1
00:00:05,730 --> 00:00:07,470
Hey everybody, thank you for coming.

2
00:00:07,610 --> 00:00:09,550
My name is Alex Stamos, and this is...

3
00:00:10,410 --> 00:00:13,070
My name is Alex Stamos, and this is Attacking Web Services.

4
00:00:13,070 --> 00:00:14,830
Is that a good volume for you guys?

5
00:00:14,930 --> 00:00:16,010
Okay, great.

6
00:00:16,510 --> 00:00:20,090
This is a session from 11 to 12.50-ish.

7
00:00:20,090 --> 00:00:21,570
We'll probably run a little bit early.

8
00:00:22,050 --> 00:00:25,670
But I'll be available for Q&A afterwards, and my email address is in here.

9
00:00:25,870 --> 00:00:28,830
So at any time, please feel free to drop me an email.

10
00:00:29,430 --> 00:00:31,810
Also, I want to make this an interactive thing.

11
00:00:31,810 --> 00:00:36,090
It's really hard to judge, especially when you do, like, background information, what people's backgrounds are.

12
00:00:36,110 --> 00:00:42,070
So please raise your hand, or if I don't notice, just yell out a question, if you have it at any time during the presentation, okay?

13
00:00:44,190 --> 00:00:46,170
So I was joking about the whole Cisco thing.

14
00:00:46,210 --> 00:00:49,910
Obviously, Cisco doesn't deploy any web service boxes, so... fortunately.

15
00:00:50,610 --> 00:00:51,630
So what are we going to talk about?

16
00:00:51,630 --> 00:00:53,170
I'm going to talk about who I am.

17
00:00:53,910 --> 00:00:55,650
My speaking partner, Scott, was supposed to be here.

18
00:00:55,650 --> 00:00:56,830
He did a lot of this work.

19
00:00:56,830 --> 00:01:02,710
I need to give him a shout-out, but I let him go to his engagement party so he doesn't get divorced because of DEF CON.

20
00:01:03,550 --> 00:01:17,930
So we'll talk about what we do, what web services are, where they're being used, talk about the basic technologies and new attacks that we're now seeing in the deployment of these technologies, as well as traditional attacks that we've lived with for a long time,

21
00:01:17,930 --> 00:01:25,070
especially, you know, traditional web applications that now can be retooled a bit to work in the web services XML world.

22
00:01:25,350 --> 00:01:27,390
And then we'll be doing a couple of demos.

23
00:01:27,390 --> 00:01:30,650
So it looks like the network's up for now, so we should be able to do a couple of those.

24
00:01:30,650 --> 00:01:33,190
If you want to play along, there's an URL in here.

25
00:01:33,590 --> 00:01:40,910
You can start downloading our software off the web and the 19 different Python packages you need to make it run.

26
00:01:41,090 --> 00:01:44,050
And if somebody actually gets it running, you can play along while we do the demo.

27
00:01:44,250 --> 00:01:47,010
And like I said, please interrupt at any time if you guys need something.

28
00:01:47,690 --> 00:01:49,330
So who are we, or I?

29
00:01:49,330 --> 00:01:51,010
I'm a founding partner of iSEC Partners.

30
00:01:51,790 --> 00:01:57,130
We're all ex-stakers, all wounded children from the at stake semantic merger.

31
00:01:57,490 --> 00:02:02,470
Based on the West Coast, we do consulting and research, mostly in application security.

32
00:02:04,030 --> 00:02:04,830
Why?

33
00:02:05,170 --> 00:02:06,330
What are we going to talk about?

34
00:02:06,330 --> 00:02:07,450
Well, we're talking about web services.

35
00:02:07,450 --> 00:02:08,230
And why is that important?

36
00:02:08,230 --> 00:02:10,210
Well, they're deployed all around us.

37
00:02:10,210 --> 00:02:15,950
It's kind of this stealth deployment that a lot of people don't realize, especially a lot of people in the security community.

38
00:02:15,990 --> 00:02:24,950
If you're in the enterprise security community, or if you're an enterprise developer, I'm sure you've heard the term SOAP or XML from a manager, or had to buy a book about it.

39
00:02:24,950 --> 00:02:27,410
But it's not something that there's been a lot of security research in.

40
00:02:27,850 --> 00:02:36,250
So, you know, we're not saying that this is definitely not the definitive talk that's going to be given on web services over the next decade.

41
00:02:36,250 --> 00:02:37,810
This is the first run through.

42
00:02:38,850 --> 00:02:40,170
We found some bugs.

43
00:02:40,170 --> 00:02:41,830
There's some interesting stuff going on.

44
00:02:41,830 --> 00:02:47,490
But really what we're trying to do is create interest about web services in the security community and kick off research by other people.

45
00:02:47,490 --> 00:02:49,330
Because there's a lot we don't know.

46
00:02:49,330 --> 00:02:52,270
There's tons of acronyms out there that need to be attacked.

47
00:02:52,350 --> 00:02:54,290
And we're looking for your guys' help.

48
00:02:54,950 --> 00:03:00,510
So, like I said before, the latest version of these slides is... the CD is way old.

49
00:03:01,470 --> 00:03:04,030
isecpartners.com slash defcon.html.

50
00:03:04,030 --> 00:03:07,970
If you go to isecpartners.com, you can click all the way through speaking engagements.

51
00:03:07,970 --> 00:03:16,030
And then there's a demo web service at wsdemo.isecpartners.com slash expathservice slash expathservice.asmx.

52
00:03:16,430 --> 00:03:24,930
I will concede right now that there's somebody in this room with a botnet that could destroy this machine and make the data center itself fall into the gaping maw of the earth.

53
00:03:24,930 --> 00:03:27,030
And I concede you're a bigger man than I.

54
00:03:27,030 --> 00:03:28,890
Please don't sin flood it or anything.

55
00:03:29,090 --> 00:03:31,310
I'd like people to be able to play around with it, okay?

56
00:03:33,330 --> 00:03:39,590
So, this talk is supposed to be not only talking about the security stuff, but we're going to try to do a background on the relevant technologies.

57
00:03:39,590 --> 00:03:43,130
Because, like I said, a lot of people, especially in the security community, haven't been exposed to them yet.

58
00:03:43,130 --> 00:03:45,550
It's not something that you get off a CD.

59
00:03:45,550 --> 00:03:46,970
It's not something that ships you through Dell.

60
00:03:46,970 --> 00:03:49,490
It's generally not something that you can download off a BitTorrent.

61
00:03:49,490 --> 00:03:51,950
And therefore, it's not something that gets researched very much.

62
00:03:53,010 --> 00:03:55,650
And so, we'll give a little background on that.

63
00:03:55,790 --> 00:04:00,770
Please let me know if you have any questions, because I don't want to spend too much time on that, especially for the people here who are experienced in web services.

64
00:04:01,050 --> 00:04:05,610
Then we're talking about some of the security risks that are associated with web services.

65
00:04:06,150 --> 00:04:11,090
A lot of them sound pretty much familiar, because a lot of technologies are familiar, or built upon older technologies.

66
00:04:11,830 --> 00:04:13,830
But there's lots of different things.

67
00:04:13,830 --> 00:04:24,710
Like I said, I think there's going to be a lot of stuff in the next several years, both attacks enabled through web services at applications that are insecure, or in the frameworks and technologies themselves.

68
00:04:24,830 --> 00:04:28,470
This is not a talk about the WS-security standards.

69
00:04:29,310 --> 00:04:35,270
That's a class of standards that does, like, encryption, allows you to do authentication and authorization, all that kind of stuff.

70
00:04:35,690 --> 00:04:37,350
They're pretty interesting.

71
00:04:37,350 --> 00:04:38,230
They do all kinds of stuff.

72
00:04:38,230 --> 00:04:40,510
They come in books 700 pages long.

73
00:04:40,510 --> 00:04:41,690
Nobody deploys them.

74
00:04:41,730 --> 00:04:43,070
So that's one reason not to talk about them.

75
00:04:43,070 --> 00:04:52,090
But they're also about things like being able to do legal signatures online using a web service, which has nothing to do with actually attacking or defending that application.

76
00:04:52,090 --> 00:04:58,310
Just because you have XML signing, digital signatures enabled, doesn't mean you can't attack it.

77
00:04:58,310 --> 00:05:04,270
Just as if you have SSL on your web application, and there's a little lock in Internet Explorer, it doesn't mean your application is secure.

78
00:05:04,270 --> 00:05:05,450
It's kind of the equivalent.

79
00:05:05,450 --> 00:05:09,170
So this isn't a talk about that, which is good, because you people would leave.

80
00:05:09,470 --> 00:05:10,950
So what are web services?

81
00:05:10,950 --> 00:05:21,150
It's a very overloaded term, mostly because you can get millions of dollars thrown at you by venture capitalists if you put the words web services and Indian programmers, like, in your prospectus.

82
00:05:21,870 --> 00:05:26,450
For our purposes, web services, our communication protocols, are based on XML.

83
00:05:27,050 --> 00:05:30,950
That's pretty much the only standard we'll be talking about that's universal.

84
00:05:30,950 --> 00:05:40,030
Lots of people do all kinds of weird web services, not like SOAP or any definitions, but just moving XML files around using HTTP or even SMTP, and they call it web services.

85
00:05:40,030 --> 00:05:40,890
That's fine.

86
00:05:40,890 --> 00:05:44,150
But for our purposes, we're talking about XML as the base language.

87
00:05:44,150 --> 00:05:55,510
They provide computer-to-computer communication, which is an important point to understand and kind of underlies a lot of the security issues, is that these are things that are not meant to be consumed by human beings, at least not initially.

88
00:05:55,510 --> 00:06:03,550
It's not like moving HTML over HTTP, where the goal of the HTML is to be rendered into something that a human being can read.

89
00:06:03,550 --> 00:06:08,850
A web service might be rendered into a GUI or something, but maybe not.

90
00:06:08,950 --> 00:06:20,070
And a lot of the technologies are based upon the idea that human beings don't have to be involved, which is both scary for programmers who want to be in their jobs, but it's also scary from a security standpoint.

91
00:06:20,630 --> 00:06:22,210
They use standard protocols.

92
00:06:22,210 --> 00:06:25,630
They're often controlled by the W3C, OASIS, and WSI.

93
00:06:25,690 --> 00:06:29,930
Web services, as a technology, has more acronyms than I've seen anywhere else.

94
00:06:29,930 --> 00:06:31,430
It is unbelievable.

95
00:06:31,430 --> 00:06:32,810
It's not my fault.

96
00:06:32,810 --> 00:06:34,250
I just want to say that up front.

97
00:06:34,270 --> 00:06:35,650
Blame Tim Berners-Lee.

98
00:06:35,690 --> 00:06:38,490
And they're designed to be platform- and transport-independent.

99
00:06:38,490 --> 00:06:49,250
Although a lot of these standards have been made by IBM, or one standard has been made by Microsoft, all of them are generally accepted and patent-free and able to be deployed by anybody.

100
00:06:49,250 --> 00:06:53,970
And that's kind of what makes them powerful and makes them so compelling.

101
00:06:54,510 --> 00:06:55,590
Why are they compelling?

102
00:06:55,590 --> 00:06:59,710
Well, these web services are based upon some pretty well-understood technologies.

103
00:06:59,710 --> 00:07:03,270
How many people here have ever edited or created an XML file?

104
00:07:03,710 --> 00:07:05,090
Right, a lot of people.

105
00:07:05,090 --> 00:07:05,690
Right.

106
00:07:06,390 --> 00:07:07,210
That's great.

107
00:07:07,210 --> 00:07:15,950
That doesn't mean that you've done web service programming, but you now have a basic knowledge that a lot of people inherited from the HTML world anyway to get into it.

108
00:07:16,170 --> 00:07:20,570
The adoption of web services has been very, very quick by large software vendors.

109
00:07:20,570 --> 00:07:30,910
The whole creation of these standard bodies has gone rid of the not-invented-here syndrome, so Microsoft and IBM are willing to implement it without either one of them taking credit for the other guy's invention.

110
00:07:30,910 --> 00:07:34,390
That's pretty unique in the software industry.

111
00:07:35,690 --> 00:07:44,030
One of the reasons they're compelling is that they're described as kind of a panacea for interoperability issues, both internal to the enterprise and externally, and we'll talk about some scenarios of that.

112
00:07:44,370 --> 00:07:48,150
But probably why they're most compelling is the magic pixie dust, right?

113
00:07:48,150 --> 00:08:06,190
This is the same magic security pixie that comes by when you plug your computer into the wall at Caesars, and it automatically gets an IP address, and then it's automatically able to talk to the gateway, even though it doesn't know the MAC address through this crazy little pixie dust protocol called ARP,

114
00:08:06,190 --> 00:08:06,610
right?

115
00:08:06,610 --> 00:08:14,370
It's all these magic pixie dust protocols that make things happen magically and automatically and without human intervention that create insecurities, right?

116
00:08:14,370 --> 00:08:22,550
Because there's nothing secure about plugging into any network in the world, and that's because everything has always been built to be easy, and easy is bad, right?

117
00:08:22,550 --> 00:08:26,830
If there's not a human being involved saying, yes, you're allowed to do that, then that's a bad thing.

118
00:08:26,830 --> 00:08:29,390
And there's tons of magic pixie dust in this.

119
00:08:29,390 --> 00:08:32,730
For example, this is a little, what, 10 or 12 lines of C-sharp.

120
00:08:33,130 --> 00:08:36,610
Open up anybody who has MSDN installed, open up Visual Studio right now.

121
00:08:36,610 --> 00:08:51,070
If you create a new project, you point it at something that has a web server, IS6 installed, and it's got ASP.NET activated, you set up that project, you copy and paste this into a file, you compile it, it will automatically compile the C-sharp into CLR,

122
00:08:51,070 --> 00:09:06,950
create an ASP page that corresponds with that C-sharp file, create a configuration file, create a web discovery document called a disco file, create a WSDL, which is that web service document link which we'll talk about, load all these up, if you have a UDDI server,

123
00:09:06,950 --> 00:09:22,170
it will automatically register with UDDI, and you'll now have a function that if somebody over the internet can send a message to IIS, which then hands it up to an XML parser, which hands it to a SOAP handler, which then finally hands it to a program which gives it a string,

124
00:09:22,170 --> 00:09:28,470
and then it goes all the way back down, with ten lines of programming, and there's then millions of lines of code running around it.

125
00:09:29,030 --> 00:09:33,210
That's a lot of magic pixie dust, and that's the kind of stuff that we'll be talking about today.

126
00:09:36,010 --> 00:09:41,250
Another reason that you see them all over the place is the value is really well understood by the pointy-haired bosses.

127
00:09:41,410 --> 00:09:45,050
This is just a little fake quote, but this is something that we actually see.

128
00:09:45,470 --> 00:09:50,670
I see a couple gray hairs and ponytails in here, so those are people that might actually know what Kix is.

129
00:09:50,670 --> 00:09:54,970
It's a crazy little programming language for mainframes, but you can't hire people that do it anymore, right?

130
00:09:54,970 --> 00:09:58,970
All those guys are retired after all the Y2K money they made.

131
00:09:58,990 --> 00:10:04,270
And so a lot of these enterprises have these IBM boxes from the 70s that their whole enterprises are running on.

132
00:10:04,490 --> 00:10:15,190
Now, it's their stock trading system, or your health records, or a bank, your bank account numbers, are all on a mainframe, and they can't hire people to talk to the mainframe.

133
00:10:15,190 --> 00:10:16,110
So what do you do?

134
00:10:16,110 --> 00:10:23,290
Well, you go buy some IBM products, because IBM is able to take machines they sold in the 70s and continually make money off of them.

135
00:10:23,290 --> 00:10:34,390
You go buy an IBM product and some IBM Global Services guys, and they come over and they put some WebSphere right in front of it, and they create this SOAP interface by which, just using XML and HTTP, you can talk to the mainframe.

136
00:10:34,430 --> 00:10:41,290
And now, I can get all these guys that have Learn Java in 30 Days books and have them write all my new enterprise applications to talk to the mainframe.

137
00:10:41,290 --> 00:10:43,970
Don't need to get any of those gray-haired ponytail guys.

138
00:10:44,090 --> 00:10:47,150
And that is very, very compelling to corporate management, right?

139
00:10:47,150 --> 00:10:49,390
Because they want to extend stuff and they don't want to spend money.

140
00:11:09,380 --> 00:11:11,180
Okay, so I have been told.

141
00:11:11,180 --> 00:11:13,000
I mean, this was all pre-arranged, obviously.

142
00:11:13,300 --> 00:11:16,520
This is issue number 13, numbered.

143
00:11:16,820 --> 00:11:17,400
Independent.

144
00:11:17,400 --> 00:11:17,920
I'm sorry.

145
00:11:17,920 --> 00:11:20,560
It's the last issue of Frack, numbered 13.

146
00:11:20,560 --> 00:11:21,820
They're individually numbered.

147
00:11:21,960 --> 00:11:25,420
It's still warm from the printing press, and it's incredible leet-ness.

148
00:11:25,420 --> 00:11:26,360
Come on.

149
00:11:29,020 --> 00:11:31,580
And it will be given to somebody in this room today.

150
00:11:31,620 --> 00:11:36,120
And I have to come up with a competition while I'm talking to you guys in my head about how we'll do that.

151
00:11:36,120 --> 00:11:39,420
So we'll have some kind of hacking competition at the end.

152
00:11:41,000 --> 00:11:42,320
Let me think about how we'll do it.

153
00:11:42,320 --> 00:11:45,060
But pay attention, because it'll have to do something with the slides, okay?

154
00:11:45,460 --> 00:11:46,440
Please don't mob me.

155
00:11:46,440 --> 00:11:47,140
Slow down.

156
00:11:47,140 --> 00:11:48,480
There's a lot of security guys here.

157
00:11:48,480 --> 00:11:52,100
I know you want it, but put it here so you guys can look at it.

158
00:12:03,270 --> 00:12:06,770
Okay, so now we're going to talk about what services are being used, right?

159
00:12:06,770 --> 00:12:08,450
Where are you going to run into it?

160
00:12:08,450 --> 00:12:15,450
Like I said, web services are not something that you consciously run into like you run into RPC and Windows, right?

161
00:12:15,450 --> 00:12:21,350
If you're a hacker and you use Windows and you've ever done a file transfer, you probably understand, like, ports 137, 139, Samba, and stuff.

162
00:12:21,350 --> 00:12:22,890
It's a technology you run into.

163
00:12:22,910 --> 00:12:36,110
But a lot of people in here have not run into web services, even though, most likely, everybody in here, either your credit report, your social security number, your tax information, your bank information, it's been moved over a web service protocol at one time or another.

164
00:12:36,490 --> 00:12:37,710
So where are they being used?

165
00:12:37,710 --> 00:12:38,470
Between companies.

166
00:12:38,470 --> 00:12:40,350
This is a big mover.

167
00:12:40,350 --> 00:12:42,290
This is the whole B2B thing, right?

168
00:12:42,290 --> 00:12:47,930
Which meant business-to-business, then it meant back-to-banking after the dot-com bust.

169
00:12:48,410 --> 00:12:50,250
But now, it means business-to-business again.

170
00:12:50,250 --> 00:12:51,910
And people are doing this using web services, right?

171
00:12:51,910 --> 00:12:56,170
We got a pass not invented here, so you can get your vendor to support it.

172
00:12:56,350 --> 00:12:58,630
And it gets rid of these stupid protocols that people invented.

173
00:12:58,630 --> 00:13:07,010
I mean, they're not stupid, but these incredibly complex, dense, binary protocols, like EDI and stuff, and all the X protocols that people have talked from company to company.

174
00:13:07,510 --> 00:13:10,690
You can get rid of those, and now you can write it in nice and easy XML.

175
00:13:10,690 --> 00:13:11,830
You can read it in English.

176
00:13:11,830 --> 00:13:12,570
It uses HTTP.

177
00:13:12,570 --> 00:13:13,490
Everybody knows how that works.

178
00:13:13,490 --> 00:13:14,750
It's based upon a web browser.

179
00:13:14,750 --> 00:13:17,990
Much easier for people to use than these old protocols to talk from business-to-business.

180
00:13:17,990 --> 00:13:25,570
A great example, the credit card companies have these weird, binary-packed, ultra-small formats for doing credit card clearing.

181
00:13:25,570 --> 00:13:27,690
Well, they're also moving to doing web service stuff.

182
00:13:27,710 --> 00:13:35,790
So, the credit card clear, when your order comes in, can talk to the bank, which can talk to the credit bureau, which can talk to the lender, and all this can happen over SOAP.

183
00:13:35,790 --> 00:13:41,050
And you can write it all in Java, and you don't have to buy a specific product for the credit card industry.

184
00:13:41,050 --> 00:13:44,730
You can just buy WebSphere or ASP.net and write it on top of that.

185
00:13:45,170 --> 00:13:47,890
Internal to companies, a lot of people like to hook their stuff up, right?

