Application Security

APPLICATION SECURITY

Jerry Grugin

 

The weak link to security in an organization is the end user.  Most all of us are end users.  In this blog, we will look at several key areas of application security.  We will look at the most majorly vulnerable areas.  We will look at mitigation strategies against some of these vulnerabilities.  Some of the things we will look at include:  Active X, Java, Scripting, Cookies, XSS, Buffer Overflows, SMTP Open Relays, P2P File Sharing, Instant Messaging, and Phishing.  This is not an all encompassing list, but it is an important list to know, especially if taking the security + examination.

Active X

Active X security is a Microsoft technology that has been implemented in its browsers for several years now.  Active X presents what is called controls, scriplets, or applets which allows you to customize the web experience.  Active X extends and enhances the web experience beyond just basic HTML.  It allows you to customize controls, icons, and features.  Active X runs on the client side and it has historically been a huge vulnerability in internet explorer.  However, IE v.7 has what is called Active X opt in.  Anyone who is designing Active X controls should follow Microsoft guidelines for secure design principles.  The technology or method that Microsoft uses for security is called Authenticode.  Authenticode leverages certificate technology that allow active X components to be validated by certificate servers.  You should not automatically accept Active X controls.  If you automatically accept all Active X controls, you run the risk of accepting Active X that has embedded malicious code which can exploit vulnerabilities on a system.  Thus, in summary, Active X has four key components:

• Enhances web experience
• Huge vulnerability in I. E.
• Should follow secure design principles
• I.E. 7 has Active X opt in

JAVA

JAVA is a full-blown programming language.  It is a full program of applications.  It includes things like the JAVA virtual machine, the JAVA run-time environment.  For our purposes, we are concerned with JAVA Applets, which are small chunks of code which can be run on embedded devices, mobile phones, and web browsers to provide improved functionality when browsing the world wide web.  Remember the following things about JAVA:

• A platform or related products from SUN written in JAVA programming language
• Clients have to download the JAVA runtime environment (JRE)
• JAVA applets are downloaded to clients and run in a "safe" sandbox
• Attackers create or exploit unsafe JAVA applets

Scripting

Active X controls can be written through script.  There is also JAVA script in addition to other kinds of script.  Scripts are small chunks of code or applets that deliver functionality.  A script is not a full blown application or a full blown program.  It provides extended functionality to a program or application.  Remember the following:  CGI scripts can be problematic.  They present security holes.  They might intentionally or unintentionally leak information about a client system

XSS (Cross-Site Scripting)

Cross site scripting is one of the most popular categories of exploitation found on the internet.

• XSS is accountable for over 80% of documented security vulnerabilities.
• It allows code injections into web pages
• Also does phishing attacks / browser exploitation
• Attack is often transparent to users
• XSS written in several languages
• There have been many XSS attacks since the 1990s
• DOM-based, persistent, non-persistent

Buffer Overflows

• Second most popular client attack
• APP receives more data than expected
• Program terminates or writes beyond
• May leave system vulnerable
• Program errors or malicious code
• Code Red & SQL Slammer Worms

SMTP Open Relays

• An SMTP email server that permits third-party relay of e-mail messages
• A.K.A. third party relay or insecure relay
• Malicious senders can send large volumes of spam
• Sever owner, web misconfigurations, is often unaware
• Can lead to system crashes, equipment damage, and loss of business
• M.A.P.S is now owned by TrendMicro

P2P File Sharing

• A good rule --- just don't use P2P. 

Instant Messaging Threats

• Instant messaging is a threat to productivity
• Instant messaging sends information in clear-text.  Therefore, it is a threat to security.

Phishing

Beware of look-alike websites that mimic the real websites.  People send other people emails using links to fake websites that look like real companies such as ebay, DirecTV, or other popular websites.  They bait people into giving information such as credit card numbers, addresses, phone numbers, bank account numbers, telephone numbers, etc, etc.

Conclusion

In this blog, we have looked at several areas of application security to include the following:  ActiveX, JAVA, Scripting, Cookies, XSS, Buffer Overflows, SMTP Open Relays, P2P File Sharing, Instant Messaging, and Phishing.  Hope the information provided in this blog has been helpful.