AWS WAF @indusfacepromotions-blog - Tumblr Blog

Being and Beyond the Emerging Information Security Product Company

Somewhere in October last year, NASSCOM-DSCI closed its nominations for the prestigious DSCI Excellence Award. Indusface was up for the Emerging Information Security Product Company award with our popular Total Application Security solution.

The Data Security Council of India (DSCI) had collaborated with PricewaterhouseCoopers (PwC) to recognize and honor emerging product ideas in the Information Security domain. Solving security problems, taking thought leadership, creating a conducive business environment, increasing trustworthiness, and building resilience were the shortlisting criteria they were looking for.

Interestingly, these were also the things that we at Indusface wanted to achieve with the Total Application Security solution.

The Problems That We Solve

Digital businesses, big or small, cannot survive without an extensive application infrastructure. This is something that hackers and attackers have grown increasingly fond of. They want to attack the core business functionality that basically enables banks, financial institutions, new-age businesses, and retailers serve customers and prospects.

And by large, problem lies in these three facts:

86% of all the websites have 1 serious application flaw.*

55% of retail trade sites are always vulnerable to attacks.*

70% of all web attacks happen on the application layer. #

In fact, as business ideas and applications get more complex, moderately controlled, and rarely monitored for security flaws, risks multiply. The other part of the issue is business implication. According to a survey conducted by Gemalto, 64% of the people are unlikely to shop or do business with a company hit by data breach. And it’s not just about the online or digital business entirely. Earnings at Target, largest US retail chain after Walmart, dropped by 16% and they even lost $148 million recovering from the breach. So clearly, application breaches pull down businesses, and with a huge force.

Indusface realizes that application breaches are only going to grow exponentially in the coming years. New-age companies and startups aggressively chasing customers will have little time to cover web application security.

Total Application Security offers just the solution that companies need today. Combining automated and expert-mandated technologies, it enables application owners to find out weaknesses in the applications infrastructure, block attacks that use those flaws, and monitor all the relevant application data. All of this is put together on a simple dashboard, for real-time analytics and absolute control.

Becoming the Top Emerging Information Security Product Company

Early in December, DSCI finally released its shortlisted entries and Indusface was among the four top companies selected to represent its emerging product idea and its impact to the real business world to the jury, which included:

Abhay Karandikar, Professor, Department of Electrical Engineering, IIT Bombay.

Sandeep Singhal, Managing Director, Nexus India Capital Advisors Pvt. Ltd.

Saurabh Srivastava, Co-founder & Former Chairman, NASSCOM.

Siva Sivasubramanian, Chief of Security, Airtel.

V. Mohandas Pai, Chairperson, Manipal Global Education Services P Ltd. And Co-founder AARIN Capital.

Pitted against CipherCloud India, Parablu Systems, and ShieldSquare Indusface was evaluated and graded by both audience and jury members. Finally, on the eve of 16 December, we were announced the Top Emerging Information Security Product Company, an honor received by Indusface’s CEO Ashish Tandon.

Being and Beyond the Recognition

So, what does it mean to be the Emerging Information Security Product Company? How does it change how the world or we see Total Application Security? Where do we go from here?

It’s a great honor to be recognized as the foremost emerging security product company. In fact, Indusface was also selected in the revered InTech50 annual listing by iSpirit last year. However, we also understand that both web and mobile application security remain undervalued security domain. Statistics show that most data breaches and mobile app penetrations could have been avoided with prior testing and patching. Over the years, we plan to empower companies deal with four major security challenges. One, businesses do not know if their website can be hacked. Even if they test it once, applications are updated frequently and there is no way to get vulnerability updates on that. Two, vulnerabilities should be patched. It takes time and resources. And till that happens, the website is open to all kinds of threats. Three, bad people are just waiting to launch distributed denial-of-services attacks with these fancy bots and machines that send so much traffic to the website that the server crashes. Four, hiring and maintaining a separate security team is a huge responsibility. It’s not just about the money, it takes time too, which takes away the focus from key business objectives.‘Total Application Security’ idea is to overcome all four of these obstacles, at once. It packs web application scanning that looks for website vulnerabilities continuously. It doesn’t matter if you make application code level changes or update the website frequently, once scanning finds an OWASP weakness or malware injection it will report it immediately.Total Application Security also provides web application firewall that blocks exploitations and application distributed denial-of-services (DDoS) attempts. In simpler words, it prevents attacks from hackers that use OWASP vulnerabilities or malware on your website with the help of dedicated security expert team that monitors and analyzes traffic, attack vectors, and DDoS instances continuously to improve your security model accordingly. *SC Magazine #Gartner

#AWS WAFWEB APPLICATION FIREWALLWEB APPLICATION SECURITYDDOS ATTACK

Interestingly, these were also the things that we at Indusface wanted to achieve with the Total Application Security solution.

Somewhere in October last year, NASSCOM-DSCI closed its nominations for the prestigious DSCI Excellence Award. Indusface was up for the Emerging Information Security Product Company award with our popular Total Application Security solution.

The Data Security Council of India (DSCI) had collaborated with PricewaterhouseCoopers (PwC) to recognize and honor emerging product ideas in the Information Security domain. Solving security problems, taking thought leadership, creating a conducive business environment, increasing trustworthiness, and building resilience were the shortlisting criteria they were looking for.

Interestingly, these were also the things that we at Indusface wanted to achieve with the Total Application Security solution.

