Database Info

A paper on closing possible holes

An interesting read :
Closing Open Holes
#JDevil#
With the spread of Hackers and Hacking incidents, the time has come, when not only system administrators of servers of big companies, but also people who connect to the Internet by dialing up into their ISP, have to worry about securing their system. It really does not make much difference whether you have a static IP or a dynamic one, if your system is connected to the Internet, then there is every chance of it being attacked.
This manual is aimed at discussing methods of system security analysis and will shed light on as to how to secure your standalone (also a system connected to a LAN) system.
Open Ports: A Threat to Security?
Now, which option is used to display all open connections on the local machine. It also returns the remote system to which we are connected to, the port numbers of the remote system we are connected to (and the local machine) and also the type and state of connection we have with the remote system.
For Example,
C:\windows>netstat -a
Active Connections
Proto Local Address Foreign Address State
TCP ankit:1031 dwarf.box.sk:ftp ESTABLISHED
TCP ankit:1036 dwarf.box.sk:ftp-data TIME_WAIT
TCP ankit:1043 banners.egroups.com:80 FIN_WAIT_2
TCP ankit:1045 mail2.mtnl.net.inop3 TIME_WAIT
TCP ankit:1052 zztop.boxnetwork.net:80 ESTABLISHED
TCP ankit:1053 mail2.mtnl.net.inop3 TIME_WAIT
UDP ankit:1025 *:*
UDP ankit:nbdatagram *:*
Now, let us take a single line from the above output and see what it stands for:
Proto Local Address Foreign Address State
TCP ankit:1031 dwarf.box.sk:ftp ESTABLISHED
Now, the above can be arranged as below:
Protocol: TCP (This can be Transmission Control Protocol or TCP, User Datagram Protocol or UDP or sometimes even, IP or Internet Protocol.)
Local System Name: ankit (This is the name of the local system that you set during the Windows setup.)
Local Port opened and being used by this connection: 1031
Remote System: dwarf.box.sk (This is the non-numerical form of the system to which we are connected.)
Remote Port: ftp (This is the port number of the remote system dwarf.box.sk to which we are connected.)
State of Connection: ESTABLISHED
Netstat? with the ? argument is normally used, to get a list of open ports on your own system i.e. on the local system. This can be particularly useful to check and see whether your system has a Trojan installed or not. Yes, most good Antiviral software are able to detect the presence of Trojans, but, we are hackers, and need to software to tell us, whether we are infected or not. Besides, it is more fun to do something manually than to simply click on the ?Scan? button and let some software do it.
The following is a list of Trojans and the port numbers which they use, if you Netstat yourself and find any of the following open, then you can be pretty sure, that you are infected.
Port 12345(TCP) Netbus
Port 31337(UDP) Back Orifice
For complete list, refer to the Tutorial on Trojans at: hackingtruths.box.sk/trojans.txt
----
Now, the above tutorial resulted in a number of people raising questions like: If the 'netstat -a' command shows open ports on my system, does this mean that anyone can connect to them? Or, How can I close these open ports? How do I know if an open port is a threat to my system's security of not? Well, the answer to all these question would be clear, once you read the below paragraph:
Now, the thing to understand here is that, Port numbers are divided into three ranges:
The Well Known Ports are those from 0 through 1023. This range or ports is bound to the services running on them. By this what I mean is that each port usually has a specific service running on it. You see there is an internationally accepted Port Numbers to Services rule, (refer RFC 1700 Here) which specifies as to on what port number a particular service runs. For Example, By Default or normally FTP runs on Port 21. So if you find that Port 21 is open on a particular system, then it usually means that that particular system uses the FTP Protocol to transfer files. However, please note that some smart system administrators delibrately i.e. to fool lamers run fake services on popular ports. For Example, a system might be running a fake FTP daemon on Port 21. Although you get the same interface like the FTP daemon banner, response numbers etc, however, it actually might be a software logging your prescence and sometimes even tracing you!!!
