INTRODUCTION TO INSECURE DESERIALIZATION

INTRODUCTION TO INSECURE DESERIALIZATION 

Insecure deserialization is an attack, enclosed in OWASP top 10 attacks in 8th place in web applications. It occurs when an untrusted data file to abuse the overall architecture of the application. It could lead the attacker to do Remote Code Execution (RCE), DOS, and DDOS attacks.  Insecure Deserialization vulnerability was first discovered by a company called Foxglove security in the year 2015.

CONTENTS:

1. Why is insecure deserialization updated on owasp top 10 2017?

2. Serialization

3. Deserialization

4. Who is vulnerable to insecure deserialization?

5. Examples for insecure deserialization

6. Prevention for insecure deserialization

7. Protect your concern from insecure deserialization

WHY IS INSECURE DESERIALIZATION UPDATED ON OWASP TOP 10 2017?

The use of Java-based object serialization methods is evolving in recent years. These serializing objects and its functions have led to this insecure deserialization vulnerability exploited on a large scale within few months. This vulnerability can use in various popular software like WebSphere, WebLogic, JBoss and Jenkins. The rise in the exploitation of this vulnerability has created a requirement among multiple cybersecurity companies to research this specific vulnerability. Researchers wrote Lot of whitepapers, articles and blogs about this vulnerability. This is one of the primary reasons why Insecure Deserialization in updated in Owasp Top 10 2017 vulnerability list

SERIALIZATION

Serialization refers to a process of converting an object into a format which can be persisted to disk (for instance, spared to a document or a data store), sent through streams (for instance stdin, stdout), or transmitted over a system. The arrangement, in which a protest is serialized into double or organised content (for instance XML, JSON YAML). JSON and XML are two of the most usually utilised serialization designs inside web applications.

DESERIALIZATION

Deserialization is the other hand of serialization, that means the streams or systems can be converted into an object format. In this attack, the attacker could lead to execute the Remote Code Execution (RCE) and Denial of service attack (DOS) and to bypass the authentication process.

{abc: [1, 4, 7, 10], abc: "baz"}
 serializing a string using a value

'{"abc":[1,4,7,10],"abc":"baz"}'
 The receiver can de-serialize this string and it checks the original file (object). {abc: [1, 4, 7, 10], abc: "baz"}.

WHO IS VULNERABLE TO INSECURE DESERIALIZATION?

Anyone who performs the deserialization process in the code those products must be vulnerable like apache tomcat, WordPress, Jira. , Etc. Applications which are written in this language like PHP, Python, Ruby, Java and some other languages also could lead to insecure deserialization vulnerabilities.

EXAMPLES FOR INSECURE DESERIALIZATION

Example:

A PHP type uses PHP object serialization to save a "super" cookie, containing the user's credentials like username, user ID, and password hashing.
 a:3:{i:0;i:156;i:1;s:7:"Sam";i:2;s:4:"admin";i:3;s:32:"b5a1b3bea65fe0e05022f8f3c88bc761";}

An attacker changes the serialized object to give themselves admin privileges: a:3:{i:0;i:1;i:1;s:5:"Tom";i:2;s:5:"user";i:3;s:32:"b5a1b3bea65fe0e05022f8f3c88bc761";}

PREVENTION FOR INSECURE DESERIALIZATION

• The application should not accept serialized objects from untrusted sources to use serialization mediums that only permit primitive data types.
• Implement Integrity checks on serialized objects to prevent malicious object creation or data tampering.
• Enforcing strict type constraints during deserialization of user inputs before object creation is also useful to prevent insecure deserialization.
• Isolation of running code that deserialises the objects (user data) in high privilege environment will help to avoid insecure deserialization.
• Log deserialization exceptions and failures, such as where the incoming type is not the expected type, or the deserialization throws exceptions.
• Restricting or monitoring incoming and outgoing network connectivity from containers or servers that deserialize.
• Monitoring deserialization, alerting if a user deserializes continuously.

