OWASP Top Ten 2017 Release Candidate is out (and how it affects you)

The Open Web Application Security Project published the Release Candidate of the ten most critical Web application security risks in the OWASP Top Ten 2017. OWASP is instrumental in raising awareness about the most critical security issues affecting Web applications these days – and in today’s connected world, the security of Web applications is more critical than ever.In the last decade the OWASP Top Ten list became the most important reference point with respect to Web application security trends, such as:

Which vulnerabilities are becoming more critical due to the prevalence of poor development practices – or, conversely, the discovery of new attack techniques;

Which risks have become less significant over time due to the adoption of effective best practices and countermeasures and; and finally

What completely new threats have appeared due to changes in the design and implementation of web applications, such as moving towards cloud-based deployments with a large number of external dependencies.

In the end, such lists are handy to prioritize threats when developing your application. However, keep in mind that such a top list is definitely not an exhaustive list of security problems, and should not be used as such. It is not a checklist and neither is it something one can “comply” with; it is just a starting point of a journey through Web application security!

The changes of the 2017 release candidate as compared to the previous 2013 list are relatively minor:

• The old A7 – Missing Function Level Access Control was merged with A4 – Insecure Direct Object References now forming the new A4 – Broken Access Control.
• A7 – Insufficient Attack Protection and A10 – Underprotected APIs are two new risks on the list.
• Finally, the old A10 – Unvalidated Redirects and Forwards fell out from the new top ten.

So what do these changes tell us about the current trends from a secure coding standpoint?

The first change is actually just bookkeeping – Broken Access Control was originally present in

earlier Top Ten lists, undergoing various splits and merges over time. Thus, both merged risks remain as important as ever under this new category.

However, the appearance of the two new risks – Insufficient Attack Protection and Underprotected APIs – highlights something more interesting: neither is connected only to the code and the implementation of the web application, rather they reflect threats stemming from the environment and the various components providing APIs – such as libraries, web services or microservices. Reliance on third-party components vastly increases the exposure of a system to potentially malicious interactions, and the attack surface is extended beyond just the developer’s own code. This is becoming more and more an aching point for software development projects; the two new items continue the trend that already started in 2013 by introducing Using Components with Known Vulnerabilities as a new component of the top ten list.

Insufficient Attack Protection refers to the inability to detect, prevent and respond to various kinds of attacks against the application as a whole. This – due to the large number of unaudited third-party components that may contain critical vulnerabilities – necessitates the use of generic security tools such as intrusion detection systems (IDS), and web application firewalls (WAF) that can identify an ongoing attack such as SQL injection. It focuses on the consequences instead of the root causes of the weaknesses.

Underprotected APIs looks at the problem from the other direction: with web applications increasingly relying on web services – both public APIs as well as the web application’s own core functionality implemented as a set of Internet-facing microservices – developers often forget that the attackers can access these APIs directly as well, and they don’t get the level of scrutiny that they deserve.

All in all, the 2017 OWASP Top Ten shows a continued shift towards merging AppSec and OpSec – it’s not just about making sure your own code is secure, it’s also about adding assurances that other code will not be able to harm your system, even if they include vulnerabilities (or just misbehave). In the age of rapid application development, Agile, and DevOps, maybe one of the current combo-buzzwords (DevOpsSec, SecDevOps or DevSecOps) will emerge as the path to take.

Balazs Kiss has been working in the area of application security for nearly a decade. He is one of the lead trainers at SCADEMY with several years of experience in various fields of software security education.

Informator kan tillsammans med Secure Coding Academy erbjuda dig ett unikt kursutbud inom Secure Coding. Se alla våra kurser inom Secure Coding här.

Läs mer

Developers’ key role within software engineering security

Application security has changed and evolved throughout the years. However, it is clear to see it failed to keep up with how software engineering has evolved. Developers are asked to code better and faster, improving features… which has a negative impact on sound security and quality practices. As a result, the code produced becomes more vulnerable, easier to hack… and the danger of falling victim to cyber-criminality starts to rise.

Developers have a key role in maintaining great security and quality within their daily coding practices. Most companies still struggle to join the dots when putting security and productivity on the same level.

Ask yourself the following : What if incorporating security from the start led to being more productive?

A look-back : Penetrate and Patch.