The Registered Ports are those from 1024 through 49151. This range of port numbers is not bound to any specific service. Actually, Networking utlites like your Browser, Email Client, FTP software opens a random port within this range and starts a communication with the remote server. A port number within this range is the reason why you are able to surf the net or check your email etc.
If you find that when you give the netstat -a command, then a number of ports within this range are open, then you should probably not worry. These ports are simply opened so that you can get your software applications to do what you want them to do. These ports are opened temporarily by various applications to perform tasks. They act as a buffer transfering packets (data) received to the application and vis-a-versa. Once you close the application, then you find that these ports are closed automatically. For Example, when you type www.hotmail.com in your browser, then your browser randomly chooses a Registered Port and uses it as a buffer to communicate with the various remote servers involved.
The Dynamic and/or Private Ports are those from 49152 through 65535. This range is rarely used, and is mostly used by trojans, however some application do tend to use such high range port numbers. For Example,Sun starts their RPC ports at 32768.
So this basically brings us to what to do if you find that Netstat gives you a couple of open ports on your system:
1. Check the Trojan Port List and check if the open port matches with any of the popular ones. If it does then get a trojan Removal and remove the trojan.
2. If it doesn't or if the Trojan Remover says: No trojan found, then see if the open port lies in the registered Ports range. If yes, then you have nothing to worry, so forget about it.
***********************
HACKING TRUTH: A common technique employed by a number of system administrators, is remapping ports. For example, normally the default port for HTTP is 80. However, the system administrator could also remap it to Port 8080. Now, if that is the case, then the homepage hosted at that server would be at:
http://domain.com:8080 instead of
http://domain.com:80
The idea behind Port Remapping is that instead of running a service on a well known port, where it can easily be exploited, it would be better to run it on a not so well known port, as the hacker, would find it more difficult to find that service. He would have to port scan high range of numbers to discover port remapping.
The ports used for remapping are usually pretty easy to remember. They are choosen keeping in mind the default port number at which the service being remapped should be running. For Example, POP by default runs on Port 110. However, if you were to remap it, you would choose any of the following: 1010, 11000, 1111 etc etc
Some sysadmins also like to choose Port numbers in the following manner: 1234,2345,3456,4567 and so on... Yet another reason as to why Port Remapping is done, is that on a Unix System to be able to listen to a port under 1024, you must have root previledges.
************************
Firewalls
Use of Firewalls is no longer confined to servers or websites or commerical companies. Even if you simply dial up into your ISP or use PPP (Point to Point Protocol) to surf the net, you simply cannot do without a firewall. So what exactly is a firewall?
Well, in non-geek language, a firewall is basically a shield which protects your system from the untrusted non-reliable systems connected to the Internet. It is a software which listens to all ports on your system for any attempts to open a connection and when it detects such an attempt, then it reacts according to the predefined set of rules. So basically, a firewall is something that protects the network(or systen) from the Internet. It is derived from the concept of firewalls used in vehicles which is a barrier made of fire resistant material protecting the vehicle in case of fire.
Now, for a better 'according to the bible' defination of a firewall: A firewall is best described as a software or hardware or both Hardware and Software packet filter that allows only selected packets to pass through from the Internet to your private internal network. A firewall is a system or a group of systems which guard a trusted network( The Internal Private Network from the untrusted network (The Internet.)
NOTE: This was a very brief desciption of what a firewall is, I would not be going into the details of their working in this manual.