#ispirit #AWS WAF

Interestingly, these were also the things that we at Indusface wanted to achieve with the Total Application Security solution.

Somewhere in October last year, NASSCOM-DSCI closed its nominations for the prestigious DSCI Excellence Award. Indusface was up for the Emerging Information Security Product Company award with our popular Total Application Security solution.

The Data Security Council of India (DSCI) had collaborated with PricewaterhouseCoopers (PwC) to recognize and honor emerging product ideas in the Information Security domain. Solving security problems, taking thought leadership, creating a conducive business environment, increasing trustworthiness, and building resilience were the shortlisting criteria they were looking for.

#ispirit #AWS WAF

New Zero-Day Vulnerability found in Internet Explorer: Targeting Versions 6 to 11

New critical zero-day vulnerability found in Internet Explorer 6 to 11- this is the news that we woke up to, on this Monday. This vulnerability affects versions of IE from 6 to 11, although exploits available in the wild currently target versions 9 to 11. That is more than 50% of the world’s browsers, as Internet Explorer 9 to 11 constitute about 26% of the world’s browsers. This is a zero-day vulnerability as there are already exploits in the wild and no patch available yet, although one can take measures to avoid getting hacked.

This news comes in wake of Heartbleed vulnerability, that affected OpenSSL a widely used SSL implementation on the internet — a vulnerability that affected almost 2/3rd of websites not to mention SSL clients, and network gear also. The vulnerability affects all Windows Operating Systems from Windows XP onwards as the above browsers are available in these OSes. Now, given that Microsoft has stopped supporting XP and will refuse to make a patch available for this vulnerability for XP, those still using XP will be left in the lurch.

Fix for Internet Explorer’s zero-day vulnerability

The vulnerability can be exploited via malicious sites which are visited via a vulnerable browser or via attachments sent by email. Microsoft is working on a fix, but it is not yet ready. As of now, the following measures can be taken for Operating Systems others than XP to avoid the vulnerability:

Turn on Enhanced Protection Mode (EPM) — this facility is available only for IE versions 10 and 11, disable flash plugin, or download and install Microsoft’s Enhanced Mitigation Experience Toolkit version 4.1

Other measures include not to use Internet Explorer at all. Use chrome, Mozilla, Opera, Safari or some other browser. As Microsoft is not going to come up with a fix for XP for this, the best way out is to upgrade from XP to a newer OS. Some third parties might come up with XP fixes, but we have to wait and see to be sure.

Personally, I use Internet Explorer to access a US government website. May US Federal websites either require or recommend use of Internet Explorer browser. As a result, I have no other option but to use Internet Explorer and use the above fixes. I cannot move to Chrome or Mozilla for the above purpose.

Can you check if you are affected by this critical vulnerability?

As of now, I do not see a site where one can go and check if one is affected or download something that will automatically do configuration changes to your IE so that you are secure. But watch out – it is not unrealistic to expect such sites / services to come up soon, given that more than 50% of browsers on the Internet are affected with this vulnerability.

The bigger concern overall is the huge productivity loss due to time that is going into deploying patches or playing catch up with these vulnerabilities and keeping oneself secure. Is there a way out?

In this particular case, the best option would be to dump XP and move onto the latest Windows OS – that is Windows 8. Other than that, we can only wish for a silver bullet that will come up sometime in the future that will save us the huge productivity losses from dealing with these vulnerabilities.

Am I Vulnerable To 'Broken Authentication and Session Management'?

Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities.

EXAMPLE

For www.vulnerable-bank.com , imagine typical username and password login page with session-id. The attacker can take advantage of server side misconfiguration by exploiting weak session management flaws.

BANK application supports URL rewriting, putting session IDs in the URL:

www.vulnerable-bank.com/username=victim&password=victim123&session=12345

An authenticated user of the site wants to let his friends know about the bank’s new policy. He e-mails the above link without knowing he is also giving away his session ID. When his friends use the link they will use his session and bank details.

Attacking Scenario:

www.vulnerable-bank.com/username=attacker&password=attacker123&session=12345

In above scenario, attacker can access victim’s bank account by replaying the session and login into his/her account with his/her own password (just having session of victim and replaying it with own credentials).

Are session management assets like user credentials and session IDs properly protected? You may be vulnerable if:

User authentication credentials aren’t protected when stored using hashing or encryption.

Credentials can be guessed or overwritten through weak account management functions (e.g., account creation, change password, recover password, weak session IDs).

Session IDs are exposed in the URL (e.g., URL rewriting).

Session IDs are vulnerable to session fixation attacks.

Session IDs don’t timeout, or user sessions or authentication tokens, particularly single sign-on (SSO) tokens, aren’t properly invalidated during logout.

Session IDs aren’t rotated after successful login.

Passwords, session IDs, and other credentials are sent over unencrypted connections.

How do I Prevent ‘Broken Authentication and Session Management’?

The primary recommendation for an organization is to make available to developers:

A single set of strong authentication and session management controls. Such controls should strive to:

Strong efforts should also be made to avoid XSS flaws which can be used to steal session IDs.

Meet all the authentication and session management requirements defined in OWASP’s Application Security Verification Standard (ASVS) areas V2 (Authentication) and V3 (Session Management).

Have a simple interface for developers. Consider the ESAPI Authenticator and User APIs as good examples to emulate, use, or build upon.

