Web Application Interfaces

This post will be a bit different than some of my other ones, much less technical with a focus on what it takes to create a quality user interface for a web application. The impetus for this is recent experiences I have had with several web applications. Let's start with the disclaimer that what I look for and what is important for me in a web application is different than what matters for other folks, suffice it to say I want security, convenience and an intuitive interface. For the security professionals reading this we know that security has an inverse relationship to convenience, the more secure something is, the less convenient it is... 99 times out of 100. And it really is challenging to make that 1% cut. This post will cover some of the epic failures and provide some ideas on how to approach the 1%.

A little background for the layman... The web application/interface this blog will discuss is something seemingly simple like the login page for webmail or the account setting page for your online banking website. However the topics presented will lend themselves to any website that asks you to create an account; which usually includes the requirement to setup some type of username, password, Q/A and provide an email address as well as other personal information.

For me the account creation process is sacred important and is like the handshake of the company presenting the website. A simple process that works the first time and accepts my 19-103 character password without client-side scripts being required equates to a firm two pump executive handshake that I can be happy with. The converse would be a website that complains about the special characters I have chosen, neglects to tell me specifically which characters is can't handle, then errors out once I remove all of them because the password is too long. Thanks for the sweaty dead fish of a handshake.

Lets mention the client-side script conundrum. Flash and javascript are often employed to try and make the interface look nicer (simply put) as well as provide convenience and to a lesser extent attempt to provide a security control. Here is a typical form used for account creation:

 

Without javascript enabled the form will simply not work:

• There is no captcha image
• The form is missing the email confirmation box
• The form is missing the password confirmation box
• The “Create account” button requires javascript

Enabling javascipt and going through the motions we end up with this:

  








With javascript enabled we can see that the form in question is doing several things right. The requirements are clearly being communicated for the most part (we can only guess what “Nonstandard symbols and characters" are), the minimum length is a bit short, but it also does not allow some easy to guess passwords or portions thereof and last but not least there is everyone's favorite... CAPTCHA. However the epic fail comes in the form of an inability to paste in my password and this is why.


Best practice dictates that every website you login to should be done so using a different password. Let that sink in if you are not nodding your head. To put this in perspective I will share the fact that I have over 100 different accounts spread all over the internet and each one has a different password. In today's world it should be an expectation that you will need to use a password vault of some sort to not only store your passwords for you, but aid in the process of complex password creation. This is where the copy and paste concept comes into play; yes I have over 100 different passwords but I don't actually “know” what any of them are. When registering for yet another account I simply use a tool to create a complex password for me, then I copy the newly created unique and complex password, and paste it into the input field on the website. To get back on topic lets look at the source code to see what is stopping us from pasting in a password (and email):

In case you missed it:

Javascript is what is preventing the copying or pasting into or out of the email and password fields. But if you recall javascript is required to be enabled for the interface to even show the “Re-enter” sections of each input. So turn off javascript and the form does not work, (probably only 1% of the humans visiting the site have javascript disabled so no big deal right) allow javascript to execute and you are prevented from copying and pasting in your password. Of course a proxy like ZAP or plugin like tamper data will let us get around the restriction and still submit the form while copying in the password, just mentioning this for thoroughness - there is always a way around client-side controls.

Lets take a quick look at another interface.

Above there is a form as it looks without javascript enabled. Enabling javascript does not change the look and the user is able to simply sign up with only three fields required. A password of less than six characters will cause an error. Two-step verification (not show on this page) is an option but not required. Best of all no CAPTCHA, this is a winner from a user perspective. From the development/administration side I can see this form getting spammed by bots trying to create thousands of account a day. But without looking at the server-side source code I can't say for sure as there are plenty of other ways to thwart bots, CAPTCHAS are not the only solution, they are just one of the more straight-forward methods.

Using flash or javascript to display a password strength meter is a nice touch in most cases and using transparent methods to determine if a user is a human versus a robot/script is always preferable to a CAPTCHA. Determining the best solution comes down to knowing the target audience and in some cases regulatory requirements or direct user feedback will dictate the features and functionality of the web application. Another driving element in determining what functionality to introduce to the application is the sensitivity of the information the application houses. It's interesting that Gmail provides two factor authentication as an option and then parses (reads) email to provide more targets ads while the majority of banking websites don't even support two factor authentication. Keep in mind that an application that requires a password and security question to authenticate a user is an example of the same factor twice: Something the user knows. Presenting the same factor twice is not two factor authentication.

