Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Security Automation Pipeline

Matt Konda
January 14, 2016

Security Automation Pipeline

IJUG Meetup where we talked about security tools, where they fit in continuous delivery pipelines and how the OWASP pipeline tool can help.

Matt Konda

January 14, 2016
Tweet

More Decks by Matt Konda

Other Decks in Programming

Transcript

  1. Introduction 1997 2006 2014 Consultant Engineer Software Architect Director of

    Engineering Rabble Rouser: Perl Java Applet C++ J2EE J2EE
 Spring Analytics Certificate Authority Vulnerability Scanner Penetration Test Manager Pricing Retail Banking Manufacturing Pharma Healthcare Research Ruby Rails Chicago BSides 2011, 2012 Defcon Skytalk OWASP Chicago, MSP 2013 AppSec USA 2012, 2013 ChicagoRuby 2013 Secure 360 Lone Star Ruby 2013 WindyCityRails 2013 Chicago JUG 2014 RailsConf 2014 Converge 2014 Chicago Coder Conference 2015 MS in CS Founder Consultant Agile Clojure Graph Database Trying to hack a business model that succeeds while helping developers. Domains: Projects: DevOps / Automation Training Coaching Code Review Plugged in to SDLC Consulting Assessments @mkonda [email protected] DevOps Growing
  2. What do I do? • Bug bounty • Breaking •

    Mostly SDLC • Training • Automation
  3. Overview • Quick overview of security tools • DevOps /

    Continuous Delivery & Rugged • Leveraging security automation where possible • Hands on with Pipeline for labs (time permitting)
  4. Static Analysis Live App Scanning Dynamic Analysis Dependency Checks Web

    Application Firewall Runtime Security Monitoring IP Reputation Anti-Automation Penetration Testing
  5. B+ C B+ F D D F B A- C

    The items on the left are the OWASP Top 10. The grades are mine and are arbitrary. https://www.owasp.org/index.php/Top_10_2013-Top_10
  6. <vulnerabilities> <vulnerability> <name>CVE-2014-0050</name> <cvssScore>5.0</cvssScore> <severity>Medium</severity> <cwe>CWE-264 Permissions, Privileges, and Access

    Controls</cwe> <description>MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop&apos;s intended exit conditions.</description> <references> <reference> <source>BID</source> <url>http://www.securityfocus.com/bid/65400</url> <name>65400</name> </reference> <reference> <source>BUGTRAQ</source> <url>http://www.securityfocus.com/archive/1/archive/1/532549/100/0/threaded</url> <name>20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts library</name> </reference> <reference> <source>BUGTRAQ</source> <url>http://www.securityfocus.com/archive/1/archive/1/534161/100/0/threaded</url> <name>20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities</name> </reference> <reference> <source>BUGTRAQ</source> <url>http://www.securityfocus.com/archive/1/archive/1/535181/100/0/threaded</url> <name>20150402 NEW : VMSA-2015-0003 VMware product updates address critical information disclosure issue in JRE</name> </reference> <reference> <source>CONFIRM</source> <url>http://advisories.mageia.org/MGASA-2014-0110.html</url> <name>http://advisories.mageia.org/MGASA-2014-0110.html</name> </reference> <reference> <source>CONFIRM</source> <url>http://svn.apache.org/r1565143</url> <name>http://svn.apache.org/r1565143</name> </reference> <reference> <source>CONFIRM</source> <url>http://tomcat.apache.org/security-7.html</url> <name>http://tomcat.apache.org/security-7.html</name> </reference>
  7. <vulnerability> <name>CVE-2013-0248</name> <cvssScore>3.3</cvssScore> <severity>Low</severity> <cwe>CWE-264 Permissions, Privileges, and Access Controls</cwe>

    <description>The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.</description> <references> <reference> <source>BUGTRAQ</source> <url>http://archives.neohapsis.com/archives/bugtraq/2013-03/0035.html</url> <name>20130306 [SECURITY] CVE-2013-0248 Apache Commons FileUpload - Insecure examples</name> </reference> <reference> <source>OSVDB</source> <url>http://www.osvdb.org/90906</url> <name>90906</name> </reference> </references> <vulnerableSoftware> <software>cpe:/a:apache:commons_fileupload:1.0</software>
  8. <vulnerabilities> <vulnerability> <name>CVE-2007-0185</name> <cvssScore>5.0</cvssScore> <severity>Medium</severity> <description>Getahead Direct Web Remoting (DWR)

    before 1.1.4 allows attackers to cause a denial of service (memory exhaustion and servlet outage) via unknown vectors related to a large number of calls in a batch.</description> <references> <reference> <source>BID</source> <url>http://www.securityfocus.com/bid/21955</url> <name>21955</name> </reference> <reference> <source>CONFIRM</source> <url>http://getahead.ltd.uk/dwr/changelog</url> <name>http://getahead.ltd.uk/dwr/changelog</name> </reference> <reference> <source>OSVDB</source> <url>http://osvdb.org/32658</url> <name>32658</name> </reference>
  9. <vulnerability> <name>CVE-2013-2251</name> <cvssScore>9.3</cvssScore> <severity>High</severity> <cwe>CWE-20 Improper Input Validation</cwe> <description>Apache Struts