PROTECT YOUR CONCERN FROM INSECURE DESERIALIZATION

The deserialization data vulnerability and about the mitigation to block this issue, and it is not possible an attacker could only send a serialized object of any class because the server will be unable to load the class. Make sure the developers need the security awareness training.

  REFERENCES

• https://www.acunetix.com/blog/articles/what-is-insecure-deserialization/
• https://dzone.com/articles/what-is-insecure-deserialization

AUTHOR

Aravindan S

Security Engineer

Briskinfosec Technology and Consulting  Pvt Ltd.,

https://www.linkedin.com/in/aravindhan-s-90b98787/

From Tech to Business-Driven Security

FROM TECH TO BUSINESS-DRIVEN SECURITY

INTRODUCTION:

In today’s digital world, IT security strategy must be transformed into Business-driven security strategy to prevent failure of vital digital transformation projects which will become irrelevant to the business model of an organisation.

TRANSFORMATION TO BUSINESS-DRIVEN SECURITY:

Information Security Practitioners like security analyst and consultants of an organisation should look at the information security from a business perspective to enforce proper risk management so that it will be useful to prevent the data loss or assets that are most important to the organisation during the time of a threat.

For enforcing the business-driven model of Information Security in an organisation, it is essential to understand and assess the risks for the organisation in real time and mitigating the risk by determining the incidents conclusively by a skilled incident management professional team. In short, it is critical to have a “Risk Management in an Organization” than a regular threat management team.

To create a compelling business-driven security model, a business organisation must identify all of its assets, where they are placed, which assets are more vulnerable to threats and attacks etc., which will help them to categorize their holdings for the useful incident and risk management and mitigation of threats.

WHY BUSINESS DRIVEN SECURITY MODEL : ITS IMPORTANCE :

The need for business-driven security arises, mainly due to the evolving threats from various aspects of technology which includes the latest trends like the Internet of Things (IoT), Artificial Intelligence (AI), Machine Learning etc., As these new technologies evolve, the attack vector for these technologies also evolves every day.

For example, IoT devices may have vulnerabilities in firmware level and application level, which an attacker can exploit to take over the IoT device’s control, which gradually increases the threat for the owning organisation.

Another primary reason for the business-driven security model is “The Gap of Grief”. The Gap of Grief is a concept used to refer to void in understanding of how the security vulnerabilities can cause financial and reputation loss problems in an organisation. A significant part of this problem comes with the fact that the CISOs and other information security staffs in general like Penetration testers and consultants failing to translate the challenges and risks in assessing a threat. In cyber-security terms, the problems created by not effectively being able to report security issues to the appropriate people at the right time causes the gap of grief.

Let’s consider an example scenario: The CEO tours television and radio studios in a bid to dispel negative press and to assure the public that their data is safe with the company. This often backfires when it becomes apparent that the CEO has very little knowledge of their company’s cyber-security operations, let alone how the breach occurred or how many customers were affected. This causes problems to the organisation, and the gap occurs.

ASPECTS OF BUSINESS DRIVEN MODEL:

The key element of the business-driven security model is to focus more on detection and assessing the threats then protection as it is a complicated job to carry out. Then there should be a valid defence strategy specifically for all the assets and their vulnerabilities. This defence strategy should have a definite cost to benefit values assigned.

Another aspect of the business-driven security model is, it should include the required and skilled people,  process and technology (Tools and services) for carrying out risk management process.

Organizations need to find out the security gaps between the current security level of their application and infrastructure and where they want to be for an ideal security level for effective risk management. This gap analysis process is one of the key aspects to create a business-driven security model for the organisation. This gap analysis process helps out the security staffs to work on patching the gaps and vulnerabilities effectively.

Management should come up with a proper rank level for all their assets and applications based on the key values of assets. Then it will be easy for the security people to carry out gap analysis on a regular basis based on the risk ratings of assets and applications.

CONCLUSION:

The business-driven security model is more useful for an organisation, not just regarding cost but also regarding proper assessment of threats and risk. If implemented incorrect way, it will become an essential security model to help security people mitigate the threats and security breaches.Through a business-driven approach, BriskInfosec productively orchestrates business driven security with more agile and secure way. Since it relies heavily on the risk levels for an organisation, it will help any organisation to save a lot of money and time which they were spending on the incident and threat management.