Creating a convenient and secure interface can be a balancing act, as a developer you don't want to alienate users or limit security functionality. As a user I don't want to be inundated with questions and restrictions. It's important to understand what equates to security functionality too, for instance asking for an email address so that password resets can be sent to it is bad practice. Providing the ability to support out-of-band authentication (like SMS, a phone call, a token, biometric solutions, etc) in addition to a password is better security, enforcing/requiring the user to use the second factor however is less convenient. Ideally the web application would employ true multi-factor authentication that is transparent to the end user... not an easy task.

To sum it up we need to take a step back and realize that we are responsible for securing our own accounts, the web application is our partner in this effort. For all of us users out there we need to use the options the application affords us to increase our own security, for the application developers out there we need you to implement quality controls in a convenient way, and make sure you let folks copy and paste into the password field.

Information Security Certifications

I get asked from time to time “what is the value of a certification”. The context is industry certifications specific to the information security field of study... so think: CEH, CISSP, GIAC certifications, OffensiveSecurity certifications (OSCP, OSCE, OSWP, etc) and the like. Questions regarding value, industry recognition and level of effort required to obtain said certifications often come up. As my previous blog posts suggest, I am currently teaching a SANS class, SEC542, and this very concept was brought up during our first class which in turn made me think about it, specifically if certifications really matter in the information security realm.

Personally I hold several GIAC certifications and the CISSP along with a couple of college/university degrees. I know many folks in my industry that do not have any of the same credentials as I yet are orders of magnitude better at what they do than most myself included. Talking numbers in terms of salary I can say we are on par, some of my peers with no college background and no certificates earn more than I do and others a bit less; that's just the reality. From a hiring perspective I can say personally that college education/degrees and these industry certifications don't make or break the deal for hiring a candidate nor do they differentiate between “qualified” or not.

 

The reality is that I am not currently solely responsible for hiring, and that value, just as beauty, is in the eye of the beholder. Often times companies will require that a candidate have a bachelor's degree as a matter of course while certificates are “nice to have” but not usually required. The value of a certification in this case could mean more leverage at the bargaining table or standing out amongst the other applicants. The perception of value regarding the certification process is that folks holding the certificate are thought to have demonstrable knowledge in their field and their superior knowledge comes with a price tag or prestige tag as the case may be. Which certificate is right though?

There are a multitude of different certifications to choose from in the information security industry, some with more clout than others. The process of becoming certified usually comes in the form of paying for and taking a class (although NOT always required), paying for and taking a certification exam and scoring high enough on the exam to get a passing grade and thus becoming certified. The re-certification process, since these types of certification do expire usually in an amount of time measured in years, consists of paying a fee and or submitting credits to show continuing education in the same field of study.

Let's quickly break it down based on what I have been through:

The CISSP exam is closed book, memorization oriented, mile-wide – inch deep. Lots of information to take in; my 3,231 page “Information Security Management Handbook” 6^th edition sums up that concept nicely. However when it came time to take the test it was mostly all common sense (in my opinion, based on my experience). The type of common sense that one has after being in the industry for 5+ years gaining critical experience. 

SANS GIAC certifications are open book and seem to test on how well the test taker knows the material. The way to “know the material” is to have hands-on experience with the tools, know what you are looking at, how to interact with the subject media or target environment as the case may be and is centered on specific course material like forensics or penetration testing.

At the end of the day deciding on whether or not to get certified and which certification is right for you can come down to where you are in your career and where you want to go. Folks without a minimum of four years of experience are dissuaded from taking the CISSP while signing up for the GCFA exam without any forensic experience is setting yourself up for failure. Take your time and understand your current work environment to learn if earning a certification is something your current employer will pay for or will help you to earn more. Sometimes having the piece of paper counts.