If we look back at the last 20 years, software engineering has been evolving at a high pace, with the accent put on quickness and features. As a result, most companies are amazing at producing applications in a speedy manner… by neglecting security from the start. Instead, they take on a “penetrate and patch” approach, hoping that this will save the day, should there be vulnerabilities in the code.

“Penetrate and patch” has quite a few limitations, among which :

• Developers can only patch issues they know about.

• Patches are often the results of market pressure, and often introduce new problems of their own.

• Patches usually only fixes the issues, but do not take a proper look at what is causing the problem.

• When looking at the end-user, patches are sometimes overlooked… A system admin which is overworked might not be so keen on applying a patch to a system that works.

This is still how lots and lots of companies operate, and part of the reasons why the state of IT security is so alarming.

What else can be done?

Know your enemy better than you know yourself.

As “Sun Tzu” said, “Know your enemy and know yourself and you can fight a hundred battles without disaster”.

We highly recommend companies to send some of their developers to hackers’ conferences. By doing so they will be able to understand how they think, how they act, what their motivations are, etc. By doing so, your developers will start to have a “security-first” mindset, which we help them code better.

All of our courses are presented in a way to achieve that goal as well, by providing our trainees with case-studies and live-hacking fun exercises. Our Java and Web Application course can be seen here.

Attend security conferences

Attending such conferences is a very good way of keeping up-to-date with best practices. Above all, those are a place where you can exchange with other devs, or security professionals on their success stories and set-backs.

Educate yourself, your team, your company!

The ultimate solution to make sure your developers are in great position to fulfill that key role in security, is simply to make sure they have the knowledge to do so. You may ask ten times a developer to make sure his piece of work cannot be hacked using Sequel Injection… if He does not know how to prevent it from happening, you might end up with an issue on our end.

Two types of learning methods are currently available. Online Learning (remote distance and/or CBT) and Onsite (F2F) learning.

While online learning presents some advantages (flexibility, easier roll-out when a lot of developers are concerned…), one can wonder how much knowledge really is retained by such a learning method.

On the other side, we have onsite live classroom, where trainees have a physical trainer in front of them, who presents them the knowledge and the challenges. Q&A is also happening live, and it is also easy for the trainer to validate understanding (or not) of the concepts taught.

Here below are some of the courses we have been providing companies with.

Microsoft SDL Core Training

C/C++ Secure Coding

Comprehensive C# and .Net Application Security

Secure Coding in PHP

Advanced JAVA and Web Application Security

Complementary topics for JAVA

Complementary topics for .Net

Read more here.

Why educating software engineers in security?

It may happen that you do feel confident about your security practices… or that you have a security team in place. However, the odds are that they are likely to be overworked, and that makes it very hard to keep up with the latest hacking techniques and found vulnerabilities. That is why having a partner that will raise that security knowledge within your developing team will be of great help.

Stay Secure in 2017!

/Gauthier

Gauthier has been active in the IT field for over 10 years. Currently working for Scademy Ltd, He oversees global Sales and Marketing.

Informator kan tillsammans med Secure Coding Academy erbjuda dig ett unikt kursutbud inom Secure Coding. Se alla våra kurser inom Secure Coding här.

Läs mer

How to Prevent Cyber Crime

A Little Bit of Background

Cyber crime can be divided into two categories: Crimes that target computers directly such as viruses, attacks and malware; and online crime that uses computer networks or devices as means to perform fraud and identity theft through social engineering as well as cyber bullying, cyber stalking and cyber warfare.
Currently, companies in the United States experience an annual loss of more than 525 million US dollars due to cyber crime. The majority of these losses are due to malicious code and denial of service attacks.

People tend to believe that working with an Security Expert, after producing the different apps… will allow them to live happily ever after while staying away from Cyber Crime. They could not be more wrong!

Prevention through Education and Training

Let me put it this way. Picture yourself as MD of a logistics company. Would you put unlicensed drivers in front of the stirring wheel of your trucks? The answer is NO.

Were you to run a Hospital, Would you let a GP practice an open-heart surgery on a patient? The answer is NO.

Those are of course extreme cases, but not so far by software engineering best practices. Cyber threats are all around. The way we see it, companies around the world face two choices.

Option A: They live on the so called “Never happened to me before, Cannot foresee it happening to me ever!” statement. Well… this is very, very close to gambling! It might be true, it is likely not to be. Cyber Crime is growing day in, day out. So why take the risk to let it hurt you and your company?