Just Talk and Hire us to create Business Driven security solutions for your orgnization

Email – contact@briskinfosec.com 

REFERENCES:

• https://www.scmagazineuk.com/bridging-the-gap-of-grief-with-business-driven-security/article/670551/
• https://www.bankinfosecurity.asia/interviews/business-driven-security-how-works-i-3688
• https://atos.net/wp-content/uploads/2017/05/atos-whitepaper-cyber-security-ready-for-anything.pdf
• https://www.scmagazineuk.com/bridging-the-gap-of-grief-with-business-driven-security/article/670551/

AUTHOR :

Dawood Ansar

Security Engineer

Briskinfosec Technology and Consulting Pvt Ltd

Find me @https://www.linkedin.com/in/dawood-ansar-29403213b/

HOST HEADER INJECTION

HOST HEADER INJECTION

Most of the common web servers are configured in the form of the same server to host many web applications with the same IP address this type of configuration is the reason for the Host Header issues. Here we are going to deal with the host header injection attack in various forms, its impact and mitigation.

CONTENTS:

1. HOST HEADER ISSUES
2. RISK
3. HOW ATTACKERS UTILIZE HOST HEADER ATTACK
4. WHY HOST HEADER HAPPEN
5. HOW TO FIND HOST HEADER ISSUES
6. PHASES OF HOST HEADER ISSUES
7. IMPACT OF HOST HEADER ISSUES
8. MITIGATIONS FOR HOST HEADER ATTACK
9. CONCLUSION

HOST HEADER ISSUES:

An attacker can manually divert the code to produce the hacker desired output simply by editing the host header. Most probably web servers are configured to pass the host header to the first virtual host in the list without proper reorganisation, So It is possible to send the HTTP requests with arbitrary host headers to the first virtual host. In that case, if we specify an invalid Host means the web server process it and pass the invalid host header to the first virtual host in the list.

An attacker can modify the host name by giving a fake web page or a vulnerable website and deliver it to the user and fraud the users.

Example:

The result will redirect the user to the attacker’s website by simply modifying the host header

RISK:

Most probably many websites use the values provided in the user input field and uses it afterwards without an improper input validation. Commonly this will not have that much impact on the application, but in some cases, if the application accepts the host header, the risk lays there. There may occur,

• URL redirection problems.
• Username and password credentials may be theft.
• Financial loss may happen in Finance sectors.

HOW ATTACKERS UTILIZE HOST HEADER ATTACK:

The exploitation is based on the logic of the web application. If the application does not use the user input value, then there is no risk. But the host header attack is considered as a serious issue at the time of resetting our password. When we are resetting our forgotten password, or we change our password for our privacy, the web application generates a link dynamically there it uses the host header provided in the request. In this scenario, the hacker uses this header for their evil cause. The hackers use some social engineering and phishing attacks for getting the link. So, the developer should realise the importance of the host header attack.

WHY HOST HEADER HAPPEN:

It is an injection type of attack that done on the HTTP headers.

• HTTP headers are dynamically generated based on the input of the user. User inputs can be edited or spoof by attackers. It is accessible by everyone.
• Any website that does not correctly validate or verify the HTTP Host headers.

HOW TO FIND HOST HEADER ISSUES:

Verify the header of the request. Inject other domain in the header field and check the response in the browser.

PHASES OF HOST HEADER ISSUES:

1. WEB CACHE POISONING WITH SINGLE HOST HEADER:

Web cache poisoning is a kind of technique used by a hacker to manipulate a web cache that serves a poisoned content for those who requests that webpage. For this attack, the hacker needs to poison a caching proxy run by the website itself, or content delivery networks (CND’s), or other caching mechanisms are carried out between the client and the server. In this scenario where caching is enabled, A hacker will potentially embed a remote URL as the base-URL for any website. This scenario then causes other users who request the site will be redirected unknowingly. Thus if an application fails to prevent the user from using the X-Forwarded-Host header, it will effectively override the Host header. The cache will serve the poisoned content to everyone those who request the webpage without the knowledge of the victim.

