial account, and found their provisioning process is totally not secure.

When I added an existing phone on account admin portal, it prompted me to input the IP address of my IP Desk Phone. I am curious how the flow works underneath, then I dig it out and find RingCentral uses http instead of https. It doesn't provide either server side certificate or client side certificate for mutual TLS authentication. This means the provisioning data packets are exposed to hackers, and also any device can get provisioned through their provisioning portal. I am very surprised of their design from security perspective.

Phone resync URL
http://10.100.61.87/admin/resync?http://service.ringcentral.com/op/?u=1953899020&ai=803497337020&sn=$SN&pn=$PN

Proxy to their provisioning portal using HTTP
http://service.ringcentral.com/op/?u=1953899020&ai=803497337020&sn=$SN&pn=$PN

Variables in the URL will be replaced by desk Phone with serial number and product model
http://service.ringcentral.com/op/?u=1953899020&ai=803497337020&sn=CCQ214808CZ&pn=SPA525G2

If you sniff the network, you can clearly see the request and response in clear text (including user ID, password, auth ID etc info in plain XML file), and you can use any User agent to do the provisioning acting as a Cisco IP Phone.

This design worries me about their security design. I am not sure if they design by purpose or design by mistake.

Mutual TLS Authentication

Mutual authentication or two-way authentication refers to two parties authenticating each other at the same time. By default the TLS protocol only proves the identity of the server to the client using X.509 certificate and the authentication of the client to the server is left to the application layer. TLS also offers client-to-server authentication using client-side X.509 authentication.

When Mutual TLS authentication is in place, both client and server authenticate each other through the digital certificate so that both parties are assured of the others' identity. In this aspect, both client and server use 12 handshake messages to establish the encrypted channel prior to message exchanging.

Refer to https://www.codeproject.com/articles/326574/an-introduction-to-mutual-ssl-authentication

When set up Mutual TLS authentication, it involves creating your own Certification Authority, self-signing the server certificate and client certificate, then installs self-signed certificate on server and client. The detailed steps are as followings:

1. Generate CA certificate:
1.1. Generate CA key:
openssl genrsa -out ca.key 2048
1.2. Generate CA certificate request:
openssl req -new -key ca.key -out ca.csr -subj /C=US/ST=ABC/L=XYZ/O=Example/OU=Test/CN=Root/emailAddress=john.doe@example.com
1.3. Generate CA certificate:
openssl x509 -req -days 3650 -in ca.csr -signkey ca.key -out ca.pem

2. Generate server certificate:
2.1. Generate server key:
openssl genrsa -out server.key 2048
2.2. Generate certificate request:
openssl req -new -key server.key -out server.csr -subj /C=US/ST=ABC/L=XYZ/O=Example/OU=Test/CN=test.cert.example.com/emailAddress=john.doe@exampl
e.com
2.3. Generate certificate:
openssl x509 -req -in server.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out test.cert.example.com.pem -days
365

3. Generate client certificate:
3.1. Generate client key:
openssl genrsa -out client.key 2048
3.2. Generate certificate request:
openssl req -new -key client.key -out client.csr -subj /C=CN/ST=FJ/L=City/O="Company"/OU=Dept/CN=ClientID/emailAddress=support@company.com
3.3. Generate certificate:
openssl x509 -req -in client.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out client.pem -days 365

4. Combine cert and key:
cat client.pem client.key > client2.pem

Some client like Firefox, to install the client certificate, we’ll need a PKCS#12 file which stores both the certificate and the client’s private key.
openssl pkcs12 -export -clcerts -in client.pem -inkey client.key -out client2.p12

5. Configure server:
Apache:
TLSCACertificateFile ca.pem
TLSCertificateKeyFile server.key
TLSCertificateFile test.cert.example.com.pem
TLSVerifyClient demand

Nginx:
ssl_certificate test.cert.example.com.pem;
ssl_certificate_key server.key;
ssl_client_certificate ca.pem;
ssl_verify_client on;

6. Configure client (device or browser):
6.1 Add ca.pem as a trusted CA certificate on client side
6.2 Add client2.pem or client2.p12 as a client certificate and use it

https://blog.codeship.com/how-to-set-up-mutual-tls-authentication/ also gives step-by-step instructions to set up mutual authentication using openssl commands.