186
00:13:47,890 --> 00:13:51,410
I want my payroll system to work with my inventory system.

187
00:13:52,130 --> 00:13:56,130
Web services to connect those, instead of people having to understand each other's formats.

188
00:13:56,630 --> 00:13:58,930
In front of legacy systems, I already told you about this.

189
00:14:00,530 --> 00:14:02,610
Mainframes, AS400s, all that kind of stuff.

190
00:14:02,610 --> 00:14:07,270
Between tiers of web applications, and this is a really interesting one for some of the bugs we're talking about.

191
00:14:07,290 --> 00:14:14,190
A lot of people are moving towards using an XML data format on the back end.

192
00:14:14,190 --> 00:14:18,130
So if you do something on a web application, that XML data goes somewhere.

193
00:14:18,130 --> 00:14:32,110
Now, it might go to an XML-enabled database, which can mean anything from a database that can understand XML and put it into a normal table, to being transported somehow and then eaten up by a middle-tier software or something like that.

194
00:14:32,510 --> 00:14:41,350
This makes the X injections, and you might mean X star, there's different kinds of protocols here, injections into those protocols very interesting.

195
00:14:42,650 --> 00:14:46,010
And the way that most people have here, who here has used Google Maps?

196
00:14:46,710 --> 00:14:48,350
Who here has used Gmail?

197
00:14:49,070 --> 00:14:50,990
Right, so you guys have used web services.

198
00:14:50,990 --> 00:14:53,070
Those are AJAX applications.

199
00:14:53,270 --> 00:14:55,030
Asynchronous JavaScript and XML.

200
00:14:55,110 --> 00:14:59,570
They don't use SOAP or any of the heavy-duty web service, but it's still a web service.

201
00:15:00,310 --> 00:15:07,690
Really cool for people who haven't noticed, these are applications that allow you to do all kinds of interactive stuff without reloading the page constantly.

202
00:15:09,570 --> 00:15:14,790
Microsoft came out with Internet Explorer, has the ability to talk to what's called the XMLHTTP object.

203
00:15:15,190 --> 00:15:19,750
And now Mozilla now simulates that and stuff, even though it's obviously not ActiveX.

204
00:15:21,310 --> 00:15:23,470
Basically, I can give you an HTML page once.

205
00:15:23,470 --> 00:15:24,910
It has a bunch of JavaScript in it.

206
00:15:24,910 --> 00:15:29,350
That JavaScript talks to this object in the browser, which actually does all of its communication.

207
00:15:29,350 --> 00:15:32,610
And it's able to move XML files back and forth over HTTP.

208
00:15:32,650 --> 00:15:35,130
And it can do that without reloading, it can do it asynchronously.

209
00:15:35,130 --> 00:15:36,450
So it can do it multiple times.

210
00:15:36,450 --> 00:15:44,210
You scroll around in Google Maps, and it can spawn a bunch of these XMLHTTP objects to load up the address separately from loading up the pictures to loading up this and that.

211
00:15:44,210 --> 00:15:46,250
And it gives you a great end-user experience.

212
00:15:47,330 --> 00:15:50,770
A lot of people are using this enterprise as a replacement for thick clients.

213
00:15:50,890 --> 00:15:57,430
SAP doesn't want to have to ship an end-client for Macs and Linux and Windows.

214
00:15:57,430 --> 00:16:03,050
They'd rather ship something that just loads into Mozilla on all those platforms and allows you to have the same kind of user experience.

215
00:16:03,050 --> 00:16:08,190
Which, you know, the user experience kind of sucked in web applications because of reloading the backbone and stuff, and you can get rid of that.

216
00:16:08,610 --> 00:16:11,730
There are some definite interesting security issues with AJAX.

217
00:16:12,390 --> 00:16:13,770
We'll talk about that a bit.

218
00:16:13,770 --> 00:16:16,070
A lot of this stuff is also about the heavy-duty protocols.

219
00:16:17,550 --> 00:16:19,010
So what's the point of this?

220
00:16:19,370 --> 00:16:21,130
The code is broken free, right?

221
00:16:21,130 --> 00:16:25,070
One of the reasons people like web services is you do lots of powerful stuff over one port.

222
00:16:25,150 --> 00:16:27,770
Because back in the day, everybody put their whole enterprises on the internet.

223
00:16:27,810 --> 00:16:30,070
Then they herded this thing called a firewall.

224
00:16:30,290 --> 00:16:32,170
And they hired some firewall guys.

225
00:16:32,170 --> 00:16:33,550
And they paid Cisco some money.

226
00:16:33,550 --> 00:16:34,570
And they installed a firewall.

227
00:16:34,570 --> 00:16:40,670
And now, if you look at the outside of a normal corporation, you'll generally just see SMPP, HCP, HPS.

228
00:16:41,130 --> 00:16:44,030
Every once in a while, a Firewall 1 management port.

229
00:16:44,030 --> 00:16:48,150
But you don't see things like RPC open to the internet.

230
00:16:48,150 --> 00:16:50,330
Well, it's open to the internet again now.

231
00:16:50,450 --> 00:16:52,130
You're moving it over a different protocol.

232
00:16:52,130 --> 00:16:57,310
But now, with web services, you can move all this stuff over ports that people have had closed.

233
00:16:57,310 --> 00:16:59,790
And that's actually an advertisement for some of these products.

234
00:16:59,790 --> 00:17:01,810
Get around your firewall engineers.

235
00:17:02,030 --> 00:17:03,510
Buy our web service product.

236
00:17:03,790 --> 00:17:10,610
So, our new slogan is we poke holes in your firewall so you don't have to.

237
00:17:10,830 --> 00:17:12,470
Just set up your firewalls once.

238
00:17:12,470 --> 00:17:13,890
Fire your network engineers.

239
00:17:14,010 --> 00:17:15,690
Add all your functionality to a SOAP interface.

240
00:17:15,690 --> 00:17:16,430
And you're done.

241
00:17:17,790 --> 00:17:19,710
So, now we're going to talk about some of these technologies.

242
00:17:19,710 --> 00:17:21,630
Give you a little background in the attacks.

243
00:17:22,730 --> 00:17:23,890
So, XML.

244
00:17:24,010 --> 00:17:26,650
Everybody here kind of knows what XML is.

245
00:17:26,650 --> 00:17:31,210
It's this incredibly complex standard for representing all the data in the known universe.

246
00:17:31,210 --> 00:17:33,930
Which sounds like a really easy problem for them to tackle.

247
00:17:34,610 --> 00:17:37,950
Especially if it's supposed to be English readable on top of it.

248
00:17:37,950 --> 00:17:39,090
And it's very hard work.

249
00:17:39,090 --> 00:17:41,830
You've got things like binary data, internationalization.

250
00:17:42,270 --> 00:17:44,990
XML has internationalization built in from the beginning.

251
00:17:44,990 --> 00:17:47,470
Unicode 1.0 is the standard for XML.

252
00:17:47,470 --> 00:17:49,550
With XML 1.1, it would be Unicode 2.0.

253
00:17:49,550 --> 00:17:52,210
This makes internationalization attacks really interesting.

254
00:17:52,210 --> 00:17:53,410
Because we've seen these attacks before.

255
00:17:53,410 --> 00:17:56,190
Things like non-minimal UTF-8 encodings.

256
00:17:56,190 --> 00:17:59,830
Doing things like changing character sets to do like SQL injection and cross-site scripting.

257
00:17:59,870 --> 00:18:01,930
That's always been kind of stapled on.

258
00:18:01,930 --> 00:18:04,690
Because internationalization was stapled on to web apps.

259
00:18:04,750 --> 00:18:08,530
With web services, internationalization is from the beginning.

260
00:18:08,530 --> 00:18:14,230
And so, if you talk to something that understands XML, it probably understands all those character sets.

261
00:18:14,230 --> 00:18:15,610
You no longer have to get lucky.

262
00:18:15,610 --> 00:18:18,970
Like somebody installed the Japanese character set pack on the SQL server.

263
00:18:18,970 --> 00:18:20,470
Like you used to have to get.

264
00:18:20,470 --> 00:18:23,630
So, that's a really big deal for internationalization attacks.

265
00:18:23,630 --> 00:18:24,970
Which have been covered by other people.

266
00:18:24,970 --> 00:18:26,710
But definitely move over to web services.

267
00:18:26,870 --> 00:18:28,290
You have to represent meta-characters.

268
00:18:28,290 --> 00:18:30,870
You have to be able to define and validate how these documents are.

269
00:18:30,870 --> 00:18:31,470
Yada, yada.

270
00:18:31,470 --> 00:18:35,270
Because of the size of the product space, we've ended up with dozens and dozens of standards.

271
00:18:36,090 --> 00:18:38,490
And very few people understand a lot of them.

272
00:18:38,490 --> 00:18:40,430
And there's nobody who understands all of them.

273
00:18:40,970 --> 00:18:43,130
Which is a little different than web applications, right?

274
00:18:43,130 --> 00:18:47,930
Because it's pretty easy to understand both HTML and HTTP.

275
00:18:48,290 --> 00:18:50,310
Okay, I can understand how those work.

276
00:18:50,310 --> 00:18:52,770
I mean, I can't recite the RFCs.

277
00:18:52,770 --> 00:18:55,070
But it's almost impossible to do that with web services.

278
00:18:56,410 --> 00:18:58,670
There's a couple of basic strict rules.

279
00:18:58,830 --> 00:19:00,010
Why do you guys care about it?

280
00:19:00,010 --> 00:19:04,470
Well, when you're attacking a web service interface, you generally have to use legal XML.

281
00:19:05,150 --> 00:19:07,070
If you don't, you're just attacking the parser.

282
00:19:07,070 --> 00:19:07,770
And people have done that.

283
00:19:07,770 --> 00:19:10,890
People have already parked things that do all kinds of wacky stuff with XML.

284
00:19:10,970 --> 00:19:12,250
But people have done that before, right?

285
00:19:12,250 --> 00:19:16,270
What we're trying to get to is the applications behind that standard XML parser.

286
00:19:16,750 --> 00:19:18,730
I'm not going to walk you guys through how this works.

287
00:19:18,730 --> 00:19:22,290
But here's a simple element in XML attack, right?

288
00:19:22,290 --> 00:19:23,550
It's called the parent node.

289
00:19:23,550 --> 00:19:24,990
Those are called children nodes.

290
00:19:25,270 --> 00:19:27,030
Here's a full legal document.

291
00:19:27,030 --> 00:19:29,350
It does things like define the encoding.

292
00:19:29,370 --> 00:19:33,230
This is obviously Latin character set 1 for us English speakers.

293
00:19:33,230 --> 00:19:37,010
The default encoding for XML is UTF-8, which is great.

294
00:19:37,410 --> 00:19:40,490
This is the definition of a namespace.

295
00:19:40,490 --> 00:19:42,310
This XML document belongs to this namespace.

296
00:19:42,310 --> 00:19:43,210
So you can, like...

297
00:19:43,210 --> 00:19:51,190
If I had manufacturers shouldn't overlap with somebody else's namespace in an XML document, I also define a schema by which this can be...

298
00:19:51,190 --> 00:19:52,310
These pearls aren't real.

299
00:19:52,310 --> 00:19:53,950
Don't try to go grab them.

300
00:19:54,110 --> 00:19:56,250
A schema by which this document can be verified.

301
00:19:57,790 --> 00:19:59,850
Schemas are the way you verify documents.

302
00:19:59,850 --> 00:20:00,910
DTDs are the old way.

303
00:20:00,910 --> 00:20:01,930
It was a non-XML base.

304
00:20:01,930 --> 00:20:03,950
There's this weird thing with colons and stuff.

305
00:20:03,950 --> 00:20:08,390
The great thing with DTDs is there's a number of nasty attacks that have mostly been fixed.

306
00:20:08,390 --> 00:20:11,790
But as people come out with new XML parsers, they might be in there again.

307
00:20:11,850 --> 00:20:18,590
One of the attacks was to make a self-referencing DTD that could say, Oh yeah, I define a type B.

308
00:20:18,590 --> 00:20:22,210
And then B defines type C, which defines type D, which defines E.

309
00:20:22,210 --> 00:20:24,530
And then E defines something that has a subtype A.

310
00:20:24,530 --> 00:20:27,010
And you can get the DTD parsers to infinitely loop.

311
00:20:27,010 --> 00:20:31,970
You could also reference things that are external to the DTD, but most of these have been fixed already.

312
00:20:32,510 --> 00:20:34,990
XSDs, XML Schema Documents, are XML based.

313
00:20:34,990 --> 00:20:36,350
They're the new way of doing it.

314
00:20:36,490 --> 00:20:44,250
The important thing for security people to understand is that from a defense perspective, XML schemas can actually be very powerful.

315
00:20:44,250 --> 00:20:47,630
From an attacker standpoint, nobody uses them, so who cares?

316
00:20:51,890 --> 00:20:54,710
Like I said, they can prevent many of the attacks we're going to discuss.

317
00:20:54,990 --> 00:20:58,790
So if you are on the defense side, think about validating stuff with a strong schema.

318
00:20:59,090 --> 00:21:01,790
And don't do stupid stuff like having the all tag and stuff like that.

319
00:21:01,790 --> 00:21:02,750
We'll talk about that later.

320
00:21:03,290 --> 00:21:04,410
This is a schema.

321
00:21:05,310 --> 00:21:06,190
It's pretty readable.

322
00:21:06,190 --> 00:21:10,570
The only interesting thing here is I have a restriction that I have an element called year.

323
00:21:10,610 --> 00:21:13,290
I'm saying it has to be an integer and it has to be between these dates.

324
00:21:13,290 --> 00:21:17,070
This means I can't do SQL injection in the integer field.

325
00:21:17,090 --> 00:21:23,710
If I give it something that looks like a string, the XML parser itself is going to die before it ever gets close to the database.

326
00:21:24,410 --> 00:21:26,170
So here's a little bit of a protection.

327
00:21:27,010 --> 00:21:28,610
Most people don't do this kind of stuff.

328
00:21:28,630 --> 00:21:32,030
The magic pixie dust that we talked about generally doesn't include XML schemas.

329
00:21:35,050 --> 00:21:36,070
So parsing.

330
00:21:36,070 --> 00:21:38,250
So how do you... I get an XML document, how do I read it?

331
00:21:38,250 --> 00:21:39,650
There's kind of two standard ways.

332
00:21:39,650 --> 00:21:41,190
Both ways have security flaws.

333
00:21:41,190 --> 00:21:42,650
The first one is called SAX.

334
00:21:42,910 --> 00:21:45,030
Simple API for XML, I think it is.

335
00:21:45,090 --> 00:21:50,290
This is a step-by-step, stateless parser that expects you to store the state.

336
00:21:50,310 --> 00:21:53,970
It's kind of like a thing I say, go one more step, go one more step.

337
00:21:53,970 --> 00:21:54,830
Oh, you have children node?

338
00:21:54,830 --> 00:21:56,490
Okay, I want that child, I want that child.

339
00:21:56,490 --> 00:22:00,030
So when people use it, it's nice and it's lightweight, it's pretty easy to use.

340
00:22:00,070 --> 00:22:02,250
But it's not very powerful.

341
00:22:02,330 --> 00:22:08,250
And it has the downside of if you use a SAX parser, you have to track what data you've gotten.

342
00:22:08,250 --> 00:22:15,290
If I want to get out of that car, if I want to get manufacturer, I have to say car, okay, I got car, I want the child named manufacturer.

343
00:22:15,290 --> 00:22:19,190
It gives me manufacturer, and then I have to store it in a variable for myself.

344
00:22:19,430 --> 00:22:23,130
And there's an attack against that called XML injection that we'll talk about.

345
00:22:23,210 --> 00:22:25,910
And then the other one is DOM, Document Object Model.

346
00:22:25,910 --> 00:22:29,370
This is really powerful parsing, this is how most people do it in enterprise applications.

347
00:22:29,450 --> 00:22:32,110
And that turns out to be a bad thing from a denial of service standpoint.

348
00:22:32,110 --> 00:22:38,590
Because building, if I have a big XML document, what this means is it takes and it builds a data structure in memory that represents it.

349
00:22:38,770 --> 00:22:42,630
It represents all the nodes that are linked to all the child nodes, it's linked to this, it's linked to this.

350
00:22:42,630 --> 00:22:51,510
And each one of those nodes is an object in Java with its own garbage collection and all the information that gets wrapped around any variable in Java.

351
00:22:51,570 --> 00:22:54,130
So DOM has issues with denial of service.

352
00:22:54,590 --> 00:22:58,370
And then there's always a really bad idea, people make their own parsers with like regex and stuff.

353
00:22:58,370 --> 00:23:02,050
Don't do it, you can get an XML parser for every language, there's no reason to do it again.

354
00:23:02,050 --> 00:23:03,710
Because you'll probably screw it up.

355
00:23:04,950 --> 00:23:07,730
So an attack against X, XML injection.

356
00:23:07,730 --> 00:23:14,390
So this is a situation in which the attacker can control a string that gets put into an XML document.

357
00:23:14,490 --> 00:23:16,110
There's multiple ways this can happen.

358
00:23:16,110 --> 00:23:19,930
This can be an XML document that is standing in for like a database query.

359
00:23:19,930 --> 00:23:28,370
If I send, maybe it's my user login, and it puts the login information I give it, it puts it in the XML document and hands it off somewhere else to get parsed.

360
00:23:28,370 --> 00:23:32,230
Or it could be something like a document I upload, because that's how I upload data.

361
00:23:32,530 --> 00:23:33,810
It could be a lot of things.

362
00:23:33,810 --> 00:23:41,630
But anyway, if I can control text in it, and it's not being input filtered, I can put more XML tags in there.

363
00:23:41,630 --> 00:23:44,250
So in this situation, we have a user record.

364
00:23:44,250 --> 00:23:49,390
Let's say this is a bank, and I've created my user, because I have a bank account.

365
00:23:49,430 --> 00:23:53,970
And so I go in and I now create my web user, and it asks me for something like my email address.

366
00:23:53,970 --> 00:24:03,970
And so when I fill out my email address, I give it an email address, and then I close the email tag, and I create a new tag called unique ID.

367
00:24:04,570 --> 00:24:07,350
And then I say the email again, this is for the parser.

368
00:24:07,570 --> 00:24:09,330
Why did I put this unique ID in here?

369
00:24:09,330 --> 00:24:13,590
Well, this is in a situation where perhaps I have some knowledge of how the XML document is laid out.

370
00:24:13,590 --> 00:24:18,910
I know that there's a unique ID child node in there that defines what my ID is.

371
00:24:20,370 --> 00:24:23,890
This is like a unique ID that's used by the application itself.

372
00:24:24,390 --> 00:24:37,170
And so with a SACS parser, if I was writing a SACS parser to read this, generally, and remember, this is a fault with the application, not the parser itself, but we see it over and over again because people don't expect this, is you step through the document,

373
00:24:37,170 --> 00:24:40,190
and you go to user record, and you say, give me the first tag.

374
00:24:40,190 --> 00:24:42,910
And it says, okay, tag is unique ID, value is this.

375
00:24:42,910 --> 00:24:44,630
And so I write it to a temporary variable.

376
00:24:44,630 --> 00:24:46,670
And then I say name, and I write that to a variable.

377
00:24:46,670 --> 00:24:48,390
And I say email, and I write that to a variable.

378
00:24:48,390 --> 00:24:50,050
And I get to unique ID again.

379
00:24:50,050 --> 00:24:57,110
And because the parser itself isn't tracking the state, I'm just going through and have a switch statement that says, when I get this information, put it into a variable.

380
00:24:57,270 --> 00:24:59,990
I overwrite that information and put the zero back in.

381
00:25:00,690 --> 00:25:04,490
So who do you guys think user zero is on a web application?

382
00:25:04,990 --> 00:25:06,890
It's the admin, almost always, right?

383
00:25:06,890 --> 00:25:15,010
This is the same kind of, when you do SQL injection, you do OR 1 equals 1, it gets the first user in the table, and it always turns out to be either the developer or an admin.

384
00:25:15,030 --> 00:25:16,230
It's the same kind of problem.

385
00:25:16,230 --> 00:25:22,110
And so the SACS parser, if I step through like this and store it in variables, gives me a unique ID of zero.

386
00:25:22,410 --> 00:25:23,850
How do you defend against this?

387
00:25:23,850 --> 00:25:28,790
You can do an XML schema where you say you can only have one unique ID per user record.

388
00:25:28,810 --> 00:25:34,870
Or you can use a DOM parser, which you would specifically reference one of these, and it would probably check this one.

389
00:25:39,110 --> 00:25:40,310
No, oh, oh, I'm sorry.

390
00:25:40,310 --> 00:25:42,150
So this red, you're right, that's an excellent question.

391
00:25:42,150 --> 00:25:43,950
Why not do unique ID zero in the first place?

392
00:25:43,950 --> 00:25:46,350
This red area is the only part I control.

393
00:25:46,350 --> 00:25:53,790
So I imagine this is a web form that's taking my information and putting it into an XML document where it stores all my information about my bank account.