EXAMPLE:

 

2. X-FORWARDED HOST HEADER:

Host header injection is mitigated by preventing the tampering of Host header. It means if any request is made with tampered host header, the application responds with an error message like “404 Not Found”. Another way to pass arbitrary Host headers is to use the X-Forwarded-Host header. In some configurations, this header will rewrite the value of the Host header. Therefore it’s possible to make the following request.

EXAMPLE:

3. WEB POISONING WITH MULTIPLE HOST HEADERS:

It is one of the forms of web cache poisoning attack. It is similar to that of the web cache poisoning using the single header. The only difference is that in this type is that it use multiple headers more than one to the users those who request the website. By tampering with the header, it is possible. The web cache will deliver the wrong content to the user with their knowledge.

EXAMPLE:

GET / HTTP/1.1

Host: www.example.com

Host: www.evil.com

4. PASSWORD RESET POISONING:

 The significant impact of Host header attack lies in the password resetting functionality. The most common scenario of this attack the hacker generates a secret token and sends a mail that has a link that contains the mysterious symbol of the hacker. The hacker urges the user to make use of his link, and to requests, a password reset link which redirects the user to him. In this case, if the web application makes use of this host header value when composing with the reset link and when the user clicks the poisoned reset link in the mail, then the user will become a victim to the hacker. The attacker will obtain the password reset token and make use of his password for his destructive purposes.

EXAMPLE:

 

IMPACT OF HOST HEADER ISSUES:

1. A hacker can modify the legitimate host header with a wrong host in the request, and it poisons the cache of the web application server and the proxy. It has nothing to do with the browser. When the authorised user tries to access the host, but still the cache of the web server is poisoned with the hacker’s domain that redirects the licensed user to the domain of the hacker.
2. If the host headers are used for writing links without a proper HTML encoding, there may be a possibility for Cross-site
3. Access to the internal
4. HTML INJECTION also can be done.

MITIGATIONS FOR HOST HEADER ATTACK:

• Proper sanitation of input values.
• Proper verification of the request that it came from the original target host or not.
• Mitigate the Host header attack in Apache and Nginx by creating a dummy virtual host that catches all requests from unrecognised Host headers.
• Whitelist the trusted domains at the initial phase of the web application.
• Respective Mapping of the domains that received in the host header of each HTTP request with itself.
• Use secure server configuration.
• Disable the support for the X-Forwarded-Host header option.

CONCLUSION:

Many application developers did not realise that the HTTP host header is accessible and controlled by all user. In an application security perspective, the input given by the user is always deceivable, and it is unsafe to trust. So, a web developer should consider host header issues as a dangerous thing not to and neglect it; we should find the impacts caused by the host header and follow the mitigation to safeguard ourselves.

We Briskinfosec is Center for Cyber Security Excellence passionate to protect you from all application security threats on your budget. Talk to our experts contact@briskinfosec.com

AUTHOR

Alex Daniel Raj

Security Engineer

Briskinfosec Technology and Consulting Pvt Ltd.,

follow me @https://www.linkedin.com/in/alex-daniel-raj-xavier-b77869145/

RED HAWK VERSION 2.0.0

RED HAWK VERSION 2.0.0

ABOUT  THE  TOOL :

RED HAWK is one of the best information gathering and vulnerability assessment tool. It is written in  PHP language. It allows the pen tester to perform numerous scans by merely selecting the type of scan he wants. It reduces the time consumption of every security professional during penetration testing by providing overall scans and displays the output for the specific scans in a convenient manner.