Anyway,the term 'Firewalls', (which were generally used by companies for commerical purposes) has evolved into a new term called 'Personal Firewalls'. Now this term is basically used to refer to firewalls installed on a standalone system which may or may not be networked i.e. It usually connects to an ISP. Or in other words a personal firewall is a firewall used for personal use.
Now that you have a basic desciption as to what a firewall is, let us move on to why exactly you need to install a Firewall? Or, how can not installing a firewall pose a threat to the security of your system?
You see, when you are connected to the Internet, then you have millions of other untrusted systems connected to it as well. If somehow someone found out your IP address, then they could do probably anything to your system. They could exploit any vulnerability existing in your system, damage your data, and even use your system to hack into other computers.
Finding out someone'e IP Address is not very difficult. Anybody can find out your IP, through various Chat Services, Instant Messengers (ICQ, MSN, AOL etc), through a common ISP and numerous other ways. Infact finding out the IP Address of a specific person is not always the priority of some hackers.
What I mean to say by that is that there are a number of Scripts and utilities available which scan all IP addresses between a certain range for predefined common vulnerabilities. For Example, Systems with File Sharing Enabled or a system running an OS which is vulnerable to the Ping of Death attack etc etc As soon as a vulnerable system is found, then they use the IP to carry out the attacks.
The most common scanners look for systems with RAT's or Remote Administration Tools installed. They send a packet to common Trojan ports and display whether the victim's system has that Trojan installed or not. The 'Scan Range of IP Addresses' that these programs accept are quite wide and one can easily find a vulnerable system in the matter of minutes or even seconds.
Trojan Horses like Back Orifice provide remote access to your system and can set up a password sniffer. The combination of a back door and a sniffer is a dangerous one: The back door provides future remote access, while the sniffer may reveal important information about you like your other Passwords, Bank Details, Credit Card Numbers, Social Security Number etc If your home system is connected to a local LAN and the attacker manages to install a backdoor on it, then you probably have given the attacker the same access level to your internal network, as you have. This wouls also mean that you will have created a back door into your network that bypasses any firewall that may be guarding the front door.
You may argue with me that as you are using a dial up link to your ISP via PPP, the attacker would be able to access your machine only when you are online. Well, yes that is true, however, not completely true. Yes, it does make access to your system when you reconnect, difficult, as you have a dynamic Internet Protocol Address. But, although this provides a faint hope of protection, routine scanning of the range of IP's in which your IP lies, will more often than not reveal your current Dynamic IP and the back door will provide access to your system.
*******************
HACKING TRUTH: Microsoft Says: War Dialer programs automatically scan for modems by trying every phone number within an exchange. If the modem can only be used for dial-out connections, a War Dialer won't discover it. However, PPP changes the equation, as it provides bidirectional transportmaking any connected system visible to scanners?and attackers.
*******************
So how do I protect myself from such Scans and unsolicitated attacks? Well, this is where Personal Firewalls come in. They just like their name suggests, protect you from unsolicitated connection probes, scans, attacks.
They listen to all ports for any connection requests received (from both legitimate and fake hosts) and sent (by applications like Browser, Email Client etc.) As soon as such an instance is recorded, it pops up a warning asking you what to do or whether to allow the connection to initiate or not. This warning message also contains the IP which is trying to initiate the connection and also the Port Number to which it is trying to connect i.e. the Port to which the packet was sent. It also protects your system from Port Scans, DOS Attacks, Vulnerability attacks etc. So basically it acts as a shield or a buffer which does not allow your system to communicate with the untrusted systems directly.
