Various Security Misconception awareness topics on: OS, Languages, Frameworks, Libraries, .... May invite me private talk session for your team.

1. 1© 2019 CONFIDENTIAL 1© 2019 CONFIDENTIAL
Alex Ong, ongbp@onet.sg, +6017-3180163
Solutions Architect, OneT Solutions Pte Ltd.
COMMON SECURITY
MISCONCEPTIONS

2. 2© 2019 CONFIDENTIAL 2
ABOUT SPEAKER

3. 3© 2019 CONFIDENTIAL
About Alex(Matthew) ONG
• 20+ Years(since 1997) in ICT or Related Industries
• Certified Sun Microsystem(now Oracle) Train the Trainer
• Ex-Mimos Master Trainer (2014-2016)
• Master Trainer HRDF, Australian TAE40110 Certified.
• Cross Industries & Process Regional Consultation:
• ICT, Education, Manufacturing
• Financial banking, Telecommunication
• Defense: I can neither confirm nor deny..
• Singapore, Australia, Malaysia, Indonesia, Philipine

4. 4© 2019 CONFIDENTIAL 4
BACKGROUND INFO

5. 5© 2019 CONFIDENTIAL
DISCLAIMER
•Speaker Disclaimer:
• DOES NOT advocate anyform of hacking
• Hacking computer resources is against the law in most country
• is NOT legally trained, please seek a competent legal council for
cyberlaw for your country
• What happens in rawsec, stays in rawsec
• Pentesting(whitehat hacking) is advocated and should be done
with AFTER formal written agreement from target clients

6. 6© 2019 CONFIDENTIAL
SECURITY CONCERNS COVERED
• We will be covering some of:
• BIOS: Intel ATM
• WAF Limitations
• OS: Win, Mac
• Languages: .NET, Java
• Libraries: OGNL, JSR 233
• DB: SQL Injections
• Browsr: XSS

7. 7© 2019 CONFIDENTIAL
SECURITY? NOT REALLY MY ISSUES
FEW UNDERSTAND SECURITY
Many security engineers don’t understand development
— and most developers don’t understand security.
Source: SANS State of Application Security, 2015
Average Application
Only 21% Custom Code
93% overall Vulnerabilities
APPS ARE CHANGING
• Agile and DevOps
• Cloud and container
• Microservers and APIs
• Libraries and code reuse
Can legacy Application
Security Solutions have been
able to keep up?

8. 8© 2019 CONFIDENTIAL
TYPICAL SECURITY PROCESS

9. 9© 2019 CONFIDENTIAL
IS APPSEC REAL ISSUES?

10. 10© 2019 CONFIDENTIAL
HACKING IMPACT

11. 11© 2019 CONFIDENTIAL 11
COMMON MISCONCEPTION

12. 12© 2019 CONFIDENTIAL
WE DO .NET/WINDOZES
Priced at USD 2k-3k for general entry ticket.
extra cost for courses:
• Win 64 Kernel level(Ring 0) Exploits
• Heap spraying DEP(Data Execution
Protection)
• ASLR(Address Space Layout
Randomization) bypass
• SMEP(Supervisor Mode Execution
Prevention) bypass
• https://www.corelan.be/index.php/20
11/12/31/exploit-writing-tutorial-part-
11-heap-spraying-demystified/

13. 13© 2019 CONFIDENTIAL
WINDOWS BACKDOOR HOOK
• MS: This API is a function/feature.
• https://docs.microsoft.com/en-
us/windows/desktop/winmsg/using-hooks

14. 14© 2019 CONFIDENTIAL
WE DO APPLE
• AppleScript automation engine
• Plenty of Apple users are not
aware of this.
• How to Create a Fake PDF Trojan
with AppleScript
• Script embedded in PDF.
• Able to bypass scanning by
Antivirus tools.

15. 15© 2019 CONFIDENTIAL
BIOS FRONTDOOR FROM BACK

16. 16© 2019 CONFIDENTIAL
APPEARANCE OF SAFETY
Health warning!
You may leave if:
• weak heart
• hypertension(high blood
pressure)
• had panic attack/insomia
REAL SCARY STUFF to follow.