How do WAF’s (Web Application Firewall) help in solving the above problems?

We can use a WAF to validate sessions. A WAF does this by setting a collection of variables which store the session id and related information when it is created and sent to the client from the server. Every time the client sends a subsequent request, the WAF intercepts it and checks to see if a valid session id has been sent. Validity will depend on various factors including a time period. For instance, sessions are not allowed to go beyond a certain time period.

There are also session fixation rules that a WAF implements. Session fixation happens when a client sends a cookie even when the cookie is not set by the server. This happens when a hacker steals a cookie/session id of another user and uses it to impersonate him.

Finally, WAF’s help implement sticky sessions — verifying that parameters such as User-Agent and IP address, which are meant to be constant/unchanged in a particular session stay unchanged.

The following example illustrates a way of implementing session id checks using modsecurity, an open-source WAF. It is taken from https://secure.jwall.org/blog/2009/01/08/1231374852674.html

This example is about a php application. The following rule sets some variables when the session id is set.

# Store session issued by the server

#

# We do this by extracting the cookie’s value from the SERVER and

# create a new session collection named by that value

#

SecRule RESPONSE_HEADERS:/Set-Cookie2?/ “PHPSESSID=([a-f0-9]+)\;\s?” \

“phase:3,capture,msg:’Captured session id from response cookie: %{TX.1}’,chain”

SecActionsetsid:%{TX.1},setvar:session.valid=1,expirevar:session.valid=1000, \

setvar:session.id=%{TX.1},expirevar:session.id

# If the client did send a session cookie we need to make ModSecurity load

# the corresponding session using “setsid”.

#

SecRule REQUEST_COOKIES:PHPSESSID !^$ “phase:1,log, \

msg:’Found cookie in request, initializing session!’, \

setsid:%{REQUEST_COOKIES.PHPSESSID},skip:1”

In the following rule, we enforce session management. That is, if the session is not valid, then we will drop the request.

# If the client did not pass a session cookie, e.g. in the first request,

# we do not check for session validity and skip the validity check-rule

#

SecAction phase:1,log,skip:1, \

msg:’No session transmitted, skipping session validity check!’

# If the session id is invalid then we drop the connection

#

SecRule&SESSION:VALID “@eq 0” phase:1,log,auditlog,deny,status:500, \

msg:’The requested session is not valid!!’

What is the possibility of False Positives?

In the above context, a False Positive would be if a WAF blocks a valid session id believing that it is not valid. This would be possible only if another user has the valid user’s session id naturally that is — without stealing it. Ordinarily, this would not be possible as the space of session ids is huge and the chances of two users getting the session id in a short time interval is nearly zero, if the session id algorithm is implemented properly. Thus, this would in fact indicate that the session id implementation algorithm of the said website is weak. Thus, this would not be really a False Positivebut would indicate a different problem on the part of the website developers.

In the case of a False Positive, the session would be declared invalid even if the user has got a legitimate session id. This would happen because the session id setting algorithm developed by the web developers was weak. This would then need to be strengthened.

#WAF #AWS WAF #AWS security #web application firewall #web application security #web app security

Top 3 Critical Vulnerabilities in Web Applications

From Indusface’s study on the State of Application Security in India, related to an analysis of vulnerabilities data collected by IndusGuard Web, Indusface’s web application security solution, the top 3 critical vulnerabilities faced by web applications are SQL Injection, Invalid TLS/SSL Certificate and HTTP Basic Authentication Enabled.

DOWNLOAD THE INFOGRAPHIC HERE

Discover

The top types of critical vulnerabilities, increasing the risk exposure of websites

The time taken to patch these vulnerabilities

The number of critical vulnerabilities which remain un-patched

#web app security #web application security #web application firewall #AWS security #AWS WAF #WAF

Defense in-depth, a Managed Services differentiation

Recently, I was conducting a security audit for an organization. They had deployed a WAF (Web Application Firewall) for their critical web apps. However, when I asked them about the web server access logs, they said they were not aware of whether they had them. In fact, they told me that since a WAF was deployed with all sorts of rules, what is the need for web server logs from a security viewpoint? The WAF will block all malicious attempts, they said. I was a bit taken aback at the lack of understanding of the security folks at the organization. Let me spend some time explaining the reason behind my conclusion above.

Here is why web server access logs are important. In any security scenario – even though we try to ensure that we do as best as we can to protect the systems — we need to consider the possibility that we could do better. We need to learn from day-to-day traffic, from ways by which hackers attack our system, and use that to improve our WAF rules. Secondly, even the best of security could be breached. And this could be due to various reasons including discovery of zero day vulnerabilities in the platforms used. And in case of a breach or a successful WAF evasion, the only way we would get information about the hack or the hacker would be through web server access logs.

What then can we learn from web server logs? To elaborate further, usually, before a hacker is successfully able to breach the web site, he/she would probably have made a few unsuccessful attempts. These attempts if not blocked byWAF would be available as unusual entries in the web server logs. Also, in the normal operation of the web apps, regular users would be using certain urls, making certain type of requests etc. This normal behaviour would result in certain log entries in the web server access logs. Security admins operating the website should be intimately familiar with normal web server logs corresponding to the normal use of their web apps. Thus, when unusual entries arise in the web server access logs, they represent anomalies. Some of them could be attempts to hack. Thus, security admins should write scripts or use automated tools to analyse web server logs. These scripts would filter out the normal entries and only throw out unusual entries which can then be looked at by a human. The source IP addresses corresponding to these unusual entries can be watched or subsequently blocked, as also more signatures can be added into the WAF corresponding to these attack attempts by understanding what these hackers are trying to do.

