Me, My Raspberry Pi and I

In this post, I would like to share my raspberry experiment. I don't want to write another post of "How to do <this> with raspberry pi", but instead, share my experience. First of all:

What is Raspberry Pi?

From Raspberry Pi's FAQ:

The Raspberry Pi is a credit-card sized computer that plugs into your TV and a keyboard. It’s a capable little PC which can be used for many of the things that your desktop PC does, like spreadsheets, word-processing and games. It also plays high-definition video. We want to see it being used by kids all over the world to learn programming.

Raspberry Pi and I

I totally agree with the FAQ's definition! And I would recommend to all parents who are PC "aware" to buy a RP for their children!

My history with RP was quite long! I had been thinking of buying a RP a long time ago. But, I have a drawback (apart from my noumerous advantages of my character! :P); if I want something badly, I want it at the same time! Therefore, I wanted to buy a RP and didn't want to wait about 3 weeks, so I ordered from ebay. Unfortunately, I had bad luck. I ordered Friday and Saturday (as far as I can remember), it was announced that RP new releases would come with 512MB RAM instead of 256MB. All customers who had order from the authorized resellers they would get the 512MB version without any extra cost. But I had ordered from ebay!... So, no luck!... Nevertheless, I didn't get disappointed.

My "Project Plan"

My experiment with RP was to create a RP to host the following:

• VPN server
• Torrent downloader
• TOR proxy
• Syslog
• Dropbox uploader
• File Server
• (I hope the list will grow!)

Getting Started

I will skip the first steps because they are well documented at RP's site here!

Initially I had an SD with 8GB RAM but unfortunatelly it was declared dead.... So, I bought a 16GB SD, class 10! :)

First steps

I will start from the classics. Change the default password and throught raspi-config, extend file system to occupy the whole SD card and enable SSH. You will need it some time!

One of the classic security basics is to change your password! Through raspi-config, change the timezone and the keyboard. Another way to do this is to edit XKBLAYOUT and set it to "us" at /etc/default/keyboard.

Update your RP

In order to keep my RP distro up to date I used RPi update. You can get it by doing the following:

> sudo apt-get install git-core

> https://github.com/Hexxeh/rpi-update

Copy it to a cron directory, according to your needs (I have copied to the cron.weekly for example).

VPN Server

I have set up a VPN server in order to get connected to website & services over unsecured WIFIs. I have used this useful guide to set it up!

Torrent Box

I use bittornado client. Generally, you can use apt-get command and install your preferable torrent client software. Here you can find a guide for installing trasmission on your RP!

TOR Proxy

TOR project is an open network which you can use in order to tunnel your requests through many proxies all over the Internet. The purpose of the project is to provide its user anonymity. Here you can find information regarding TOR project.

The installation on my RP was quite simple. Issue the command:

apt-get install tor

and your RP is hosting your TOR proxy. Now you must alter your proxy settings on your browser in order to route all your requests through the TOR software. A very nice firefox add-on is QuickProxy!

Syslog

I also use syslog service of my RP to gather all logs from my network devices. You have to un-comment the following lines from /etc/rsyslog.conf:

$ModLoad imudp

$UDPServerRun 514

and instruct the network devices to use your RP as a syslog server!

Dropbox uploader

One of my first thoughts with RP was to upload files to dropbox through RP in order to take advantage of RP's low consumption. Moreover, it won't be necessary to have my macbook powered on in order to upload large files!

I found a useful script which uploads files to Dropbox with a Bash script. It's very useful and easy to install and use! You can find it here.

File Server

My RP is always ON! So why not share some files? For example some photos? So, I created a user, installed samba and voilá; my photos are shared on my home network. I used the following sequence:

#Install samba
> apt-get install samba samba-common-bin
#Created a user
> adduser <username>
#Set user samba password
smbpasswd -a <username>
#Added the following lines in /etc/samba/smb.conf:
[Photos]
comment = Photos Folder
path = <path here>
writable = no
guest ok = no
#Restart Samba Service
> /etc/init.d/samba restart

Now, the path entered in Samba.conf file is being shared over the network!