394
00:25:53,790 --> 00:25:54,850
Does everybody understand that?

395
00:25:54,870 --> 00:25:59,090
So I can only control what's between these two tags, because it takes my data and puts it in.

396
00:25:59,090 --> 00:26:05,990
And as you see, I have to do the email twice so that there's not this hanging email tag out here, which will make it choke probably, right?

397
00:26:06,450 --> 00:26:13,990
So like I said, for defense, you can do an XML schema validation, or you can use a DOM parser, or you can go through and check to make sure that you don't get multiple inputs.

398
00:26:14,550 --> 00:26:17,970
This also works with XPath, which we'll talk about.

399
00:26:17,970 --> 00:26:25,870
So if I did this attack and somebody was trying to pull this information out using XPath, even with a DOM parser, the attack would probably work as well.

400
00:26:29,050 --> 00:26:30,830
So, which takes us to XPath.

401
00:26:30,970 --> 00:26:36,230
XPath is this very simple language by which people are supposed to be able to reference what's in an XML document.

402
00:26:36,490 --> 00:26:39,230
It's kind of a cross between direct relations and regex.

403
00:26:40,530 --> 00:26:42,710
XPath number one was supposed to be nice and simple.

404
00:26:42,710 --> 00:26:46,870
XPath one has like 20 pages of documentation, the standard.

405
00:26:46,870 --> 00:26:51,650
XPath two is something like 300 pages, and nobody's read them all yet, so I'm not sure what's in it.

406
00:26:51,650 --> 00:26:54,390
But it looks really scary, some of this stuff in two.

407
00:26:54,390 --> 00:26:56,350
But these attacks work on XPath one.

408
00:26:56,410 --> 00:26:58,150
So say this was our car example.

409
00:26:58,910 --> 00:27:02,770
XPath entries are something like, so I get this XML, this is part of it.

410
00:27:02,770 --> 00:27:07,370
I load it into a parser, and then I want to ask the parser for information from the XML document.

411
00:27:07,370 --> 00:27:13,770
And so, one of the things I might ask for is, let's say there's a bunch of car nodes, right, in this document.

412
00:27:13,770 --> 00:27:15,450
It's a big list of used cars.

413
00:27:15,810 --> 00:27:18,030
I want to return all of the children of the node.

414
00:27:18,030 --> 00:27:19,670
XPath queries always return a list.

415
00:27:19,670 --> 00:27:21,630
It might be, it's like MATLAB or something.

416
00:27:22,110 --> 00:27:25,790
It might be a list of one item, but it always returns a list, which is really interesting.

417
00:27:25,810 --> 00:27:30,590
Because if I just say car, it gives me all of them in a big list, all of these nodes.

418
00:27:30,690 --> 00:27:36,470
If I return, if I do slash car, that just gives me the root element, right, only the first one.

419
00:27:36,470 --> 00:27:40,790
If I do slash slash car, it does all the car elements in the document.

420
00:27:40,790 --> 00:27:43,750
I'm sorry, car, if you say just car, it's all the children of the car.

421
00:27:44,010 --> 00:27:48,870
Car slash slash color will give me all the color underneath car.

422
00:27:48,870 --> 00:27:51,370
And then the interesting one is when you can have conditionals.

423
00:27:51,450 --> 00:27:57,870
Give me search for car, and give it to me the list of cars where color equals blue, right.

424
00:27:57,870 --> 00:28:00,270
And you can actually do pretty complex queries in here.

425
00:28:00,270 --> 00:28:02,770
And as you can see, this is really, really cool, right.

426
00:28:02,770 --> 00:28:06,450
Because this makes it really easy to get information out of an XML document.

427
00:28:06,450 --> 00:28:09,130
Because this is a pretty easy to understand language.

428
00:28:09,130 --> 00:28:17,930
And if my document's not incredibly complex, this is much easier to use than doing all these, you know, Python or C sharp calls to the DOM parser.

429
00:28:18,690 --> 00:28:19,970
What's the downside?

430
00:28:20,690 --> 00:28:22,070
Well, we'll get to that in a second.

431
00:28:22,070 --> 00:28:23,510
So where do people use XPath?

432
00:28:23,510 --> 00:28:25,510
People often use it to talk to databases.

433
00:28:25,510 --> 00:28:31,470
It's starting to replace SQL in situations where people are storing XML data in a database.

434
00:28:31,830 --> 00:28:35,810
All of these, XPath is supported by all of these database servers.

435
00:28:35,810 --> 00:28:39,070
I think you need like SP3 or something for 2000.

436
00:28:39,070 --> 00:28:40,750
So what's the problem?

437
00:28:41,150 --> 00:28:50,710
Well, like our old friend SQL from SQL injection, XPath uses, puts data and the commands you want to do, puts the verb and the noun right next to each other.

438
00:28:50,710 --> 00:28:54,770
And those are delineated by our old friend, the single quote, right.

439
00:28:54,770 --> 00:29:01,230
So if I want to say, give me the car where the color is blank, I use the single quote to say this blank describes the car.

440
00:29:01,230 --> 00:29:03,030
That's not a command I want you to run.

441
00:29:03,030 --> 00:29:04,110
That's a description.

442
00:29:04,930 --> 00:29:09,390
Unlike SQL, there is no access control in XPath or XML documents.

443
00:29:09,450 --> 00:29:13,910
So generally, if you run an XPath query against an XML document, you can read everything in that document.

444
00:29:15,010 --> 00:29:20,250
That's good, right, because sometimes SQL injection just doesn't work because they have good database schema.

445
00:29:20,530 --> 00:29:22,110
That doesn't exist here.

446
00:29:22,110 --> 00:29:24,790
There's also no real safe way of using XPath, right.

447
00:29:24,790 --> 00:29:27,250
A lot of times we'll do a pen test, we won't find SQL injection.

448
00:29:27,250 --> 00:29:31,030
We'll say, hey, no SQL injection, congrats, you must be doing really good input filtering.

449
00:29:31,050 --> 00:29:32,510
And they'll be like, input what?

450
00:29:32,510 --> 00:29:35,110
And we'll say, well, why don't we have SQL injection?

451
00:29:35,110 --> 00:29:43,050
Well, it turns out, because they want things to run faster, they use prepared statements, where they call and distort procedures, and that's a nice secure way of doing it, and SQL injection doesn't work in that case.

452
00:29:43,050 --> 00:29:44,510
There's nothing like that for XPath.

453
00:29:44,510 --> 00:29:45,650
There's no secure way to call it.

454
00:29:45,650 --> 00:29:53,090
The way people always call it is you concatenate a bunch of strings together, and then you give that string to the parser, right, which is the bad way of using SQL.

455
00:29:53,090 --> 00:29:54,430
That's the only way to use XPath.

456
00:29:55,250 --> 00:30:04,630
So the outcome is if I can control any data that gets into an XPath statement, and I can get a quote in, I can return arbitrary data and access arbitrary stuff in the document itself.

457
00:30:05,490 --> 00:30:06,710
And here's the example.

458
00:30:07,190 --> 00:30:11,610
So, in this example, say it's this bank again, and I've created an XML document.

459
00:30:12,110 --> 00:30:15,470
You know, I don't need a database, right, because I'm a small bank.

460
00:30:15,470 --> 00:30:17,850
So I just keep a flat XML document of all my users.

461
00:30:17,850 --> 00:30:20,530
I've already been XML injected, so I fix that, right?

462
00:30:20,530 --> 00:30:23,150
Oh, I'm so stupid, I should have known that people could have gotten stuff in.

463
00:30:23,150 --> 00:30:30,530
And so I fixed it by going over to a DOM parser, a nice big complicated parser that you can't do XML injection against.

464
00:30:30,530 --> 00:30:36,510
But since it's so hard to use, I'm going to use XPath to get information out of it instead of stepping through it, step by step.

465
00:30:36,530 --> 00:30:42,830
And so one of the things that I have to do is when people log in, I have to go see if they're in this big flat XML file of users.

466
00:30:43,090 --> 00:30:44,590
Everybody with me so far?

467
00:30:45,010 --> 00:30:45,630
Okay.

468
00:30:45,790 --> 00:30:46,210
Yeah.

469
00:30:46,210 --> 00:30:47,490
Great hypothetical, huh?

470
00:30:48,110 --> 00:30:49,190
Real original.

471
00:30:49,270 --> 00:30:55,270
So I'm going to create an XPath statement, and then give it to my parser, and it's going to look up the user for me.

472
00:30:55,270 --> 00:31:02,950
And so I'm going to say, slash slash user, search for the user whose name is equal to Joe, and whose password is equal to let me in.

473
00:31:02,950 --> 00:31:07,870
And the two red things here are information that come from the web form, the login and the password field.

474
00:31:08,590 --> 00:31:09,530
Okay, that's fine.

475
00:31:09,530 --> 00:31:10,210
It works.

476
00:31:10,210 --> 00:31:15,870
This will return a list of all the users, right, because slash slash will be a list of all the users that match that.

477
00:31:15,870 --> 00:31:16,970
It's probably only one.

478
00:31:16,970 --> 00:31:17,850
It should be.

479
00:31:18,330 --> 00:31:20,790
But it does return a list, a list of one element.

480
00:31:23,170 --> 00:31:26,670
So now we come to our new canonical statement that we'll replace.

481
00:31:26,670 --> 00:31:29,110
If you're really, really cool, quote...

482
00:31:29,110 --> 00:31:30,950
What's the canonical SQL statement?

483
00:31:31,130 --> 00:31:32,970
This will be the first point for getting the book.

484
00:31:32,970 --> 00:31:33,950
Raise your hand.

485
00:31:34,270 --> 00:31:34,710
Yes, sir.

486
00:31:34,710 --> 00:31:35,350
Back there.

487
00:31:37,190 --> 00:31:38,590
And then what after it?

488
00:31:39,930 --> 00:31:40,990
Right, dash dash.

489
00:31:40,990 --> 00:31:43,350
It may be semicolon, dash dash, depending on that, right?

490
00:31:43,450 --> 00:31:45,370
So this is our new statement.

491
00:31:45,370 --> 00:31:47,230
Everybody memorize it, put it on t-shirts.

492
00:31:47,590 --> 00:31:49,270
I have to get money from the t-shirts.

493
00:31:49,270 --> 00:31:54,150
But I've actually seen that, like, on t-shirts, which is horrible about me and my social life.

494
00:31:55,730 --> 00:32:00,190
This is our new canonical statement that will tell us if XPath injection is working.

495
00:32:00,190 --> 00:32:02,450
Single quote, or one equals one.

496
00:32:02,450 --> 00:32:03,750
Hey, that sounds familiar.

497
00:32:04,090 --> 00:32:10,550
Or, single quote, single quote, that's not a double quote, that's two single quotes, equals one single quote.

498
00:32:10,550 --> 00:32:13,910
I know not everybody can see it, but download the PDF, it'll be in there.

499
00:32:14,610 --> 00:32:21,810
So what this does, is now I have, give me all the users whose name equals Joe, and my first single quote closes out the Joe string.

500
00:32:21,870 --> 00:32:26,550
Or, one equals one, which is a sylla... what's the word for something that's always true?

501
00:32:27,550 --> 00:32:28,190
Apology.

502
00:32:28,190 --> 00:32:29,010
It's apology.

503
00:32:29,010 --> 00:32:31,190
Something that's always true, so this always returns true.

504
00:32:31,190 --> 00:32:33,630
Or, quote quote equals quote quote.

505
00:32:33,630 --> 00:32:36,670
Why do I need that quote quote equals quote?

506
00:32:36,750 --> 00:32:37,490
Anybody?

507
00:32:38,810 --> 00:32:40,230
To get rid of the last quote, right.

508
00:32:40,230 --> 00:32:44,090
So I don't have, XPath doesn't have the ability to do comments in line, like SQL.

509
00:32:44,090 --> 00:32:52,670
So I can't use the dash dash, which we used for SQL injection to throw away the rest of the line, or a semicolon to make mine a statement, and then make the next one a different statement.

510
00:32:52,770 --> 00:32:55,750
I have to actually use what's in my application.

511
00:32:55,870 --> 00:33:02,890
And so the easy way to do that, I've got a single quote floating out there, is I create an empty string, and then I create another empty string using that single quote.

512
00:33:02,890 --> 00:33:09,070
So only the red stuff I control, that last black one is put in there by the application, but I neutralize it by doing this.

513
00:33:09,070 --> 00:33:10,370
End password, let me in.

514
00:33:10,370 --> 00:33:12,150
So, why does this work?

515
00:33:12,150 --> 00:33:13,630
Because it's an or or and.

516
00:33:13,850 --> 00:33:14,570
Anybody?

517
00:33:14,610 --> 00:33:15,930
Why would this work?

518
00:33:18,670 --> 00:33:21,570
Well, the end's not quoted out, the end's used, but, sorry?

519
00:33:23,110 --> 00:33:23,930
Operator precedence.

520
00:33:23,930 --> 00:33:26,690
Somebody took a first year CS class and hated it.

521
00:33:26,690 --> 00:33:27,430
Right, sir?

522
00:33:27,970 --> 00:33:29,490
Yes, operator precedence.

523
00:33:29,490 --> 00:33:32,050
The thing that bites you in your ass when you start CS.

524
00:33:32,370 --> 00:33:34,590
When you look at this, it first does the and.

525
00:33:34,590 --> 00:33:38,430
There's an implied parentheses around this.

526
00:33:38,430 --> 00:33:40,170
So the and is the first thing.

527
00:33:40,370 --> 00:33:43,190
Quote quote and pass equals let me in, so this turns to a not.

528
00:33:43,190 --> 00:33:48,150
But then we have false or true or false, which turns into true.

529
00:33:48,450 --> 00:33:53,010
And so, what this does is returns all of the users, because it's a tautology.

530
00:33:53,010 --> 00:33:54,350
It returns a list of all the users.

531
00:33:54,350 --> 00:33:55,850
Well, what use is that?

532
00:33:55,850 --> 00:33:59,070
Well, like I said, XPath, everything's a list.

533
00:33:59,070 --> 00:34:03,890
So if I'm using XPath to log somebody in, I have to take a list, and what do I have to do with it?

534
00:34:06,010 --> 00:34:09,590
Well, not to protect, but what do I have to do, like, just to use it normally?

535
00:34:09,590 --> 00:34:13,490
I have to ask for the first element, and then use that as the login, right?

536
00:34:13,610 --> 00:34:18,690
So, I just ask for the first element anyway, and the first guy who's returned becomes my login user.

537
00:34:19,410 --> 00:34:20,790
That make sense to everybody?

538
00:34:21,470 --> 00:34:22,010
Right?

539
00:34:22,010 --> 00:34:26,610
A lot of people yelled at me at Black Hat, because they're like, how could it work, because it returns multiple things?

540
00:34:26,610 --> 00:34:30,150
Well, you know, unlike SQL, in this situation, everything is a list.

541
00:34:30,150 --> 00:34:33,350
So I'm going to take this output and ask, what's the number one guy?

542
00:34:33,350 --> 00:34:35,710
And use that person, the first child, thank you.

543
00:34:37,210 --> 00:34:43,850
So if we want to get all super powerful, we can do things like now change and put more stuff in there.

544
00:34:43,850 --> 00:34:48,590
This is obviously much more useful if you have access to information with it, and you know how the XML is laid out.

545
00:34:48,590 --> 00:34:53,570
So this is an open source or commercial product that you can get your hands on, and you can figure out how the XML is laid out.

546
00:34:54,530 --> 00:34:59,550
And we can do things like create more rules, and change around the statement to do all kinds of cool stuff.

547
00:35:00,110 --> 00:35:00,910
And we'll do that.

548
00:35:00,910 --> 00:35:02,170
I'll show a demo of that later.

549
00:35:02,170 --> 00:35:09,810
So, like SQL injection, this requires some knowledge of the query, which makes it much easier if error messages are on.

550
00:35:10,270 --> 00:35:16,430
How many people in here are going to vote that they don't give you all the information by default in all the major web service stacks?

551
00:35:16,430 --> 00:35:17,590
Anybody want to take that bet against me?

552
00:35:17,590 --> 00:35:18,790
I'll give you ten to one odds.

553
00:35:19,590 --> 00:35:20,090
Nobody?

554
00:35:20,090 --> 00:35:21,030
Okay, that's true.

555
00:35:21,030 --> 00:35:25,970
The default is, give them all the information they need to make an XPath query, and we'll show you on the default ASP.NET.

556
00:35:26,910 --> 00:35:37,290
Even if you can't get access to it, Amit Klein, who used to be at Syncdome, I guess he's not there anymore, which is now Watchfire, which is now probably today it's Verisign, and tomorrow it'll be part of Time Warner.

557
00:35:37,290 --> 00:35:39,390
I don't know what's going on in the security industry while I'm here.

558
00:35:40,230 --> 00:35:44,230
But he wrote an excellent paper called Blind XPath Injection, drop that into Google and you'll find it.

559
00:35:44,470 --> 00:35:52,270
He claims he has a way of getting the entire XML document out bit by bit, by creating a conditional that's set on what the next character is.

560
00:35:52,270 --> 00:35:56,470
And so whether you log in or not is that one bit of covert channel you get out.

561
00:35:56,470 --> 00:36:05,170
Of course, they had a test of there's 40 characters after, and it took them two hours to get those 40 characters out, because you have to do all the logins and test all possible characters, but it's pretty cool.

562
00:36:06,690 --> 00:36:11,350
If anybody knows him, I'm trying to find him, have him release the tool, please, so we can play with it.

563
00:36:11,470 --> 00:36:15,870
But XPath 2 might give us a lot more ways of actually getting all that information out.

564
00:36:16,050 --> 00:36:20,590
XPath 2 does a lot of cool things, like you have the ability to reference outside documents.

565
00:36:20,590 --> 00:36:24,410
I can have tests that ask for information from an outside document, right?

566
00:36:24,410 --> 00:36:27,230
Like if this user is equal to the user in this.

567
00:36:27,610 --> 00:36:32,370
Now, the control of where that outside document comes from isn't really defined by the standard, right?

568
00:36:32,370 --> 00:36:37,090
That's going to have to be up to the people that write the implementation themselves.

569
00:36:37,210 --> 00:36:42,230
So how many people want to bet that at some point you're going to be able to get a document from your web server, right?

570
00:36:42,530 --> 00:36:45,990
And that way I'd probably be able to leak a bunch of information out about the rest of the XML.

571
00:36:46,610 --> 00:36:54,910
The future, if you guys want to be really, really elite and get the next T-shirt before this T-shirt, that's going to come out after this T-shirt, is XQuery injection.

572
00:36:54,950 --> 00:36:59,650
XQuery is a super set of XPath that is now the standard for talking to XML databases.

573
00:37:00,590 --> 00:37:05,030
And one of the really cool things it can do is you can reference a bunch of different documents and stuff.

574
00:37:05,850 --> 00:37:12,710
Downside is now people are actually building an access controller, and so boo-hoo, we won't be able to read everything, but that hasn't stopped us from SQL injection, right?

575
00:37:13,610 --> 00:37:18,030
And in this attack, and in a bunch of other attacks that we're talking about, our big friend is the cdata field.

576
00:37:18,030 --> 00:37:24,490
So I'm not going to talk about it in detail, but it's basically just a way that XML has built in to get nasty stuff into XML, right?

577
00:37:24,490 --> 00:37:30,230
Things in XML that you don't want it to interpret as part of the XML document, you put it in the cdata field, and it disappears.

578
00:37:30,390 --> 00:37:42,410
So I can put things like with single quotes and with brackets and all that kind of stuff into a cdata field, and that goes into the XML parser, and then when you ask the XML parser for the string, it gets rid of that cdata field for you.

579
00:37:42,410 --> 00:37:44,410
So the application never sees that you did that.

580
00:37:44,650 --> 00:37:48,890
There's also other escaping methods that work just as well, but the cdata field is so powerful and easy.

581
00:37:48,950 --> 00:37:49,990
It's the best way to do it.

582
00:37:50,210 --> 00:37:52,470
Once again, XML schema is for defense.

583
00:37:52,530 --> 00:37:54,350
You turn off cdata fields in XML.

584
00:37:58,840 --> 00:38:01,120
So any questions on the XPath injection?

585
00:38:01,520 --> 00:38:03,020
And soon to be expert.

586
00:38:03,140 --> 00:38:06,040
Okay, I'm going to demo that at the end, because it's a cool one.

587
00:38:06,240 --> 00:38:06,940
So SOAP.

588
00:38:07,260 --> 00:38:12,740
SOAP is a standard where all of these, like, really cool web service stuff, this is where a lot of the magic exists.

589
00:38:12,740 --> 00:38:17,960
It's a standard that defines how to move XML around, that can do remote procedure calls, that can do RPC calls.

590
00:38:18,920 --> 00:38:21,060
It's generally over HTTP, but it doesn't have to be.

591
00:38:23,520 --> 00:38:25,680
SOAP is defined by things called WSDLs.