Most Personal Firewalls have extensive logging facilities which allows you to track down the attackers. Some popular firewalls are:
ZoneAlarm: The easiest to setup and manage firewall. Get it for free at: www.zonelabs.com
Once you have installed a firewall on your system, you will often get a number of Warnings which might seem to be as if someone is trying to break into your system, however, they are actually bogus messages, which are caused by either your OS itself or due to the process called Allocation of Dynamic IP's. For a details description of these two, read on.
Many people complain that as soon as they dial into their ISP, their firewall says that such and such IP is probing Port X. What causes them?
Well, this is quite common. The cause is that somebody hung up just before you dialed in and your ISP assigned you the same IP address. You are now seeing the remains of communication with the previous person. This is most common when the person to which the IP was assigned earlier was using ICQ or chat programs, was connected to a Game Server or simply turned off his modem before his communication with remote servers was complete.
You might even get a message like: Such and Such IP is trying to initaite a Netbios Session on Port X. This again is extrememly common. The following is an explanation as to why it happens, which I picked up a couple of days ago: NetBIOS requests to UDP port 137 are the most common item you will see in your firewall reject logs. This comes about from a feature in Microsoft's Windows: when a program resolves an IP address into a name, it may send a NetBIOS query to IP address. This is part of the background radiation of the Internet, and is nothing to be concerned about.
What Causes them? On virtually all systems (UNIX, Macintosh, Windows), programs call the function 'gethostbyaddr()' with the desired address. This function will then do the appropriate lookup, and return the name. This function is part of the sockets API. The key thing to remember about gethostbyaddr() is that it is virtual. It doesn't specify how it resolves an address into a name. In practice, it will use all available mechanisms. If we look at UNIX, Windows, and Macintosh systems, we see the following techniques:
DNS in-addr.arpa PTR queries sent to the DNS server
NetBIOS NodeStatus queries sent to the IP address
lookups in the /etc/hosts file
AppleTalk over IP name query sent to the IP address
RPC query sent to the UNIX NIS server
NetBIOS lookup sent to the WINS server
Windows systems do the /etc/hosts, DNS, WINS, and NodeStatus techniques. In more excruciating detail, Microsoft has a generic system component called a naming service. All the protocol stacks in the system (NetBIOS, TCP/IP, Novel IPX, AppleTalk, Banyan, etc.) register the kinds of name resolutions they can perform. Some RPC products will likewise register an NIS naming service. When a program requests to resolve an address, this address gets passed onto the generic naming service. Windows will try each registered name resolution subsystem sequentially until it gets an answer.
(Side note: User's sometimes complained that accessing Windows servers is slow. This is caused by installing unneeded protocol stacks that must timeout first before the real protocol stack is queried for the server name.).
The order in which it performs these resolution steps for IP addresses can be configured under the Windows registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\ServiceProvider.
Breaking Through Firewalls
Although Firewalls are meant to provide your complete protection from Port Scan probes etc there are several holes existing in popular firewalls, waiting to be exploited. In this issue, I will discuss a hole in ZoneAlarm Version 2.1.10 to 2.0.26, which allows the attacker to port scan the target system (Although normally it should stop such scans.)
If one uses port 67 as the source port of a TCP or UDP scan, ZoneAlarm will let the packet through and will not notify the user. This means, that one can TCP or UDP port scan a ZoneAlarm protected computer as if there were no firewall there IF one uses port 67 as the source port on the packets.
Exploit:
UDP Scan:
You can use NMap to port scan the host with the following command line:
nmap -g67 -P0 -p130-140 -sU 192.168.128.88
(Notice the -g67 which specifies source port).
TCP Scan:
You can use NMap to port scan the host with the following command line:
nmap -g67 -P0 -p130-140 -sS 192.168.128.88
(Notice the -g67 which specifies source port).
JDevil