17. 17© 2019 CONFIDENTIAL
OUR WIFI IS HIDDEN, LOCAL AND SECURE
• https://www.gdt.id.au/~gdt/presentations/2002-07-02-questnet-wlan/driveby.pdf
Tiny Enemy Within/Nextdoor

18. 18© 2019 CONFIDENTIAL
DISCOVER HIDDEN WIFI SSID
• https://www.acrylicwifi.com/en/blog/hidd
en-ssid-wifi-how-to-know-name-of-
network-without-ssid/

19. 19© 2019 CONFIDENTIAL
WE DO WAF/IDS/IPS
• Perimeter protection tools:
• Requires Constants Monitoring+Updating
• MANUAL CVE/OWASP/DISA/PCI tracking.
• CAN Protect Typical DOS/DDOS
• highly trained experts needed
• Non accurate blocking
• Mostly Uses REGEXP(easy DOS/DDOS)
• Hard to pick from Long list(16K) of rules
• AI training needs time to build up

20. 20© 2019 CONFIDENTIAL
CRAFT AN EFFECTIVE REGEXP FOR THIS??
• Sample library attack(strut 2)
• Need to pick right rules from long
list of choices.
• Need to match the right amount of
patterns.
• Ensure no REGEXP overflow for
DOS attack.
• Ensure NO OVER BLOCKING of
actual business traffic.

21. 21© 2019 CONFIDENTIAL
WE HAVE SSL AUTHENTICATION
• https://security.stackexchange.com/que
stions/2087/how-to-hijack-a-session
• List of session Hijacking tools

22. 22© 2019 CONFIDENTIAL
WE DO JAVA: OGNL EXP INJECTION
• Commonly used java expression library
• OGNL Exploits
• https://pt.slideshare.net/hackstuff/cmd-
injection

23. 23© 2019 CONFIDENTIAL
EXPRESSION INJECTION
• OGNL Exploits since Feb 2013.
• Expression inject can allow hacker to
run any OGNL code to:
• upload malware file into server
• run malware file
• does almost anything.
• Also exploitable for JSR223 languages

24. 24© 2019 CONFIDENTIAL
OUR JS GURU PROTECT BROWSERS
• Really Skilled Hackers does NOT
use browser attack, NORMALLY.
• Too many alerts created and highly
tracable.
• Xsser, SQLninja, Metasploit...

25. 25© 2019 CONFIDENTIAL
DEMO TIME.
• Download:
• https://github.com/WebGoat/WebGoat/rel
eases/tag/7.1
• Duration depends on time.
• SQL Injection
• XSS
• ...

26. 26© 2019 CONFIDENTIAL
APPSEC OWASP TOP 10(2013, 2017)
Jeff Williams
OWASP Chair for 8 years
Creator of OWASP Top 10

27. 27© 2019 CONFIDENTIAL
A WHOLE NEW WORLD

28. 28© 2019 CONFIDENTIAL
YOU NEED RUNTIME WHITEBOX APPSEC
Software is a black box.
HTTP
Traffic
Code
Frameworks
Libraries
Runtime
Data Flow
Runtime
Control Flow
Backend
Connections
Configuration
Data
Server
Configuration
Etc…
Platform
Runtime
Software
Architecture
SAST
DAST
WAF
IAST
RASP
whitebox: full visibility into running app

29. 29© 2019 CONFIDENTIAL
WHO IS WHO IN APPSEC
• Founded by Jeff Williams after leaving OWASP
• Founded 2013
• New paradigm of Security solutions.

30. 30© 2019 CONFIDENTIAL
SPEAKER DOES RECOMMENDS
• Totally unrelated to hacking incident of any banks.
• You should have 3 or more banks accounts from different banks.
• By law, banks are suppose to keep your data private.
• They are:
• One for salary and main income(ATM only)
• Fixed Deposits in different bank. Totally offline.
• Visa/Master/Debit card from also another bank and can have
online. Have minimum balance and low credit limit(less than 7K).

31. 31© 2019 CONFIDENTIAL
SOME SHORT QUESTIONS
• Those who don't study AppSec are
doomed to be hacked. Those who do
study AppSec are doomed to watch
helplessly while everyone else were
hacked.

32. 32© 2019 CONFIDENTIAL
THANK YOU
Alex Ong, ongbp@onet.sg, +6017-3180163