592
00:38:26,060 --> 00:38:29,780
WSDLs are these really ugly documents that are never meant for human beings to read.

593
00:38:29,840 --> 00:38:32,100
They're meant for computers to read, and they're generated by computers.

594
00:38:32,160 --> 00:38:40,140
And the great part of them is that, as an attacker, as somebody who's scoping out an application, the WSDL tells you everything you need to know to attack the application.

595
00:38:40,140 --> 00:38:45,640
So this is so much more powerful than we had for web application hacking, right?

596
00:38:45,640 --> 00:38:55,120
Because to do a web application hack, you have to start off playing with the application for days, using a user, trying everything, and then mapping it out and seeing all this functionality it has, right?

597
00:38:55,120 --> 00:38:57,660
With web services, they just tell you up front.

598
00:38:57,860 --> 00:39:00,160
They tell you, these are all the things I can do.

599
00:39:00,160 --> 00:39:02,960
These are all the things you can ask me to do on your behalf.

600
00:39:03,440 --> 00:39:07,200
Which is really, really cool, and it makes a lot of things a lot easier.

601
00:39:07,940 --> 00:39:13,860
Generally, asking for WSDL is as easy as adding a question mark WSDL at the end of a document.

602
00:39:14,100 --> 00:39:18,960
And we have a tool that will do this automatically for you, so you don't have to go through and do question mark WSDL over and over again.

603
00:39:20,500 --> 00:39:21,940
They define all this stuff.

604
00:39:21,940 --> 00:39:22,800
This is just for reference.

605
00:39:22,800 --> 00:39:23,660
You guys don't need to know.

606
00:39:23,660 --> 00:39:33,240
Basically, it defines something like, if I had a service that sold used cars, it would define how I ask you to sell me the car, and then your response to me, and what that means.

607
00:39:35,380 --> 00:39:36,760
There's no way you can read this.

608
00:39:36,760 --> 00:39:40,720
This is like a third of a single WSDL for a very simple eBay thing.

609
00:39:40,820 --> 00:39:42,980
It's incredibly complex and dense.

610
00:39:43,160 --> 00:39:44,500
What's good about that?

611
00:39:44,500 --> 00:39:49,320
That means that the developers that wrote that almost certainly never read the actual WSDL.

612
00:39:49,320 --> 00:39:51,280
The WSDLs are generally automatically generated.

613
00:39:51,280 --> 00:39:59,280
Like my thing I wrote before, if you write a bunch of stuff that's accessible through web services, and you turn it on, all of a sudden the WSDL is generated that tells somebody all those things.

614
00:39:59,280 --> 00:40:02,060
So they can point a web service at it and not have to talk to you about it.

615
00:40:02,060 --> 00:40:03,120
That's the whole idea.

616
00:40:03,720 --> 00:40:08,540
And so that often includes things like hidden debug messages, and I've actually seen this.

617
00:40:08,580 --> 00:40:15,540
This is a web application that was ported over to having web service support, and they had ported over all of their functionality.

618
00:40:15,660 --> 00:40:25,880
I think it had been on struts or something, and they ported out all this functionality over to web services, and one of the methods in the WSDL that obviously they had never read was make me admin.

619
00:40:25,880 --> 00:40:37,340
It was a debug call that the developers would have, just normal low rights users, could make that call, and they'd become the administrator of the service.

620
00:40:37,580 --> 00:40:41,000
Now, they had had that in the web application before, and it had never been attacked.

621
00:40:41,000 --> 00:40:41,300
Why?

622
00:40:41,300 --> 00:40:45,020
Because it was a parameter you had to put into a post.

623
00:40:45,100 --> 00:40:52,140
And that's not something that somebody might not... make me admin might not be something that you guess, and that you shove into every single parameter in every single post.

624
00:40:52,140 --> 00:40:53,560
But I didn't need to try anything.

625
00:40:53,560 --> 00:40:55,520
All I had to do was look at the WSDL, and it said it right there.

626
00:40:55,520 --> 00:40:56,520
Make me admin.

627
00:40:56,520 --> 00:41:00,020
It takes a user ID for which admin you want to become.

628
00:41:02,120 --> 00:41:04,960
That has always existed, and now it's just really, really simple.

629
00:41:04,960 --> 00:41:06,300
There's also all these cruft systems.

630
00:41:06,300 --> 00:41:10,460
Who here knows of a 1AM batch FTP job that they're embarrassed about?

631
00:41:11,040 --> 00:41:12,020
Come on.

632
00:41:12,340 --> 00:41:13,440
Yeah, right.

633
00:41:13,660 --> 00:41:16,640
It's unbelievable what's transferred over FTP in the middle of the night.

634
00:41:16,640 --> 00:41:19,300
If I was a router engineer, I'd be all over it.

635
00:41:19,480 --> 00:41:21,400
All this kind of stuff's getting moved over to web services.

636
00:41:21,400 --> 00:41:23,620
Nobody's ever thought about security for them before.

637
00:41:23,620 --> 00:41:28,000
Maybe they've been kind of hidden because you have to be on the right router at the right time to get the information.

638
00:41:28,060 --> 00:41:29,320
Now all you have to do is ask.

639
00:41:29,440 --> 00:41:32,760
And you can use something like UDI to say, hey, tell me all of your secret services.

640
00:41:32,820 --> 00:41:33,820
We'll talk about that.

641
00:41:34,520 --> 00:41:35,760
So what's your defense?

642
00:41:35,780 --> 00:41:37,520
You can manually review the WSDLs.

643
00:41:37,520 --> 00:41:45,560
Everybody should know what's in their WSDLs if they're broadcasting the world to make sure there's nothing in there that's supposed to be a private function or that you're really embarrassed is in there, like debug functionality.

644
00:41:45,960 --> 00:41:46,820
You can hand edit them.

645
00:41:46,820 --> 00:41:50,620
Like Google writes theirs by hand, I think, mostly for compatibility reasons.

646
00:41:50,620 --> 00:41:54,700
But the better part is don't have things like make me admin in your production app.

647
00:41:54,700 --> 00:41:56,580
Get rid of that before it gets out to production.

648
00:41:57,540 --> 00:41:59,960
So there's a number of different attacks with SOAP.

649
00:42:01,140 --> 00:42:11,380
One big one we'll talk about a lot, well, not a lot, but we've got a couple of slides on, is application-level denial of service through XML complexity.

650
00:42:11,380 --> 00:42:17,440
And SOAP obviously takes XML, but you're probably wondering, obviously I probably can't give SOAP arbitrary XML, right?

651
00:42:17,440 --> 00:42:23,620
Because maybe a method only wants... it says, you know, buy a car, and all it takes is the VIN number.

652
00:42:23,620 --> 00:42:24,640
It takes one string.

653
00:42:24,640 --> 00:42:27,820
How do I shove arbitrary XML into that one string?

654
00:42:27,920 --> 00:42:29,980
Well, there's fun things called SOAP headers.

655
00:42:30,060 --> 00:42:35,540
SOAP headers are part of the message that almost nobody ever uses, but everybody listens to and reads.

656
00:42:35,680 --> 00:42:40,680
And they're there because, you know, all these things like WS routing and all the encryption standards and stuff use them.

657
00:42:40,680 --> 00:42:45,520
You can put arbitrary XML in a SOAP header because there's no definition of what can and can't go in there.

658
00:42:45,520 --> 00:42:47,860
And that gets read and parsed by the application.

659
00:42:48,740 --> 00:42:50,800
You can also do some source routing sometimes.

660
00:42:50,800 --> 00:42:58,820
Sometimes people have multiple applications that are exposing to web services, and so they have to make a decision on where... who you talk to when your message comes in.

661
00:42:58,940 --> 00:43:03,160
Well, sometimes that decision comes from the header, and that can be set by the application itself.

662
00:43:03,160 --> 00:43:05,300
This is like a client that you downloaded or something.

663
00:43:05,300 --> 00:43:12,960
If you see something that looks like routing in the header, try other things that sound like they might be web services inside the application and see if you can get it bouncing off a different thing on the inside.

664
00:43:15,360 --> 00:43:17,860
SOAP has a lot of session management problems.

665
00:43:17,860 --> 00:43:19,020
It doesn't have session management.

666
00:43:19,020 --> 00:43:19,880
It's just like HTTP.

667
00:43:20,160 --> 00:43:22,340
You do a post, you get a response.

668
00:43:22,380 --> 00:43:23,200
That's it.

669
00:43:23,960 --> 00:43:26,540
That means people have to develop their own session management.

670
00:43:26,580 --> 00:43:29,120
A lot of people do dumb stuff like they use cookies, right?

671
00:43:29,120 --> 00:43:29,980
HTTP cookies.

672
00:43:29,980 --> 00:43:30,980
They still work.

673
00:43:31,060 --> 00:43:34,460
Obviously, it's on a browser on the other side, but somebody has to understand it.

674
00:43:34,540 --> 00:43:37,600
Well, what happens to that cookie once it hits the web server?

675
00:43:38,320 --> 00:43:39,740
It's stripped off, right?

676
00:43:39,740 --> 00:43:41,940
Like, this XML document's going somewhere.

677
00:43:42,140 --> 00:43:43,060
It's going to a mainframe.

678
00:43:43,060 --> 00:43:43,840
It's going to a database.

679
00:43:43,840 --> 00:43:45,320
That cookie doesn't go with it.

680
00:43:45,340 --> 00:43:54,440
And so this causes a lot of access control problems for people because they're setting these cookies, and they never see them actually where they're making decisions, like whose bank account can you transfer money out of, right?

681
00:43:56,140 --> 00:43:57,900
So, you know, that's an issue.

682
00:43:57,900 --> 00:44:00,280
There's also all the old classical state issues.

683
00:44:00,280 --> 00:44:02,300
A lot of people have to implement their own state mechanisms.

684
00:44:02,300 --> 00:44:03,960
They haven't had to do it for years, right?

685
00:44:03,960 --> 00:44:06,560
They've been able to use WebSphere's or ASP's little cookie.

686
00:44:06,580 --> 00:44:17,900
So they're kind of old at it, and they don't remember that doing things like counting up from 1,000 and then making the next user number 1,001 in that field is definitely a little bit guessable, right?

687
00:44:17,900 --> 00:44:21,500
As are things like counting up from 1,000 and doing a SHA-1 or something like that.

688
00:44:21,500 --> 00:44:24,960
So we see that all the time again with web services because people have to rule their own.

689
00:44:26,820 --> 00:44:28,420
So this is a SOAP message.

690
00:44:28,540 --> 00:44:29,040
Yada, yada.

691
00:44:29,040 --> 00:44:29,900
It's kind of generic.

692
00:44:29,980 --> 00:44:32,200
You don't want to be actually writing these by hand.

693
00:44:32,200 --> 00:44:34,500
They're really hard to write by hand to make them accurate.

694
00:44:34,600 --> 00:44:38,380
And I'll show a little free tool that you can download that does all the communication itself.

695
00:44:38,380 --> 00:44:39,800
Remember, we don't have a web browser here, right?

696
00:44:39,800 --> 00:44:47,380
When we're talking to a web service, it's expecting another computer to talk to it, so we don't automatically get something that has a GUI on it to put information in.

697
00:44:48,400 --> 00:44:51,620
And then you'll see in the demo, there's this thing called SOAP faults.

698
00:44:51,620 --> 00:44:54,320
If something breaks, it sends a fault back that has a string.

699
00:44:54,400 --> 00:44:57,180
So who here can find the interesting part of this?

700
00:44:59,320 --> 00:45:02,800
Right, so what do you think this is here?

701
00:45:03,580 --> 00:45:05,620
What does that look like that we've just talked about?

702
00:45:05,620 --> 00:45:08,580
That looks like an XPath query.

703
00:45:08,940 --> 00:45:12,820
This is the default functionality of ASP.NET 1.1 Service Pack 1.

704
00:45:13,460 --> 00:45:15,940
If XPath breaks, tell the user.

705
00:45:16,060 --> 00:45:19,620
Tell the user exactly the XPath string that broke and how it broke.

706
00:45:24,930 --> 00:45:27,410
So we'll demo all that in just a second.

707
00:45:27,410 --> 00:45:30,030
And then something I talked about was Web Services Download Service.

708
00:45:30,030 --> 00:45:33,970
This is, in my opinion, much, much, much, much, much more powerful.

709
00:45:33,970 --> 00:45:39,270
I'd rather have a good XML attack than a thousand bots on a botnet to do a SYNFLUD.

710
00:45:39,450 --> 00:45:39,910
Why?

711
00:45:39,910 --> 00:45:42,870
Because I have a huge, huge multiplier.

712
00:45:42,890 --> 00:45:50,470
I don't have a huge multiplier with a SYNFLUD now that somebody's got $100,000 arbor boxes or really nice net screens or something on the other side.

713
00:45:50,470 --> 00:45:55,170
But I get a huge, huge multiplier with an XML attack against an application.

714
00:45:55,250 --> 00:45:56,890
And I have to look for this advantage.

715
00:45:56,890 --> 00:46:00,950
And often this advantage... we've explored two different types.

716
00:46:00,950 --> 00:46:03,950
We're not releasing the code because it works too well.

717
00:46:03,950 --> 00:46:06,090
But it's pretty easy to recreate it yourself.

718
00:46:06,090 --> 00:46:12,090
But you either do attacks against the parser itself or against the application and its database backend.

719
00:46:12,090 --> 00:46:15,790
And against the parser itself, you get very large multipliers of CPU time and memory.

720
00:46:15,790 --> 00:46:21,150
If I can send you an XML document, how hard is that for me to send you a text document?

721
00:46:21,150 --> 00:46:22,950
It doesn't have to be dynamically generated.

722
00:46:22,950 --> 00:46:26,330
I don't have to use .NET to create this document.

723
00:46:26,530 --> 00:46:29,270
I only have to write it once and send it with a Perl script.

724
00:46:29,990 --> 00:46:31,430
So I send it once.

725
00:46:31,430 --> 00:46:33,230
OK, that's a couple cycles.

726
00:46:33,290 --> 00:46:35,530
I can probably do a couple thousand of those a second.

727
00:46:35,570 --> 00:46:42,350
When it gets to the other guy, he takes that document and he says, OK, well, you want me to download a schema and you want me to set the namespace.

728
00:46:42,350 --> 00:46:45,470
Now I'm going to build a model that represents this document.

729
00:46:45,470 --> 00:46:47,190
So I have the head node, which is A.

730
00:46:47,190 --> 00:46:48,590
And I have the child node that's B.

731
00:46:48,850 --> 00:46:50,710
Oh, and B has a child node called B.

732
00:46:50,710 --> 00:46:52,230
And B has a child node called B.

733
00:46:52,310 --> 00:46:54,030
And repeat that 100,000 times.

734
00:46:54,030 --> 00:46:56,350
And then close B off 100,000 times.

735
00:46:56,350 --> 00:47:04,710
And that guy builds an object in memory in some heavy-duty language like Java or C Sharp, where memory management isn't that easy anyway.

736
00:47:04,710 --> 00:47:05,770
It uses a lot of memory.

737
00:47:05,770 --> 00:47:10,870
And it builds this huge object that's 100,000 objects long and deep.

738
00:47:11,690 --> 00:47:13,670
That is a huge, huge advantage.

739
00:47:13,670 --> 00:47:16,990
And all that happens before it makes a decision what to do with it, right?

740
00:47:17,050 --> 00:47:17,970
This is just the parser.

741
00:47:17,970 --> 00:47:20,390
The application hasn't even seen that anything's happened yet.

742
00:47:20,390 --> 00:47:23,310
This is the magic pixie dust framework that's done all this work for you.

743
00:47:23,310 --> 00:47:24,590
Gives you a huge advantage.

744
00:47:24,590 --> 00:47:25,630
How big of an advantage?

745
00:47:25,630 --> 00:47:35,870
Well, we've taken down four enterprise-level hardware with a real, patched, good web services server with one of these laptops.

746
00:47:36,710 --> 00:47:38,150
CPU pegged them.

747
00:47:38,230 --> 00:47:41,870
And I don't think the CPU was actually from the parsing as well as the memory management.

748
00:47:41,910 --> 00:47:45,550
Because every time a message came in, it would build that DOM, and then it would destroy that object.

749
00:47:45,550 --> 00:47:46,830
And then do it again and again.

750
00:47:46,830 --> 00:47:53,330
Because we can get a couple thousand queries a second, or a couple thousand a second out of 20 threads of Perl.

751
00:47:53,770 --> 00:47:55,410
So that is really, really powerful.

752
00:47:55,410 --> 00:47:59,550
And that's, you know, it would take a lot more than one laptop to SYN flood those four boxes, right?

753
00:47:59,550 --> 00:48:01,090
Especially if they have a real load balancer.

754
00:48:01,370 --> 00:48:04,330
The other attack we've looked at is database connections, right?

755
00:48:04,390 --> 00:48:06,170
Database connections are coming from a pool.

756
00:48:06,170 --> 00:48:07,210
There's a limit of how much.

757
00:48:07,250 --> 00:48:09,250
They're pre-created, and then they're used.

758
00:48:09,250 --> 00:48:14,370
And they're usually not, like, even for sites that have millions of users, they're something like 200 or 500, right?

759
00:48:14,370 --> 00:48:17,050
Because they're only used when the query's going across.

760
00:48:17,330 --> 00:48:21,410
So, like we said, this WSDL tells you all the things that it can do, right?

761
00:48:21,410 --> 00:48:22,830
And you can do all of those things.

762
00:48:22,830 --> 00:48:23,790
It's stateless.

763
00:48:23,790 --> 00:48:28,530
You can do all those things as many times as you want, generally, unless they're doing something very smart.

764
00:48:29,230 --> 00:48:30,270
And so what do I do?

765
00:48:30,270 --> 00:48:31,350
I go through this WSDL.

766
00:48:31,350 --> 00:48:35,930
I find something that looks like it's a very heavy-duty thing that it has to look up in the database.

767
00:48:36,090 --> 00:48:40,370
Somebody name a query in which you have to read a big table, and you have to do it every time somebody asks you.

768
00:48:41,430 --> 00:48:42,490
Login, right?

769
00:48:42,570 --> 00:48:50,730
If I log into a machine, it's got a big list of users, and I give you a username, especially if it's randomized and you don't have it cached, you have to go ask the database, who's this user?

770
00:48:50,730 --> 00:49:01,030
And so to create these user requests with random usernames and passwords over and over again is not very heavy-duty, but it requires, it takes up one of these connections while it's asking that question over and over again.

771
00:49:01,030 --> 00:49:08,790
And this is a great thing against enterprise servers, because often, especially sites that have been DOSed before, they have 20 or 30 or 40 front-end web servers.

772
00:49:08,790 --> 00:49:10,490
How many database servers do they have?

773
00:49:11,350 --> 00:49:15,750
One or two in HA, or maybe two HA clusters, right?

774
00:49:15,750 --> 00:49:18,770
And that HA is probably cold failover, so they're not actually running.

775
00:49:19,910 --> 00:49:23,830
And it's not considered a failure when you use up all the database connections, right?

776
00:49:23,830 --> 00:49:26,730
That doesn't mean the box is broken, it just means that the queue is filled up.

777
00:49:26,730 --> 00:49:37,850
And so we've also done this against an enterprise system where there's a ton of web servers in the front, and two database servers in the back in an HA config, and with a couple of laptops, we choked the database server.

778
00:49:37,850 --> 00:49:43,890
The database server only had like 5% CPU used, but that connection pool was all used up, because we did something that took a lot of time.

779
00:49:43,890 --> 00:49:46,290
Why doesn't this get caught in normal testing?

780
00:49:46,290 --> 00:49:51,930
Well, in normal testing, you don't log in 100,000 times over a course of two minutes, right?

781
00:49:51,930 --> 00:49:53,470
That's not part of people's regression testing.

782
00:49:53,470 --> 00:49:55,650
You log in once, and then you do the heavy-duty stuff.

783
00:49:55,890 --> 00:50:03,450
And so that kind of application-level attack, while it's been doable with web applications, is really easy with SOAP, right?

784
00:50:03,450 --> 00:50:10,530
Because the login, all I have to do is change a little bit about the particulars, and maybe generate some random usernames, and my Perl script has destroyed the database.

785
00:50:13,190 --> 00:50:15,690
In either case, there's some important things to remember.

786
00:50:15,690 --> 00:50:17,970
You have to have a legal SOAP request, right?

787
00:50:17,970 --> 00:50:21,910
You don't want it thrown out before it hits the application, especially on the database side.

788
00:50:22,050 --> 00:50:23,890
And then speed is very important, too.

789
00:50:23,890 --> 00:50:36,710
We used multiple processes with multiple threads, but, you know, it is still a little heavy-duty compared to like a SYN flood, and obviously the attacker's position is given away.

790
00:50:36,870 --> 00:50:40,750
So that's a downside for the attackers, it's a good thing for the good guys, right?

791
00:50:40,750 --> 00:50:43,830
Because you have to use real TCP connections to move this stuff across.