[Q] How do i analyse ssl network traffic in apps on uncommon ports?

I recently started looking into the data applications, especially the free ones send to the net.
I wanted to know if they leak personal data to their coders.
Therefore i decided to redirect connections through a proxy software on my computer.
I installed http://www.charlesproxy.com/ and added their ssl ca to the trusted certificates on my cellphone.
It was quite intresting to see what kind of requests certain apps make to the internet, especially when you look inside the ssl encrypted connections.
I then found out that some connections seemed to be missing from that analysis, not enough traffic showed up in the proxy compared to the network activity.
So i used https://play.google.com/store/apps/details?id=lv.n3o.shark and the resulting file was quite a few times bigger.
It contained connections to other ports than 80/443 which i saw in charles.
So my questions are: Does Android ignore the proxy for non http(s) requests?
How can i redirect EVERY request to my computer and strip the ssl from it to look inside?
I suspect some of the applications to use basic stuff like json, xmpp and xml but cannot proof it currently.
As a beginner, i might also be using the wrong tools.

You may be able to run tcpdump on your router to see what exactly your phone is connecting to, then see if it corresponds to your proxy traffic.

that does not help to look inside the ssl encrypted tunnel unfortunately

Free your data: running your own server (post under construction :)

So you want to run your own server, eh? Whether you want to free yourself from data mining, commercialising, monetising, greedy be-tied-and-suited media moguls or from the spiritual successors of J. Edgar Hoover and Yuri Andropov does not matter. You want your data to be just that, *your* data. While this might seem extreme to some the idea is actually not far fetched, nor is it impossible to realise. After all, the 'net and the web were conceived as a decentralised network of services. This model, while good in allowing diversity and freedom, is less than ideal from a profitability standpoint so you should not expect those who stand to profit from hoarding your data to lend a helping hand here You're on your own here.
Well, not really on your own of course as there is a metric ton of information on this subject to be found on the 'net. Everything from how to turn that old laptop into a server through using single-board computers as servers through re-purposing whatever you happened to find dumpster-diving. Suffice to say that you need hardware, software and a network connection. A separate router, preferably one under your own control, running known software (OpenWRT, DD-WRT, Tomato, etc) on stable and not to anemic hardware so it can be used to run a VPN to your phone. You'll want your own domain name as well, either one from the free services which are (still) around or something more 'personal'.
Network connection and domain
Here you often don't have that much choice. If possible, choose a wired connection over a wireless one, both for the higher reliability as well as the usually more acceptable use policies and the fact that wireless connections often change IP address. Choose a connection without a traffic cap over one which has one. Choose the connection with the highest upload rate, even if this means settling on a lower download rate - servers send traffic up the net after all.
There are many ways to get a domain name. You can buy one, of course. For a personal server this might be overkill, but the choice is yours. One advantage of having your own domain is that it enables you to keep your mail/jabber/web/whatever addresses no matter what happens (as long as you pay the registrar, of course). You're totally free here as you can simply point your domain elsewhere if you happen to move to another ISP (and/or country...). Cheaper - as in 'free' - is to use one of the many free dynamic DNS services. As long as you have an address to feed your phone and other devices which will make use of your server you're fine.
Router
Best here is to use a router which is fully under your own control. While some ISP routers might be marginally usable, these devices are often at the whim of the ISP as they can be remotely controlled and configured. This is not what you want for your network, so just use the thing in bridge mode if possible, otherwise forward all traffic to your own router. With one of the free and open router firmwares on a reliable device you can do interesting things, ranging from port knocking on the router to VPN tunnels to your mobile devices.
Hardware, storage
Power consumption. heat- and noise production are of more importance than raw power here. There should be enough memory to keep the thing from paging (or 'swapping') on the intended work load on the chosen OS. The same goes for storage: If it fits in the box, fine. If it does not (external drives on laptops, Raspberries, etc) make sure the whole contraption is stable so you don't get any sudden 'disconnects'. For a personal server, power consumption, noise and heat production (which directly relates to reliability) are - again - more important than raw performance.
OS
Any 'unix' of choice is fine here. Linux, *BSD, doesn't matter. Even MacOS would do. Windows, not so much. It is not impossible to use Windows but it is more of a hassle given that a lot of the software is tailored to a unix environment. If you really insist on running Windows, at least make sure it is patched up to the hilt and that all - and that means all - unnecessary services have been switched off.
Software
This is the interesting bit, and the reason why this message is here in the first place. On one of the forum threads here someone was surprised by the fact that I don't run any of the Google apps on my devices, wondering how I got by without Google Play, GMail, contacts and calendar sync etc. Part of the answer to that question involves running your own server, part is covered by using alternatives for the Google-provided apps and services. I would have put this all in a table but it seems this silly forum does not support those...
Commercial service: Alternative (Remarks)
Google Play: F-Droid (The F-Droid store only contains free software. It does not provide a full alternative to the Play Store. If you really want to run the Play Store but still have a notion of privacy on your device, consider enabling Google Services only when required, disabling them afterwards. You can also designate one device as the one which gets to run the Play Store and side-load apps from this device to all others. Theoretically this should be possible using an emulator on your server as well, automating the whole process and creating a 'playstore by proxy'. I have not tried this.)
GMail: IMAP to your own server, eg the Debian standard dovecot daemon. K9 or the standard Android email client on your device.
Contacts: CardDav to your own server (service is provided by ownCloud, amongst others), DAVdroid on your phone or tablet.
Calendar: CalDav to your own server (service is provided by ownCloud, amongst others), DAVdroid on your phone or tablet.
Cloud storage (Dropbox, Google Drive, etc): WebDav to your own server (service is provided by ownCloud, amongst others), one of the many webdav clients on your phone. There is a specific ownCloud app as well.
Photo sharing (Flickr, Smugmug, etc): Trovebox to your own server, Trovebox app on phone
Streaming service (Spotify, Google Music, etc): subsonic on your own server, dSub or Subsonic app on phone (there is a rudimentary streaming service in ownCloud as well, based on Ampache)
More will follow...
If you get in the game on time you might be able to join the Reset the Net initiative!

