Dip Your Toes in the Sea of Security (phpDay 2016)

@asgrim
Dip Your Toes
in the Sea of Security
James Titcumb
phpDay 2016

@asgrim
James Titcumb
www.jamestitcumb.com
www.roave.com
www.phphants.co.uk
www.phpsouthcoast.co.uk
Who is this guy?

@asgrim
Some simple code...
<?php
$a = (int)filter_var($_GET['a'], FILTER_SANITIZE_NUMBER_INT);
$b = (int)filter_var($_GET['b'], FILTER_SANITIZE_NUMBER_INT);
$result = $a + $b;
printf('The answer is %d', $result);

@asgrim
The Golden Rules
(my made up golden rules)

@asgrim
4. Don’t reinvent the wheel

@asgrim
5. Never trust anything

@asgrim
OWASP
& the OWASP Top 10
https://www.owasp.org/

@asgrim
Application Security
(mainly PHP applications)

@asgrim
Always remember…
Filter Input
Escape Output

@asgrim
© 2003 Disney/Pixar. All Rights Reserved.
SQL Injection (#1)

@asgrim
SQL Injection (#1)
http://xkcd.com/327/

@asgrim
SQL Injection (#1)
1. Use PDO / mysqli
2. Use prepared / parameterized statements

@asgrim
SQL Injection (#1)
<?php
// user_id=1; DROP TABLE users; --
$user_id = $_GET['user_id'];
$sql = "
SELECT * FROM users
WHERE user_id = {$user_id}";
$db->execute($sql);
✘

@asgrim
SQL Injection (#1)
<?php
$user_id = $_GET['user_id'];
$sql = "
SELECT * FROM users
WHERE user_id = :userid";
$stmt = $db->prepare($sql);
$stmt->bind('userid', $user_id);
$stmt->execute();
✓

@asgrim

@asgrim
exec($_GET)
https://github.com/search?q=exec%28%24_GET&ref=cmdform&type=Code

@asgrim
eval()
https://github.com/search?q=eval%28%24_GET&type=Code&ref=searchresults

@asgrim
Cross-Site Scripting / XSS (#3)

@asgrim
Cross-Site Scripting / XSS (#3)
● Escape output
<?php
$unfilteredInput = '<script type="text/javascript">...</script>';
// Unescaped - JS will run :'(
echo $unfilteredInput;
// Escaped - JS will not run :)
echo htmlspecialchars($string, ENT_QUOTES, 'UTF-8');

@asgrim
Cross-Site Request
Forgery / CSRF (#8)
http://www.factzoo.com/invertebrates/cuttlefish-chameleon-of-the-sea.html

@asgrim
Cross-Site Request Forgery / CSRF (#8)
<?php
if (!$isPost) {
$csrfToken = base64_encode(random_bytes(32)));
$_SESSION['csrf_token'] = $csrfToken;
// ... output the form ...
echo '<input type="hidden" name="csrf_token" value="'.$csrfToken.'" />';
} else if ($isPost) {
if (hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
die("Token invalid...");
}
// ... handle the form ...
}

@asgrim
<?php
if (!$isPost) {
$csrfToken = base64_encode(random_bytes(32)));
$_SESSION['csrf_token'] = $csrfToken;
// ... output the form ...
echo '<input type="hidden" name="csrf_token" value="'.$csrfToken.'" />';
} else if ($isPost) {
if (hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
die("Token invalid...");
}
// ... handle the form ...
}
Cross-Site Request Forgery / CSRF (#8)

@asgrim
Timing attacks
From zend_is_identical:
return (Z_STR_P(op1) == Z_STR_P(op2) ||
(Z_STRLEN_P(op1) == Z_STRLEN_P(op2) &&
memcmp(Z_STRVAL_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op1)) == 0));

@asgrim
Timing attacks
Actual string: “foobar”
● a (0.00001)
● aa (0.00001)
● aaa (0.00001)
● aaaa (0.00001)
● aaaaa (0.00001)
● aaaaaa (0.00002) ← success!
● aaaaaaa (0.00001)
● aaaaaaaa (0.00001)
● aaaaaaaaa (0.00001)

@asgrim
Timing attacks
1 int memcmp(const void* s1, const void* s2,size_t n)
2 {
3 const unsigned char *p1 = s1, *p2 = s2;
4 while(n--)
5 if( *p1 != *p2 )
6 return *p1 - *p2;
7 else
8 p1++,p2++;
9 return 0;
10 }
http://clc-wiki.net/wiki/C_standard_library:string.h:memcmp#Implementation

@asgrim
Timing attacks
Actual string: “foobar”
● “aaaaaa” (0.00001)
● “baaaaa” (0.00001)
● …
● “faaaaa” (0.00002) ← success!
● “fbaaaa” (0.00002)
● “fcaaaa” (0.00002)
● …
● “foaaaa” (0.00003) ← success!