Iptables 

Last but not least, you need to setup a firewall. Iptables is a fine solution. If your RP is exposed to the Internet, it would be wiser if you configure your iptables. Here is some of fine guided I have used to write my iptables:

http://www.cyberciti.biz/tips/linux-iptables-examples.html

http://www.garron.me/linux/iptables-manual.html

http://www.thegeekstuff.com/2011/06/iptables-rules-examples/ 

Sum-up

My adventure with the RP does not end here. I experiment a lot with my RP and currently I am working on the project Kali Linux on RP, so stay tuned!

Further Reading

1. Raspberry Pi FAQ
2. Buy Raspberry Pi from Farnell or RS.
3. RPi Tutorials list.

Intellectual Property and Code of Ethics 001

As you may have noticed, I have watermarked every picture embedded in my blog posts. I had a recent plagiarism incident where my whole post was copied and integrated to somebody's blog and there was no citation to it apart from a link at the end of this blog post.

I would like to mention in this post that the information I write to my blog is free for everyone to share. But, the initial source of this information should be mentioned following the academic ethics. I am sure that the majority of infosec professionals had an academic education and therefore written some kind of dissertation according to some official rule set. For example in my MSc we have the following rules.

After a long search over the Internet I found a document under the name "Data Citation Best Practice Discussion Document" which can be found here.
It is a nice reference for all of us who do use references in our blog posts and we don't copy them without respecting the work of our colleague.

I am free to discuss this subject and of course, eager to hear any different point of view.

CISSP Study Notes

It has been a while when I passed my CISSP exam. I don't think that an introduction is needed to describe the CISSP exam; it is well known how important is for an Information Security professional.

Because of some "tidiness projects" I have taken over in my house, I found my lost CISSP study material! However, I found that my notes were a little bit destroyed in their upper parts, but they are still readable.

I decided to "digitize" them and share them with Information Security community. My main study resource was Shon Harris' All-in-One-Exam Guide (all times classic!) and therefore any page reference found in my notes, is referred to this book.

Please note that -as every personal notes- my notes are not perfect. What is more, they focus on domains that I needed -or wanted?- to focus more. There sure will have mistakes on them too! So, I don't want to take this as a disclaimer, but use at your own risk! :P

I suggest you to use them -if you wish- as an auxiliary material, and of course I need your feedback! If I have a mistake or any kind of misinterpretation on them, I would be grateful if you could share it with me.

 

Good luck with your exams!

 

Notes link: http://dl.dropbox.com/u/75624475/CISSP.zip

Data Loss Prevention: A competitive advantage for today's businesses

First of all I would like to wish to all my readers a happy new year! I wish to all of you the best and may the 2013 be a landmark - year for the mankind!

After a couple of weeks of processing, finally I have managed to publish the following article! I wanted to write an article regarding security solutions but with a different perspective; I would like to escape from the strict technical view and present them from management's point of view. Therefore, the current post has to do with the role of Data Loss Prevention (DLP) in Information Security Management (ISM) and how the DLP solutions help in Risk Management and in IT Compliance.

Introduction

Key terms: 

• What is Data Loss Prevention? 
• What is Information Security Management? 
• What is Risk Management?

From the ancient years, information was one of the most, or perhaps the most valuable thing that one possesses. Its significance can be evaluated by the way and care people handle it over the years. Wars can have a different turnover only with the possession of some valuable information. Nowadays, the nature of the information has changed and has become more digitized than ever.  Credit cards, health records, nuclear missiles launch codes, military schematics, promising technical patents are some examples of how the nature of the information has changed. Moreover, the methods of stealing such information have changed as well; from the gangsters with guns entering a store in order to steal physical and tangible objects, to people sitting in front of a computer with an Internet connection. Therefore, the attack vector has changed. It has become even more complicated and even larger than it used to be. Some years ago, a couple of locks, a big fence and a large, cement wall were sufficient in order to keep your information safe. On the contrary, these days you need hardware and a hypervisor with a couple of virtual machines running sophisticated security software in order to provide surveillance of  the whole infrastructure through different security perspectives such as data leakage preventions, encryption, anti-virus protection etc..
Information security is a necessity for all organizations nowadays, not just because they have to comply with industry standards, but because of the need to protect their information, their assets and their infrastructure. Investing on the right policies and procedures is the equivalent of a health insurance; you pay a very small percent in order to prevent a bigger loss in the near future.

