Aon Plc · NYSE:AON
Aon — Technical Presentation (2009)
53 slides from Aon's technical presentation, 2009
Slide 1: Protecting Vulnerable Applications with IIS7
Protecting Vulnerable Applications with IIS7 Brian Holyfield Source Boston 2009
Slide 2: Agenda
Agenda • Overview • IIS7 Integrated Mode • IIS7 Modules – Request Filtering Module – Add-on Modules (from Microsoft) – Custom Modules – Case Study: SPF 2
Slide 3: What’s new in IIS7
What’s new in IIS7 • Totally New Design – File-Based Configuration – Completely Modular – Integrated Pipeline Mode – Support for non-HTTP Services (WCF) • Built-In Security Features – Request Filtering – Minimal Default Attack Surface 3
Slide 4: IIS7 Integrated Mode
IIS7 Integrated Mode • Unified Request Processing Pipeline – Both native and managed components (modules) – Modules can be applied to all requests, regardless of handler – ASP.NET HttpModules now comparable to ISAPI (can hook into one or more IIS7 pipeline events) Integrated Pipeline + Modular Desig
Slide 5: IIS Pipeline Events
IIS Pipeline Events Pre-Execution Events Post-Execution Events •BeginRequest •PostRequestHandlerExecute •AuthenticateRequest •ReleaseRequestState •PostAuthenticateRequest •PostReleaseRequestState •AuthorizeRequest •UpdateRequestCache •PostAuthorizeRequest •PostUpdateRequestCache •ResolveRequestCache
Slide 6: Case Study: Sample Application
Case Study: Sample Application • Battle Blog Application – Free Open Source Blogging Software – Written in Classic ASP – Vulnerable to numerous common security issues • Failure to Restrict Admin URLs • Cross-Site Request Forgery • SQL Injection • Information Disclosure 6
Slide 7: IIS7 Request Filtering
IIS7 Request Filtering • Native Module (C++) – URLScan functionality built in to IIS7 – Called on BeginRequest Event • Effective for providing generic protection mechanism against certain attacks – Configurable for each application – Lacks granularity at the page/parameter level – No support for Reg
Slide 8: IIS7 Request Filtering
IIS7 Request Filtering Request Filtering Directive Description & Options allowDoubleEscaping Prevents Double-encoded Requests allowHighBitCharacters Allows or rejects all requests with non-ASCII characters fileExtensions Controls permitted file extensions • Uses allowUnlisted option to define defaul
Slide 9: IIS7 Add-On Modules
IIS7 Add-On Modules • The Microsoft IIS team is continually releasing new add-on modules for IIS7 • Some have potential security uses – Dynamic IP Restrictions – URL Rewrite – Application Request Routing 9
Slide 10: Dynamic IP Restrictions
Dynamic IP Restrictions • Dynamic IP Restrictions Extension – Dynamically blocking of requests from IP address based on • Number of concurrent requests • Number of requests over a period of time – Configurable at the Site or Server Level – Support for permanent static allow or deny list • Domain Nam
Slide 11: URL Rewriter for IIS7
URL Rewriter for IIS7 • IIS7 version of mod_rewrite – Called on BeginRequest event – Regular expression pattern matching – Access to server variables and HTTP headers – Rule actions include redirect and request abort • Not specifically designed for security, but can be used to block or validate cert
Slide 12: Case Study: Demo
Case Study: Demo • Demo: White List URLs with Rewrite Rules – Only allow requests to authorized files – Only allow valid query string values 12
Slide 13: Request Filter vs. URL Rewrite
Request Filter vs. URL Rewrite Request Entity Request Filtering URL Rewrite Scan requested URL path Yes (Substring) Yes (Regex) Check URL length Yes No Scan query string No Yes (Regex) Check query string length Yes No Check HTTP verbs Yes Yes Check request content length Yes No Scan HTTP headers No
Slide 14: Application Request Routing
Application Request Routing • Similar to mod_proxy – Can perform HTTP based routing decisions based on HTTP request data – Load balancing algorithms – Client and hostname affinity 14
Slide 15: Custom IIS7 Modules