792
00:50:43,830 --> 00:50:45,830
But you don't have to listen to that connection, right?

793
00:50:45,830 --> 00:50:49,050
You can make a connection, send them the post, and then drop it.

794
00:50:49,050 --> 00:50:51,490
If you're using your own TCP stack, then just stop listening.

795
00:50:51,490 --> 00:50:57,250
Don't send a reset, let it respond, but you don't have to actually have that memory allocated to get the response.

796
00:50:57,250 --> 00:50:58,510
Makes it very, very efficient.

797
00:50:59,790 --> 00:51:04,230
We're also looking into ways to make it faster, like HTTP 1.1 pipelining.

798
00:51:04,230 --> 00:51:08,910
This is especially important with SSL, because I don't want to do an RSA transaction for every post I do.

799
00:51:08,910 --> 00:51:14,750
If I do pipelining, I just send them all up with like, create a pool of 20 or 30 TCP SSL connections, and send them up.

800
00:51:14,750 --> 00:51:15,850
Or things like XPath.

801
00:51:15,850 --> 00:51:18,930
Anybody hear about those crazy RegEx attacks?

802
00:51:19,350 --> 00:51:22,910
That you can do to null service by getting somebody to do a weird RegEx?

803
00:51:22,910 --> 00:51:24,670
That's really, really hard.

804
00:51:24,670 --> 00:51:32,850
Well, XPath, obviously if I can do arbitrary things in XPath, I can probably do things in my XPath injection that are really bad, even if I can't use it to own the application.

805
00:51:33,510 --> 00:51:35,710
Unfortunately, defense isn't very easy for this.

806
00:51:35,710 --> 00:51:41,730
For things like the SOAP header XML complexity, there's nothing you can do as an application developer in your application.

807
00:51:41,730 --> 00:51:47,490
Because like I said, the SOAP message comes in, even if it's not for you, you've never heard of it at your application.

808
00:51:47,490 --> 00:51:51,910
It's WebSphere, or it's Access Apache, or it's ASP.NET that's doing it for you.

809
00:51:52,810 --> 00:52:03,590
So the only defenses against that are something like, you have an XML firewall, this is one of the reasons they actually sell a couple boxes a year, that looks at them and has limitations on it.

810
00:52:03,590 --> 00:52:11,290
You can set your own limitations, like if you only do small messages, you use 50K messages, and you set that in Apache or IIS, and so that's important.

811
00:52:11,290 --> 00:52:15,430
There's no reason somebody should be able to upload a 20MB XML file to you, right?

812
00:52:16,090 --> 00:52:22,330
Or you can do something like write your own Apache filter, or work with something like Apache Mod Rewrite or Mod Proxy to look for this kind of stuff.

813
00:52:22,990 --> 00:52:24,770
SACS is not vulnerable, right?

814
00:52:24,770 --> 00:52:25,390
Yes, sir.

815
00:52:27,750 --> 00:52:28,870
Limiting RAID from source IP.

816
00:52:28,870 --> 00:52:30,430
So you could do it from source IP, of course.

817
00:52:30,430 --> 00:52:33,110
This is the problem everybody's running with other issues.

818
00:52:33,110 --> 00:52:38,410
In situations like an AOL situation, you might kill one of their 12 megaproxies, right?

819
00:52:38,570 --> 00:52:44,650
Or, you know, whatever Nippernet has like 15 ways it gets out to the internet or something like that.

820
00:52:44,650 --> 00:52:45,930
So, I mean, you could.

821
00:52:45,930 --> 00:52:46,990
Rate limit by source IP.

822
00:52:46,990 --> 00:53:02,930
The way to do it is you need to make them do work to ask you, so you need to have them ask you for a session ID, you generate a session ID randomly, don't put it in the database, just generate randomly in memory, give it to that person, and then have them send it back with the login information.

823
00:53:02,970 --> 00:53:06,690
And then you can check against the table in memory, which is much faster than going to the database.

824
00:53:06,770 --> 00:53:12,110
As for the XML stuff, you have to put a protection in front that looks for the complexity and stops it before it gets to the web server.

825
00:53:12,290 --> 00:53:14,350
Either that's a firewall or it's your own thing.

826
00:53:18,430 --> 00:53:19,550
Oh, right, and size.

827
00:53:19,550 --> 00:53:21,490
Yes, I do recommend limiting size.

828
00:53:21,530 --> 00:53:27,830
If you never have anything larger than 50K, set it to 75 or something, most people, almost nobody thinks about that, right?

829
00:53:27,830 --> 00:53:31,170
And by default, this stuff accepts up to like 20 or 30 meg posts and stuff.

830
00:53:31,170 --> 00:53:32,350
And that's when it gets really nasty, right?

831
00:53:32,350 --> 00:53:41,090
It takes a minute to, you know, it takes me 30 seconds or something to upload a 20 meg post over a 100 megabit connection, and then it takes a minute for it to parse it, right?

832
00:53:44,150 --> 00:53:47,030
XML firewalls are these... well, okay.

833
00:53:47,030 --> 00:53:49,590
So it's another venture capital term.

834
00:53:49,630 --> 00:53:51,390
So it's something that makes people venture capital.

835
00:53:51,390 --> 00:53:53,210
That's the basic definition.

836
00:53:53,310 --> 00:53:56,510
Generally, there are things that sell that look at XML.

837
00:53:56,510 --> 00:53:58,790
They're like application-level firewalls.

838
00:53:58,890 --> 00:54:01,770
A lot of the XML firewalls aren't created for security purposes.

839
00:54:01,990 --> 00:54:03,610
They're created to do stuff like routing.

840
00:54:03,750 --> 00:54:08,330
So if I have multiple web interfaces, web services, I can just put one box in front of them.

841
00:54:08,330 --> 00:54:09,570
It's kind of like a load balancer.

842
00:54:09,630 --> 00:54:11,670
And it says, oh, you want to talk to the mainframe.

843
00:54:11,830 --> 00:54:13,670
I will send that information to the mainframe.

844
00:54:13,730 --> 00:54:15,130
Oh, you want to talk to this database.

845
00:54:15,130 --> 00:54:16,330
I'll send the information to this database.

846
00:54:16,350 --> 00:54:22,210
But they now, because of security issues, they do things like they'll check for the complexity of the document before it comes through and not let it through.

847
00:54:22,210 --> 00:54:35,550
So kind of like Syncton's AppShield in front of web apps, XML firewalls or SILK firewalls or web service firewalls or whatever gets you the most money right now, whatever they're called, look at the request and filter it for things that might be dangerous.

848
00:54:35,550 --> 00:54:38,830
They'll also do things like look for SQL injection and XPath injection and things like that.

849
00:54:38,950 --> 00:54:40,290
I can't always recommend them.

850
00:54:40,470 --> 00:54:43,310
This is one of the only things that you can't fix yourself.

851
00:54:43,650 --> 00:54:45,310
If you have a SQL injection bug, fix it.

852
00:54:45,310 --> 00:54:54,930
Don't spend $100,000 for a hardware firewall that's now in your critical path that, if it turns out they didn't do the right thing with their TCP stack, somebody can DOS it anyway and take you down network-wise, right?

853
00:54:54,930 --> 00:54:56,450
Or it's something you have to pay to maintain.

854
00:54:57,590 --> 00:55:01,090
They're not things that you can just drop in front of your app and expect them to work.

855
00:55:01,950 --> 00:55:03,710
Anybody in here sell XML firewalls?

856
00:55:03,790 --> 00:55:05,110
Obviously we're not a vendor.

857
00:55:08,700 --> 00:55:09,460
Excuse me?

858
00:55:11,040 --> 00:55:12,940
I think Teros might do this kind of stuff.

859
00:55:12,940 --> 00:55:15,060
Forum Systems, Sarvega.

860
00:55:18,060 --> 00:55:21,240
Somebody come up with a prefix and postfix for a startup company.

861
00:55:22,520 --> 00:55:24,520
There's like 20 or 30 companies that do it.

862
00:55:24,520 --> 00:55:30,460
Like I said, they're mostly to do stuff like I want to do encryption on my web service and I don't want to write into my app, so the box will do it automatically.

863
00:55:30,460 --> 00:55:35,180
So any questions on the DOS?

864
00:55:35,180 --> 00:55:38,060
Like I said, we're not releasing them, but it's pretty easy for people to recreate them.

865
00:55:38,060 --> 00:55:40,680
You just need to build really complex but legal XML.

866
00:55:43,340 --> 00:55:45,560
Complex just means deep, right?

867
00:55:45,560 --> 00:55:50,340
If I have five root nodes that have 100,000 deep child nodes, right?

868
00:55:50,340 --> 00:55:56,320
It's not just the number of nodes, but it has to be the linkage between them for something like a DOM attack.

869
00:55:56,440 --> 00:55:58,020
That's a really, really powerful attack.

870
00:55:58,020 --> 00:55:59,120
It's pretty easy to recreate.

871
00:55:59,120 --> 00:56:02,620
Obviously there's no reason for us, it would not be a very ethical thing to release that.

872
00:56:05,120 --> 00:56:06,380
So discovery methods.

873
00:56:06,380 --> 00:56:07,740
We talked about WSDLs.

874
00:56:09,060 --> 00:56:10,600
I don't think we'll do it.

875
00:56:10,600 --> 00:56:11,980
Let's talk about this real fast.

876
00:56:11,980 --> 00:56:15,040
UDDI is another great discovery method, like a WSDL, what I talked about.

877
00:56:15,040 --> 00:56:16,800
It just defines one service, right?

878
00:56:16,800 --> 00:56:18,600
You ask for a service, how do I talk to you?

879
00:56:18,600 --> 00:56:20,880
How do you find that service in the first place?

880
00:56:20,880 --> 00:56:26,560
Well, there's this great thing called UDDI, which lists all the services that somebody's running, right?

881
00:56:26,740 --> 00:56:27,760
So... yes, sir.

882
00:56:29,380 --> 00:56:30,220
Yeah.

883
00:56:33,610 --> 00:56:34,450
No.

884
00:56:34,630 --> 00:56:35,130
No.

885
00:56:35,130 --> 00:56:38,830
They will not load... people learn their lesson off the DTD attacks.

886
00:56:38,830 --> 00:56:42,470
And they will not load off-site XSDs.

887
00:56:42,890 --> 00:56:43,890
By default.

888
00:56:43,930 --> 00:56:46,690
Certainly you can tell your XML parser that you want to.

889
00:56:47,830 --> 00:56:50,730
But, you know, I haven't seen anybody do that.

890
00:56:51,530 --> 00:56:52,050
Sure.

891
00:56:52,230 --> 00:56:52,970
Any other questions?

892
00:56:52,970 --> 00:56:54,170
I'm sorry on the DOS stuff.

893
00:56:57,190 --> 00:56:57,910
Okay.

894
00:56:58,130 --> 00:57:00,850
So UDDI is a way I can list all these web services.

895
00:57:01,030 --> 00:57:04,910
And you might think that nobody's deploying them, but I've seen a bunch of them, right?

896
00:57:04,910 --> 00:57:09,750
A lot of people are doing testing of web services right now, or they have two or three that their business partners use.

897
00:57:09,750 --> 00:57:12,910
And so they put a UDDI server, which is XML on top of HTTP.

898
00:57:13,150 --> 00:57:14,830
It's nothing very complex.

899
00:57:14,890 --> 00:57:21,230
There's a bunch of free Google for UDDI browser, and you can download free ones or use web applications that will do it free for you.

900
00:57:22,110 --> 00:57:34,710
And then they put these IP addresses out, and they tell their B2B partners, wow, you know, it's so hard to set up a VPN, so what we're going to do is we're going to give you our UDDI address, and then you guys can figure out how to hook up to them SSL is on,

901
00:57:34,710 --> 00:57:34,950
right?

902
00:57:34,950 --> 00:57:35,790
So use SSL.

903
00:57:35,790 --> 00:57:37,230
That's what we'll use instead of a VPN.

904
00:57:37,230 --> 00:57:40,590
And they expect people won't find these UDDI servers, right?

905
00:57:40,590 --> 00:57:45,310
Because if you do nmap-a, I think right now, it won't say this is a UDDI server, right?

906
00:57:45,310 --> 00:57:48,530
Because it's just a port 80, so you have to report 443.

907
00:57:49,970 --> 00:57:53,910
The great thing about UDDI is it tells you everything you need to know to attack a web service.

908
00:57:54,170 --> 00:57:57,390
And it tells you, if an enterprise is deploying it, everything they're deploying.

909
00:57:57,390 --> 00:58:01,670
Now, they don't have to list everything, but like I said, some of this stuff automatically lists.

910
00:58:01,690 --> 00:58:05,650
If you have a UDDI server, Visual Studio will automatically list it up for you, right?

911
00:58:06,510 --> 00:58:08,630
So how do I find UDDI servers?

912
00:58:08,730 --> 00:58:19,570
Well, IBM, Microsoft, SAP, and Nippon Telegraph and Telephone have very kindly stepped in and given us a nice searchable web interface that tells you UDDI servers that people have registered.

913
00:58:19,570 --> 00:58:21,270
So you guys see this hierarchy here?

914
00:58:21,270 --> 00:58:28,410
The whole idea is that, you know, I should be able to do a web service with another company without ever talking to somebody at that company.

915
00:58:28,410 --> 00:58:30,370
So first I go to a UBR.

916
00:58:30,470 --> 00:58:32,430
I search and I want to talk to SAP.

917
00:58:32,430 --> 00:58:33,750
I search for SAP.

918
00:58:33,910 --> 00:58:36,410
I see all the web services that they're listing.

919
00:58:38,230 --> 00:58:41,530
The UBR will tell me their UDDI server, if they have one.

920
00:58:41,570 --> 00:58:45,370
I talk to their UDDI server, and it has things like invoicing, right?

921
00:58:45,370 --> 00:58:48,490
Maybe I want to do... I've sold them some stuff, I want to invoice them.

922
00:58:48,990 --> 00:58:56,750
And so it says, the invoicing web service, this is the contact information for that person, and it exists at this URL.

923
00:58:56,750 --> 00:59:05,170
And so I go to that URL, I add a question mark WSDL, and the invoicing service tells me, OK, these are the nine things you can do with the invoicing service.

924
00:59:05,170 --> 00:59:08,250
And now I have the ability to do whatever I want to those different methods.

925
00:59:08,270 --> 00:59:10,230
So that's the tree, and that's how people envision it.

926
00:59:10,230 --> 00:59:14,070
Obviously, it makes things easy for businesses, but it also makes things easy for attackers.

927
00:59:14,070 --> 00:59:21,750
One of the really scary things is there's currently no real binding of somebody who's in the UBR really is that person, right?

928
00:59:21,770 --> 00:59:25,310
Like this next one, who here is going to trust this entry?

929
00:59:25,310 --> 00:59:26,650
Bank of China, right?

930
00:59:26,650 --> 00:59:30,770
There's no cryptographic protection saying this is the Bank of China, but here they are.

931
00:59:30,770 --> 00:59:37,250
They're listed in the UBR, and with a character set that I can't read in my browser because I don't have the Chinese character set, right?

932
00:59:37,250 --> 00:59:43,210
Now, people are working on these big PKIs by which you can authenticate web services, but people are fighting over the standards.

933
00:59:43,350 --> 00:59:44,610
Obviously, it's a lot of money.

934
00:59:44,610 --> 00:59:52,490
Just as it's a lot of money to be able to sign certificates for web apps, it's going to be a lot of money for web services because it's only corporations.

935
00:59:52,490 --> 00:59:53,810
It's very rarely individuals.

936
00:59:54,290 --> 00:59:57,710
And so, there's no good way of verifying this right now.

937
00:59:58,130 --> 01:00:01,770
So, we'll do a little walk through a UBR.

938
01:00:01,770 --> 01:00:04,590
Microsoft has the prettiest interface, so I think I'll use theirs.

939
01:00:06,130 --> 01:00:11,650
So, fortunately, Microsoft puts up a big barrier to keeping attackers from using a UBR.

940
01:00:12,670 --> 01:00:14,490
You have to be registered.

941
01:00:14,490 --> 01:00:16,590
What kind of registration do you think you need?

942
01:00:17,270 --> 01:00:18,610
A passport.

943
01:00:18,610 --> 01:00:24,070
So, I mean, if that restricts all attackers with a Hotmail account, I think we're all okay.

944
01:00:29,290 --> 01:00:35,210
I'm going to sign in first so you guys can't razz me with how short my passport is.

945
01:00:36,590 --> 01:00:38,350
Are any of the passport guys in here?

946
01:00:38,690 --> 01:00:40,090
Passport's great, by the way.

947
01:00:40,190 --> 01:00:41,710
Are any of the passport guys here?

948
01:00:48,640 --> 01:00:50,760
There are actually some really smart guys.

949
01:01:03,500 --> 01:01:06,720
Okay, well, I'm going to talk about something while this is loading.

950
01:01:07,860 --> 01:01:08,580
What?

951
01:01:08,580 --> 01:01:09,240
Sorry?

952
01:01:12,910 --> 01:01:13,870
Oh, wait, a book.

953
01:01:13,870 --> 01:01:14,650
Excellent.

954
01:01:14,950 --> 01:01:17,370
Yeah, because this is going real slow.

955
01:01:17,550 --> 01:01:20,190
Somebody's tossing Microsoft in the dustbin, probably, so...

956
01:01:20,190 --> 01:01:22,070
Okay, compensation.

957
01:01:24,510 --> 01:01:31,410
Okay, the first person who can raise their hand and give me the new canonical XPath gets the prize.

958
01:01:32,050 --> 01:01:32,830
Yes, sir.

959
01:01:39,000 --> 01:01:40,080
Er, next?

960
01:01:40,080 --> 01:01:41,960
The next, the injection attack itself.

961
01:01:41,960 --> 01:01:42,460
The string.

962
01:01:42,460 --> 01:01:43,200
Yes, sir.

963
01:01:45,780 --> 01:01:47,140
It's not a semicolon.

964
01:01:48,600 --> 01:01:50,240
Okay, I'm going to close my eyes.

965
01:01:50,240 --> 01:01:51,100
Oh, no, I'm not closing my eyes.

966
01:01:51,100 --> 01:01:52,360
I'm going to say yes.

967
01:01:52,360 --> 01:01:55,000
I'm going to say now and then everybody raise their hand and whoever's fastest.

968
01:01:55,100 --> 01:01:56,560
Jesus, there's no way to do this.

969
01:01:56,840 --> 01:01:57,380
Now.

970
01:01:58,900 --> 01:02:01,420
I think this gentleman was up there.

971
01:02:05,740 --> 01:02:06,340
Bam!

972
01:02:06,340 --> 01:02:07,620
You are the winner, sir.

973
01:02:07,700 --> 01:02:08,520
What is your name, sir?

974
01:02:08,520 --> 01:02:10,000
Come on up, get your prize.

975
01:02:11,720 --> 01:02:13,640
And he can't even see the slides.

976
01:02:13,640 --> 01:02:14,660
That is amazing.

977
01:02:17,760 --> 01:02:18,760
What's your name, sir?

978
01:02:19,500 --> 01:02:20,680
I've spotted the Fed.

979
01:02:20,680 --> 01:02:21,820
Mike, show them the shirt.

980
01:02:27,930 --> 01:02:30,130
Okay, that was perfect timing, Mike.

981
01:02:30,130 --> 01:02:32,650
Good work, because now I am logged into the UBR server.

982
01:02:32,650 --> 01:02:34,190
Now, I'm not trying to beat up a Microsoft.

983
01:02:34,190 --> 01:02:37,190
I'm just using them because they have the prettiest interface.

984
01:02:37,990 --> 01:02:39,730
And you don't have to really register.

985
01:02:39,730 --> 01:02:40,530
You just use Passport.

986
01:02:40,530 --> 01:02:43,490
But as I said, those four companies all run UBR nodes.

987
01:02:43,490 --> 01:02:44,830
They all sync up with each other.

988
01:02:44,830 --> 01:02:46,550
Right, so this is the same data from all of them.

989
01:02:46,550 --> 01:02:51,430
So, we can do things like we can register ourselves as users.

990
01:02:51,430 --> 01:02:53,590
We can publish ourselves.

991
01:02:53,610 --> 01:02:59,030
Like I said, when you publish yourself as Bank of America, nobody calls the Bank of America headquarters to make sure.

992
01:02:59,310 --> 01:03:01,930
A little information and stuff.

993
01:03:01,930 --> 01:03:03,430
Let's try the search field.

994
01:03:04,970 --> 01:03:06,630
What should we search for?

995
01:03:07,630 --> 01:03:08,930
Any... chase.

996
01:03:08,930 --> 01:03:09,570
Okay.

997
01:03:11,770 --> 01:03:13,910
Like a car chase, you mean.

998
01:03:13,910 --> 01:03:14,590
Right?

999
01:03:17,650 --> 01:03:19,530
Another cool thing is they've got all these...

1000
01:03:19,530 --> 01:03:20,390
Well, it's not cool.