During my research for an definition for Data Loss Prevention (DLP), I found numerous entries defining DLP as a "system" or "software". But, I would like to present a different definition and a point of view for DLP; I could say that DLP is a strategy, a mentality. DLP is a complete planning of preventing sensitive information from leaving the corporate network. It should not be just a DLP software solution; all deployed IT solutions should cooperate in order to implement a DLP strategy and mentality on our organisation. For example, endpoint protection software, email gateways, endpoint encryption software, all of them can work to enforce, along with DLP solution, the organisation's policy regarding the prevention of data leakage. 

The following key term is Information Security Management, which is a superset of Information Risk Management. According to the wikipedia article [1]:

"Information security management (ISM) describes controls that an organization needs to implement to ensure that it is sensibly managing these risks."

Information Risk Management (IRM) is a integral part of Information Security Management. One of my favourite definitions is the following:

 "Information Risk Management is the process of identifying and assessing risk, reducing it to an acceptable level, and implementing the right mechanisms to maintain that level". [2]

Let's break down and explain in details the above key terms.

Overview of DLP solution

Without ignoring my previous statement that DLP is something more than a software enablement solution and a mentality that should be implemented on many points of our infrastructure and cultivated among the employees, I would like to present the architecture of a DLP solution and its key features with a top-down approach. 

DLP solutions are designed to provide the following features:

• Manage

DLP is managed through a user friendly but very detailed web interface. Throughout that interface numerous features are offered such as administration, view only, approve functions for releasing information, etc. Policies are configured and fine-tuned as well by this interface.

• Discover

This key feature discovers the sensitive information, with the expertise of the consultants implementing the solution and with the help of the management and of the IT department, the sensitive information is  found and its classified by the DLP.

• Monitor

Monitor feature understands the flow of the sensitive information. It monitors the information in any format, protocol or port.

• Protect / Prevent

This is the last phase of DLP; when the policies are being enforced. The prevention policies are being enforced on every boundaries of your corporate network. This can be email, web, instant messaging, etc.

Below you can see a very simplistic diagram of a DLP implementation:

In this simplistic implementation, the key roles are awarded according to the following:

• Network Monitor: Monitors the flow of the sensitive data.
• Network Prevent: Enforces the policies applied.
• Endpoint Discover: Discovers sensitive data on endpoints (laptops, desktop).
• Endpoint Prevent: Detects and prevents sensitive data from leaving the endpoint.

Dealing with the Risk 

What is at stake?

As I mentioned at the beginning of my article, it 's all about information; sensitive information. Therefore, its loss could cause massive loss to a business. It could be from a credit card loss (failing to comply with industry standards, for example), to an industrial pattern. Industrial espionage attempts are also common nowadays. Moreover, frustrated employees are also a risk. In many countries, Labour Law mandates that an employee has to be warned some days/months later if he is about to get fired. Those employees can be a potential risk to a business because they might think to leak some sensitive data they handle in order to cause harm to the organisation that is firing them. DLP implementations address those risks.
What is more, on large organisations help identify business processes leaking confidential data. For example, a secretary sending a corporate document at her gmail account in order to work from her home computer. These practices and behaviours are monitored, identified and addresses by DLP implementations.
Last but not least, a DLP solution could help implement ISM procedures and policies all over the organisation and provide the necessary data to the management regarding the internal (and external where applicable) compliance policies.

Achieving Compliance through DLP

For many industry standards, information leakage prevention is a requirement in order to get certified and comply with them.

Let's present an example; PCI/DSS is one of the most common standards in the bank industry.