Food for thought:

It happens

Back in 2001

python and ZMap

During the reconnaissance phase of network penetration testing engagements or black box web application testing, there will come a point when scanning all ports on a target network simply needs to be done. In the past I have relied on nmap for this task and indeed still do for aggressive scanning and to interrogate discovered services. More recently I have been testing and using ZMap to aid with service discovery, more specifically to determine if a port is open. ZMap has some distinct advantages over other networking scanning tools, mainly its speed; ZMap's claim to fame is that it can be used to scan the entire IPv4 address space in under 45 minutes... one port of the IPv4 space anyway. Doing so requires significant bandwidth resources such as gigabit Ethernet otherwise it may take a bit longer. At any rate (no pun intended) it does it's job quickly and quite efficiently.

While ZMap can come in handy during penetration testing it can also be quite useful from a blue team perspective. As the old adage goes, “the best defense is a good offense” using ZMap to scan your own corporate or private network can keep you apprised of what services are available externally. For the home user this could mean discovering services that your new router has available and turned on by default. For the corporate security professional this is your check and balance for all of the firewall rule requests that you see being submitted or are directly responsible for approving.

Given the scenarios above I found it useful to write a python script that would help with the task of network discovery. From an offensive perspective this script can be used to quickly identify open ports on a target network or host. From a defensive perspective this script can be used for the same thing; schedule it and validate the results with what you expect to see then remediate as necessary in terms of disabling firewall rules.

A couple of things to note as this is a beta release, you will need to identify your primary network interface and manually provide the interface name to the script. There are several enhancements in the pipeline, but for now it should work as long as:

• You can run it as root
• The correct interface is specified
• And the python environment is adequate

The advantage of this script over simply using ZMap outright is the port range option and some useful features in coming releases. Below is the script (full lines and proper formatting are preserved even though it looks like it wraps around) and remember that this is in beta and I am not claiming to be a great python writer.

#!/bin/python
## SB 6-2014
##Use ZMap to scan range of ports on provided network
##65535 seconds = 18.204 hours
##You may need to change the python path above and make sure the script is executable
##Expect the script to create a new directory each time it's invoked
##On line 53, change "em1" to the name of your network interface (ifconfig -a)
##This program is distributed in the hope that it will be useful,
##but WITHOUT ANY WARRANTY; without even the implied warranty of
##MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

##import modules
import subprocess
import os
import datetime
import zipfile
import argparse
parser = argparse.ArgumentParser(
prog="zmapScan",
description="Scan ports on specified network using ZMap",
formatter_class=argparse.RawDescriptionHelpFormatter,
epilog=('''\
Example: ./zmapScan.py -sp 80 -ep 80 -r example.com - scan only port 80 on example.com
Example: ./zmapScan.py -sp 0 -ep 65535 -r example.com - scan all ports on example.com
Example: ./zmapScan.py -sp 1 -ep 1024 -r 1.2.3.4/29 - scan ports 1-1024 on a /29

tis but a scratch...
 
'''))
parser.add_argument("-sp", help="starting port *required", dest="sp", metavar="starting port", type=int, required=True, choices=range(0, 65535))
parser.add_argument("-ep", help="ending port *required", dest="ep", metavar="ending port", type=int, required=True, choices=range(0, 65535))
parser.add_argument("-r", help="ip/hostname/range *required", dest="r", metavar="ip/hostname/range", type=str, required=True)
parser.add_argument("-v", "--version", action="version", version="zmapScan version .63 (July 2014)")
results=parser.parse_args()


##get the date/time of right now
d = datetime.datetime.now()
##set a as the datetime like this: 06-26-2016_142003_941871
dirname = d.strftime('%m-%d-%Y_%H%M%S_%f')
port = 0


##Create a new directory everytime program is run
os.mkdir(dirname)
## cd into new directory
os.chdir(dirname)


##Begin ZMap work
##Have ZMap loop through ports and output one file for each port. Each file will include IPs that have that port open
for port in range (results.sp, results.ep+1):
    cmd = "sudo zmap -p{0} -o zmapoutput_{1} -B 100k -c 2 -v 0 -q -i em1 {2}".format(port, port, results.r)
    subprocess.call(cmd.split(), shell=False)
    print "Port %s complete" % port
##End ZMap work


##Begin clean-up of ZMap output (delete any empty files)
##Get current working directory
    folder = os.getcwd()
##Loop through every file that ZMap outputs
    for file in os.listdir(folder):
## Remove empty files. Files that have data will be retained since they are useful
        try:
            if os.stat(file)[6]==0:
                os.remove(file)
        except Exception, e:
            print e
##End clean-up of ZMap output

##Begin zip ZMap results
## zip up result files
zf = zipfile.ZipFile("ZmapResults.zip", "w")
for dirname, subdirs, files in os.walk("./"):
    zf.write(dirname)
    for filename in files:
        zf.write(os.path.join(dirname, filename))
zf.close()
##End zip ZMap results

SANS SEC 542 Mentor Class – Aurora Colorado!