Option B: You start tackling the problem through education and training. Why wait until you get hacked? Educating, and training your software engineers will make you save money in the long run, a huge amount of money. The amount of hacking attempts you’ll avoid… the time you will gain on producing new code… and not reviewing old one in order to find, test and fix bugs will be considerable!

So wait no more! Tackle the problem before it even hits you. Join the community of secure coders, and help us make the IT world a safer place.

/Gauthier

Gauthier has been active in the IT field for over 10 years. Currently working for Scademy Ltd, He oversees global Sales and Marketing.

Informator har lång erfarenhet av utbildning inom olika inriktningar och systemutvecklingsspråk. Tillsammans med vår partner Secure Coding Academy presenterar vi det antagligen mest heltäckande kursutbudet när det kommer till att skriva säker kod. 

Läs mer

Cyber-Criminals surfing on the Pokemon Go Hype

Pokemon GO is without doubt one of the biggest (if not the biggest) buzz the Internet has seen in the last years. Rolled over around the world, millions of users are now running around, phone in their hands, trying to catch Pokemons. This is all fun and games, but also a great opportunity for bad guys to affect millions of devices around the world.

ESET has discovered a lock-screen app, names Pokemon Go Ultimate. This app locks the screen right after the app is launched, forcing the user to reboot the device. However, the reboot function is unfortunately unavailable in most cases since the malicious app overlays all the other apps as well as system apps. The reboot can only be done via the Android Device Manager or by pulling out the Battery. So much for catching Pokemons… uh?

The Pokemon Go Ultimate app actually installs a PI Network app/icon, which once ran will freeze the screen and force the user to do a manual reset.  After rebooting the device, the app will stay hidden, but will still be running in the background and, by example, clicking on banners so as to generate revenues for its owners.

More importantly, this is step one of possibly upgrading this lock-screen malware to a ransomware! Users have to stay careful, and only use trusted apps!

But that’s not all!

Other malicious apps were also unfortunately discovered by ESET such as “Guide & Cheats for Pokemon Go” and “Install Pokemongo”. Those apps promises the users with PokeCoins, Pokeballs and any other sort of things… When what they really do is install malwares or scarewares onto your device, trying to lure the user into subscribing to numerous expensive bogus services.

Gotta Catch ’em All…. But please Beware of them all!

After ESET reported those Malicious Apps, they were immediately taken away from the Google Play Store. However, there will be others. It is important to still pay attention and to not download and is tall those malicious apps.

Those three apps could reach 500-1.000 users; 100-500 users and 10.000-50.000 users!

If you simply cannot resist to go out there and catch some Pokemons, we recommend to follow those guidelines before installing any apps :

1. Only install from reputable sources
2. Read reviews, filter out the positive ones to only read the negative ones.
3. Pay attention to Ts&Cs, and apps permissions
4. Have a mobile security solution!

/Gauthier

Gauthier has been active in the IT field for over 10 years. Currently working for Scademy Ltd, He oversees global Sales and Marketing.

Informator kan tillsammans med Secure Coding Academy erbjuda dig ett unikt kursutbud inom Secure Coding. Se alla våra kurser inom Secure Coding här.

Läs mer

DDoS vs DynDNS : the cyber attack that crippled American WEB giants

Security experts were unanimous: the Mirai botnets network had the capacity to massively disturb the majority of internet websites. Indeed, end of last week, it massively hit the DynDNS service, indirectly affecting thousands of american websites, for several hours.

DynDNS allows websites having dynamic IP addresses to only have a single URL, the company then taking care of providing the service redirecting the web user towards the right IP address.

On Friday night, the DynDNS service became victim of a harsh DDoS cyber attack from the Marai botnet network, which comprises of IoT devices such as IP security cameras and Routers/switches. Several major american players were affected, among which Netflix, Spotify, Twitter, Ebay and many others. In a nutshell, it is safe to say that all websites using DynDDS were affected, a share that was later estimated at just below 5% of the world wide web.

Mostly American web users got affected by those successive cyber attacks, even though a small share of Europeans also encountered difficulties while trying to log in to those services.

On Saturday, DynDNS published a blog post explaining the attack, and mentioning that the situation was now under control. Nevertheless, last Friday’s attack was very significant in terms of sophistication and complexity, not to mention the financial aspect of things. Indeed, Giants such as Paypal or Ebay are likely to have lost quite an amount of business during the downtime. Numbers are still to be communicated, if ever.

Do you feel the power?