@asgrim
Sensitive Data Exposure (#6)

@asgrim
curl + https
<?php
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
✘

@asgrim
curl + https
<?php
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_CAINFO, "/path/to/certificate");
✓

@asgrim
Third Party Code
!!! WARNING !!!

@asgrim
Third Party Code
github.com/ /SecurityAdvisories
!!! WARNING !!!

@asgrim
We are not all
security experts!

@asgrim
We are not all
security experts!
… but we CAN write secure code

@asgrim
Hack your own system!

@asgrim
What do you want?
Think like a hacker

@asgrim
How do you get it?
Think Differently

@asgrim
Threat Modelling
D.R.E.A.D.
© Buena Vista Pictures

@asgrim
Threat Modelling
Damage
R
E
A
D

@asgrim
Threat Modelling
Damage
Reproducibility
E
A
D

@asgrim
Threat Modelling
Damage
Reproducibility
Exploitability
A
D

@asgrim
Threat Modelling
Damage
Reproducibility
Exploitability
Affected users
D

@asgrim
Threat Modelling
Damage
Reproducibility
Exploitability
Affected users
Discoverability

@asgrim
Rank them in order
And fix them!

@asgrim
Authentication
& Authorization

@asgrim
Authentication
Verifying Identity

@asgrim
Case Study: Custom Authentication
We thought about doing this…

@asgrim
Case Study: Custom Authentication
We thought about doing this…
✘

@asgrim
Password Hashing
password_hash()

@asgrim
Authorization
Verifying Access

@asgrim
CRYPTOGRAPHY
IS
HARD
NEVER EVER “ROLL YOUR OWN”

@asgrim
CRYPTOGRAPHY
IS
HARD
NEVER EVER “ROLL YOUR OWN”
EVER!!!

@asgrim
I’ve got some
great ideas for
encryption...
Image: The Guardian (http://goo.gl/pUkyvO)

@asgrim
How to encrypt then?
libsodium PECL package

@asgrim
Create an SSH Fortress

@asgrim
iptables
#!/bin/bash
IPT="/sbin/iptables"
$IPT --flush
$IPT --delete-chain
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP
# Loopback
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
# Inbound traffic
$IPT -A INPUT -p tcp --dport ssh -j ACCEPT
$IPT -A INPUT -p tcp --dport 80 -j ACCEPT
$IPT -A INPUT -p tcp --dport 443 -j ACCEPT
# Outbound traffic
$IPT -A OUTPUT -p tcp --dport 80 -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 443 -j ACCEPT
$IPT -A OUTPUT -p udp --dport 53 -m state --state NEW -j ACCEPT

@asgrim
ufw
sudo ufw enable
sudo ufw allow 22
sudo ufw allow 80

@asgrim
Mitigate Brute Force
Attacks

@asgrim
Install Only
What You Need

@asgrim
Case Study: Be Minimal
Internets
Postfix
Squid Proxy
(badly configured)
hacker
spam

@asgrim
Resources
● http://securingphp.com/
● https://www.owasp.org/
● http://blog.ircmaxell.com/
● https://github.com/paragonie/random_compat
● https://github.com/ircmaxell/password_compat
● https://paragonie.com/blog
● https://websec.io/resources.php

@asgrim
The Golden Rules
1. Keep it simple
2. Know the risks
3. Fail securely
4. Don’t reinvent the wheel
5. Never trust anything / anyone

@asgrim
If you follow all this, you get...

@asgrim
Any questions? :)
https://joind.in/talk/fc2dc
James Titcumb

Dip Your Toes in the Sea of Security (phpDay 2016)

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (8)

Andere mochten auch

Andere mochten auch (20)

Ähnlich wie Dip Your Toes in the Sea of Security (phpDay 2016)

Ähnlich wie Dip Your Toes in the Sea of Security (phpDay 2016) (20)

Mehr von James Titcumb

Mehr von James Titcumb (18)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Dip Your Toes in the Sea of Security (phpDay 2016)