FEATURES :

• It does some Basic Scan like
  1. Title of the Target site.
  2. IP Address of the Target site.
  3. To Discover the Web Server of the Target site.
  4. TO Discover the CMS.
  5. To Discover the Cloudflare.
  6. It includes robots.txt Scanner
• IT performs the WHOIS LOOKUP of the Target site.
• Look for the GEO-IP of the Target site.
• It is also providing Banner Grabbing facility.
• It also performs the DNS Lookup.
• It provides Nmap Port Scan.
• Sub-Domain Scanner
  1. SUBDOMAINS of the target site.
  2. IP ADDRESS of the target site.
• GET REVERSE IP-ADDRESS LOOKUP & DISCOVERING CMS
  1. Hostname of the target site.
  2. IP Address of the target site.
  3. CMS Tracing.
• Error Based SQL Scanning of the Target
• Bloggers View NEW
  1. HTTP Response Code
  2. Site Title
  3. Domain Authority of the target site
  4.  Links Extractor of the target site
  5. Link Grabber of the target site.
• WordPress Scan NEW
  1. Sensitive Files Crawling
  2. Version Detection
  3. Version Vulnerability Scanner
• Crawler
• MX Lookup NEW

 INSTALLATION :

STEP 1: We have to clone the RED HAWK tool from GITHUB.

root# git clone https://github.com/Tuhinshubhra/RED_HAWK

Fig-1

STEP 2: We have to Parse into the RED HAWK tool folder and list it view the installation file.

root# cd  RED_HAWK

root#~/RED_HAWK# ls

Fig-2

STEP 3: PHP is an inbuilt function in the OS so install it.

Root # PHP  rhawk.php

Fig-3

STEP 4: RED_HAWK is installed. Then specify the Target site to scan.

Fig-4

STEP 5: Then specify the Connection that the Target site is Running on.

Fig-5

STEP 6: Then specify the Type of Scan to be performed on the Target Site.

Fig-6

STEP 7: For Basic Recon Scan select 0 from the list of actions.

Action Panel Fig-7

STEP 8: For GEO-IP LOOK UP select option 2 from the list of actions in above image (Fig-7).

Fig-8

STEP 9: For WHOISLOOK UP select option 1 from the list of actions in the action panel image (Fig-7).

Fig-9

STEP 10: For MX LOOKUP select option 13 from the list of actions in action panel image (Fig-7).

Fig-10

STEP 11: For Banner Grabbing select option 3 from the list of actions in action panel (Fig-7).

Fig-11

RED_HAWK is one of the best information gathering tools it fetches the information efficiently and delivers it to the Security Professional.  A lot of further up gradation and modification are made in this tool and make it more enhanced way.

AUTHOR

Alex Daniel Raj

Security Engineer

Briskinfosec Technology and Consulting Pvt Ltd.,

follow me @https://www.linkedin.com/in/alex-daniel-raj-xavier-b77869145/

ANDROID MANIFEST FILE ANALYSIS

ANDROID MANIFEST FILE ANALYSIS

ANDROID MANIFEST File can be obtained by extracting any.APK Files and this file contains the several information’s about the device needs to run the app, and it also includes the information about the component of the applications such as services, content providers, activities and broadcast receivers etc.

It also contains the protected information for an application like

1.1     PERMISSION LEVEL ACCESS

It includes the list of information’s that imply the hardware features it’s available in user feature, user permissions

For example, the code in user features available in the manifest file

1. < uses - permissionandroid: name = "string"

2. android: maxSdkVersion = "integer"/ >

1.2     USER PERMISSION:

Specifies system permission that the user must grant to run the app correctly. The user grants permissions when the application is installed (on devices running Android 5.1 and lower) or while the app is running (on devices running Android 6.0 and higher)

For more information’s about the user permissions, you can check on to the “android. Manifest. Permission” to process over the list of permissions that you wish to be enabled

It can be permission defined by the application with the  <permission> element;
one can set one of the standard features (such as "android.permission.CAMERA" 
or "android.permission.READ_CONTACTS") etc.

1.3     ANDROID API INFORMATION:

The API Level expressed by an application will be compared with the given Android version API level is a single integer, and it can vary based on different Android OS version. Here it’s been assigned to based on the minimum, targeted and maximum SDK version and they are based on the developer choice on based on their app requirements.

