Presentation "Top Security Threats for .NET Developers" at the dotnetconf.ru conference.

1. Top Security Threats
for .NET developers
Mikhail Shcherbakov
Product Manager at Cezurity
10-я конференция .NET разработчиков
19 апреля 2015
dotnetconf.ru

2. About me
 Product Manager at Cezurity
 One of the core developers of the source code
analyzer PT Application Inspector
 Former Team Lead at Acronis, Luxoft, Boeing,
SPC KRUG

3. Security Development
Where to Begin?

4. Security Development

5. Security Development
How to write code?

6. Glossary

7. Glossary
 Threat - a potential violation of security (ISO
7498-2).
 Impact - consequences for an organization or
environment when an attack is realized, or
weakness is present.
 Attack - a well-defined set of actions that, if
successful, would result in either damage to an
asset, or undesirable operation.

8. Glossary
 Weakness - a type of mistake in software that, in
proper conditions, could contribute to the
introduction of vulnerabilities within that software.
 Vulnerability - an occurrence of a weakness (or
multiple weaknesses) within software, in which the
weakness can be used by a party to cause the
software to modify or access unintended data,
interrupt proper execution, or perform incorrect
actions that were not specifically granted to the
party who uses the weakness.

9. Glossary
Need to Deal with Weaknesses!

10. Classifications

11. Classifications
https://www.owasp.org/index.php/Category:Atta
ck

12. Classifications
https://www.owasp.org/index.php/Category:Vuln
erability

13. Classifications
http://projects.webappsec.org/w/page/13246978
/Threat%20Classification

14. Classifications
Create a classification for
developers!

15. Improper Input/Output
Handling
Implementation

16. Improper Input/Output
Handling
 SQL Injection
 OS Commanding
 XML Injection
 XPath Injection
 XQuery Injection
 LDAP Injection
 Cross-site scripting
(XSS)
 Unrestricted File
Upload
 Path Traversal
 HTTP Response
Splitting
 Content Spoofing
 Buffer Overflow

17. Injection Anatomy

18. Input Data
’ OR 1=1 --
‘ union all select password FROM CustomerLogin
WHERE email = ‘x@exapmle.com'--

19. Injection Anatomy

20. SQL Injection with EF
Show me code!

21. Cross-site scripting (XSS)
 Reflected
 Stored
 DOM-based

22. Stored XSS
Show me code!

23. DOM-based XSS
Show me code!

24. Insufficient Control Flow
Management
Design/Implementation

25. Insufficient Control Flow
Management
 Cross-Site Request Forgery (CSRF)
 Mass Assignment
 Business Logic Errors
 Abuse of Functionality

26. CSRF

27. CSRF
 ASP.NET MVC
<%= Html.AntiForgeryToken() %>
<input name="__RequestVerificationToken" type="hidden“ …
 ASP.NET Web Forms
__VIEWSTATE, __EVENTVALIDATION
http://www.jardinesoftware.com/Documents/ASP_Net_W
eb_Forms_CSRF_Workflow.pdf

28. Business Logic Error
Samples

29. Sensitive Data Exposure
Design/Implementation/Deployment

30. Sensitive Data Exposure
 Insufficient Transport Layer Protection
 Insecure Cryptographic Storage
 Insufficient Client-side Data Protection

31. Improper Access Control
Design/Implementation/Deployment

32. Improper Access Control
 Insufficient Authentication
 Insufficient Authorization
 Insufficient Password Recovery
 Insufficient Session Expiration
 Credential/Session Prediction
 Improper File System Permissions
 Brute Force
 Insufficient Anti-automation

33. Secure Misconfiguration
Deployment

34. Secure Misconfiguration
 Application Misconfiguration
 Server Misconfiguration
 Information Exposure Through an Error
Message
 Information Leakage
 Directory Indexing
 Insecure Indexing
 Using Components with Known Vulnerabilities

35. Summary
 OWASP Top Ten Project (2010/2013)
http://bit.ly/1OffewO
 OWASP .NET Project http://bit.ly/1cz62Sv
 Vladimir Kochetkov Blog http://bit.ly/1DecXWI
 Troy Hunt Blog www.troyhunt.com
 OWASP Developer Guide http://bit.ly/1JcQLoh
 CWE/SANS Top 25 Most Dangerous Software
Errors (2011) http://bit.ly/1bjDTOH

36. Thank you for your attention!
Mikhail Shcherbakov
ms@cezurity.com
linkedin.com/in/mikhailshcherbakov
github.com/yuske
@yu5k3
Product Manager at Cezurity