The keystone is the PCI Data Security Standard (PCI DSS), which provides an actionable framework for developing a robust payment card data security process -- including prevention, detection and appropriate reaction to security incidents. [3]

Below, I have gathered a sample of PCI/DSS requirements that a DLP help in order to achieve them:

• 3.5: Protect cryptographic keys used for encryption of cardholder data against both disclosure and misuse.
• 4.2: Never send unencrypted PANs by email.
• 6.3.4: Production data (live PANs) are not used for testing and development.
• 7.1: Limit access to system components and cardholder data to only those individuals whose job requires such access.
• 10: Track and monitor all access to network resources and cardholder data.

It is apparent therefore that a DLP not only manages the risk arrousing from handling sensitive information but also helps the organisation comply with many industry standards.

Conclusion

With the current article, I wanted to present the DLP solution and highlight its benefits for management.
I am looking forward to your comments! Thank you!

Further Reading

Wikipedia

Data Loss Prevention SANS
Prevent Data loss and comply with PCI/DSS security standards

References

1. Wikipedia

2. All in One CISSP, Shon Harris
3. PCI SSC Data Security Standards Overview 

Code Reviewing in Software Development Lifecycle

Overview

Software vulnerabilities is a reality in today's world. Every day we can read news in Information Security magazines and websites reporting a zero-day vulnerability. Software vulnerabilities occur due to numerous reasons, but the most significant are: lack of security awareness of developers and deadline pressure. Lack in awareness of security issues is usually depicted in some statements such as: "We will not get hacked", "Our services reside on internal network", "We trust our internal users (eg employees, partners)", "We have a very expensive web application firewall (waf) protecting us", etc. But nowadays, when industrial espionage is a reality, trust can cost money and reputation.

 

Code review generally is the process when examining the source code of an application for vulnerabilities. It is a necessity in order to develop secure software and contributes in the Software Development Life Cycle (SDLC). We can examine one of the most famous SDLC guide providing guidelines in developing secure software: Microsoft Security Development Lifecycle (SDL).

 

Security flavour in SDL

The phases of Microsoft SDL:

 

 

Security is integrated in almost all phases. Further details can be found on SDL's website.

Code review resides mainly in "Verification" phase. In SDL website, Microsoft provides a list of tools for code reviewing, but in this current article I am going to present a demo of Yasca, an open source code review tool.

 

Yasca

From Yasca website:

"Yasca is a source code analysis tool that I started writing in 2007. It could best be described as a "glorified grep script" plus an aggregator of other open-source tools.
Yasca can scan source code written in Java, C/C++, HTML, JavaScript, ASP, ColdFusion, PHP, COBOL, .NET, and other languages."
 

The main advantage of Yasca is that collaborates perfectly with a wide list of static code review tools such as: FindBugs, PMD, JLint, JavaScript Lint, PHPLint, CppCheck, ClamAV, RATS, Pixy.

Personally, I have installed Yasca in a Windows 7 Ultimate and works perfectly in command line, whereas I have abandoned the installation in Backtrack 5 R3 because of numerous errors.

 

Demo

I extracted the vulnerable code (guess from where?! Of course from OWASP broken web applications VM where there is a tone of vulnerable code just waiting to be hacked!). The vulnerable code is from WebGoat web application found on the path:

/owaspbwa/WebGoat-svn/src/main/java/org/owasp/webgoat/lessons
 

Here is a sample of Yasca's report:

 

 

 

Wrap-up

Code review should be included in every software deployment project. It is an essential safeguard in order to produce secure software and minimize the risk from potential vulnerabilities. Besides, we should always apply security techniques in every layer of our web application (code review, web application firewall, access control, etc).

