Security Pitfalls vs. Best Practices

Inspiring people toshare

TYPO3 Developer Days - Hamburg 2013

Security Workshop

T3DD13 Security Workshop

Helmut Hummel <helmut@typo3.org>

07.07.2013

Security Pitfalls vs. Best Practices

Security Workshop

T3DD13 Security Workshop

Agenda• What does Security mean?

• Knowing the enemy

• Pitfalls

• Best Practice

• TYPO3 Security Team

Security Workshop

What does Security mean?

Security Workshop

Absence of potential Damage

Security Workshop

Protecting Information

Security Workshop

Unauthorized access

Security Workshop

Unauthorized modification

Security Workshop

CIA Triad

Availability

CIA Triad

Integrity

Confidentiality

Information

Security Workshop

What is Security?

Security is relative• Security depends on your needs/ kind of Information

• Security depends on a certain point in time

• Security needs to be constantly adapted and improved

Security Workshop

What is Security?

Characteristics of Security• There is no absolute Security

• An evironment is only as secure as it‘s weakest point

• Security is an investment

• The efforts for Security must be proportianal to the potential damage

• A system can be called secure, if the effort of compromising it are way higher than the possible gains

Security Workshop

Security is a process, not a product.(Bruce Schneier)

Security Workshop

General Security Priciples• Least privilege

• Minimize Exposure

• Do not rely on „security by obscurity“

• Defense in depth

Defense in Depth

PHP-application

Webserver

Server FirewallProxy

mod_security

suhosinPHP

Harding

security layer(s)

SQL Proxy

Security Workshop

Knowing the enemy

Security Workshop

Knowing the enemy

Different Motivations

• Money

• Influence

• Fame

• Fun

Security Workshop

Knowing the enemy

Different Proceedings

• Automated attacks

• Targeted attacks

Security Workshop

Pitfalls

Security Workshop 21

Security Workshop

TypoScript

page.10 = CONTENTpage.10.table = tt_contentpage.10.where = colPos=0page.10.andWhere.data = GP:page_idpage.10.andWhere.wrap = pid=|

page.10 = CONTENTpage.10.table = tt_contentpage.10.where = colPos=0page.10.andWhere.data = GP:page_idpage.10.andWhere.intval = 1page.10.andWhere.wrap = pid=|

page.10 = TEXTpage.10.field = titlepage.10.wrap = <h1 class="c-{field:layout}">|</h1>page.10.insertData = 1 DB : be_users:1:password

page.10 = TEXTpage.10.field = titlepage.10.wrap = <h1 class="c-{field:layout}">|</h1>page.10.insertData = 1

page.10 = TEXTpage.10.field = titlepage.10.dataWrap = <h1 class="c-{field:layout}">|</h1>

page.10 = TEXTpage.10.field = titlepage.10.dataWrap = <h1 class="c-{field:layout}">|</h1>page.10.htmlSpecialChars = 1

Security Workshop

Security Problems

Security Workshop

HTML Contexts• HTML-Element

• HTML-Attribute Value

• JS-Values

• URL Parameter

Security Workshop

Security Workshop

Avoid CSRF• Secret random token in the request

• Save token in session

• One-Time Token may have usability impacts

Security Workshop

File Handling

Security Workshop

Header Injection

Security Workshop

Code Injection

Security Workshop

Insecure Unserialize

Security Workshop

Extbase Security

Security Workshop

extbase

XSS• Flash Messages

• Context

Security Workshop

Mass Assignment

Security Workshop

Access Violation

Security Workshop

Best Practice

Security Workshop

Best Practice• Every request is an attack as long the opposite is proven

• User input is untrustable

• User input needs to be validated and encoded and escaped right before output

• Encoding and escaping depends on the context

• Separation of Concerns

Security Workshop

What is User Input?• $_REQUEST ($_GET, $_POST, $_COOKIE)

• $_FILES

• $_SERVER

• Filenames

• External Services

• Editors are users

Security Workshop

How to treat User Input• Validation

• Filtering

• Escaping

• Encoding

How to treat User Input

Escaping/ Encoding

User Input

Output

Validate/ Filter

evil™

stop execution?

context!

Security Workshop

How to treat User Input• Filter Input

• Escape Output

Security Workshop

How to treat User Input• Filter Input

• Check Type

• Check Format

• Check length

• Escape Output

• Context!

• DB, HTML, JS

• Directly before output

Separation of Concerns• Security issues are bugs

• Clean code leads to less bugs

• Test Driven Development

• Leave Security to Security Code

Security Workshop

TYPO3 Security Team

Security Workshop

TYPO3 Security Team

TYPO3 Security Team• Responsible Disclosure Policy

• One communication channel (security@typo3.org)

• Pre-Announcements for critical issues only

• You can support us with sober and precise communication and reading the Security Bulletins carefully

Security Workshop

TYPO3 Security Team

CVSS2 Score• It is a calculation to help you to identify the severity of a

Security Issue

• The result are 4 different Scores

• Base Score

• Temporal Score

• Environmental Score

• Overall Score

Questions?

Thank you!

@helhumhelmut.hummel@typo3.org

Security Pitfalls vs. Best Practices

Technology

Transcript of Security Pitfalls vs. Best Practices

Tips, Pitfalls and Best Practices for Managing Nonprofits’ Risk ... GWSCPA...Tips, Pitfalls and Best Practices for Managing Nonprofits’ Risk with Thrid Partesi 2019 GWSCPA Nonprofit

Libraries and licenses: Best practices, pitfalls and trends

Social Media for School Districts: Legal Pitfalls and Best Practices

Global Clinical Trials: Best Practices & Common Pitfalls

Automated Acceptance Test Practices and Pitfalls

Practices and pitfalls in inferring neural representations

CORPORATE INTERNAL INVESTIGATIONS best practices, pitfalls ...

POWERS OF ATTORNEY: Pitfalls and Best Practices Session 7A - The Power of...1 . POWERS OF ATTORNEY: Pitfalls and Best Practices . Susan Dawson-Tibbits, Attorney at Law . JOHNSON, BUNCE

New Best Practices and Pitfalls for Building Products out of … · 2017. 12. 14. · Best Practices and Pitfalls for Building Products out of OpenDaylight Colin Dixon, TSC Chair,

Effective Sqoop: Best Practices, Pitfalls and Lessons

Avoiding Workplace Pitfalls - Domestic and Foreign Employee Compliance - Best Practices

Due Diligence Best Practices and Pitfalls

Indexing Repositories: Pitfalls & Best Practices Anurag Acharya.

Software Outsourcing: Pitfalls and Best Practices

Pitfalls and Best Practices for Apps on FHIR · Amsterdam, 14-16 November | @HL7 @FirelyTeam | #fhirdevdays18 | Jenni Syed Cerner, Principal Engineer Pitfalls and Best Practices for

CUDA Streams: Best Practices and Common Pitfalls

Implementing Section 501(r): best practices and pitfalls

Procedures, Pitfalls and Costs: Best Practices for Securing Foreign Patents

CMS selection: The process, pitfalls and best practices

Tips, Pitfalls and Best Practices for Managing … - Tips Pitfalls...12 Best Practices for Managing Risk with Third Parties 23 Why It’s Important • Ensures clarity of expectations