Here are a few scenarios that could happen.

A url that contains the word admin could be an attempt to gain admin access or access using admin privileges.

An attempt that has a name of a CMS (content management system) platform that is not supported by the website – say joomla where the website is not running on joomla – reflects an attempt by a bot to figure out the type of platform used by the site. Normal users who use a browser wouldn’t be able to come up with such a url in the normal course of their use.

A zero day vulnerability found in the wild could result in an unusual url. A WAF wouldn’t have a signature for such a vulnerability till the vulnerability becomes well-known.

To conclude, it is important to keep a watch on web server logs in addition to having the best of signatures in the WAFfor a defense in-depth strategy. This continuous process of monitoring and watching over logs all the time is best done by a Managed Services offering. Managed Services involves humans watching over logs all the time, filtering them using scripts or automated tools, and learning from the traffic to continuously improve the WAF rules.

In most cases, Managed Services provide 24x7x365 management and real-time monitoring for web application firewalls. This ensures that there is a dedicated support system in place for the entire WAF cycle providing maximum protection and minimizing risk exposures for all types of protected web applications.

#WAF #AWS WAF #AWS security #web application firewall #web application security #web app security

Injection flaws like SQL, reign the 2013 OWASP Top 10 Most Dangerous Web Vulnerabilities, Second time in a Row

Open Source Web Application Consortium releases its list of top 10 web vulnerabilities, every three years. Second time in a row, Injection flaws like SQL and LADP, have managed to keep their top position secure and have emerged as the worst web vulnerability. Injection flaws, such as SQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.

Source: OWASP

Following example will explain an injection attack scenario:

For Www.Vulnerable-Bank.Com, imagine a typical username and password login page. Let’s take an attacking example and how it works scenario.

Normal Scenario: username = author and password = author123

SQL Query:

SELECT * FROM AUTH_TABLE WHERE user =‘author’ and passw = ‘author123’

Attacking Scenario: username = author and password = ‘ or ‘1’=’1

SQL Query:

SELECT * FROM AUTH_TABLE WHERE user =‘author’ and passw = ‘ ‘ or ‘1’=’1’

The above line says, password equals to null or 1=1 (which is universal truth), so the attacker modifies logical AND to logical OR.

The best way to find out if an application is vulnerable to injection is to verify that all use of interpreters clearly separates untrusted data from the command or query. For SQL calls, this means using bind variables in all prepared statements and stored procedures, and avoiding dynamic queries.

Checking the code is a fast and accurate way to see if the application uses interpreters safely. Code analysis tools can help a security analyst find the use of interpreters and trace the data flow through the application. Manual penetration testers can confirm these issues by crafting exploits that confirm the vulnerability.

Automated dynamic scanning which exercises the application may provide insight into whether some exploitable injection problems exist. Scanners cannot always reach interpreters and can have difficulty detecting whether an attack was successful.

How to prevent injections like SQL:

Preventing injection requires keeping untrusted data separate from commands and queries.

The preferred option is to use a safe API which avoids the use of the interpreter entirely or provides a parameterized interface. Beware of APIs, such as stored procedures, that appear parameterized, but may still allow injection under the hood.

If a parameterized API is not available, you should carefully escape special characters using the specific escape syntax for that interpreter. OWASP’s ESAPI has some of these Escaping Routines.

Positive or “whitelist” input validation with appropriate canonicalization also helps protect against injection, but is not a complete defense as many applications require special characters in their input. OWASP’s ESAPI has an extensible library of White List Input Validation Routines.

Here are some recommended best practices to prevent injection exploits:

Make white box testing and secure code review an integral part of the development cycle.

Manual penetration testing should be part of the QA cycle.

Automated along with periodic manual checks should be part of the operations process after deployment to keep up with new vulnerabilities and the automated scanning can help perform basic security sanity checks. It is very common to have injection issues introduced even with minor code changes as such changes may not be subjected to a fully fledged security review process in the development cycle.

In situations where fixing the code of detected vulnerabilities cannot be done in a timely manner a WAF can be used for virtual patching after deployment

#web app security #web application security #web application firewall #AWS security #AWS WAF #WAF

State of Website Defacement in India.

Website defacement is the electronic graffiti of choice for most “Hacktivists” these days. According to Wikipedia – Website defacement is “an attack on a website that changes the visual appearance of the site or a webpage”. It is an unauthorized access and edit to the website, mostly without the knowledge of the site owner.

When a hacker manages to steal administrative control of a website they can launch a defacement attack via many methods including “SQL Injection”, one of the most deadly attack vectors. Historically, defacement has been a harmless prank to inflict public relation agony on the target enterprise. But recent trends are alarming, more often than not, website defacements are being used to spread malware and stealing essential data from target entity.

CERT-In, has an excellent program focused around raising the awareness of the extent of web defacement malice across Indian websites. Analysis here, leverages the data collected and published by CERT-In on their website (Web Defacement Statistics – Http://Www.Cert-In.Org.In/)

Key Take Aways:1. Disproportionately higher impact for .in domains compared to .com domains2. Owners of .com websites got their defences strengthened during 20133. Scary, fearful, insecure future for those who indulge in unprotected online commerce

1. Disproportionately higher impact for .in domains compared to .com domains

According to CERT-In data, between 2010 and 2013, .in websites had 225% more instance of defacement compared to .com sites. More SMB’s tend to host their website on an .in domain extensions compared to .com. One can correlate SMBs lack of dedicated security programs to consistent higher website defacement rates observed by a typical .in domains compared to .com.

