SQL injection - Attacks and defense by Justin Clarke et al. - Book review

This book was published by Syngress in 2009. It was the book of the year in 2009 for Richard Bejtlich in taosecurity. It has ten authors, the main one is Justin Clarke.

In my eyes, this is an obliged reference book for everyone testing web applications using a database (most of them, BTW) today (and in the last 10 years!)

The book is broken down into 10 chapters - Let's go one by one:

Chapter 1 - What is SQL injection?
A generic introduction to the topic of the book. A little bit confusing chapter. I would recommend to re-read it at the end. The reader will then have more than one eureka moment.

Chapter 2 - Testing for SQL injection
This chapter wears the "hacker's hat" and shows how to find SQL injection samples in a web application connected to a database. This is a nice intro to the rest of the book. It provides useful tips about displayed SQL errors in MS SQL server, MySQL and Oracle. One of the coolest points of this book is the collection of tools that most of the chapters offer at their end. This is also the case for chapter 2. Worth mentioning, mainly because it is a free tool (and a very good one!) is the Paros Proxy.

Chapter 3 - Reviewing code for SQL injection
This chapter wears the "developer's hat" and shows how to follow user data (the use the nice term of "tainted data") through lines of PHP, Java and C# code. The end of the chapter mentions some source code analysis tools like YASCA or the MS Source Code Analyzer for SQL Injection.

Chapter 4 - Exploiting SQL injection
These pages show the deep foundations of this art, with steps such as identifying the database, extracting data through UNION statements, using conditional statements, enumerating the database schema, escalating privileges, stealing password hashes, out-of-band communication and finally, they present some tools to automate SQL injection exploitation such as sqlmap and bobcat.

Chapter 5 - Blind SQL injection exploitation
This chapter wears the "advance hacker/detective's hat". Using time-based, binary search, bit-by-bit inference and response=based techniques, they present ways to infer knowledge out of the interaction with a database. They also mention some tools such as Absinthe, Sqlninja and Squeeza.

Chapter 6 - Exploiting the operating system
Normally a database is an application software residing on top of an operating system. In this chapter, they keep on wearing the "advanced hacker/detective's hat" and present ways to read and write files and execute OS commands.

Chapter 7 - Advanced topics
Richard Bretjlich considers funny that in this "advanced & technical" book the authors have inserted a chapter for "even more" advanced topics. I agree with him. Whatever our views are, this chapter describes ways to evade input filters, to exploit second-order SQL injection and to use hybrid attacks.

Chapter 8 - Code-level defenses
This is the chapter that "developers" should read without any doubt. The key to avoid SQL injection attacks is to completely code the access to a database based on customised parameters that are out of the users' reach. The authors propose a series of recommendations to validate input and to encode output.

Chapter 9 - Platform-level defenses
Together with excellent coding practices, there are some measures, related to the operating platform, that we can take to avoiod SQL injection. These are, for example, using web application firewalls, web server filters, IDSs and securing the database itself.

Chapter 10 - This chapter is the chapter every "white hat hacker" should have at hand when assessing a web app connected to a database. It is a great reference of SQL commands and SQL injection tweaks for SQL Server, MySQL, Oracle, PostgreSQL and even DB2. If you need to select only one chapter, focus on this
one.

You can also read Richard's reference to this book in Amazon.

All in all, a book worth its price, keep it as a web app pen test reference book! Thanks to the authors for this nice work. And also a special mention to the one who merged and composed the input from 10 different authors into a unique book.

Happy reading!

Brian Snow on Information Security in a malicious environment

Risk based security is incredibly popular in information security nowadays. However, this is not the only way. I listened to the episode 191 of the Risky Business Podcast. In that episode, Patrick Gray interviews Brian Snow, former NSA director. He provides some experience-based thoughts on probabilistic risk assesment (PRA) and proposes alternative approaches in Infosec:

About PRA:
- Useful in scenarios with benign players (e.g. when Nature is the threat agent)
- Useful when there is enough good solid statistical information in the form of distributions curves and failure rates.
- The problem comes when trying to mitigate:
a. high impact risks with very very low probability or
b. a handful of low probability events with low impact that, if all of them happen in concert, the impact is huge.
- Probabilistic risk assessment does not take malice into consideration. When malice comes into play, distribution curves do not matter.
- Attackers do not use PRA as their main methodology to select targets (I would add, they choose their targets based on their relevance - benefit to risk ratio - and potential economic or mental benefit).
- PRA works well for reliability in a benign environment.

Thinking outside PRA (e.g in product security)

Designing security:
- Economic terms help i.e. let's design a system that is cheaper to create than the effort to attack it (this takes even decades!).
- How much (money) can the attacker devote to hit us?
- Forget studying the probability of malice-based acts, get some people in your security team thinking like the opponent. Look for the malice.
- Commercial product creators are not thought to counter malice.
- Military principles e.g. simple interfaces are required when you counter malice.
- It takes time to design security (quick time to market is not possible).
- Will the product work under attack? This is a key question to answer.

Practising security
- Have an holistic attack team, at the design time, to systematically attack the product.
- 3 recommendations:
a. Make sure that you study the interactions among the different scenario dimensions and players. Pay more attention to the interactions.
b. Once you are under attack, whom can you call for help? Look for partnerships (especially intelligence sharing) in the industry arena, even among competitors (e.g. CERTS already do that).
c. Have some attack scenarios that you exercise yourself (even at design time). Think in advance and try to prepare yourself against them already at design time.

Food for thought. Enjoy and digest it!
Happy June!

Black Hat Europe 2011 Keynote by Bruce Schneier

The following lines constitute a subjective summary and/or collection of thoughts triggered by the keynote that Mr. Bruce Schneier offered at Black Hat Europe 2011. The title of the keynote was cyberwar. An exciting word that nowadays reaches TV channels, radios and newspapers around the globe.