Register now for SANS SEC 542: Web App Penetration Testing and Ethical Hacking

This 10 week class starts Thursday July 10th, 2014 and runs once per week for two hours each Thursday night. This class will prepare students for the GIAC GWAPT (Web Application Penetration Tester) certification exam.

SECURITY 542: Web App Penetration Testing and Ethical Hacking: www.sans.org/event/34840

Meeting once a week after work, you'll learn all facets of Web App Penetration Testing and Ethical Hacking in this popular Mentor multi-week format, with time between classes to absorb and master the material. You also receive downloadable MP3 files of the full class being taught to enhance your studies.

Course Details:

Class Title: SEC 542: Web App Penetration Testing and Ethical Hacking

Start Date: Thursday July 10th, 6:00-8:00pm

Location: Aurora Colorado

Instructor: Mentor Serge Borso

Registration details: www.sans.org/event/34840

Each week your local Mentor, Serge Borso will highlight the key concepts you need to know and assist you with hands on labs and exercises. From attack methodology to server-side discovery, you'll be learning the exploits and tools needed to protect your systems from attack. The class wraps up with a Capture the Flag event where the students will be able to use the methodology and techniques explored during class to find and exploit the vulnerabilities within an intranet site. Each week you will be able to show off your knowledge the next day at the office!

The SANS Mentor Program is HERE! Starting in just over one month in the Denver metro area, conveniently located in Aurora near I-225 and Parker Road. Train Local and Save on the same material taught at SANS six-day conferences. Several students are registered, open spots are however still available... register now for savings.

Heartbleed Bug - taking a stab at it

Today I presented at the Denver Technical Professionals networking meeting. First off thanks to all of the folks that showed up, there were a lot of good questions from the audience and I think we all walked away richer for the experience. The topic of the presentation was the heartbleed bug.

Please feel free to download the slides here

One challenge that I had when putting together material to present was one that I face when writing on this blog and that is determining how technical to get with the information that I am conveying. I try to stay in the middle; high level enough to not intimidate folks or bore you but detailed enough to convey the technical elements of the topic at hand. Instead of presuming everyone knows what a 0day is versus explaining it and citing examples, the same goes for TLS and memory heap allocation etc.


I enjoyed the time today and had lots of fun researching the topic. As promised here some of the resoucres that I mentioned I would post:

http://news.yahoo.com/passwords-change-now-because-heartbleed-140022858.html

Additional Impacted Sites

SSL/TLS Website Tool

Main Source of Information

The last slide in the deck (references) points to many more websites with more detailed information about the bug.

Thanks again everyone, and feel free to contact with any questions on this or other information security topics.

SANS SEC 542: Web App Penetration Testing and Ethical Hacking

Register now and save $$

The SANS Mentor Program is coming to the Denver metro area with SECURITY 542: Web App Penetration Testing and Ethical Hacking. (www.sans.org/event/34840).

Meeting once a week after work, you'll learn SANS Web App Penetration Testing and Ethical Hacking in our popular Mentor multi-week format, with time between classes to absorb and master the material. You also receive downloadable MP3 files of the full class being taught to enhance your studies.

Course Details:

SECURITY 542: Web App Penetration Testing and Ethical Hacking

Start Date: Thursday April 3rd, 6:00-8:00pm

Location: Aurora Colorado

Registration and Tuition details: www.sans.org/event/34840

Each week your local Mentor, Serge Borso will highlight the key concepts you need to know and assist you with hands on labs and exercises.  From attack methodology to server-side discovery, you'll be learning the exploits and tools needed to protect your systems from attack. The class wraps up with a Capture the Flag event where the students will be able to use the methodology and techniques explored during class to find and exploit the vulnerabilities within an intranet site.  Each week you will be able to show off your knowledge the next day at the office!

Train Local and Save on the same material taught at SANS six-day conferences.

This could turn out to be an opportunity of a lifetime! Really, its going to be awesome!