2.

Owners of .com websites got their defences strengthened during 2013

This trend seems to have been aggravated in the New Year. During January 2014, .in websites had 2170 defacement instances compared to 548 for .com websites. .in domains experienced a whopping 4x more defacement instances compared to .com websites.

Between 2012 and 2013, instances of .in website defacement went up by 37% compared to a 33% reduction in website defacement across .com domains. These trends clearly indicate that the .com website owners are deploying security service like IndusGuard Malware Monitoring ( to detect and mitigate website defacements. )

3. Scary, fearful, insecure future for those who indulge in unprotected online commerce

If you are a website owner, you owe it to your customers, visitors and stakeholders (including shareholders and employees) to get serious about securing the front doors of your online megastores. Hope is a great thing; we hope you don’t get hacked. We hope your applications are as secure as they deserve to be. But false hope is equally dangerous.

“ We cling with both arms to false hope, refusing to believe the weightiest proofs against it, embracing it with all our strength “– from “The Postmaster” by Rabindranath Tagore

Invest time to get a free scan from IndusGuard Web to see what hackers most likely already know about your website’s weaknesses. Ensure on-going monitoring of malware and application vulnerability with our IndusGuard Premium and IndusGuard Malware Monitoring services. Do you have a mobile applications, get is audited by ourIndusGuard Mobile application security service.

Someone once said, “Luck happens when preparation meets opportunity”, you have identified an opportunity, and your website is ready. BUT are you prepared for the uncertain world of cybercrime? We can help. Please [email protected]

#WAF #AWS WAF #AWS security #web application firewall #web application security #web app security

OWASP TOP 10 Vulnerabilities

SR No.Vulnerability Title% of vulnerability

1Application Error message43%

2Browsable Web directory11%

3Cross Site Scripting10%

4Potential Information Leakage10%

5SQL Injection7%

6Debug feature enabled6%

7Possible Sensitive Directories/Files Exposed4%

8Source Code Disclosure3%

9OS Command Injection3%

10Possible Backup File(s)1%

Application Error message

An attacker can try to force the target website to produce error messages by passing different attack vectors to different parameters and then analyse the errors to get target information.This page contains an error/warning message that may disclose sensitive information.

Browsable web directory

A web directory was found to be browsable, which means that anyone can see the contents of the directory. Browsable directories could allow an attacker to view “hidden” files in the web root, including CGI scripts, data files, or backup pages.

Cross Site Scripting

XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation and escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

Potential Information Leakage

The application uses the ASP.NET 2.0 view state (__VIEWSTATE) feature without encryption to maintain application state. Application designers have been known to put passwords and other sensitive data inside the view state. Therefore, it is a good idea to always use view state encryption in ASP.NET applications.

SQL Injection

Web applications that do not properly sanitize user input before passing it to a database system are vulnerable to SQL injection. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing unauthorized data.

Debug feature enabled

The ASP.NET application is running in debug mode which allows a remote user to gather information about an application by using the DEBUG verb in an HTTP request. This can leak information including source code, hidden filenames, and detailed error messages.

Possible Sensitive Directories/Files Exposed

These directory/files are not directly linked from the website. This check looks for common sensitive resources like backup directories, database dumps, administration pages, temporary directories. Each one of these directories could help an attacker to learn more about his target.

Source Code Disclosure

Source code disclosure allows a malicious user to obtain the source code of a server-side application from a webpage. Disclosure of source code can be devastating for a web application.

OS Command Injection

A web form contains fields with data that is probably sensitive in nature. This form data is submitted over an unencrypted connection, which could allow hackers to sniff the network and view the data in plaintext.

Possible Backup File(s)

Possible Backup files are usually created by developers to backup their work or by administrators when making backups of the web server.

#WAF #AWS WAF #AWS security #web application firewall #web application security #web app security

Beating WAF Signatures

Today, on the internet, a whole range of applications are moving to the web, and so are security vulnerabilities. Hackers are concentrating on attacking web applications. As part of the defense of web apps, WAFs (web application firewalls) are now becoming commonplace.. A WAF blocks layer 7 http(s) attacks; it is becoming as important as a traditional firewall. WAFs are indispensable now for banks, e-commerce sites and any other site that does commercial transactions via their websites.

Among web attacks, SQL injection is one of the deadliest because it has the potential of retrieving the whole database from the web server. To look at things in a larger perspective, most security attacks come about due to an essential feature of how computers were designed. We keep both data and code in similar containers — both are in memory. There is no fundamental distinction between data and code, in the sense that both exist as binary data in memory. As a result, hackers insert code inside memory meant to hold data to fool the computer and make it execute code that hackers want instead of what the original programmer wanted. In sql injection, the query itself is changed so that the attacker can get different data out from the database than what the original query intended to give out.

Consider a classical sql injection example. Suppose there is a form on a web page which asks for the userid and password. After the user, say John, inserts his userid and password, and clicks the submit button, the following sql query gets executed so that John gets logged on, and a login screen appears.