<uses-sdk android:minSdkVersion="integer"
           android:targetSdkVersion="integer"
           android:maxSdkVersion="integer" />

1.4     APP PERMISSIONS:

APP Permission is used to protect the privacy of the Android user and android apps must request permission to access sensitive user data are like SMS and CONTACTS and also other certain features like (CAMERA, INTERNET and WIFI) etc.

Permission request for any kinds of APP is assigned in the manifest file which is an APK file, and you can see in your day-to-day activities like code for the user permission to send SMS in the manifest file as shown below:

1. < manifest xmlns: android = "http://schemas.android.com/apk/res/android."

2. package= "com.example.snappyyapp" >

       < uses - permission android: name = "android.permission.SEND_SMS" / >

       < application... >      ...
   
       < /application> </manifest >

If an app has a typical kind of information, then the lower level of permissions can be used, but if your app contains any sensitive level of information’s then you have to assign the above code for the security purpose

APP PERMISSIONS:

In the above figure tells about the various permissions that have generally been allocated to an app and here I have checked the different authorities that have used for the cliq app.In this list of options you can enable the required option which you need to set the app permission by default and once you select any one of this option than later it will not ask for any user permission

If you did not enable any permissions over here, then it will ask for the app permissions every time like the diagram as follows.

DEFAULT APP PERMISSIONS:

This is the various levels of permissions that are available in manifest file and also on your smartphones.

1.5     ANDROID VULNERABILITY ANALYSIS:

Vulnerability analysis in android can be done by analysing the manifest file, and once you deobfuscated the code, you can manually examine the code to check the vulnerabilities. Many vulnerabilities can occur on the manifest file, and here I have explained some vulnerable code for your reference and what are the various options that can lead to the vulnerabilities

1.5.1      BACKUP MODE ENABLED:

The name usually describes the automatic enabling of the backup data. The backup mode allows backup option as the attacker can take the backup of your data as well as he can also steel some sensitive information’s present in your applications making it a vulnerable. According to the security purpose and by default the google drive is the default destination of the app backup’s and the backup option code available in the manifest file as follows

1. < application…android: allow Backup = ”true” > < /app>

 Prevention: Backup mode should be set false to prevent this kind of attacks

1.5.2      DEBUG MODE:

The debug mode defines that whether the applications are debuggable or not. Also, when the debug is enabled the attacker can gather plenty of information. In  Staging environment when the app is not in production state, it can be set as true, and once it moves to the final stage for execution it should be set as false, it’s a one of the critical vulnerability which leads anyone to capture sensitive information’s of an applications

Debug code available on manifest file

1. < application android: debuggable = "false"< /application>

1.5.3      APP COMPONENT VULNERABILITY:

The app component vulnerabilities mainly describe the components present in the manifest file like activity, services, Content provider or Broadcast receiver and they can be either private or public the exported attribute in each component declaration in the manifest file defines that the component is private or public

If the component is public it can be exported to the other apps, if the component is private then it cannot be exported, by exporting option the attacker can export any information’s from the application and this kind of export options depends upon the applications and the severity level of this vulnerability may vary upon the application

1. android: exported = "true">

2. < intent-filter> < /intent-filter> < /service>... < /manifest>

3. < manifest xmlns: android = "http://schemas.android.com/apk/res/android"

4. package= "com.example.testapps.test1" > ... < service android: name = ".MailListenerService

5. android: enabled = ""

Prevention:

• If an application has an exported option, then it should have a permission function for each file that is to be exported

1.6     CONCLUSION:

It is one of the ways to analyse the Android manifest file and by this blog the information about the permission access, backup and debug mode analysis can be done.

Reference Links:

• https://developer.android.com/guide/topics/manifest/uses-feature-element
• https://www.oreilly.com/library/view/application-security-for/9781449322250/ch04.html
• https://blog.devknox.io/what-is-android-allowbackup-how-it-affects-your-app/

AUTHOR

Ram Kumar

Security Engineer

Briskinfosec Technology and Consulting Pvt Ltd.,

follow me @https://www.linkedin.com/in/ram-kumar-3439b511a/