Reserved #2
This position is reserved for a more thorough list of services

Reserved #3
This position is reserved for a more thorough list of services

YetAnotherForumUser said:
Commercial service: Alternative (Remarks)
Google Play: F-Droid (The F-Droid store only contains free software. It does not provide a full alternative to the Play Store. If you really want to run the Play Store but still have a notion of privacy on your device, consider enabling Google Services only when required, disabling them afterwards. You can also designate one device as the one which gets to run the Play Store and side-load apps from this device to all others. Theoretically this should be possible using an emulator on your server as well, automating the whole process and creating a 'playstore by proxy'. I have not tried this.)
GMail: IMAP to your own server, eg the Debian standard dovecot daemon. K9 or the standard Android email client on your device.
Contacts: CardDav to your own server (service is provided by ownCloud, amongst others), DAVdroid on your phone or tablet.
Calendar: CalDav to your own server (service is provided by ownCloud, amongst others), DAVdroid on your phone or tablet.
Cloud storage (Dropbox, Google Drive, etc): WebDav to your own server (service is provided by ownCloud, amongst others), one of the many webdav clients on your phone. There is a specific ownCloud app as well.
Photo sharing (Flickr, Smugmug, etc): Trovebox to your own server, Trovebox app on phone
Streaming service (Spotify, Google Music, etc): subsonic on your own server, dSub or Subsonic app on phone (there is a rudimentary streaming service in ownCloud as well, based on Ampache)
More will follow...
More later, no time now,
Click to expand...
Click to collapse
This is an interesting topic mainly because android has the potential to become non dependant of google services and I would be nice to keep personal data really personal.
Also there is a No Gapps project here in xda that is quite interesting.

YetAnotherForumUser said:
Router
Best here is to use a router which is fully under your own control. While some ISP routers might be marginally usable, these devices are often at the whim of the ISP as they can be remotely controlled and configured. This is not what you want for your network, so just use the thing in bridge mode if possible, otherwise forward all traffic to your own router. With one of the free and open router firmwares on a reliable device you can do interesting things, ranging from port knocking on the router to VPN tunnels to your mobile devices.
Click to expand...
Click to collapse
This reminded me of something that happened in my dad's office recently:
http://arstechnica.com/civis/viewtopic.php?f=10&t=1209257
The ISP guys configured it that way because dad wanted to run a webserver on one system, the one directly connected to the modem on bridged mode. They apparently didn't think it was necessary to also add a router betweenthe modem and the network of computers :/
Lessons:
1. Don't trust anything the ISP guys do
2. Always us a standalone router or firewall
3. Don't use XP. Seriously.