1001
01:03:20,390 --> 01:03:21,870
It's actually incredibly boring.

1002
01:03:21,870 --> 01:03:23,090
But it might be useful.

1003
01:03:23,090 --> 01:03:26,710
Is that there's all these different ways you can categorize these web services that are all competing.

1004
01:03:26,710 --> 01:03:28,290
Like the government has some.

1005
01:03:28,290 --> 01:03:30,630
And then the visual studio has its own.

1006
01:03:30,630 --> 01:03:31,690
All this kind of stuff.

1007
01:03:31,690 --> 01:03:42,170
And eventually, when a lot of people are using it, you should be able to walk your way down this tree and find all the things that are important.

1008
01:03:42,190 --> 01:03:43,870
Finance, that sounds like important.

1009
01:03:56,100 --> 01:03:57,540
Okay, they say there's none.

1010
01:03:57,540 --> 01:03:58,300
Okay.

1011
01:03:58,680 --> 01:04:01,520
That doesn't mean that they've actually categorized everything.

1012
01:04:07,660 --> 01:04:08,260
Let's see.

1013
01:04:08,260 --> 01:04:10,320
Did anybody see where I searched my name on this?

1014
01:04:12,980 --> 01:04:14,100
Maybe it's enterprise.

1015
01:04:16,060 --> 01:04:17,300
You're right, you're right.

1016
01:04:17,820 --> 01:04:22,800
So I can provide... providers is like the English name of the company or enterprise or whoever it is.

1017
01:04:26,700 --> 01:04:29,720
And I'm going to do something more general than chase because I'm not sure they're in here.

1018
01:04:29,720 --> 01:04:32,120
I'm just going to do bank and we'll see what happens.

1019
01:04:33,940 --> 01:04:38,280
There's not a huge number of people because there's not a huge number of people deploying them publicly.

1020
01:04:39,220 --> 01:04:44,560
One of the things that our web... WSMAP, one of the tools that we're releasing.

1021
01:04:44,700 --> 01:04:47,280
One of the functionalities we had to pull at the last minute.

1022
01:04:50,320 --> 01:04:57,120
It's funny, if you buy like a learned web services book and it's got like an example how to do a UDDI registry, search for that thing.

1023
01:04:57,120 --> 01:05:02,140
It's going to be like Acme Bank or something and there'll be hundreds of listings of all the people who have downloaded it and actually done it.

1024
01:05:02,140 --> 01:05:03,480
Which tells you something about this.

1025
01:05:04,100 --> 01:05:05,220
So, Ms.

1026
01:05:05,220 --> 01:05:08,520
Matma Sharma is the contact.

1027
01:05:08,880 --> 01:05:11,840
Here's her email and phone address that I'm not going to click through actually.

1028
01:05:11,960 --> 01:05:17,260
But you put contact information in case you can't get all this magic pixie dust doesn't work and you actually have to call somebody.

1029
01:05:18,980 --> 01:05:21,840
This is saying that Bank of America has a lending service.

1030
01:05:22,760 --> 01:05:23,840
Oh, it's a...

1031
01:05:27,940 --> 01:05:29,680
Oh, they use a local host.

1032
01:05:29,680 --> 01:05:31,460
So, somebody's just been playing around.

1033
01:05:31,720 --> 01:05:36,100
So, but if Port 18000 is now something very interesting to put in your NMAP scan.

1034
01:05:36,100 --> 01:05:38,440
Right, when you look at the Bank of America.

1035
01:05:38,440 --> 01:05:45,740
But if this was... if they're actually... if they're actually exposing this, then this would be an URL to something that's internet exposable.

1036
01:05:45,740 --> 01:05:47,100
And then there'll be interface.

1037
01:05:47,100 --> 01:05:49,580
There's different ways of defining how an interface works.

1038
01:05:51,200 --> 01:05:53,660
Let's see what their interface model is.

1039
01:05:53,660 --> 01:05:56,420
It's called... like I said, there's lots of acronyms.

1040
01:05:56,700 --> 01:05:58,020
It's a T-Lender model.

1041
01:05:58,020 --> 01:06:01,320
So, at this place, if they're publicly doing it, you'd probably have something like an URL.

1042
01:06:01,320 --> 01:06:03,580
I think Bank of America had a WSDL URL.

1043
01:06:07,680 --> 01:06:09,840
Ironically, not a... think of Lithuania.

1044
01:06:09,940 --> 01:06:10,380
Awesome.

1045
01:06:12,280 --> 01:06:15,600
We'll have like an URL that goes to a WSDL that points you directly to...

1046
01:06:15,600 --> 01:06:18,300
Oh, something I forgot to mention about WSDLs that were in the slides.

1047
01:06:18,320 --> 01:06:21,580
A WSDL gives you everything you need to know to attach to a service.

1048
01:06:21,580 --> 01:06:24,020
So, that includes the location of it.

1049
01:06:24,060 --> 01:06:24,440
Right?

1050
01:06:24,440 --> 01:06:29,160
So, a WSDL text document, if it's just floating around, contains all the information.

1051
01:06:29,280 --> 01:06:30,820
Like, this is what you can do.

1052
01:06:30,820 --> 01:06:32,020
This is how you log in.

1053
01:06:32,020 --> 01:06:33,240
This is how you transfer money.

1054
01:06:33,240 --> 01:06:35,260
And this is exactly where the URL is.

1055
01:06:35,260 --> 01:06:38,560
So, if you have a WSDL, you have everything you need to know to actually do the attack.

1056
01:06:38,560 --> 01:06:38,760
Right?

1057
01:06:38,760 --> 01:06:44,140
Because the location of the service, what platform it's running on, all that kind of stuff is contained in there.

1058
01:06:44,820 --> 01:06:45,840
God, this is so slow.

1059
01:06:45,840 --> 01:06:48,760
So, anyway, everybody can go play with this when they're on their fast connections.

1060
01:06:48,760 --> 01:06:54,680
Uddi.microsoft.com or you search for UBR and you can play with other people's if you have a preferred vendor.

1061
01:06:57,160 --> 01:06:57,900
Oh, yeah.

1062
01:06:57,900 --> 01:06:58,920
All kinds of stuff.

1063
01:07:00,140 --> 01:07:04,400
So, at this point, well, I guess I'll show you how the discovery works if I was actually going to do something nice.

1064
01:07:07,660 --> 01:07:11,120
If I wanted to use a web service for legitimate purposes.

1065
01:07:11,840 --> 01:07:18,680
There is a nice little program called WS Web Services Studio.

1066
01:07:18,760 --> 01:07:24,880
It's distributed off of .net.com, which is like the Microsoft community site for .net developers.

1067
01:07:24,880 --> 01:07:28,500
I think it's actually made by Microsoft but not supported, so they throw it on the cheap site.

1068
01:07:28,640 --> 01:07:30,900
So, they don't have people calling the 800 number about it.

1069
01:07:31,160 --> 01:07:32,600
It's a great little graphical interface.

1070
01:07:32,600 --> 01:07:42,480
Like I said, you know, web services, unless somebody gives you the client or if it's something like an Ajax app, you don't have a nice gooey way of talking to it.

1071
01:07:42,480 --> 01:07:43,860
So, it's a good thing for a developer.

1072
01:07:43,860 --> 01:07:44,360
Yes , sir.

1073
01:07:48,080 --> 01:07:50,980
Right, and Eclipse has a web service platform.

1074
01:07:50,980 --> 01:07:54,660
I use XMLSpy, which is really expensive, but there's all kinds of really cool stuff, too.

1075
01:07:56,120 --> 01:07:57,400
So, Web Services Studio.

1076
01:07:57,400 --> 01:07:58,660
I think I've already gone to the bank.

1077
01:08:00,800 --> 01:08:02,960
So, this is the studio.

1078
01:08:04,120 --> 01:08:06,900
It does things like, like I said, you put a WSDL in there.

1079
01:08:06,900 --> 01:08:08,780
It can either be on the internet and you ask for it.

1080
01:08:08,780 --> 01:08:11,780
It can be local and then it'll figure out where it is from the local one.

1081
01:08:12,680 --> 01:08:17,460
And I'm going to go back to the Bank of Lithuania.

1082
01:08:18,180 --> 01:08:20,340
To the interest rates.

1083
01:08:21,740 --> 01:08:22,700
Details.

1084
01:08:28,310 --> 01:08:29,290
Ah, here we go.

1085
01:08:29,290 --> 01:08:30,550
Here's the access point.

1086
01:08:33,270 --> 01:08:34,430
ASM.ASMX.

1087
01:08:34,430 --> 01:08:37,170
So, what platform do you guys think that is?

1088
01:08:38,030 --> 01:08:39,150
Windows, right?

1089
01:08:39,150 --> 01:08:40,470
It's probably ASP.NET.

1090
01:08:41,510 --> 01:08:48,530
Although web services are supposed to be universally worked with each other, there's lots of little details and so it doesn't always work.

1091
01:08:48,650 --> 01:08:52,910
In fact, one of our tools, you know, there's some problems.

1092
01:08:52,910 --> 01:08:53,650
I'll demonstrate.

1093
01:08:53,650 --> 01:08:55,450
There's some problems with the Python implementation.

1094
01:08:55,590 --> 01:08:59,410
One of the problems is, you know, not a lot of people are doing web services person-to-person.

1095
01:08:59,610 --> 01:09:02,090
They generally control the software on both sides.

1096
01:09:02,090 --> 01:09:04,630
So, they use the same platform so these bugs don't get caught, right?

1097
01:09:04,690 --> 01:09:07,370
So, it's good that this is a Windows 1.

1098
01:09:07,550 --> 01:09:12,670
So, we'll just guess that they have WSDL generation on there.

1099
01:09:13,710 --> 01:09:15,570
Looks like he was able to get it.

1100
01:09:19,590 --> 01:09:21,290
This network is so slow.

1101
01:09:24,820 --> 01:09:27,540
Is Kaminsky talking now and doing his weird network stuff?

1102
01:09:27,540 --> 01:09:27,980
No.

1103
01:09:28,660 --> 01:09:29,260
Last night.

1104
01:09:29,260 --> 01:09:29,780
Okay.

1105
01:09:30,100 --> 01:09:30,960
Was that good?

1106
01:09:33,920 --> 01:09:34,840
Excuse me, sir?

1107
01:09:36,880 --> 01:09:37,420
Really?

1108
01:09:37,420 --> 01:09:38,940
He ended up at the hospital, Dan Kaminsky.

1109
01:09:40,080 --> 01:09:40,800
Jesus.

1110
01:09:40,800 --> 01:09:44,220
Okay, we're taking a collection in the memory of Dan Kaminsky.

1111
01:09:46,940 --> 01:09:51,280
Unlike Dan Kaminsky, I actually don't put in applause, pauses in my presentation.

1112
01:09:51,280 --> 01:09:52,520
Do you guys think I should do that?

1113
01:09:52,900 --> 01:09:53,440
Let go.

1114
01:09:53,440 --> 01:09:54,580
And that's a WSDL!

1115
01:09:55,500 --> 01:09:56,360
Ta-da!

1116
01:09:56,700 --> 01:09:57,560
Thank you.

1117
01:09:57,700 --> 01:09:58,280
Thank you.

1118
01:09:58,880 --> 01:10:01,980
So, this was able to grab the WSDL.

1119
01:10:02,480 --> 01:10:05,780
And it's generated, like I said, it has all the information it needs to know on the service.

1120
01:10:05,780 --> 01:10:06,900
These are different methods.

1121
01:10:06,900 --> 01:10:11,380
This is just as if I was writing an application and I call a function that's defining my function.

1122
01:10:11,380 --> 01:10:13,880
Just think of it as that, although it goes across the internet.

1123
01:10:14,220 --> 01:10:24,340
In the web app world, these could be either parameters in a post, like transfer money or do this, or it could be the URLs themselves, like slash interest slash get money.

1124
01:10:25,020 --> 01:10:30,840
So if I click on one of these, it tells me what was defined in the header and the body for each one of these.

1125
01:10:31,020 --> 01:10:34,000
This has nothing, so that means it doesn't take any input.

1126
01:10:34,900 --> 01:10:38,760
This one takes one string in the body.

1127
01:10:38,900 --> 01:10:44,960
And so if I wanted to put a value in there, I could put it in there and say invoke.

1128
01:10:44,960 --> 01:10:51,840
This is meant for legitimate users, so it won't let you do things other than what they define.

1129
01:10:52,100 --> 01:10:57,740
But like I said, people sometimes don't check very well, so it might be very possible...

1130
01:10:57,740 --> 01:11:10,200
One good way to do an attack on this would be to run Web Service Studio or Eclipse or XML Spy through WebScarab, watch the traffic that's legitimate, and then edit it byte by byte by byte.

1131
01:11:10,200 --> 01:11:13,760
Remember, it's UTF-8, so it's two bytes per character if it's internationalized.

1132
01:11:15,040 --> 01:11:18,760
Interest rate, interest rates by day, interest rates by date type, yada yada.

1133
01:11:18,760 --> 01:11:24,620
So this one doesn't require anything to invoke it, so I'll invoke it, and I should get something back.

1134
01:11:24,620 --> 01:11:35,120
So right now it's going across the internet, it used the WSDL to generate a message that it thinks these people are going to understand, and it sends it to them as an HTTP post and waits for the response, and here's the response.

1135
01:11:35,620 --> 01:11:38,400
It's an XML document, it automatically parses it for us.

1136
01:11:39,720 --> 01:11:42,800
Like I said, this is not how you're supposed to use this, right?

1137
01:11:42,900 --> 01:11:47,860
If I was another bank and I wanted to get the interest rate, I'd have some application that would do this automatically and then give it to a user.

1138
01:11:47,880 --> 01:11:52,520
Or if I was Bank of Lithuania, I'd create a nice little pretty GUI to do this for people, right?

1139
01:11:52,520 --> 01:11:53,960
So that's why this is all ugly.

1140
01:11:54,180 --> 01:11:56,440
Like I said, this isn't meant for human consumption.

1141
01:11:57,180 --> 01:12:02,520
But here it gives us all the data that came back, we can say request response, and we'll actually see...

1142
01:12:04,860 --> 01:12:12,620
SOAP messages have the envelope, the body, the header, we talked about the header, the envelope's required, it has things like what version of SOAP am I using, what's the namespace, stuff like that.

1143
01:12:12,720 --> 01:12:15,840
And then the response, which is just an HTTP response.

1144
01:12:16,720 --> 01:12:21,460
I love this, they tell us the exact service pack version of ASP.NET.

1145
01:12:23,000 --> 01:12:29,260
And then a UTF-16 encoded XML document that gives all the input that comes back.

1146
01:12:29,260 --> 01:12:37,180
Just like if I called in a program, if I called, give me an interest rate, and it had three things it returns, this will return everything even if it doesn't have information in there.

1147
01:12:37,220 --> 01:12:38,340
And we're good to go.

1148
01:12:38,340 --> 01:12:40,640
So, here's the WSDL, it's really ugly.

1149
01:12:40,640 --> 01:12:42,220
You can see why people don't read them.

1150
01:12:42,220 --> 01:12:46,200
For something that simple, right, it's all that WSDL.

1151
01:12:46,520 --> 01:12:48,320
You have to define everything like four times.

1152
01:12:49,220 --> 01:12:52,500
And you can see why that might be a place that people don't look.

1153
01:12:57,580 --> 01:13:01,200
So, we'll do an attack and we'll use Web Service Studio for it.

1154
01:13:01,200 --> 01:13:03,240
So, to wrap up before we get to the demo.

1155
01:13:04,180 --> 01:13:05,940
Why do we have all these discovery methods?

1156
01:13:05,940 --> 01:13:09,040
It's this thing called service-oriented discovery, more venture capital.

1157
01:13:09,040 --> 01:13:12,940
It's amazing how much of the English language is based upon what can get you venture capital.

1158
01:13:13,580 --> 01:13:15,080
Service-oriented architectures.

1159
01:13:15,120 --> 01:13:18,520
The idea is that delayed binding of applications.

1160
01:13:18,560 --> 01:13:33,180
If I'm Bank of America, and I know most of the banks in the world use some kind of standard thing to, say, clear checks, then I can, not even knowing who those other banks are, go to a registry, cryptographically check that that person is who they are,

1161
01:13:33,180 --> 01:13:40,160
because it's signed by somebody I trust, find the web service to do the transfer, find how to talk to that web service and talk to it.

1162
01:13:40,160 --> 01:13:42,860
And you can program their software to do all this, right?

1163
01:13:43,140 --> 01:13:45,660
Lots of MagicPC dust, it's a little bit scary.

1164
01:13:45,980 --> 01:13:52,740
But because this is so powerful, and because you can automate stuff to do things without humans ever involved, it's going to be very popular with people.

1165
01:13:53,220 --> 01:13:55,560
Other than UBRs, there's some cool third-party registries.

1166
01:13:55,560 --> 01:13:58,860
x-methods.net has a big list of fun services.

1167
01:13:59,020 --> 01:14:00,980
A lot of these are by people who are just having fun.

1168
01:14:00,980 --> 01:14:03,380
Things like census data by zip code and stuff like that.

1169
01:14:03,380 --> 01:14:06,900
It's a good place to play around if you just want to learn about web services.

1170
01:14:07,440 --> 01:14:10,240
And then there's this thing called Disco slash WS Inspection.

1171
01:14:10,240 --> 01:14:12,160
Disco is a lightweight UDDI.

1172
01:14:12,160 --> 01:14:17,580
Instead of running a whole server to tell you what my services are, I just have a text file you can read it in, an XML file.

1173
01:14:17,580 --> 01:14:25,520
This was a Microsoft-specific thing that's becoming now WS Inspection, which is going to be a real standard to do this without running a whole other server to do it.

1174
01:14:25,520 --> 01:14:27,920
Our tool will automatically look for Disco files for you.

1175
01:14:28,280 --> 01:14:33,440
Like I said, a Disco file will automatically be deployed for you if you hit the compile button on Visual Studio.

1176
01:14:36,540 --> 01:14:38,560
And so those are some of the new issues.

1177
01:14:38,560 --> 01:14:41,280
The traditional attacks that we've always had still exist, right?

1178
01:14:41,280 --> 01:14:46,700
Design flaws, the bad idea methods like we talked about, the same OWASP top 10 things.

1179
01:14:46,700 --> 01:14:48,580
SQL injection still exists, right?

1180
01:14:48,580 --> 01:14:53,860
Although some of these things are using XML on the back end, a lot of them are still using SQL.

1181
01:14:54,160 --> 01:14:58,180
And so just as we had in web apps, SQL injection will work.

1182
01:14:58,180 --> 01:14:59,540
I'm not going to talk about SQL injection.

1183
01:14:59,540 --> 01:15:01,460
You can go find Dave Litchfield for that.

1184
01:15:01,540 --> 01:15:04,120
The thing I will tell you is that the best way to do it is to...

1185
01:15:04,120 --> 01:15:06,060
You have to escape those characters generally.

1186
01:15:06,140 --> 01:15:14,640
You can use something like a CDATA block, put the entire SQL stream in it that will magically get transferred by the XML document into whatever the string is and then put into the query.

1187
01:15:15,560 --> 01:15:17,660
Overflow is an unmanaged code, right?

1188
01:15:17,800 --> 01:15:23,060
Managed code is the Microsoft term for things like Java and .NET that run in a virtual machine.

1189
01:15:23,060 --> 01:15:28,340
Unmanaged code being something like I compile C++ for an x86 or a Spark, right?

1190
01:15:28,340 --> 01:15:33,260
Well, there's a lot of... a lot of people have a lot of stuff written in C and C++ out there they still use.

1191
01:15:33,260 --> 01:15:35,920
It still is the core of their stuff that they want to expose.

1192
01:15:35,920 --> 01:15:42,040
And so all the vendors have cool ways of taking something that's compiled on my machine and making it web service accessible.

1193
01:15:42,040 --> 01:15:44,060
One great one is called .NET Remoting.

1194
01:15:44,060 --> 01:15:46,020
And again, I'm not beating up on Microsoft because they're bad.

1195
01:15:46,020 --> 01:15:49,280
It's just theirs is the coolest and the easiest to use, right?

1196
01:15:49,280 --> 01:15:54,820
If you have a COM object that works and, you know, it can be something... I think it has to support I Unknown.

1197
01:15:54,840 --> 01:15:56,120
It's like the same standards.

1198
01:15:56,120 --> 01:15:58,240
It has to be remotable like an ActiveX control.

1199
01:15:58,240 --> 01:16:01,200
If you have a COM object, you can just click through.

1200
01:16:01,200 --> 01:16:02,580
You don't have to write any code.

1201
01:16:03,520 --> 01:16:05,520
And say, I like this COM object.

1202
01:16:05,520 --> 01:16:07,900
I want these methods to be exposed to the world.

1203
01:16:11,420 --> 01:16:17,940
And all of a sudden, now there's a web service with all these... takes all these inputs and gives it to a C++ program.