Custom IIS7 Modules • With IIS7 modules, it is easy to monitor, change or add every request • ASP.NET modules can now be used to protect any application running on IIS – .NET class that implements the ASP.NET System.Web.IHttpModule interface 15
Slide 16: Extensibility Examples
Extensibility Examples • “Enhancing Applications with the IIS7 Integrated Pipeline” -- Mike Volodarsky - MSDN 2007 • Used IIS7 Managed Module to enhance QDig (PHP) – Authentication • FormsAuthenticationModule – Search Engine Friendly URLs • Inbound: Server.TransferRequest • Outbound: Response.Filter
Slide 17: Application Security Module
Application Security Module • Custom module to secure outbound data and validate inbound requests – Request/Response Parsing – Data Validation – Input tracking & Parameter Encryption • Defend Against Application Attacks – Known Bad Signatures – Intelligent Authorization Defense 17
Slide 18: Leveraging Response Events
Leveraging Response Events • Goal – Only allow the user do what the application expects them to be able to do • How – Analyze what is presented to the users (response) – If an option is not presented, don’t let them use it – If we don’t ask the user for input, don’t accept it! 18
Slide 19: Secure Parameter Filter (SPF)
Secure Parameter Filter (SPF) • IIS Secure Parameter Filter (SPF) – Protects Non-Editable Data from Manipulation • ASP.NET HttpModule (C#) • Does not require any changes to underling application – Response & Request Filter • Output Tracking • Request Validation – Free and available for download • ht
Slide 20: How it Works
How it Works • Response Filter – Analyzes HTML (HTML Agility Pack) • Embedded URLs • HTML Form Data • Cookies • JavaScript Functions – Tracks Form “State” • Editable vs. non-editable input – Correlates Forms & Links to each session 20
Slide 21: How it Works
How it Works • Request Filter – Analyzes HTTP requests to ensure only “authorized” URLs and inputs are accepted • User sessions are tracked with a unique ID – Only configured “entry points” are permitted without authorization – Inspect editable-data against configurable Regular Expressions (Black Li
Slide 22: SPF Pipeline Events
SPF Pipeline Events Pre-Execution Events Post-Execution Events •BeginRequest •PostRequestHandlerExecute •AuthenticateRequest •ReleaseRequestState •PostAuthenticateRequest •PostReleaseRequestState •AuthorizeRequest •UpdateRequestCache •PostAuthorizeRequest •PostUpdateRequestCache •ResolveRequestCache
Slide 23: Installing a Module
Installing a Module • IIS7 modules can be installed in of two ways – Configuration file (web.config) – IIS7 Management Console • Module must be registered globally • Custom Configuration Settings – Minimal Configuration – Configure default behavior & define exceptions to the default 23
Slide 24: Case Study: Demo
Case Study: Demo • Demo: Failure to Restrict URL Access – Application fails to restrict access to some administrator URLs – These URLs are not linked from un-authenticated pages • “Security through Obscurity” 24
Slide 25: URL Access Protection
URL Access Protection • Cryptographic “token” appended to every protected URL rendered to the user – Verifies integrity of Query String values – Verifies authorization to access page • Required for protected URL access USER APPLICATION SPF /ShowArticle.aspx?ArticleId=123 25
Slide 26: URL Access Protection
URL Access Protection • Cryptographic “token” appended to every protected URL rendered to the user – Verifies integrity of Query String values – Verifies authorization to access page • Required for protected URL access USER APPLICATION SPF /ShowArticle.aspx?ArticleId=123&UrlToken=182734:A7A9369D50B2
Slide 27: URL Access Protection
URL Access Protection • Cryptographic “token” appended to every protected URL rendered to the user – Verifies integrity of Query String values – Verifies authorization to access page • Required for protected URL access USER APPLICATION SPF /ShowArticle.aspx?ArticleId=123&UrlToken=182734:A7A9369D50B2