TJKV said:
This reminded me of something that happened in my dad's office recently:
http://arstechnica.com/civis/viewtopic.php?f=10&t=1209257
The ISP guys configured it that way because dad wanted to run a webserver on one system, the one directly connected to the modem on bridged mode. They apparently didn't think it was necessary to also add a router betweenthe modem and the network of computers :/
Lessons:
1. Don't trust anything the ISP guys do
2. Always us a standalone router or firewall
3. Don't use XP. Seriously.
Click to expand...
Click to collapse
I can recommend something like this. They come with web-face, but you need have atleast base knowledge of how network things work.

slph said:
I can recommend something like this. They come with web-face, but you need have atleast base knowledge of how network things work.
Click to expand...
Click to collapse
Nah when I realised what the ISP guys had done I bought a D-Link 2750U and set it up properly in NAT mode
Wifi also works now since it isn't bridged to a computer anymore

[Feature Request] unbound DNSSEC

Yes, I know, I'll likely be the one working on this having requested it.
Admittedly, there are a lot of usability issues with redirecting outbound DNS queries from the Android resolver to a local resolver. Most problematic are when the DHCP-specified DNS servers are to be trusted (such as on trusted WiFi or trusted VPN that has "private" address information).
Assuming that those could be worked through in some reasonable way (I haven't looked at what M offers for notification and the like, but am not terribly happy with the way that WiFi Privacy prompts when it finds an unknown MAC), I'd like to suggest that "we" look at unbound as it supplies DNSSEC, as well as being arguably more robust and secure than something like dnsmasq.
There has been some good work done on the executable port:
https://unbound.net/pipermail/unbound-users/2015-August/003976.html
https://github.com/smarek/android-unbound-dns
There will likely be additional complexities with Google dropping OpenSSL in favor of BoringSSL.
(The SSL library change will likely impact ssh and rsync on my phone, which I use for backup, so getting both of those to build again under M will be a higher priority for me)
I think the most challenging parts will be the UX on how to control it as well as getting the redirection to play nicely with widely used firewall tools out there such as AFWall.
I'll at least be thinking about that UX part. Without that, it won't have the utility to balance the cost.