1204
01:16:17,940 --> 01:16:22,580
Do you think that it goes and finds out what the limit on that stirring copy is?

1205
01:16:22,580 --> 01:16:26,240
Or what the... I'm sorry, what the static buffer that goes to that stir copy is in that C++?

1206
01:16:26,460 --> 01:16:27,280
Do you think it does that?

1207
01:16:27,280 --> 01:16:28,040
No, it doesn't.

1208
01:16:28,040 --> 01:16:28,240
Right?

1209
01:16:28,240 --> 01:16:29,220
It just gives it the information.

1210
01:16:29,220 --> 01:16:31,340
It just says a COM object can be called locally.

1211
01:16:31,340 --> 01:16:35,100
And so it makes it really easy for people to take something that's local and remote it.

1212
01:16:35,100 --> 01:16:36,900
So .NET Remoting, it's fun.

1213
01:16:37,020 --> 01:16:39,760
See it in theaters near you in 2007, right?

1214
01:16:39,760 --> 01:16:41,360
When people start really deploying it.

1215
01:16:41,360 --> 01:16:45,320
It's a cheap way to do web services if you already have stuff written on the Windows platform.

1216
01:16:45,420 --> 01:16:49,020
Java, you can do the same thing with like RMI and local calls and stuff.

1217
01:16:49,120 --> 01:16:50,040
It's not as easy though.

1218
01:16:50,040 --> 01:16:51,240
It's not just click, click, click.

1219
01:16:51,840 --> 01:16:53,560
Mistakes in authorization and authentication.

1220
01:16:53,940 --> 01:16:57,180
Because SOAP is stateless, people have to rule their own, right?

1221
01:16:57,180 --> 01:17:04,100
It's very possible that there are methods out there that you find from the WSDL that don't require you, that don't properly check your access control before they do something.

1222
01:17:04,100 --> 01:17:07,560
They take a parameter like, I want to transfer money from this bank account to this bank account.

1223
01:17:07,560 --> 01:17:09,760
They don't check whose bank accounts those are.

1224
01:17:11,120 --> 01:17:13,860
Like I said before, the auto-discovery mechanisms make this great.

1225
01:17:13,860 --> 01:17:17,140
Because you no longer have to go look for this stuff that's kind of crusty in the web application.

1226
01:17:17,140 --> 01:17:18,480
You just ask the WSDL.

1227
01:17:18,620 --> 01:17:22,360
And like, they're sometimes named really stupid things like, make me admin, right?

1228
01:17:23,140 --> 01:17:24,160
Cross-site scripting.

1229
01:17:24,160 --> 01:17:28,500
Now, like I said, this is not something, SOAP isn't something that you eat with your web browser, right?

1230
01:17:28,500 --> 01:17:33,900
So if I get cross-site scripting coming back in XML, it's not going to run as script.

1231
01:17:34,380 --> 01:17:40,340
But, and this is the big but, there's a lot of situations in which there's a web interface also in these applications.

1232
01:17:40,400 --> 01:17:45,220
And so cross-site scripting is also still doable, it's just you're not attacking the web service itself.

1233
01:17:45,220 --> 01:17:48,260
The exception to this being AJAX, right?

1234
01:17:48,660 --> 01:17:50,500
The downside is it's not easy.

1235
01:17:51,380 --> 01:17:53,840
I mean, I guess it's an upside because we're all good people in this room.

1236
01:17:53,840 --> 01:17:56,440
The downside for the bad guys is it's not easy.

1237
01:17:56,440 --> 01:18:02,680
Because I have to write something that, you know, in AJAX, like in Google Maps, it takes some XML data and then it makes it presentable.

1238
01:18:02,680 --> 01:18:08,900
So I have to figure out probably exactly how that's happening to write cross-site scripting script that'll actually run when it's transferred.

1239
01:18:08,900 --> 01:18:17,820
That being said, unless they're doing filtering on their side before the information gets to me, it might be possible for me to do input through an AJAX interface one place and pop it out somewhere else.

1240
01:18:17,940 --> 01:18:22,400
Another thing we've seen is a lot of these web services, there's a human in the loop somewhere, right?

1241
01:18:22,400 --> 01:18:32,340
If I go transfer money at a bank and I have to put a memo field in there about what my transfer's about, I put that field in, I make sure the transfer's gonna die, I call up the customer service rep.

1242
01:18:32,640 --> 01:18:33,820
Hello, how can we help you?

1243
01:18:33,820 --> 01:18:36,140
We're, you know, dumbassbank.com.

1244
01:18:36,620 --> 01:18:37,720
What can we do for you?

1245
01:18:37,740 --> 01:18:40,280
Well, you know, my transfer's not working out.

1246
01:18:40,280 --> 01:18:42,320
Can you pull my file up and see what it is?

1247
01:18:42,320 --> 01:18:43,460
Well, sure, give us your social.

1248
01:18:43,520 --> 01:18:45,820
They pull it up, it's a web interface, boom.

1249
01:18:46,300 --> 01:18:46,920
Their own.

1250
01:18:47,320 --> 01:18:49,240
Obviously, that's a pretty sophisticated attack.

1251
01:18:49,240 --> 01:18:53,220
It requires some possible inside knowledge, but maybe not.

1252
01:18:53,220 --> 01:19:06,860
And if this is, you know, if you have an IE0 day, or the way people patch IE in IE, you know, 90 day or something, in most enterprises, right, people are still writing IE5 and stuff, then you might get root control of their box.

1253
01:19:09,580 --> 01:19:13,320
So, any questions on those attacks before we kind of move into the wrap-up and then the demo?

1254
01:19:13,320 --> 01:19:15,460
I'm sorry that I know it's a lot of talking in a row.

1255
01:19:15,460 --> 01:19:16,120
Yes, sir.

1256
01:19:31,810 --> 01:19:33,950
Right, did everybody hear that?

1257
01:19:34,050 --> 01:19:37,630
That Apache Access allows you to take pre-written Java and just drop it in.

1258
01:19:37,630 --> 01:19:38,990
Yes, Access is great, too.

1259
01:19:38,990 --> 01:19:46,410
Apache Access, if you guys want to play with web services and you don't like Microsoft, Apache, the Apache project has their own web service framework, works with Java, it's very nice.

1260
01:19:46,510 --> 01:19:47,730
We're playing with that, too.

1261
01:19:47,730 --> 01:19:53,710
I know, I'm saying, I'm beating up on Microsoft here because of the demos written in Microsoft, but this is stuff that everybody does.

1262
01:19:53,850 --> 01:19:54,810
So, thank you, sir.

1263
01:19:54,810 --> 01:19:55,990
That's a good point.

1264
01:19:56,750 --> 01:19:59,330
So, we have a couple of tech tools that I'll show you.

1265
01:19:59,330 --> 01:20:07,530
One's really cool, the one that Scott wrote, the one I wrote is kind of crappy, but I'll pretend that I wrote the one that Scott wrote.

1266
01:20:07,550 --> 01:20:10,610
The cool one is WizBang, that's how we pronounce it.

1267
01:20:10,610 --> 01:20:12,230
It is a SOAP fuzzer.

1268
01:20:12,510 --> 01:20:15,890
It doesn't fuzz the SOAP implementation, it fuzzes the application behind it.

1269
01:20:15,890 --> 01:20:17,610
It takes a WSDL, right?

1270
01:20:17,610 --> 01:20:23,270
And, you know, you can go and buy, like, SPI Dynamics and SyncDyn and all these, like, attack tools, attack web apps.

1271
01:20:23,270 --> 01:20:28,730
The really hard part that those guys have to tackle in writing those is actually the discovery of the attack surface, right?

1272
01:20:28,730 --> 01:20:31,730
For us, the discovery of the attack surface is easy because we ask it.

1273
01:20:31,730 --> 01:20:37,670
And unless they're really smart and they're manually editing the WSDLs, the WSDL will most likely represent the actual attack surface.

1274
01:20:38,270 --> 01:20:42,670
If it's not automatically generated to the WSDL, it's probably not callable remotely.

1275
01:20:42,730 --> 01:20:52,330
And so, it takes a WSDL, creates a nice little proxy, looks up what the types are, like, this is a string, this is an integer, and it does nasty things depending on that type, it's all extensible.

1276
01:20:53,390 --> 01:21:01,050
It supports SOAP responses and faults, gives you a nice little interface, I'll demo it, and, well, not a nice little interface, it gives you output in a webpage.

1277
01:21:02,070 --> 01:21:08,170
And the future work we're looking at right now, it only works with RPC-style SOAP for all the really hardcore SOAP people in here.

1278
01:21:08,170 --> 01:21:14,230
It doesn't do doc lit because of a bug in Python's implementation of SOAPy, but we're working on it.

1279
01:21:14,230 --> 01:21:16,130
We're going to resubmit a patch to them and get it fixed.

1280
01:21:16,130 --> 01:21:20,130
So, once we get the libraries fixed, it should support almost all web services.

1281
01:21:20,270 --> 01:21:27,370
Oh, here's Jesse Burns, my partner, who has also helped Scott in writing this and who is always tragically late.

1282
01:21:27,370 --> 01:21:34,210
But not on consulting projects, he's never late on consulting projects for all those people with...

1283
01:21:34,210 --> 01:21:35,750
Wait, I'll do a Dan Kaminsky.

1284
01:21:35,810 --> 01:21:36,370
Jesse!

1285
01:21:36,370 --> 01:21:37,430
Ta-da!

1286
01:21:38,850 --> 01:21:39,710
Thank you.

1287
01:21:39,790 --> 01:21:41,010
Thank you very much.

1288
01:21:41,010 --> 01:21:59,070
And then the other tool that Jesse helped with, that's pretty cool, it's OK, takes a WebScarab as input, we use WebScarab a lot now, it's a really good product, WebAttackProxy is probably the most you know, it's open source, OS does it, there's this guy named Rogan in South America,

1289
01:21:59,070 --> 01:21:59,530
right?

1290
01:22:00,010 --> 01:22:01,210
I don't know where he is.

1291
01:22:01,770 --> 01:22:03,550
South Africa, I'm sorry, he's not South American.

1292
01:22:03,550 --> 01:22:04,850
That's it, he's EA, right?

1293
01:22:05,490 --> 01:22:08,130
Who works on it, and Jesse submitted patches and stuff.

1294
01:22:08,130 --> 01:22:11,050
Jesse likes to run it in Eclipse, in debug mode, like in real time.

1295
01:22:11,050 --> 01:22:12,990
He's pretty hardcore about that.

1296
01:22:13,630 --> 01:22:19,570
But anyway, it's really cool, and we use it a lot, and WizMap is not really for finding web services that are out there.

1297
01:22:19,570 --> 01:22:24,790
WizMap is useful for situations in which I have something that already talks over a web service.

1298
01:22:24,790 --> 01:22:28,730
So, maybe I... let me think of something.

1299
01:22:28,930 --> 01:22:37,190
So, back in the B2B, when I was talking about places web services are being used, there's a point on the slide about OFX, which is the standard... anybody here use Quicken or Money?

1300
01:22:37,690 --> 01:22:41,430
OK, you're not going to raise your hands, but there are people in here who use Quicken or Money to manage their money.

1301
01:22:41,430 --> 01:22:42,530
There's nothing wrong with that.

1302
01:22:42,530 --> 01:22:49,870
I'm just saying that OFX is the standard by which it talks to banks when you say, update my account, and it gets your American Express information.

1303
01:22:49,970 --> 01:22:51,050
That's called OFX.

1304
01:22:51,050 --> 01:22:54,110
The next version of OFX is based on SOAP, right?

1305
01:22:54,110 --> 01:22:55,530
So, say I have a client like that.

1306
01:22:55,530 --> 01:23:00,350
I have something that's been shipped to me, and uses a web service on the back end, and I want to reverse engineer it.

1307
01:23:00,350 --> 01:23:11,570
So, I'll put WebScarab... I'll set my HCD proxy, put WebScarab on it, and watch that traffic, because it goes up from Quicken up to Chase and MBNA and American Express and stuff, right?

1308
01:23:11,570 --> 01:23:13,190
Those don't go through Quicken.

1309
01:23:13,530 --> 01:23:16,650
Intuit just tells Quicken where to find those people, and then they go find it, right?

1310
01:23:16,650 --> 01:23:18,270
And that's all over SOAP.

1311
01:23:18,330 --> 01:23:34,650
And so, say I want to actually, you know, research that communication channel, then I'll record it in WebScarab logs, and I'll run WISMAP, and WISMAP will go through and find all of the things I called, as well as the implied directories, and try a bunch of web service discovery requests,

1312
01:23:34,650 --> 01:23:38,010
looking for WSDLs and disco files and stuff, and then write them out to the disk.

1313
01:23:38,010 --> 01:23:46,450
So, I don't have to manually go through and find the things that are actually web services or not, and they'll find all the implied web services, and maybe they don't want their disco files out there, or they just don't know that when they hit compile,

1314
01:23:46,450 --> 01:23:47,610
it automatically goes out there.

1315
01:23:47,690 --> 01:23:48,470
Stuff like that.

1316
01:23:49,050 --> 01:23:51,830
Future work, something we had to pull at the last minute because it wasn't working.

1317
01:23:51,970 --> 01:23:57,390
We're trying to get to find UDDI servers when you get a SIPR range, or maybe even an NMAP XML file, right?

1318
01:23:57,390 --> 01:24:06,470
Because they are web servers, you have to do kind of a Nickto kind of thing, where you get a UDDI, where you look at a web server and you ask it, you know, for different URLs that mean that it's a UDDI server.

1319
01:24:06,510 --> 01:24:15,690
That's going to be very powerful, because like I said, there are enterprises out there that have these exposed, just don't tell people about it, don't register them in UDRs, just tell their partners about it.

1320
01:24:16,510 --> 01:24:29,990
And then hopefully one day we'll integrate it with WSBANE, so you can run it against, you know, the people that you have a legal ability to pen test against, and then you can restrict it based on a reg X to only be within their domain, and it will go find the web services and then automatically attack them,

1321
01:24:29,990 --> 01:24:33,770
you run it overnight, and then, you know, your two-week engagement's done in an hour and a half.

1322
01:24:35,710 --> 01:24:47,870
Okay, tying it all together, I think we kind of talked about this, I can go to a UBR, I can test UDDI server, ask for the services, I go ask, you know, dumbbank.com, give me all your web services, I ask that service, give me your WSDL, it gives me the WSDL,

1323
01:24:47,870 --> 01:24:58,170
I look at the dangerous methods, I run WSBANE to try all of those, I find an XML injection, I use XML injection to change the user ID, and I become whoever I want.

1324
01:25:00,720 --> 01:25:05,220
So a question here is, are the old bugs still relevant?

1325
01:25:05,220 --> 01:25:13,860
A lot of people here would argue that OWASP Top 10 was never relevant, or that OWASP Top 10 is actually saying that OWASP Top 4 in ten different ways, but it turns out that it is, right?

1326
01:25:13,860 --> 01:25:15,860
These are still bugs that exist in our world.

1327
01:25:15,960 --> 01:25:24,020
You still have to validate input, access control is still a problem, authentication and session management is a problem, like I said, SOAP doesn't give that to you, you have to think about it yourself.

1328
01:25:24,600 --> 01:25:30,520
Cross-site scripting, less of a problem, but a problem if there's ever a web interface, and certainly a problem in AJAX applications.

1329
01:25:31,180 --> 01:25:38,800
Injection flaws, buffer overflows, things like .NET remoting make that kind of stuff a reality, because people might get lazy and not rewrite their stuff.

1330
01:25:39,420 --> 01:25:45,920
Injection flaws, SQL injection, XPath injection, this is worse now, because we've added all these new protocols that are spoke on the back end, so we have new things to try.

1331
01:25:46,900 --> 01:25:50,620
Fortunately, almost all of those things use a single quote, so it makes fuzzing really easy for them.

1332
01:25:52,080 --> 01:25:55,200
Insecure storage, denial of service, insecure configuration management.

1333
01:25:55,200 --> 01:25:57,960
I think we've proved that denial of service is still a pretty big issue.

1334
01:25:59,600 --> 01:26:01,580
So, the conclusion before we get to the demo.

1335
01:26:02,840 --> 01:26:06,040
Web services are very powerful, they're easy to use, they're fun to use.

1336
01:26:06,040 --> 01:26:13,020
It's fun to go out and get a book and write 20 lines of code, and have it do something like get me census data, and then plot it onto a map.

1337
01:26:13,020 --> 01:26:14,320
That's really, really cool.

1338
01:26:14,440 --> 01:26:17,240
But, because of all that, they're really, really dangerous.

1339
01:26:18,920 --> 01:26:21,520
Especially because of the ease of use on the developer side.

1340
01:26:22,840 --> 01:26:25,160
There's a lot of security work that needs to be acquired.

1341
01:26:25,180 --> 01:26:30,460
These people are writing these web wiz security standards, but I don't think a lot of security people are looking at them.

1342
01:26:30,600 --> 01:26:32,380
And so, those things need to be inspected.

1343
01:26:32,560 --> 01:26:35,580
We need better attack tools from everybody to help develop.

1344
01:26:36,140 --> 01:26:40,020
We GPL'd our web service stuff, so we're looking for people to help us with that stuff.

1345
01:26:40,880 --> 01:26:44,380
I guess we'll start a source code project or something, so you can do that.

1346
01:26:45,040 --> 01:26:47,280
We need people to find the best practices for development.

1347
01:26:47,420 --> 01:26:50,380
Nobody knows how to write secure web services, that's one of the problems here.

1348
01:26:50,500 --> 01:26:56,000
You can go and buy 20 books now on writing a secure web app, but you can't buy one on writing a secure web service.

1349
01:26:56,060 --> 01:27:00,660
You buy all the books that say securing web services, it's all about the encryption and stuff like that.

1350
01:27:00,660 --> 01:27:05,200
That's not a bad thing, that's something people care about, but it has nothing to do with injection attacks and stuff like that.

1351
01:27:05,200 --> 01:27:14,940
And then we need for people to settle up and stop getting greedy and build this PKI infrastructure before people start deploying and moving my credit reports over these systems.

1352
01:27:16,400 --> 01:27:19,280
And then on our shameless plug slide, we are hiring.

1353
01:27:19,280 --> 01:27:22,640
If you are a researcher or a consultant, please have your resume to career size.

1354
01:27:23,600 --> 01:27:25,340
And a shout out to all these people.

1355
01:27:25,500 --> 01:27:29,000
I mean, sorry, I'm a professional, it's not a shout out, it's a thank you.

1356
01:27:32,020 --> 01:27:35,180
My brothers want me to know how many people here know Leroy Jenkins.

1357
01:27:36,540 --> 01:27:37,260
Okay.

1358
01:27:38,960 --> 01:27:40,140
That's a pretty good number.

1359
01:27:41,220 --> 01:27:43,440
Okay, any questions before we get into the demonstration?

1360
01:27:45,180 --> 01:27:46,040
Yes, sir.

1361
01:27:58,050 --> 01:28:00,750
That's an excellent point, and I'm sorry I glossed over that.

1362
01:28:00,750 --> 01:28:02,170
It was in the slide, but I didn't say it.

1363
01:28:02,170 --> 01:28:12,650
Yes, the right thing to do is if you're a web service, you're putting out on the internet, and you don't want anybody in the world to talk to it, you just want partners to email them the WSDL, yes.

1364
01:28:13,210 --> 01:28:16,990
Turn off the auto mechanisms to publish the WSDLs and just email them.

1365
01:28:17,150 --> 01:28:19,070
That's the best protection against that kind of stuff.

1366
01:28:19,070 --> 01:28:20,470
Makes it much harder.

1367
01:28:20,470 --> 01:28:24,750
If you don't have the WSDL, there aren't built in stuff in SOAP just to ask for all the methods, right?

1368
01:28:24,750 --> 01:28:26,110
That's the method that's supported.

1369
01:28:26,150 --> 01:28:26,930
And people do that.

1370
01:28:26,930 --> 01:28:33,870
If you guys, if you go drop Google Maps into WebScarab and find out what web service they're talking to and ask it for a WSDL, it's not going to give you one.

1371
01:28:33,910 --> 01:28:35,450
So there's certainly people that understand that.

1372
01:28:35,450 --> 01:28:49,130
That's also something, because if you don't want people using your service, if the way you get people to use your service is to mail them a WSDL, or you don't want people scraping it, like eBay and stuff, so that they make money off of your work, then that's something you can do too.

1373
01:28:49,570 --> 01:28:53,010
Google API is probably one of the coolest web service interfaces out there.

1374
01:28:53,270 --> 01:28:54,790
See Johnny Long's talk.

1375
01:28:56,090 --> 01:29:01,310
Any other questions before we move on to me messing up the demonstration and you people laughing?

1376
01:29:03,370 --> 01:29:04,050
Okay.

1377
01:29:04,130 --> 01:29:06,530
I'm really sorry that there's so much talking in a row.

1378
01:29:06,690 --> 01:29:09,110
We've got to get better at putting lots of demos in there.