SELECT * from contacts WHERE userid=’john’ AND password=’xsz297gh’

contacts is the table in the database where userids and passwords are stored.

If there is no preliminary check done by the programmer as to what the fields the userid and password should consist of and the query is directly passed to the database, a lof of mischief is possible. For instance, the user could enter nothing in the space meant for userid and password as

‘OR ‘1’=’1

and the SQL query will be turned into the following:

SELECT * FROM contacts WHERE email=” AND password=” OR ‘1’=’1′

( Please note that closing quote ‘ at the end of the query is not entered by the user but provided by the system.)

SQL interprets this query as

SELECT * FROM contacts

as the latter statement

WHERE email=” AND password=” OR ‘1’=’1′

will be interpreted as true every time.

As a result, the whole database table contacts will be output and all userids and passwords on the database stolen. (We are assuming here that passwords are stored in clear text in the database, which is not a good practice, but that is a different issue.)

What is happening here? The hacker has successfully entered data such as OR ‘1’=’1’and fooled SQL in treating it as code/query. This is because of how SQL is designed. Just insert a quote and SQL changes the context from data to code or vice versa.

Usually WAFs will try to block any OR followed by ‘1’= ‘1. The interesting part here however is that not just ‘1’=’1 would work here but even ‘2”=’2’ or for that matter

‘2’ + ‘1’ = ‘3’

also. In fact, any arithmetic expression would work. For instance, something else that would work is the following:

‘ OR 1 DIV 1 —

or

‘ OR 2 DIV 2 —

( The – at the end is to ensure that the ending quote ‘ that the system provides at the end is treated as a comment. If not, an SQL error would occur. Two hyphens indicate a comment in SQL.

There would be huge such combinations out there. And it is important that the WAF is programmed to stop them all. Only experts can do this task.

Have today’s WAFs covered all such cases? The success of WAF evasion challenge competitions worldwide tells us that the answer is ‘no”. Hackers keep coming up with newer and newer combinations to beat WAFs. The best we can do is to keep pace — keep updating our signatures on a day-to-day basis and be on the lookout for new research in this direction. Companies are best off outsourcing this work to security experts rather than doing this task in-house.

Being and Beyond the Emerging Information Security Product Company

Somewhere in October last year, NASSCOM-DSCI closed its nominations for the prestigious DSCI Excellence Award. Indusface was up for the Emerging Information Security Product Company award with our popular Total Application Security solution.

The Data Security Council of India (DSCI) had collaborated with PricewaterhouseCoopers (PwC) to recognize and honor emerging product ideas in the Information Security domain. Solving security problems, taking thought leadership, creating a conducive business environment, increasing trustworthiness, and building resilience were the shortlisting criteria they were looking for.

Interestingly, these were also the things that we at Indusface wanted to achieve with the Total Application Security solution.

The Problems That We Solve

Digital businesses, big or small, cannot survive without an extensive application infrastructure. This is something that hackers and attackers have grown increasingly fond of. They want to attack the core business functionality that basically enables banks, financial institutions, new-age businesses, and retailers serve customers and prospects.

And by large, problem lies in these three facts:

86% of all the websites have 1 serious application flaw.*

55% of retail trade sites are always vulnerable to attacks.*

70% of all web attacks happen on the application layer. #

In fact, as business ideas and applications get more complex, moderately controlled, and rarely monitored for security flaws, risks multiply. The other part of the issue is business implication. According To A Survey Conducted By Gemalto, 64% of the people are unlikely to shop or do business with a company hit by data breach. And it’s not just about the online or digital business entirely. Earnings at Target, largest US retail chain after Walmart, dropped by 16% and they even lost $148 million recovering from the breach. So clearly, application breaches pull down businesses, and with a huge force.

Indusface realizes that application breaches are only going to grow exponentially in the coming years. New-age companies and startups aggressively chasing customers will have little time to cover web application security.

Total Application Security offers just the solution that companies need today. Combining automated and expert-mandated technologies, it enables application owners to find out weaknesses in the applications infrastructure, block attacks that use those flaws, and monitor all the relevant application data. All of this is put together on a simple dashboard, for real-time analytics and absolute control.

Becoming the Top Emerging Information Security Product Company

Early in December, DSCI finally released its Shortlisted Entries and Indusface was among the four top companies selected to represent its emerging product idea and its impact to the real business world to the jury, which included:

Abhay Karandikar, Professor, Department of Electrical Engineering, IIT Bombay.

Sandeep Singhal, Managing Director, Nexus India Capital Advisors Pvt. Ltd.

Saurabh Srivastava, Co-founder & Former Chairman, NASSCOM.

Siva Sivasubramanian, Chief of Security, Airtel.

V. Mohandas Pai, Chairperson, Manipal Global Education Services P Ltd. And Co-founder AARIN Capital.

Pitted against CipherCloud India, Parablu Systems, and ShieldSquare Indusface was evaluated and graded by both audience and jury members. Finally, on the eve of 16 December, we were announced the Top Emerging Information Security Product Company, an honor received by Indusface’s CEO Ashish Tandon.

Being and Beyond the Recognition

So, what does it mean to be the Emerging Information Security Product Company? How does it change how the world or we see Total Application Security? Where do we go from here?

It’s a great honor to be recognized as the foremost emerging security product company. In fact, Indusface was also selected in the revered InTech50 annual listing by iSpirit last year.