 

  

Further reading

The Owasp Code Review Top 9 :: https://www.owasp.org/index.php/The_Owasp_Code_Review_Top_9

OWASP Code Review Guide :: https://www.owasp.org/index.php/OWASP_Code_Review_Guide_Table_of_Contents

The Ten Best Practices for Secure Software Development :: https://www.isc2.org/uploadedFiles/(ISC)2_Public_Content/Certification_Programs/CSSLP/ISC2_WPIV.pdf

US Homeland Security Secure SDL :: https://buildsecurityin.us-cert.gov/bsi/articles/knowledge/sdlc/326-BSI.html

SANS Secure SDL and Code Analysis Tools :: http://www.sans.org/reading_room/whitepapers/securecode/secure-software-development-code-analysis-tools_389

 

Setting up a ModSecurity powered Reverse Proxy

Overview

Following the series of my ModSecurity related posts, in this one, I explain how we can set up a reverse proxy that will process all the requests received by any browser and then forward them to the web applications we want to protect. This reverse proxy will be an autonomous VM that is very flexible to deploy in front of numerous web applications. For example, we can write generic ModSecurity rules and then we can copy and apply the VM to multiple places in order to process the requests. Afterwards, we can parameterize each VM according to the application that resides behind it.

Infrastructure

I used the following VMs for this demo:

• Debian 6 64-bit (2 processors, 1024MB RAM), acting as reverse proxy with ModSecurity 2.5.12. Installed Apache version: 2.2.16.
• OWASP Broken Web Applications VM. Just the guarenteed solution! Download it here.
• Windows XP Pro with Hacme bank vulnerable web application installed. Installation instructions can be found here.

My aim is to create a reverse proxy that handles more than one web application's requests.

Below, there is a schematic of the VM infrastructure that I have described earlier.

Architecture

Advantages

• Unified Rules. With this architecture we have a VM that is charged with filtering every HTTP request to our web applications and therefore, we can edit the rules and parameterize it in order to filter possibly malicious requests. Core rule sets can be used in order to have a generic protection and, on the meanwhile, we can paramiterize the rules for specific fields and functions of our web applications.
• Network Security. The security of our network becomes more robust and solid. The web applications are isolated, they receive only HTTP request from the reverse proxy.
• Cost Free! I have used only freeware software, no money are needed for this architecture and infrastracture.

Disadvantages

• Time Consuming. ModSecurity needs dedicated professionals in order to write rules and parameterize the product.
• Single point of Failure. ModSecurity VM is a single point of failure, meaning that if VM is down, the web applications will be unavailable and unaccessible.

Configuration

First of all, we need to install ModSecurity at our Debian VM which will be acting as a reverse proxy. Then we enable it and then we download the OWASP Core Rule Set which can be found here.

More specifically, we follow these steps:

€ > apt-get install libapache-mod-security
€ > a2enmod mod-security

Now, we need to set up the reverse proxy. We create a file at the location /etc/apache2/sites-available and we enable it by creating a soft link to it a the location /etc/apache2/sites-enabled. Below you can see a sample site. This is only a sample, you can parameterize it and customize it as you wish.

LoadModule proxy_module /usr/lib/apache2/modules/mod_proxy.so
LoadModule proxy_http_module /usr/lib/apache2/modules/mod_proxy_http.so
<IfModule security2_module>
        Include /etc/apache2/crs/activated_rules/*.conf
</IfModule>
<VirtualHost *:80>
        ServerName modsecurity
        ProxyRequests Off
        ProxyPass               /HacmeBank_v2_Website/  http://192.168.200.15/HacmeBank_v2_Website/
        ProxyPassReverse        /HacmeBank_v2_Website/  http://192.168.200.15/HacmeBank_v2_Website/
        ProxyPass               /owaspbwa/      http://192.168.200.12/
        ProxyPassReverse        /owaspbwa/      http://192.168.200.12/
</VirtualHost>

Now, every request to the web applications is examined by ModSecurity and then, proxied to the appropriate IP inside our LAN.

Example

I am going to omit a demo attack to the OWASP BWA VM because I have already examined it on a previous post in my blog. Therefore, the scenario I am going to follow, is to send a simple SQL injection payload to the Hacme Bank web application.