- At war, it is always important to know who is at war and why. In the cyber world, these two w-questions usually have no answer.
- The word war is paradoxical: In real wars, media try to avoid the word. However, media use often the word war in a rhetorical manner (the war on terror, the war against poverty, etc.).
- The Internet kill switch idea opens a new threat vector i.e. what about that switch falling into wrong hands?
- Regarding targeted attacks, if a company or individual is targeted, it will eventually be compromised. No doubt. It is only a matter of time and effort.
- Even though international treaties are sometimes of doubtful effectiveness, they could bring good to the cyberspace.
- In a nutshell, the current attacks in Internet increasingly show war-related tactics, strategies and methods. Therefore the hype of the word cyberwar.

Some additional thoughts:
- Skype is not eavesdropping-friendly.
- Commercial companies deal with risk only up to the value of their business. This is the reason why States need to bear residual risks if they can affect citizens (e.g. risk born by critical infrastructures).
- Human beings fear human attackers the most, then animal attackers and finally natural threats.
- Human beings fear invisible threats much more than those visible ones (personal note: this can be the reason why nuclear energy is so much feared).

And finally, a title... "dishonest minorities", his forthcoming book!

The video of the keynote is available at Black Hat Archives Site (not always available) and also in youtube.
Happy viewing!

Enchanting... also in IT security

Intro
A new excellent guest on the Entrepreneurial Thought Leaders Lecture Series - Guy Kawasaki - I recommend viewing the video or, at least, listening to the podcast. The following paragraphs are a personal summary of the ideas presented by Mr Kawasaki. My proposal will be to have the IT security world in mind when reading this text and think how much (or less) of all this we already do (or can do)?

He presented some recommendations on how to be enchanting. He used the 10 point format so that the audience know when the presentation ends. He mentioned that normally CxOs go long and they are boring when they present. Sometimes, in security conferences, I wish the presenter could be both specific and entertaining.

Tips for the art of enchantment
First, you need to be likeable. For this, improve your smile, using the muscles that surround your eyes, and certainly the jaw muscles, dress for a tie with your audience i.e. follow their same level of elegance and have a great handshake because first impressions are important.

Second, after likeability, the next step is trustworthiness. For that, I highlight these points:
- If you can't do something, find someone who could do it for you better.
- Don't ask someone something you would not do yourself.
- Empower people to do tasks.
- Don't micromanage.
- Provide people with a high purpose.

How to enchant as a leader
Provide your people with a MAP:
- Mastery: The possibility to learn and excel on the things they do.
- Autonomy: The chance to perform tasks themselves.
- A higher purpose.

- Any company needs first to trust their people (employees, customers) and then they will trust the company.
- There are 2 kinds of people, eaters and bakers, the first ones see situations as zero sum games, the bakers see ways to get bigger and more pies for everyone.
- If you would like to enchant, then default to yes, think how you can help that person.

How to enchant with your products
Your products need to be DICEE:
- deep
- intelligent
- complete
- elegant
- empowering

- Your message need to be short sweet and "swallowable".
- Important point, present in many thought leaders today, tell a story, why did you start your company, your plan, your adventure?

- Before failing, consider you have failed and conduct a pre-mortem analysis, that way everyone around a product can speak freely and with less emotional load.
- Plant many seeds to obtain your critical mass.
- Use simple and understandable features, salient points, to sell your product.
- Discover who are the influencers? Most of the times, the influencers are not the executives. Executives are very high in the ladder. The air is thinner high in the ladder. Thin air is not good for intelligence.
- Forget the use of money with your customers, it brings complexity and lack of veracity.
- Sharing and glory, people don't do it for money

Invoke reciprocation
More than answering a "thank you" with a "you are welcome", tell them "I know you would do the same thing for me". This way, you tell them that you have class and ...that they owe you. 

Enchanting up
Do what managers tell you to do, create a quick prototype, take little time to come back to show them if you are on the right track and, show them problems early, and preferably, propose a way forward.

Final thoughts
- in every presentation, customise the intro with local photos, sell your dream when you speak, use 10 slides for 20 minutes and 30 points font.
- Eliminate complexity.
- Answer within 24 hours.
- Use social networking, don't leave it only for when you have spare time.

Do you enchant while doing your job in IT security?
Happy enchantment!

Jack Dorsey: Running a business idea - applicable to IT security?

What does this post have to do with security? Well, we will soon see it. Stanford University's entrepreneurship corner is one of those reasons why Internet is, even just for this, a great invention. From your screen at home or from our smartphone or mp3 player, we have access to lectures given my current entrepreneurs.

One of the latest lectures is the one given by Jack Dorsey, creator of  twitter and square. I took note of some learning points, maybe subjective, out of his talk.

They are brilliant points to consider when creating a start-up within the IT security world. Do not forget them!

• "Instrument" your company from day 1. The first thing he did in square (and not in twitter) is writing an admin control panel for their servers.
• Be a story teller. You need to inspire your team and your customers with a story, your idea.
• In the company, you act as the editor, composing the stories.
• The team you build is not permanent, different players will need to enter and exit according to their profiles, the current story and the "required edition".
• Internal communication: Everyone in the company will have the same priorities.
• External communication: You communicate with the product, your product is "your story for your customers".
• Money in the bank: The company needs it, firstly from investors and secondly, and more critical, from revenue.
• Limit the number of details. Those details that stay need to be perfect.
• A last sentence from his side:"expect the unexpected and, whenever possible, be the unexpected".

If you see value in these points, then listen to the entire podcast or watch the lecture.

Happy listening!

ps Thanks to the Stanford's Entrepreneurial Thought Leaders Seminar crew!