However, we also understand that both web and mobile application security remain undervalued security domain. Statistics show that most data breaches and mobile app penetrations could have been avoided with prior testing and patching. Over the years, we plan to empower companies deal with four major security challenges.

One, businesses do not know if their website can be hacked. Even if they test it once, applications are updated frequently and there is no way to get vulnerability updates on that. Two, vulnerabilities should be patched. It takes time and resources. And till that happens, the website is open to all kinds of threats. Three, bad people are just waiting to launch distributed denial-of-services attacks with these fancy bots and machines that send so much traffic to the website that the server crashes. Four, hiring and maintaining a separate security team is a huge responsibility. It’s not just about the money, it takes time too, which takes away the focus from key business objectives.

‘Total Application Security’ idea is to overcome all four of these obstacles, at once. It packs web application scanning that looks for website vulnerabilities continuously. It doesn’t matter if you make application code level changes or update the website frequently, once scanning finds an OWASP weakness or malware injection it will report it immediately.

Total Application Security also provides web application firewall that blocks exploitations and application distributed denial-of-services (DDoS) attempts. In simpler words, it prevents attacks from hackers that use OWASP Vulnerabilitiesor malware on your website with the help of dedicated security expert team that monitors and analyzes traffic, attack vectors, and DDoS instances continuously to improve your security model accordingly.

#aws waf #waf #web application #web application firewall #web application security

8 Things You Should Know About DDoS Attacks

Application layer DDoS attack is an unpleasant reality.

With businesses increasingly depending on their websites amid fierce competition and highly motivated hackers, distributed denial-of-services risks are more than ever. On an average, banks are losing $100, 000 per hour under such attacks and enterprises anywhere from $5,000 to $19,999 an hour.

Imagine a website being assaulted with 45, 000 requests at a time. Server simply cannot process anything under such attacks, suspending everything a business stands for. That is precisely why you need a DDoS response policy. If you haven’t had the chance to make one, begin with getting to know the attacks better.

1. DDoS attacks are cheap.

In the world of cloud computing where anyone can hire machines with advanced processing powers, how difficult you think it is to launch application level distributed denial-of-services. According to current underground market prices, bots including zombies are available for hire for less than $5. It will not cost more than $200-250 in total to overwhelm server for an average website with an application DDoS attack.

The figures might not help companies much, but they definitely provide an idea of how easy it is to target any website in the world. With motivations ranging from rivalry to disgruntled employees, sooner or later every website will face the threat.

We have talked about the prevalence of such attacks in a recent webinar. “Learn How Tata Consultancy Services (TCS) Protects Website And Mitigates DDoS Attacks”

2. ‘Take Competitor Out’ is mainstream.

How to make sure that ‘sale’ day on a particular website is unavailable to most of the visitors? How to ruin the bestselling day for a popular website? DDoS is unfortunately the simplest answer to these questions. In fact, just last year’s Christmas shopping on Sony and Microsoft websites was disrupted by such DDoS attacks and a lot of security experts have pointed towards rival brands.

Today, competition does not shy away from taking any step for decrepitating rival businesses. The practice has led to a rise of ‘take competitor out’ services and people are purchasing them readily. What’s your action plan on it?

3. Identifying attack is critical.

Did you know that most companies cannot differentiate between bot/zombie traffic and real traffic until it is too late to react? Spam traffic can range anywhere from one machine to a consolidated group from a specific location or bearing special signature or any other identity.

Half of the DDoS battle is over if you have the capacity to detect such traffic. The ‘Total Application Security’ continuously studies traffic and matches it with preloaded red flags for analytical intelligence feeding. Security experts further study this data to create mutually analogous warning signs to identify distributed denial-of-service attacks faster.

4. Beware of elastic bandwidth costs.

Often companies host their websites or application on cloud servers in order to save cost and to increase computing efficiency. Most major cloud players even offer elastic bandwidth that automatically accommodates increase in traffic by bumping up the subscription cost. In theory, it seems like a great idea. Your website or application will virtually never go down, even under a Layer-7 DDoS attacks.

What if these traffic spikes are within range of 5-10 GB or even more? While your website will perform with elastic sustainability, computing costs will shoot for the sky too. Make sure that you’re not paying for the DDoS traffic in the first place.

5. Automate attack prevention.

Not every distributed denial-of-service attack will utilize sophisticated techniques like Slowloris, bandwidth theft or server resource misutilization. Such intelligent attacks need to be monitored closely by experts to react. On the other hand, bot launch, clickjack and script injection attacks can be detected and prevented automatically if handled cleverly.

According to global statistics, a majority of application layer distributed denial-of-services attack are initiated through these simple mechanisms. In such cases, companies can master greater control by deploying Advanced Web Application Firewall to prevent them.

6. Understand that application DDoS is different.

Whenever we talk of distributed denial-of-services attacks, most people overlook application layer. The truth is that Layer 7 is actually more vulnerable and easy to penetrate as compared to network level. There is usually a flood of TCP, SYN and UDP, which is easily detected.

Further, controlling physical infrastructure is easier, but when it comes to the application layer attackers are on real IPs which are actually communicating with the server. Get to know more on The Whys And Hows Of App DDoS

7. It is often camouflaged.

When Sony’s PlayStation Network was hacked a few years back, the attempt was cleverly camouflaged by a distributed denial-of-services attack. Multiple Sony divisions were targeted in a large-scale, thoroughly coordinated attack. While their security experts were busy dealing with DDoS disaster, hackers smartly stole data for 77 million users on the servers.