Slide 28: Case Study: Demo
Case Study: Demo • Demo: Cross-Site Request Forgery (CSRF) – Administrative user-management requests are vulnerable to CSRF • Add Users • Change Password • Elevate Privileges 28
Slide 29: CSRF Protection
CSRF Protection • The same cryptographic “token” automatically protects against CSRF exploits – Tied to session cookie & source IP SPF /ShowArticle.aspx?ArticleId=123&UrlToken=182734:A7A9369D50B2E185F54A SHA1HMAC ( URL + Query String + Time Stamp + Session Cookie + Source IP ) 29
Slide 30: Case Study: Demo
Case Study: Demo • Demo: SQL Injection – Website search filter is vulnerable to SQL Injection • Anonymously Accessible • Supports POST and GET 30
Slide 31: HTML Form Protection
HTML Form Protection Two Types of Protection – Form State Protection Ensures each form submission includes only the correct input name & value combinations – Input Value Protection Protects Inputs from being viewed by users Non-editable Form inputs cannot be altered – TYPE=HIDDEN | RADIO | CHECKBOX,
Slide 32: HTML Form Protection
HTML Form Protection Form State Information <form action= "/search.aspx"> <input type=“text" name="query"> <input type ="submit" name="find" value="FIND"> <input type ="hidden" name="src" value="web"> <input type ="radio" name="scope" value="world"> <input type ="radio" name="scope" value="us"> <inp
Slide 33: HTML Form Protection
HTML Form Protection Form State Information <form action= "/search.aspx"> Action: /search.aspx <input type=“text" name="query"> <input type ="submit" name="find" value="FIND"> <input type ="hidden" name="src" value="web"> <input type ="radio" name="scope" value="world"> <input type ="radio" name="sc
Slide 34: HTML Form Protection
HTML Form Protection Form State Information <form action= "/search.aspx"> Action: /search.aspx <input type=“text" name="query"> Owner: 25574bb9-792d-4c4b-9873-c9fae1631485 <input type ="submit" name="find" value="FIND"> (Session Cookie) <input type ="hidden" name="src" value="web"> <input type ="rad
Slide 35: HTML Form Protection
HTML Form Protection <form action= "/search.aspx"> Form State Information <input type ="hidden" name="FormToken" value= Action: /search.aspx "3F2504E0-4F89-11D3-9A0C-0305E82C3301"> Owner: 25574bb9-792d-4c4b-9873-c9fae1631485 Form-Id: 3F2504E0-4F89-11D3-9A0C- <input type=“text" name="query"> 0305E82C
Slide 36: HTML Form Protection
HTML Form Protection <form action= "/search.aspx"> Form State Information <input type ="hidden" name="FormToken" value= Action: /search.aspx "3F2504E0-4F89-11D3-9A0C-0305E82C3301"> Owner: 25574bb9-792d-4c4b-9873-c9fae1631485 Form-Id: 3F2504E0-4F89-11D3-9A0C- <input type=“text" name="query"> 0305E82C
Slide 37: HTML Form Protection
HTML Form Protection <form action= "/search.aspx"> Form State Information <input type ="hidden" name="FormToken" value= Action: /search.aspx "3F2504E0-4F89-11D3-9A0C-0305E82C3301"> Owner: 25574bb9-792d-4c4b-9873-c9fae1631485 Form-Id: 3F2504E0-4F89-11D3-9A0C- <input type=“text" name="query"> 0305E82C
Slide 38: Case Study: Demo
Case Study: Demo • Demo: Information Disclosure – The comment submission CAPTCHA value is disclosed within a hidden HTML form field 38
Slide 39: JavaScript Protection
JavaScript Protection • Quoted string assignment to common JavaScript property values are treated as URLs (UrlToken) – window.location – location.href • JS Functions can also be defined for protection – Function Name & Arguments • Protect (Y/N) • URL / Form Input – INPUT NAME – TARGET URL 39
Slide 40: JavaScript Protection
JavaScript Protection • Example JavaScript Function function __doPostBack(eventTarget, eventArgument) { if (!theForm.onsubmit || (theForm.onsubmit() != false)) { theForm.__EVENTTARGET.value = eventTarget; theForm.__EVENTARGUMENT.value = eventArgument; theForm.submit(); } } 40
Slide 41: JavaScript Protection