The logs generated by ModSecurity:

--84b6cd1e-A--
[09/Nov/2012:15:19:50 +0200] UJ0C9X8AAQEAAB0xAVcAAAAC 192.168.200.1 6177 192.168.200.18 80
--84b6cd1e-B--
POST /HacmeBank_v2_Website/aspx/login.aspx HTTP/1.1
Host: 192.168.200.18
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://192.168.200.18/HacmeBank_v2_Website/aspx/login.aspx
Cookie: PHPSESSID=saafok2s1qn7tkf1ln7800isg3; ASP.NET_SessionId=tgsda3mibmrqgluhkzms4u55; CookieLoginAttempts=5
Content-Type: application/x-www-form-urlencoded
Content-Length: 120
--84b6cd1e-C--
__VIEWSTATE=dDwtNDI1MDU4NDs7Pr7Z3yoqTxmFlpDLZYX86TQOF%2Fbz&txtUserName=x%27+or+1%3D1--&txtPassword=test&btnSubmit=Submit
--84b6cd1e-F--

And the log that activated the ModSecurity rule:

Message: Warning. Pattern match "(?i:([\s'"`Β΄ββ\(\)]*)?([\d\w]+)([\s'"`Β΄ββ\(\)]*)?(?:=|<=>|r?like|sounds\s+like|regexp)([\s'"`Β΄ββ\(\)]*)?\2|([\s'"`Β΄ββ\(\)]*)?([\d\w]+)([\s'"`Β΄ββ\(\)]*)?(?:!=|<=|>=|<>|<|>|\^|is\s+not|not\s+like|not\s+regexp)([\s'"`Β΄ββ\(\)] ..." at ARGS:txtUserName. [file "/etc/apache2/crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "77"] [id "950901"] [rev "2.2.5"] [msg "SQL Injection Attack"] [data " 1=1"] [severity "CRITICAL"] [tag "WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"]
Message: Warning. Pattern match "(?i:\bor\b ?(?:\d{1,10}|[\'"][^=]{1,10}[\'"]) ?[=<>]+|(?i:'\s+x?or\s+.{1,20}[+\-!<>=])|\b(?i:x?or)\b\s+(\d{1,10}|'[^=]{1,10}')|\b(?i:x?or)\b\s+(\d{1,10}|'[^=]{1,10}')\s*[=<>])" at ARGS:txtUserName. [file "/etc/apache2/crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "134"] [id "959071"] [rev "2.2.5"] [msg "SQL Injection Attack"] [data "' or 1=1--"] [severity "CRITICAL"] [tag "WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"]
Message: Warning. Pattern match "([\~\!\@\#\$\%\^\&\*\(\)\-\+\=\{\}\[\]\|\:\;"\'\Β΄\β\β\`\<\>].*){4,}" at ARGS:txtUserName. [file "/etc/apache2/crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "171"] [id "981173"] [rev "2.2.5"] [msg "Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded"] [data "-"]
Message: Warning. Pattern match "(?i:(?i:\d["'`Β΄ββ]\s+["'`Β΄ββ]\s+\d)|(?:^admin\s*?["'`Β΄ββ]|(\/\*)+["'`Β΄ββ]+\s?(?:--|#|\/\*|{)?)|(?:["'`Β΄ββ]\s*?(x?or|div|like|between|and)[\w\s-]+\s*?[+<>=(),-]\s*?[\d"'`Β΄ββ])|(?:["'`Β΄ββ]\s*?[^\w\s]?=\s*?["'`Β΄ββ]) ..." at ARGS:txtUserName. [file "/etc/apache2/crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "217"] [id "981244"] [msg "Detects basic SQL authentication bypass attempts 1/3"] [data "' or 1=1"] [severity "CRITICAL"] [tag "WEB_ATTACK/SQLI"]
Message: Warning. Pattern match "(?i:(?:["'`Β΄ββ]\s*?(x?or|div|like|between|and)\s*?["'`Β΄ββ]?\d)|(?:\\x(?:23|27|3d))|(?:^.?["'`Β΄ββ]$)|(?:(?:^["'`Β΄ββ\\]*?(?:[\d"'`Β΄ββ]+|[^"'`Β΄ββ]+["'`Β΄ββ]))+\s*?(?:n?and|x?x?or|div|like|between|and|not|\|\||\&\&)\s*?[\w ..." at ARGS:txtUserName. [file "/etc/apache2/crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "249"] [id "981242"] [msg "Detects classic SQL injection probings 1/2"] [data "' or 1"] [severity "CRITICAL"] [tag "WEB_ATTACK/SQLI"]
Apache-Handler: proxy-server
Stopwatch: 1352467189580612 738276 (1537* 9311 -)
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.5.12 (http://www.modsecurity.org/); core ruleset/2.1.2.
Server: Apache/2.2.16 (Debian)
--84b6cd1e-Z--