    2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.</description> <references> <reference> <source>BID</source> <url>http://www.securityfocus.com/bid/64758</url> <name>64758</name> </reference> This is the one that allowed me to metasploit myself.
  10. Lab 1: Running Pipeline from Docker 1. docker-machine create --driver

    virtualbox default 2. eval $(docker-machine env default) 3. docker pull owasp/pipeline:0.8.1 4. docker run —rm owasp/pipeline:0.8.1 -h 5. docker run —rm owasp/pipeline:0.8.1 -t brakeman https://github.com/Jemurai/ triage.git
  11. I recognize that software has become a foundation of our

    modern world. I recognize the awesome responsibility that comes with this foundational role. I recognize that my code will be used in ways I cannot anticipate, in ways it was not designed, and for longer than it was ever intended. I recognize that my code will be attacked by talented and persistent adversaries who threaten our physical, economic and national security. I recognize these things – and I choose to be rugged.
  12. I recognize that software has become a foundation of our

    modern world. I recognize the awesome responsibility that comes with this foundational role. I recognize that my code will be used in ways I cannot anticipate, in ways it was not designed, and for longer than it was ever intended. I recognize that my code will be attacked by talented and persistent adversaries who threaten our physical, economic and national security. I recognize these things – and I choose to be rugged.
  13. Story Continuous Delivery: The Unit of Work is a Story

    Requirements Design Code Test Security Requirements Security Unit Tests Exploratory Testing Static Analysis on Commit Code Review Threat model / attack surface Checklists Understand Dependencies
  14. Lab 2: Running Pipeline on Your Project docker run —rm

    -v /Users/mk/code/loca:/tmp/target/ owasp/pipeline:0.8.1 \ -d \ -t owaspdependencycheck \ -f csv \ /tmp/target/ * Due to docker ease of setup, please use a directory within your home directory. It is possible to do this in other ways, but it requires further setup of shared folders in virtual box which we want to avoid for the purposes of this workshop.
  15. Lab 2: Running Pipeline on Your Project 1. docker run

    —name pipe jemurai/ pipeline:0.8 2.docker exec -it pipe bash docker ps FIND YOUR IMAGE NAME * Due to docker ease of setup, please use a directory within your home directory. It is possible to do this in other ways, but it requires further setup of shared folders in virtual box which we want to avoid for the purposes of this workshop.
  16. Lab 3: Getting into the Pipeline Docker Image 1. docker

    run -rm —i -t —entrypoint=/ bin/bash owasp/pipeline:0.8.1 2. cd lib 3. ../bin/pipeline -h Now you’re running from source. We can change anything …
  17. Lab 5: Running Pipeline on a Git Hook 1. Copy

    /hooks/pre-commit to your project in <project-root>/.git/hooks 2. chmod +x pre-commit 3. Edit pre-commit to reflect your path and tools 4. Regular process: 1. Change a <file> 2. git add <file> 3. git commit -m “Testing” <file>
  18. Overview • Pipeline is broken into different chunks to try

    to make it easy and straightforward to extend in expected ways. • These illustrate the challenges of security automation. Mounter Files Code Live Filter Reporter “Tasks”
  19. Recap of “Tasks” • File: AV, FIM • Code: •

    Ruby/Rails: brakeman, bundler-audit • JavaScript: NodeSecurityProject, eslint, retire.js • Java: owasp-dependency-check • Checkmarx • Live: ZAP
  20. Lab 4: Running JS Tools 1.docker run jemurai/pipeline:0.8 -t eslint

    https://github.com/OWASP/ NodeGoat.git Or interactively: 1.docker run -t -i —entrypoint=/bin/bash jemurai/pipeline:0.8 2.cd line/pipeline/lib 3.../bin/pipeline -t eslint https:// github.com/OWASP/NodeGoat.git Try: -t eslint,nodesecurityproject,retirejs
  21. Extension Points • Mounters: mount, supports? • Tasks: run, analyze,

    supported? • Filters: filter • Reporter: run_report Mounter Files Code Live Filter Reporter “Tasks”
  22. Other Internals • Within “Tasks”, each of the files, code

    and app phases of the pipeline can be run selectively as stages. Mounter Files Code Live Filter Reporter “Tasks”
  23. Lab 5: Adding a New Tool to Pipeline 1. docker

    run -i -t —entrypoint=/bin/ bash jemurai/pipeline:0.8 2. cd pipeline/lib/pipeline/tasks/ 3. cp bundler-audit.rb test.rb 4. Edit to always create a finding (or use the following example for grep) 5. cd /../../lib 6. …/bin/pipeline -t test /tmp/
  24. References • https://github.com/owasp/pipeline • https://www.owasp.org/index.php/OWASP_AppSec_Pipeline • https://speakerdeck.com/garethr/maintaining-control-by-letting-go-security-and-devops • http://www.slideshare.net/nickgsuperstar/devopssec-apply-devops-principles-to-security •

    https://www.rsaconference.com/writable/presentations/file_upload/asd-t07r-continuous- security-5-ways-devops-improves-security.pdf • http://gotocon.com/goto-london-2015/ • http://gauntlt.org/ • https://github.com/PearsonEducation/bag-of-holding • https://www.ruggedsoftware.org/