JavaScript Protection • Example JavaScript Function function __doPostBack(eventTarget, eventArgument) { if (!theForm.onsubmit || (theForm.onsubmit() != false)) { theForm.__EVENTTARGET.value = eventTarget; theForm.__EVENTARGUMENT.value = eventArgument; theForm.submit(); } } 41
Slide 42: JavaScript Protection
JavaScript Protection • Example JavaScript Function function __doPostBack(eventTarget, eventArgument) { if (!theForm.onsubmit || (theForm.onsubmit() != false)) { theForm.__EVENTTARGET.value = eventTarget; theForm.__EVENTARGUMENT.value = eventArgument; theForm.submit(); } } 42
Slide 43: JavaScript Protection
JavaScript Protection • Example JavaScript Function function __doPostBack(eventTarget, eventArgument) { if (!theForm.onsubmit || (theForm.onsubmit() != false)) { theForm.__EVENTTARGET.value = eventTarget; theForm.__EVENTARGUMENT.value = eventArgument; theForm.submit(); } } 43
Slide 44: JavaScript Protection
JavaScript Protection • Protecting this function with SPF <scriptProtection functionName="__doPostBack"> <functionArguments> <add argumentName="eventTarget" protect="true" targetName="__EVENTTARGET" /> <add argumentName="eventArgument" protect="true" targetName="__EVENTARGUMENT" /> </functionArgumen
Slide 45: JavaScript Protection
JavaScript Protection <a href="javascript:__doPostBack('ctl00$MainContent$gvwThreads' ,'Sort$LastPostDate')"> <a href="javascript:__doPostBack('b/xEVUeEDOCnhiKu0jS5USUs6N 4Qu1VH5OqHOwF146wSPlA87g==:1829384:61D26FD0849FF93D67B8489CF A76','b/xEVUeEDOBfdZR3UM0Ds212HDDwHY3KoYyc/+/JULiDcjQ=:1829384: 83BF
Slide 46: JavaScript Protection
JavaScript Protection <a href="javascript:__doPostBack('ctl00$MainContent$gvwThreads' ,'Sort$LastPostDate')"> <a href="javascript:__doPostBack('b/xEVUeEDOCnhiKu0jS5USUs6N 4Qu1VH5OqHOwF146wSPlA87g==:1829384:61D26FD0849FF93D67B8489CF A76','b/xEVUeEDOBfdZR3UM0Ds212HDDwHY3KoYyc/+/JULiDcjQ=:1829384: 83BF
Slide 47: JavaScript Protection
JavaScript Protection <a href="javascript:__doPostBack('ctl00$MainContent$gvwThreads' ,'Sort$LastPostDate')"> <a href="javascript:__doPostBack('b/xEVUeEDOCnhiKu0jS5USUs6N 4Qu1VH5OqHOwF146wSPlA87g==:1829384:61D26FD0849FF93D67B8489CF A76','b/xEVUeEDOBfdZR3UM0Ds212HDDwHY3KoYyc/+/JULiDcjQ=:1829384: 83BF
Slide 48: JavaScript Protection
JavaScript Protection <a href="javascript:__doPostBack('ctl00$MainContent$gvwThreads' ,'Sort$LastPostDate')"> <a href="javascript:__doPostBack('b/xEVUeEDOCnhiKu0jS5USUs6N 4Qu1VH5OqHOwF146wSPlA87g==:1829384:61D26FD0849FF93D67B8489CF A76','b/xEVUeEDOBfdZR3UM0Ds212HDDwHY3KoYyc/+/JULiDcjQ=:1829384: 83BF
Slide 49: Configuring SPF
Configuring SPF • Minimal Configuration (Exception Based) – Default Protection Settings (Required) • Protection Scope (URI, QueryStrings, Forms, Cookies) • Main Application Entry Point (URL) – Exceptions to Default Settings (Optional) • Global Exceptions (Form Inputs, Cookies) • URI Exceptions (URI,
Slide 50: OWASP Top 10 Coverage
OWASP Top 10 Coverage A1 - Cross Site Scripting (XSS) • Request tokens should thwart reflected XSS exploits A2 - Injection Flaws A3 - Malicious File Execution A4 - Insecure Direct Object Reference A5 - Cross Site Request Forgery (CSRF) • Request tokens provide CSRF protection A6 - Information Leakag
Slide 51: OWASP Top 10 Coverage
OWASP Top 10 Coverage A7 - Broken Authentication & Session Management • Cookie protection will mitigate weak/predictable session IDs A8 - Insecure Cryptographic Storage A9 - Insecure Communications A10 - Failure to Restrict URL Access • Request tokens prevent forced browsing 51
Slide 52: Conclusion
Conclusion • IIS7 is now more extensible than ever – Modules in native or managed code • Vulnerable legacy apps can be secured on IIS7 infrastructure – Built-in Features – Add-On Modules – Custom Modules Protecting Vulnerable Applications with IIS7 Source Boston 2009 52
Slide 53: Questions?
Questions? • GDS Blog – http://www.gdssecurity.com/l/b • SPF Download Page – http://www.gdssecurity.com/l/spf • SPF Demo Site (.NET StockTrader) – http://trade-spf.gdsdemo.com • Official Microsoft IIS Site – http://www.iis.net 53