Conclusion

A reverse proxy running ModSecurity can be used to protect server farms that host critical web applications. This architecture is a low cost that could offer significant security protection if ModSecurity is parameterized correctly.

References - Further reading

http://httpd.apache.org/docs/2.2/mod/mod_proxy.html

http://www.ibm.com/developerworks/web/library/wa-lampsec/

http://www.apachetutor.org/admin/reverseproxies

http://www.f5.com/glossary/reverse-proxy.html

http://en.wikipedia.org/wiki/Reverse_proxy

Securing OWASP Broken Web Apps with ModSecurity

Overview

In this blog entry I am going to secure the Apache deployed in OWASP broken web apps VM with Trustwave's ModSecurity. OWASP broken web apps VM comes with ModSecurity integrated. The only thing we have to do, is to enable it.

The main goal for this post, is to help IT professionals enable ModSecurity, an open source waf, and then, get acquainted with it.

Enabling ModSecurity Module

ModSecurity module is not enabled by default in OWASP broken web apps VM. Some actions are needed by our side in order to make the module functional.

First of all we need to shutdown Apache server:

/etc/init.d/apache2 stop

We need to edit httpd.conf located at  /etc/apache2 and add the following lines:

<IfModule security2_module>
        Include /etc/apache2/modsecurity-crs/activated_rules/*.conf
</IfModule>

Create soft links of the rules we want to activate to the activated rules folder. In our example we are going to copy the whole base rule set by issuing the command:

ln -s /etc/apache2/modsecurity-crs/base_rules/* /etc/apache2/modsecurity-crs/activated_rules/
ln -s /etc/apache2/modsecurity_crs_10_config_log.conf /etc/apache2/modsecurity-crs/activated_rules/ (for the log settings)

Next, we have to edit modsecurity_crs_10_config_log.conf in order to parameterize the loggin engine.

• If we need the ModSecurity waf to block the requests that violate any of the activated rules we have to alter the directive "SecRuleEngine" from "DetectionOnly" to "On".
• Change the directive "SecDefaultAction" to "phase:2,deny,nolog,auditlog" in order to log at at a different file.
• At the end of the file, un-comment the directive "SecAuditEngine" and if you wish, alter the log file location and name by changing the value at the "SecAuditLog" directive.

Finally, we start Apache server:

/etc/init.d/apache2 start

Now, ModSecurity is fully operational and logs every rule violation.

Attack Example

At this point, we send a simple SQL payload in order to test ModSecurity rules:

The ModSecurity logs are populated by the module. Here we can see the logs generated after our request:

Message: Rule b853e718 [id "950901"][file "/etc/apache2/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"][line "77"] - Execution error - PCRE limits exceeded (-8): (null).
Message: Rule b853e718 [id "950901"][file "/etc/apache2/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"][line "77"] - Execution error - PCRE limits exceeded (-8): (null).
Message: Pattern match "(?i:([\\s'\"`\xc2\xb4\xe2\x80\x99\xe2\x80\x98\\(\\)]*)?([\\d\\w]+)([\\s'\"`\xc2\xb4\xe2\x80\x99\xe2\x80\x98\\(\\)]*)?(?:=|<=>|r?like|sounds\\s+like|regexp)([\\s'\"`\xc2\xb4\xe2\x80\x99\xe2\x80\x98\\(\\)]*)?\\2|([\\s'\"`\xc2\xb4\xe2\x80\x99\xe2\x80\x98\ ..." at ARGS:id. [file "/etc/apache2/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "77"] [id "950901"] [rev "2.2.5"] [msg "SQL Injection Attack"] [data " 1=1"] [severity "CRITICAL"] [tag "WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"]
Message: Pattern match "(?i:\\bor\\b ?(?:\\d{1,10}|[\\'\"][^=]{1,10}[\\'\"]) ?[=<>]+|(?i:'\\s+x?or\\s+.{1,20}[+\\-!<>=])|\\b(?i:x?or)\\b\\s+(\\d{1,10}|'[^=]{1,10}')|\\b(?i:x?or)\\b\\s+(\\d{1,10}|'[^=]{1,10}')\\s*[=<>])" at ARGS:id. [file "/etc/apache2/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "134"] [id "959071"] [rev "2.2.5"] [msg "SQL Injection Attack"] [data "' or 1=1--"] [severity "CRITICAL"] [tag "WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"]
Message: Pattern match "([\\~\\!\\@\\#\\$\\%\\^\\&\\*\\(\\)\\-\\+\\=\\{\\}\\[\\]\\|\\:\\;\"\\'\\\xc2\xb4\\\xe2\x80\x99\\\xe2\x80\x98\\`\\<\\>].*){4,}" at ARGS:id. [file "/etc/apache2/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "171"] [id "981173"] [rev "2.2.5"] [msg "Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded"] [data "-"]
Message: Pattern match "(?i:(?i:\\d[\"'`\xc2\xb4\xe2\x80\x99\xe2\x80\x98]\\s+[\"'`\xc2\xb4\xe2\x80\x99\xe2\x80\x98]\\s+\\d)|(?:^admin\\s*?[\"'`\xc2\xb4\xe2\x80\x99\xe2\x80\x98]|(\\/\\*)+[\"'`\xc2\xb4\xe2\x80\x99\xe2\x80\x98]+\\s?(?:--|#|\\/\\*|{)?)|(?:[\"'`\xc2\xb4\xe2\x80\x9 ..." at ARGS:id. [file "/etc/apache2/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "217"] [id "981244"] [msg "Detects basic SQL authentication bypass attempts 1/3"] [data "' or 1=1"] [severity "CRITICAL"] [tag "WEB_ATTACK/SQLI"]
Message: Pattern match "(?i:(?:[\"'`\xc2\xb4\xe2\x80\x99\xe2\x80\x98]\\s*?(x?or|div|like|between|and)\\s*?[\"'`\xc2\xb4\xe2\x80\x99\xe2\x80\x98]?\\d)|(?:\\\\x(?:23|27|3d))|(?:^.?[\"'`\xc2\xb4\xe2\x80\x99\xe2\x80\x98]$)|(?:(?:^[\"'`\xc2\xb4\xe2\x80\x99\xe2\x80\x98\\\\]*?(?:[\\ ..." at ARGS:id. [file "/etc/apache2/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "249"] [id "981242"] [msg "Detects classic SQL injection probings 1/2"] [data "' or 1"] [severity "CRITICAL"] [tag "WEB_ATTACK/SQLI"]
Message: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/modsecurity-crs/activated_rules/modsecurity_crs_60_correlation.conf"] [line "37"] [id "981204"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 23, SQLi=13, XSS=): 981242-Detects classic SQL injection probings 1/2"]
Apache-Handler: application/x-httpd-php
Stopwatch: 1352206441253338 16368 (- - -)
Stopwatch2: 1352206441253338 16368; combined=11385, p1=165, p2=10807, p3=3, p4=91, p5=318, sr=20, sw=1, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.7.0trunk (http://www.modsecurity.org/); core ruleset/2.1.2.
Server: Apache/2.2.14 (Ubuntu) mod_mono/2.4.3 PHP/5.3.2-1ubuntu4.5 with Suhosin-Patch mod_python/3.3.1 Python/2.6.5

Conclusion

By enabling ModSecurity in OWASP Broken web apps VM is a good hands-on opportunity for waf administrations to get used to configuring and parametrizing ModSecurity open source web application firewall.

References

https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#wiki-Installation_for_Apache

http://www.modsecurity.org/documentation/modsecurity-apache/1.9.3/html-multipage/07-logging.html