No later than last Thursday, our trainer Erno Jeges was giving a presentation on secure coding. As part of our introduction, we spoke about the current situation with Botnets. While exchanging with some of the attendees, Erno mentioned how quickly a hacker, somewhere in the world, could assemble a “team” of 5,000 botnets. He then asked the audience : “Do you feel the power?”.

Well, now, you know the power.

Last October, a study revealed Mirai had around 213.000 infected machines. A few days ago, another study revealed that Mirai has over 500.000 infected machines.

So, again… Do you feel the power?

What now?

Well, friends, the situation is dark. Due to the nature of the vulnerability (default credentials that the users might not always be able to change), more attacks can be expected in the following weeks since this whole mess  will not be fixed by applying a single patch. In order for this to stop, the botnet network has to be stopped, somehow.

This not all, however. Hackers started to sell access to a huge army of hacked IoT devices, so as to launch attacks capable of disrupting web connections. More information can be found here.

“It takes less time to do a thing right, than it does to explain why you did it wrong.” - Henry Wadsworth Longfellow

/Gauthier 

Gauthier has been active in the IT field for over 10 years. Currently working for Scademy Ltd, He oversees global Sales and Marketing.

Informator har lång erfarenhet av utbildning inom olika inriktningar och systemutvecklingsspråk. Tillsammans med vår partner Secure Coding Academy presenterar vi det antagligen mest heltäckande kursutbudet när det kommer till att skriva säker kod. 

Se våra kurser inom Secure Coding från Secure Coding Academy här.

Läs mer

Learning secure coding – the most effective way of doing security

I am sometimes surprised to see how even those working in the software industry tend to forget about the fact that the burden of the security incidents we experience today are stemming from defects in the code – actually bugs – committed by software engineers designing, implementing and integrating all those systems. But on the other hand, this is not that surprising, given that software security is usually not included in standard educational programmes.

Let’s face the reality: constrained by resources, many software developers ignore security entirely until they face an incident, or are tackling security by just focusing on the options they think to be the cheapest – which usually means just going through a checklist for finding some of the most common problems. But is this really the cheapest option? Just think about it: How much does it cost if the news are full of your device being broken or website being hacked again?

To date the software development community has learned the lesson: security started to be interwoven in the whole of the product development lifecycle. But do not forget: while – in theory – engineers have to be vigilant, eliminating every single bug in the code to make a product secure, for an intelligent attacker it is enough to find a single remaining vulnerability in a rarely-used module to use it as a vehicle for committing cyber-crime.

During the 2000’s the software industry started to realize the fact that in the long run, investing in their own employees is the most effective way of doing security. Training became the key initial phase in the Microsoft Security Development Lifecycle, and is also a standard practice within the Building Security in Maturity Model followed by many. Companies started to reserve more and more from their security budget to educate their employees, as education tackles the problem of security right at its source: the engineer.

But, just as we can’t put a policeman on every corner, assigning a dedicated security expert to a development group is not enough (still better though than not doing anything at all). Usually a single small mistake committed by one of the engineers is the root cause of a complete system compromise, and so the overall average preparedness of all involved software architects, programmers and testers is the one that actually counts.

From project management point of view, it is an easy formula: your engineers work hard each day, and produce vulnerable code, resulting in hundreds of security bugs yearly…

…to test

…to find

…and to correct.

OR

You can send those programmers to a secure coding training, and they’ll start to write secure code from their next working day. The choice is yours.

A special prudence is needed however to teach security practices to software engineers: the trainer should not only be an experienced software developer, but also has to have strong security expertise. The courses should be practical but still go into enough theoretical details; shown problems should be supported by exercises giving hands-on experience, otherwise developers will forget most of the issues the next day; and classes should be intensive so they don’t pull away people from their everyday work for too long.

Our Secure Coding courses were formed based on a decade long expertise in product security and security research. In this sense with our courses we teach what we do. With a track record of thousands of attendees worldwide, the trainings in our portfolio are specifically prepared to serve diverse development groups of large companies developing any kind of software.

About Ernő Jeges - Instructor at Informator

Ernő has been a software developer ever since his childhood, working in the area of product security and security research for nearly fifteen years now. He has actively taken part in the elaboration of all course materials of SCADEMY Secure Coding Academy, and is the leading trainer with several years of teaching experience in both academic and industrial domain; he has held numerous secure coding courses for leading software developing companies all over North America, Europe, Africa and Asia.

Läs mer