CA certificate
openssl genrsa -aes256 -out ca/ca.key 4096 chmod 400 ca/ca.key
openssl req -new -x509 -sha256 -days 730 -key ca/ca.key -out ca/ca.crt
chmod 444 ca/ca.crt
openssl x509 -noout -text -in ca/ca.crt

Server certificate
openssl genrsa -out server/client-ssl.bauland42.com.key 2048
chmod 400 server/client-ssl.bauland42.com.key
openssl req -new -key server/client-ssl.bauland42.com.key -sha256 -out server/client-ssl.bauland42.com.csr
openssl x509 -req -days 365 -sha256 -in server/client-ssl.bauland42.com.csr -CA ca/ca.crt -CAkey ca/ca.key -set_serial 1 -out server/client-ssl.bauland42.com.crt
chmod 444 server/client-ssl.bauland42.com.crt
openssl x509 -noout -text -in server/client-ssl.bauland42.com.crt
openssl verify -CAfile ca/ca.crt server/client-ssl.bauland42.com.crt

Client certificate
openssl genrsa -out client/heiko.key 2048
openssl req -new -key client/heiko.key -out client/heiko.csr
openssl x509 -req -days 365 -sha256 -in client/heiko.csr -CA ca/ca.crt -CAkey ca/ca.key -set_serial 2 -out client/heiko.crt
openssl pkcs12 -export -clcerts -in client/heiko.crt -inkey client/heiko.key -out client/heiko.p12

Nginx server config
ssl_certificate /etc/nginx/certs/server/client-ssl.bauland42.com.crt;
ssl_certificate_key /etc/nginx/certs/server/client-ssl.bauland42.com.key;
ssl_client_certificate /etc/nginx/certs/ca/ca.crt;
ssl_verify_client on;

csv injection

If the csv file cell value uses formulas, it is often to see csv injection. For instance, if the cell value is  =cmd|' calc'!A0 which will launch calculator.

To prevent csv injection attack, you need either filtering or neutralizing the spreadsheet meta-characters used to define formulas. These 4 characters are +, -, =, and @

Filter is to remove the meta-characters if see excel cell value beginning with one of these 4 characters.

Neutralize is to precede cell values that begin with the characters: +, -, =, or @ with a single quote. This is called “escaping” or “neutralizing” the characters to have excel cell value interpreted as data instead of formulas.

CSP (Content Security Policy)

CSP (Content Security Policy) is a tool which developers can use to lock down their applications in various ways, mitigating the risk of content injection vulnerabilities such as cross-site scripting, and reducing the privilege with which their applications execute.

CSP is not intended as a first line of defense against content injection vulnerabilities. Instead, CSP is best used as defense-in-depth. It reduces the harm that a malicious injection can cause, but it is not a replacement for careful input validation and output encoding.

Besides CSP, Web application should try to avoid Cross-site Scripting (XSS), Cross-Site Request Forgery (CSRF) etc security attacks.

There are two options to implement CSP, one is on server side through HTTP response header, the other is client side through HTML meta element. Here are the details:

The Content-Security-Policy HTTP response header field is the preferred mechanism for delivering a policy from a server to a client.

Content-Security-Policy: script-src 'self';
                         report-to csp-reporting-endpoint

The Content-Security-Policy-Report-Only HTTP response header field allows web developers to experiment with policies by monitoring (but not enforcing) their effects.

Content-Security-Policy-Report-Only: script-src 'self';
                                     report-to csp-reporting-endpoint

A Document may deliver a policy via one or more HTML meta elements whose http-equiv attributes are an ASCII case-insensitive match for the string "Content-Security-Policy".