It has happened once and again where security teams are busy deflecting large traffic from unknown sources and intrusion goes undetected for days.

8. Find an evolving DDoS strategy.

The thing about DDoS is that it keeps evolving. You write a rule to block some country, machine signature or even payload, hackers come up with something else that’s untraceable. That is where the human part comes in. DDoS prevention security is all about evolving with attack techniques.

Your security vendor should be able to identify threat vectors and apply custom techniques that protect your business. It can be anything from blocking to timing out the connections. An existing DDoS interpretation expertise, analytics monitoring and prevention intelligence is critical to the purpose.

Need to ask questions on DDoS? You can reach an expert Here.

#ddos attack #ddos #web application firewall #web application #aws waf #web application security

3 Security Case Studies: Demystifying The Logical Flaws

How do you translate an abstract business idea in machine language? How can you process overlapping theories without making the machines bleed? Actually, you cannot.

Machines, unlike human brains, work on simplified binary logics. They respond to conditions that must lead to a simple ‘YES’ or ‘NO’, and absolutely nothing between it. However, that is not how people running businesses think. They take decisions. Often quickly, frequently, and making the out most of available information. While security is certainly on their mind, there is not enough time to study implications in detail. This is exactly what leads to business logic or domain logic flaw.

A business logic flaw is an application vulnerability, which arises by circumstantial security weakness. As one-of-a-kind problem, it does not have universal solution and cannot be detected by automated web application scanning either. Here is a simple way to understand this.

“Only those who understand your business will be able to detect your business logic flaws.”

In theory, business logic vulnerability might seem a very vague, abstract idea; it poses serious threat to security, which we will help you understand with following examples.

Case Study 1- Stock Broking Firm

A renowned stock broking firm wanted its customers to trade online. Their dummy online trading platform focused on increasing participation and making transactions faster in a two-step process.

Step 1: Users could pick stocks of their choice, number of shares, and click on ‘BUY’. The application then calculated the total value of the transaction and asked users to ‘PLACE ORDER’.

Step 2: After Step 1, users can choose to either proceed with the order or cancel the transaction.

Million Dollar Problem

The web application scanning session showed that the application was clean of any OWASP or WASC vulnerability, but problems existed. An attacker could actually take informed decisions and make huge profits without administrators knowing about it. The attacker had to select stock at current price and freeze the process at confirmation dialog box. If the next day, prices for that particular stock shoot up, he could confirm the frozen trade and get the stocks at older value.

Case Study 2- Online Auction House

An online auction house valued website security above everything else. The owners understood that many hackers would try to use brute force for forcibly getting into competitor accounts. Hence, they started using limited time account suspension for three wrong login attempts. In simpler words, the associated account ID would be locked if wrong password were used for three consecutive times.

Increasing Odds

Imagine that there are only two users who want item X on auction. They both are placing bids, topping each other, and now just one hour remains for the online auction. One of the users knows about the account suspension policy, so he uses the account ID of the other bidder and enters wrong password for three times to lock his account. This way, only one bidder remains in the auction.

Case Study 3- E-commerce Website

An ecommerce website allowed users to view product and its price, select that product, purchase summary, and then proceed to the checkout. The process was designed to be executed in this particular order only and the administrator did not set rules for something different.

Custom Pricing

An attacker discovered that he could go back to the shopping cart after inject custom price in the URL. Website’s server executed it and allowed the attacker to pay for the revised pricing.

The Logic behind Logical Flaws

In days when hacking fetches much greater rewards, crooks are always looking for ways to get around your database, or whatever they can get their hands on, which should alarm you. When complex business ideas overlap each other, chances of discovering loopholes increase far beyond what we have explained in examples above.

In fact, in recent times, more and more hackers are looking for ways that go undetected by automated scanning, the ways that exploit business logic paradoxes.

Security analysts believe that web applications were and are being exploited with business logic vulnerabilities. Unfortunately, most companies do not even know about them unless there is a monetary leakage. Following are some of the rules that need assessment.

Money-Related Application Logics- These logics command online monetary transactions, deals, discounts, refunds, shipping fee and so on.

Time-Related Application Logics- These logics define how web applications handle sessions and timeouts for users.

Process-Related Application Logics- It is also possible to exploit internal-facing applications for human resources management, procurement, warehousing and other processes.

Counterbidding Hackers with Proactive Detection

How do you patch business logic vulnerabilities before the hackers could find them? You find them first.

Business logic vulnerability is essentially a human task that requires expertise, trained to identify flaws, much like hackers do. Managed Web Application Scanning is a better way to detect all kinds of vulnerabilities within the application. While automated scanning looks for top OWASP threats, security experts will understand your business functions and their subsequent effects on web applications.

Once detected, you can either patch the vulnerability in each application or shield them with Managed Web Application Firewall. A managed web application firewall’s value goes beyond virtual patching and time to fix benefits of patching vulnerabilities. The main benefit are

a) Providing visibility of an attempted attack b) Providing more insights about attackers, which can help in taking more proactive detect and protect steps to track and block them.

Eventually, it helps in improving the Total Application Security postures consistently and not as a point in time improvement.

#AWS #web application security #web application firewall #waf #ddos #sql injuction

Trending Blogs

Recently Viewed Blogs

AWS WAF