Framework discussion

Hi all,
As part of a class I'm doing, we are required to post some content to a forum to engage in discussion on security:
.
Cross Site Scripting (XSS)
OWAPS describes Cross Site Scripting (XSS) where a website has been marked as a trusted website, which for some reason, can run malicious code or scripts through inputs such as forms. As the end user’s browser sees this site as trusted, it allows the malicious script or code to execute, which can give access to client side information before it is encrypted (such as usernames, passwords, session IDs, cookies, etc).
In PHP for example, a normal input box where a user would enter their name, would be able to enter the following:
When PHP prints this back out after submission, it will execute the script between the script tags (In this case, just a simple popup).
In this scenario, this can be solved by wrapping the input value with htmlentities:
This would print any script as literal text rather then executing it.
In Java,
XSS is still a major issue, both due to some sites not implementing simple work around such as htmlentities or htmlspecialchars, or for reasons where these cant be used. XSS affects PHP applications by as much as 86% - its PHPs biggest vulnerability.
In Java, the easiest method is to simply validate inputs and to encode special characters (<>[email protected]#$%^&*). Alternativley, OWASP have a XSS class which includes easy methods to best prevent against certain types of XSS.
Code Injection
Code injection is where using the sites scripting language, you can inject (rather, have the site pull) code from somewhere else.
For example, php can call one of its own pages like so:
however, if we replace the contact.php page with an external hosted script:
This will cause the enduser to execute that script. This all comes down to PHP validation which is coded within the PHP to ensure only valid respsonses are accepted.
This is unlike command injection. Command Injection is an attack which is designed to execute commands on the PHP hosted system (server). This can be done where most parameters are passed (headers, input boxes, etc) and will typically display any output on the returned webpage.
For example, to return a password for a certain user, you could use a command like:
Typically, to prevent such commands from executing, a whitelist of command can be made, whereby only those listed are allowed to be executed on the server. Alternativly, it is recommend where the application needs to invoke system side commands, to do this through local python scripts, rather then PHP calling the commands.
CRLF injection
CRLF injection comes from the elements CR (Carriage Return) and LF (Line Feed) – together (CRLF) this denotes a new line (done simply by pressing the enter button). If a website for example, allows you to upload a file, an attacker may name this file as follows:
This would result in a system command being carried out to delete everything in the /bin folder.
It also allows an attacker to write to the log file, by creating it own new line. If the logs are configured in such a way that they will email out any WARNINGS or ERRORS, an attacker may add these to a new log line repetitively, backing up the email and bandwidth.
The simple way around this is for JAVA to sanitise any input strings, either through substituting known commands, or through methods such as
SQL Injection
.NET SQL Injection allows an authorised SQL command to be sent to the SQL server and executed.
An SQL string may be built using inputs from a form. A possible example of this is:
Code:
SELECT email, passwd, login_id, full_name FROM members WHERE email = 'formemail';
where the red is the text from an input field.
However, we can modify this string which can allow some malicious stuff to happen:
Code:
SELECT email, passwd, login_id, full_name FROM members WHERE email = 'formemail'; DROP DATABASE members --';
Adding the red text to the email input box, would allow us to delete the whole table, or alternatively insert a new record into a table, or possible delete records, modify records (change passwords), or even delete whole tables.
To prevent this, you can limit the damage an SQL injection can do you using proper database permissions (deleting records, tables, etc), and to also use good sanitisation – look for -- or ; in any field and invalidate the data if it has these characters.
Directory Traversal
Directory traversal can also be referred to as a “dot dot slash” attack.
In php, a resource (page) can be called as follows:
However, it may be possible to get other files, not even part of the web directory using the following examples:
The easiest way to prevent this is to assign proper permission on the server itself. However, many web developers do not own the server, therefore, another layer of protection is fully qualify the file path, with the root being where the webpage sits.
Connection String Injection
Also known as connection string pollution, it is possible for an attacker to inject parameters into a connection string to a database. Typically a connection string is built by delimiting each value with a comma. In an injection attack, strings can be built using semi colons as a delimiter.
A typical connection string to a windows SQL server may look like the following:
Code:
Data source = SQL2005; initial catalog = db1; integrated security=no; user id=+’User_Value’+; Password=+’Password_Value’+;
However, if an attacker places a rouge windows SQL server on the internet, and then uses a connection string like follows:
Code:
Data source = SQL2005; initial catalog = db1; integrated security=no; user id=;Data Source=Rogue Server; Password=; Integrated Security=true;
This allows the target windows SQL server to connect to the rouge server using its own Windows credentials, exposing much data.
Backdoors
Backdoors can be common within applications and web applications and can occur across many types of frameworks, however, it’s the security around the knowledge of backdoors, and what they allow, which can be of concern. All modems, routers and some managed network infrastructure have administrator usernames and passwords. However, sometimes, the network vendor (CISCO, NETGEAR, etc) or ISP may choose to put a backdoor access onto these devices. This may be in case a user forgets their administrator credentials, for automatic firmware updates, or for remote troubleshooting. Some of these backdoors may allow for more settings then what is normally shown to an end user.
For example, some older Optus supplied modems had the hidden user: Admin, and a password of: Y3S0ptus. This was standard across thousands of supplied modems. The problem was, the end user had no way of changing the default setting for remote web access from Enabled to Disabled, which meant anyone that knew of their IP address or domain name, could now remote access their modem router, add port redirects, and now connect to devices within their LAN.
In the case of ISP provided modems, it might be safer to simply by something else, not supplied by the ISP.