<meta http-equiv="Content-Security-Policy" content="script-src 'self'">

There are many directives including script-src, frame-src, style-src, image-src etc to define the content security policies. For details, please check out https://www.w3.org/TR/CSP

Cross Site Scripting (XSS)

Today Salesforce rejected our app due to several security issues. One of these was Cross Site Scripting (XSS). This is a common issue in security domain, and we need employ the changes to prevent XSS. The problem, and possible fix solution from Salesforce is very clear, so I copied and pasted here for future reference.

Description:

The attack involves reflecting user provided data into the browser, without any modification at the server's end. Cross Site Scripting attacks can be scripted in any browser scripting technology. There are 3 different types of Cross Site Scripting attacks. The first, being the most simple, in which the data entered is reflected back. The attack is temporary and is least risky. The second, called Persistent Cross Site Scripting is very common on bulletin boards and various social networking sites. The malicious input is stored on the server and each time a user accesses the data, the code is interpreted. And finally, the third form, called DOM based Cross Site Scripting, is perpetrated by exploiting the accessibility of the DOM of HTML page the user is viewing, and then running scripts with the user's privileges on his/her machine.

The developers of the application need to have strong input validation in place. This can be done using either blacklists or whitelists of characters. Similarly, the developers need to ensure that output is well sanitized. This can be implemented by escaping all the content being directed to the browser. Methods to boost cookie security should be employed.

Recommendation:

Consider performing a combination of input filtering and context-appropriate output encoding, such as HTML entity encoding for all the data that could be provided by external data sources like databases, users or web services if that data is included in the application’s output. Sanitize all user input. Enforce input validation checks on the server side. Include data type checks, data size and range checks. Check user input against whitelist values, check against other data values for logical accuracy and data integrity based on business rules.

An example of a blacklist would be where any input that contains characters that are considered “invalid” for web applications, such as “ < > & ‘ `;. Despite efforts to authoritatively identify all such characters, some characters are likely to be left out. A better way of validating input would be to define a list of allowed characters, also referred to as a whitelist.

 

Frame busting

More and more websites don't want them to be iframed in other websites, so they added frame busting setting or codes to their websites. Our web clipper can clip website URLs as a bookmark, so we need to deal with this frame busting thing - which is called anti-frame-busting or preventing frame busting.

Three ways if you don't want your website iframed in other websites:
1. X-Frame-Options: deny
In http header, and implemented by most browsers. iOS UIWebView seems to have not implemented this as of writing.

2. Traditional Javascript code
if (top != self) { top.location.replace(self.location.href); }

3. Javascript to show/hide body due to clickjack security concern
<body style="display:none" ...>
try {
  if (top.location.hostname != self.location.hostname)
    throw 1;
  document.body.style.display = 'block';
} catch (e) {
  // possible clickjack attack, leave content hidden
}

Then how to prevent frame busting?
Check out http://stackoverflow.com/questions/958997/frame-buster-buster-buster-code-needed for the discussions.

Notes from Java security training

Threat Modeling:
Use Microsoft SDL Threat Modeling Tool to understand the system potential threats. Usually we have 4 steps, namely (1) Draw Diagrams (2) Analyze Model (3) Describe Environment (4) Generate Reports. We can focus on outfacing interface then features, and define process, data store, external interactor and data flow as well as (trust) boundary.

Here is one *.tms file snapshot:

Secure Development Life-cycle:
Organization or project group should define some secure development process to get security in the whole software development phase, from requirement analysis, design, development, deployment and so on.

Use JTest to fix insecure code:

Eclipse with JTest plugin provides better experience to help write secure code.

OWASP WebGoat Example:
http://localhost:6080/WebGoat-5.1/attack

Notes:

1. SDL Threat Modeling Tool needs Visio
2. JTest is from Parasoft, which provides a bunch of features including security scan