1379
01:29:09,110 --> 01:29:09,670
I'm sorry.

1380
01:29:12,890 --> 01:29:14,690
So here we have a...

1381
01:29:20,800 --> 01:29:22,820
I don't know if I can do this in 800x600.

1382
01:29:23,800 --> 01:29:26,020
A virtual PC of Windows 2003.

1383
01:29:26,140 --> 01:29:27,620
It's got a web service on it.

1384
01:29:27,740 --> 01:29:33,820
The exact same web service is currently running on wsdemo.isecpartners.com if you're online right now and you want to play with it.

1385
01:29:33,820 --> 01:29:38,660
Or if you go home and you want to try some of these tools, you're welcome to do a tax.

1386
01:29:38,660 --> 01:29:41,820
I'm letting you do a tax against wsdemo.isecpartners.com.

1387
01:29:41,960 --> 01:29:44,100
It's going to be the only site that's going to say that.

1388
01:29:44,940 --> 01:29:48,460
So like we talked about before, there's this cool thing called WS Studio.

1389
01:29:48,980 --> 01:29:53,600
I'm going to point it at the web service.

1390
01:29:54,340 --> 01:29:55,780
It's very, very simple.

1391
01:29:58,120 --> 01:29:59,580
No, I don't want to do it today.

1392
01:30:02,180 --> 01:30:05,160
It's got one user, or one method.

1393
01:30:05,420 --> 01:30:06,400
LogonUser, right?

1394
01:30:06,400 --> 01:30:08,640
So this is simulating maybe Word Bank.

1395
01:30:08,640 --> 01:30:11,760
And the first thing you need to do is log in before you get your account balance and stuff.

1396
01:30:12,000 --> 01:30:14,760
And it takes a string username and a string of password.

1397
01:30:15,620 --> 01:30:18,400
So say I've been hired to pentest this.

1398
01:30:18,540 --> 01:30:19,580
What am I going to do first?

1399
01:30:19,580 --> 01:30:21,780
And let's pretend this is one of those more complicated ones.

1400
01:30:21,780 --> 01:30:24,100
There's hundreds and hundreds and hundreds of methods here.

1401
01:30:24,820 --> 01:30:28,800
I want to see if there are any vulnerabilities.

1402
01:30:28,800 --> 01:30:32,880
And so I'm going to do that using

1403
01:30:45,100 --> 01:30:47,300
WSBANE to do the initial.

1404
01:30:47,300 --> 01:30:56,620
So we're big on documentation and GUIs because we're privately funded and we have no venture capital.

1405
01:30:56,800 --> 01:30:58,580
If you want GUIs, go to Foundstone.

1406
01:30:59,060 --> 01:31:00,840
They excel at that kind of stuff.

1407
01:31:02,300 --> 01:31:03,920
So WSBANE, you give it an URL.

1408
01:31:03,920 --> 01:31:05,060
This isn't descriptive enough.

1409
01:31:05,060 --> 01:31:07,060
You have to give it an URL that gives it a WSDL.

1410
01:31:07,120 --> 01:31:09,320
It can also point to a local file.

1411
01:31:10,860 --> 01:31:14,820
So I am going to give it the URL of the WSDL I grabbed.

1412
01:31:15,140 --> 01:31:16,340
WSDL hashtags.

1413
01:31:17,620 --> 01:31:22,280
This is why our partner Himanshu, who spoke at Black Hat, he video records all his demos.

1414
01:31:22,280 --> 01:31:25,060
Which I'm starting to really appreciate how smart that is.

1415
01:31:29,010 --> 01:31:30,990
That's not a real demo if it's videotaped?

1416
01:31:31,150 --> 01:31:32,390
Right, okay.

1417
01:31:33,750 --> 01:31:38,070
Because I spend an hour and a half convincing you I'm smart and then I can't type.

1418
01:31:52,110 --> 01:31:53,170
Excuse me, sir?

1419
01:31:54,030 --> 01:31:55,150
Oh, yes.

1420
01:31:55,510 --> 01:31:58,900
Thank you.

1421
01:31:59,340 --> 01:32:00,700
Is that a little more readable?

1422
01:32:02,980 --> 01:32:03,920
Okay, great.

1423
01:32:03,920 --> 01:32:06,840
So, I'm running it with an URL that should give me a WSDL.

1424
01:32:08,320 --> 01:32:09,260
Okay, I run it.

1425
01:32:09,260 --> 01:32:10,300
It pulls down the WSDL.

1426
01:32:10,300 --> 01:32:11,740
I didn't know that happened real fast.

1427
01:32:11,760 --> 01:32:13,020
It runs a bunch of tests.

1428
01:32:13,020 --> 01:32:19,440
It does this by looking up in an XML file it has, which I'll show you in a second, the type, you know, in a SOAP you define types.

1429
01:32:19,440 --> 01:32:21,940
You can do simple types, which are things like string and number.

1430
01:32:21,940 --> 01:32:25,040
You define complex types, which means you define a type.

1431
01:32:25,040 --> 01:32:31,100
It can actually be an XML document itself and stuff like that, if you want to do really cool extensible stuff, or binaries.

1432
01:32:31,760 --> 01:32:33,680
We don't support those yet, just simple types.

1433
01:32:33,680 --> 01:32:35,620
That covers probably 90% of web services.

1434
01:32:35,720 --> 01:32:40,160
So it looks up what the type is, like a string, and it looks up in the XML file the things we want to try.

1435
01:32:40,300 --> 01:32:41,280
And it tries those things.

1436
01:32:41,280 --> 01:32:43,400
These are all the things that get tried on that one method.

1437
01:32:43,640 --> 01:32:45,240
And then it reads the response.

1438
01:32:45,240 --> 01:32:47,700
And this response, coming back from the SOAP message, is made pretty.

1439
01:32:48,000 --> 01:32:49,840
And here we have something that says SOAP fault.

1440
01:32:50,820 --> 01:32:53,600
So I click here, and it gives me what actually ran.

1441
01:32:54,040 --> 01:32:56,820
So, outbound, here's my HTTP headers.

1442
01:32:56,880 --> 01:32:58,840
I set the SOAP action header.

1443
01:32:59,820 --> 01:33:02,240
Kind of glossed over this, but there may be...

1444
01:33:02,240 --> 01:33:09,200
We have seen vulnerabilities in being able to set the SOAP action header to different than actually what the method is in the SOAP message.

1445
01:33:09,780 --> 01:33:10,980
So that would be a checkbook.

1446
01:33:11,300 --> 01:33:13,780
And then, within the body, we say logon user.

1447
01:33:13,900 --> 01:33:15,660
The namespace is this namespace.

1448
01:33:15,660 --> 01:33:17,680
This is the encoding metadata.

1449
01:33:17,860 --> 01:33:20,960
And then these are supposed to be... they're not indented, but they're children to this.

1450
01:33:21,040 --> 01:33:23,280
The username and the password strings.

1451
01:33:23,660 --> 01:33:24,940
And what was our username here?

1452
01:33:24,940 --> 01:33:25,800
Anybody see it?

1453
01:33:26,440 --> 01:33:27,700
It's a single quote.

1454
01:33:28,280 --> 01:33:30,000
And the password was default.

1455
01:33:30,740 --> 01:33:33,200
And so the response was...

1456
01:33:33,940 --> 01:33:35,200
To find this XML document...

1457
01:33:35,980 --> 01:33:37,520
Oh, I threw an exception.

1458
01:33:37,520 --> 01:33:40,280
Okay, this is a fault, because it's a SOAP fault.

1459
01:33:41,060 --> 01:33:44,680
Gives me the nice little system trace of all the things I've got called.

1460
01:33:44,680 --> 01:33:47,500
Now, this is like...

1461
01:33:47,500 --> 01:33:52,720
50 lines of C-sharp that's running on the other side.

1462
01:33:52,720 --> 01:33:57,380
Look at all of the methods that get called in a row to parse that.

1463
01:33:57,380 --> 01:33:58,200
Look at this.

1464
01:33:59,100 --> 01:34:00,060
That's all...

1465
01:34:00,060 --> 01:34:04,080
Every one of those is a function that we went through to call this.

1466
01:34:04,080 --> 01:34:06,780
There's a lot of pixie dust there, right?

1467
01:34:08,540 --> 01:34:10,520
And then it gives me...

1468
01:34:18,420 --> 01:34:20,420
Actually, we'll do this the pretty way, which is...

1469
01:34:20,420 --> 01:34:23,080
If I got this, I would do it myself, then.

1470
01:34:23,220 --> 01:34:24,880
In this, so I'll try it.

1471
01:34:25,100 --> 01:34:27,140
I'll say my password...

1472
01:34:27,140 --> 01:34:28,460
My username to quote.

1473
01:34:33,430 --> 01:34:34,490
Oh, exception.

1474
01:34:34,490 --> 01:34:35,790
This isn't a local exception.

1475
01:34:35,790 --> 01:34:37,950
It just passes through a SOAP fault.

1476
01:34:37,950 --> 01:34:40,290
That's an exception on your side, and I go to request response.

1477
01:34:45,710 --> 01:34:47,270
Yeah, that's not what it's supposed to say.

1478
01:34:50,530 --> 01:34:51,290
Yeah.

1479
01:34:51,290 --> 01:34:52,330
Thank you.

1480
01:34:52,330 --> 01:34:55,490
Right, I need to have something in the password so it doesn't...

1481
01:35:00,520 --> 01:35:01,640
Ah, thank you.

1482
01:35:01,940 --> 01:35:03,360
So, I get a SOAP fault back.

1483
01:35:03,360 --> 01:35:05,080
Server is unable to process a request.

1484
01:35:06,720 --> 01:35:08,340
And what does that look like to you?

1485
01:35:09,800 --> 01:35:10,560
XPath.

1486
01:35:10,760 --> 01:35:13,280
So, what was it, sir, that I'm going to try next?

1487
01:35:13,280 --> 01:35:14,500
The winner of crack?

1488
01:35:18,250 --> 01:35:19,270
That's correct.

1489
01:35:21,830 --> 01:35:23,650
Let's give a round of applause for that.

1490
01:35:23,650 --> 01:35:24,410
Ta-da!

1491
01:35:25,350 --> 01:35:26,430
Thank you, sir.

1492
01:35:27,770 --> 01:35:28,430
Single quote.

1493
01:35:28,430 --> 01:35:29,090
Or.

1494
01:35:29,130 --> 01:35:30,890
One equals one.

1495
01:35:31,070 --> 01:35:31,830
Or.

1496
01:35:31,830 --> 01:35:32,950
Single quote, single quote.

1497
01:35:32,950 --> 01:35:34,190
That's not a double quote.

1498
01:35:34,250 --> 01:35:35,290
Equals.

1499
01:35:35,330 --> 01:35:36,270
Single quote.

1500
01:35:39,170 --> 01:35:40,750
Spaces are a significant answer.

1501
01:35:42,570 --> 01:35:44,090
Oh-ho-ho-ho.

1502
01:35:44,890 --> 01:35:52,550
I assume the pauses in his human communication between words were meant to represent the symbol also known as a space.

1503
01:35:52,710 --> 01:35:55,010
When encoded in UTF-8, so.

1504
01:35:55,030 --> 01:35:56,710
We'll let him keep the frack.

1505
01:35:59,130 --> 01:36:04,050
And string result successfully logged in on user ID 3, Henry Ackerman.

1506
01:36:04,390 --> 01:36:05,770
So, that was an XPath injection.

1507
01:36:05,830 --> 01:36:07,910
Why was it this user?

1508
01:36:07,910 --> 01:36:09,850
What's special about this user, do you think?

1509
01:36:10,710 --> 01:36:12,450
He's the last guy, right?

1510
01:36:12,450 --> 01:36:17,930
So, when they referenced the list, they probably asked for the last thing in the list, right?

1511
01:36:17,930 --> 01:36:19,990
Which you do with a negative one in Python.

1512
01:36:19,990 --> 01:36:23,850
So, they asked for index negative one, and you can either ask for the first thing or the last thing.

1513
01:36:23,850 --> 01:36:26,230
Generally, I should get the same thing, right?

1514
01:36:26,230 --> 01:36:27,910
And they asked for the last thing in the list.

1515
01:36:27,910 --> 01:36:29,970
Maybe they went to this talk and they thought it was enough.

1516
01:36:29,970 --> 01:36:33,130
They weren't paying attention to this part, just the last hour and a half.

1517
01:36:33,130 --> 01:36:38,190
And they thought it was enough just to ask, you know, not ask for the first one, because that first person might be a user.

1518
01:36:38,190 --> 01:36:39,910
So, I'm logged in, and this is good.

1519
01:36:39,910 --> 01:36:41,750
But nobody wants to stop here, right?

1520
01:36:41,750 --> 01:36:46,050
This is where you stop if you're like a real second tier hacker, right?

1521
01:36:46,070 --> 01:36:47,170
Oh, yes.

1522
01:36:47,230 --> 01:36:48,350
I'm throwing it out there.

1523
01:36:48,350 --> 01:36:49,070
That's right.

1524
01:36:49,070 --> 01:36:49,990
I said it.

1525
01:36:51,530 --> 01:36:53,350
So, what do I want to do?

1526
01:36:54,650 --> 01:37:00,950
Right, I could do user ID equals one, but although I do know how the XML file is laid out, that's kind of cheating.

1527
01:37:01,610 --> 01:37:03,050
What's another way to do it?

1528
01:37:03,690 --> 01:37:05,570
So, let's go back to our string.

1529
01:37:09,550 --> 01:37:11,010
Let's say it is pretty close.

1530
01:37:11,010 --> 01:37:12,410
It's not exactly the string, right?

1531
01:37:12,410 --> 01:37:22,610
We did see what the string was, but just because we know what the injection string was doesn't mean we know exactly what's in the XML document, right?

1532
01:37:22,610 --> 01:37:26,610
Unless it references it, right, in that path, the XPath string.

1533
01:37:26,790 --> 01:37:31,670
And so, this bottom one, what else could I do other than ask for user ID equals one?

1534
01:37:31,670 --> 01:37:33,810
It's actually simpler than that.

1535
01:37:34,910 --> 01:37:36,210
Name equals admin.

1536
01:37:36,230 --> 01:37:36,950
Yes.

1537
01:37:37,030 --> 01:37:44,990
Right, I can just do name equals or quote, quote, quote, quote, and get rid of the or one equals one because I want them to match the first one, right?

1538
01:37:44,990 --> 01:37:47,130
So, I don't make it a full tautology anymore.

1539
01:37:47,130 --> 01:37:51,470
I make it a tautology only if the name is equal to who I want it to be.

1540
01:37:51,470 --> 01:37:53,010
Does everybody understand that?

1541
01:37:54,090 --> 01:37:59,310
So, I am going to... let's say I've tried admin.

1542
01:37:59,530 --> 01:38:00,590
It didn't work.

1543
01:38:00,930 --> 01:38:05,030
And I know these people wish they were programming on Unix, right?

1544
01:38:05,030 --> 01:38:06,690
So, they used the word root.

1545
01:38:06,710 --> 01:38:09,610
And I've now successfully logged in as user ID zero, name root.

1546
01:38:10,410 --> 01:38:11,450
Ta-da!

1547
01:38:11,490 --> 01:38:12,170
Sorry.

1548
01:38:13,270 --> 01:38:18,150
If it works for Dan Kaminsky, he comes back every year to Black Hat in DEF CON.

1549
01:38:18,150 --> 01:38:20,190
So , if it works for him, it's going to work for me, right?

1550
01:38:20,550 --> 01:38:22,230
So, does everybody understand what we did here?

1551
01:38:22,470 --> 01:38:24,570
This was an XPath injection, XPath 1.

1552
01:38:24,610 --> 01:38:28,910
This could work with either an XML flat file in the back end or a quote, unquote, XML database.

1553
01:38:28,950 --> 01:38:33,150
This exact same query string would work in an XQuery, right?

1554
01:38:33,230 --> 01:38:41,270
Because, like I showed before, XQuery, I mean, the simplest way to do it is all you have to do is to find the document you're looking up, which is the same as a table, right?

1555
01:38:42,450 --> 01:38:43,410
No questions on that?

1556
01:38:43,410 --> 01:38:43,950
Yes, sir.

1557
01:38:47,250 --> 01:38:48,230
Of course, yeah.

1558
01:38:53,270 --> 01:38:56,430
How do I use that to map out the tables in the database or the XML file?

1559
01:38:56,430 --> 01:38:58,570
That is harder.

1560
01:38:59,790 --> 01:39:00,990
We're not there yet.

1561
01:39:01,070 --> 01:39:01,630
You're right.

1562
01:39:02,330 --> 01:39:07,270
Emmett Klein worked on that, and the way he found to get it out was only through logging or logging off.

1563
01:39:07,270 --> 01:39:10,430
He was not able to get error messages out that contained enough information, right?

1564
01:39:10,430 --> 01:39:13,990
Like, the traditional way of SQL is that there's SQL statements that you can do.

1565
01:39:27,700 --> 01:39:29,760
You're going to go Karl Rove style on them?

1566
01:39:37,660 --> 01:39:38,380
Okay.

1567
01:39:43,300 --> 01:39:44,220
I'm sorry.

1568
01:39:46,800 --> 01:39:48,280
It's probably doable.

1569
01:39:48,460 --> 01:39:51,140
We don't have that answer yet, and that's something that we'll be working on.

1570
01:39:51,260 --> 01:39:53,400
Emmett Klein does it through that binary.

1571
01:39:53,400 --> 01:39:56,040
I think now with XPath 2, there might be better ways of doing it.

1572
01:39:56,040 --> 01:40:04,220
You might be able, because you can reference external links, it might be possible for me to reference something and then make the rest of the XML document look like it's part of the URL, right?

1573
01:40:04,220 --> 01:40:07,120
It's like people do cross-site scripting with an image tag to get a cookie out.

1574
01:40:07,120 --> 01:40:09,900
When it hits my log, I might be able to get it out of a log.

1575
01:40:10,000 --> 01:40:10,780
I'm not sure.

1576
01:40:11,480 --> 01:40:14,260
Klein looked into doing it with error messages, and he wasn't able to do it.

1577
01:40:14,720 --> 01:40:18,060
Still, I mean, the guy's disappeared off the face of the planet, so if anybody knows him, have him email me.

1578
01:40:18,060 --> 01:40:19,320
I'd love to see what he was doing.

1579
01:40:19,480 --> 01:40:20,240
But you're right.

1580
01:40:20,360 --> 01:40:25,420
In SQL Injection, there are the 19 commands you can probably do in a row that's with the error messages.

1581
01:40:25,420 --> 01:40:28,980
You can map out the... not the tables, but the nodes.

1582
01:40:30,820 --> 01:40:35,460
Okay, well, since we've got a second, I'm just going to do a quick demo of WISMAP.

1583
01:40:38,630 --> 01:40:43,030
Well, since I learned to set it up without you guys seeing it.

1584
01:40:44,210 --> 01:40:46,350
Okay, so this is WISMAP.

1585
01:40:52,100 --> 01:40:53,460
Python's compiling it.

1586
01:40:54,200 --> 01:40:55,900
Shoot, that's going to be hard to see.

1587
01:40:58,330 --> 01:41:05,470
So, if you run it with "-h", it says you can do all these things, ask for WSDLs, ask for DISCOs, store them locally, verbose.

1588
01:41:05,470 --> 01:41:07,030
I'm going to ask it to do everything.

1589
01:41:07,030 --> 01:41:12,130
I'm running in a directory with a WebScarab conversation log.

1590
01:41:12,130 --> 01:41:15,210
Although, if you have it in a sub-directory, that's fine, too.

1591
01:41:15,950 --> 01:41:18,810
It'll search all the directories for WebScarab logs.

1592
01:41:19,030 --> 01:41:20,710
Anybody... who here uses WebScarab?

1593
01:41:21,770 --> 01:41:22,550
Decent number.

1594
01:41:22,550 --> 01:41:24,070
I recommend you guys use it.

1595
01:41:25,670 --> 01:41:28,290
Anyway, as you can see, there's no "-u", anymore.

1596
01:41:28,290 --> 01:41:31,750
We had to pull that out, which is one of the great tragedies of my life.

1597
01:41:32,130 --> 01:41:32,810
Sorry.

1598
01:41:32,810 --> 01:41:42,990
And I'll run wismap.py-wsdls-discos, write out the files, and do it verbosely.

1599
01:41:43,170 --> 01:41:51,850
And I just generate these logs by kind of cheating and going to things that I thought would have different types of web services.

1600
01:41:51,850 --> 01:41:54,910
Although, I didn't know all of them, but I knew these were different web services I would go to.

1601
01:41:54,910 --> 01:41:57,310
Like I said, this is not useful for blind.

1602
01:41:57,310 --> 01:42:01,010
This is useful for reverse engineering something that uses web services.

1603
01:42:01,470 --> 01:42:10,170
And if the network actually worked here at DEF CON, you would see that it would find multiple WSDLs and DISCOs here and then write them to the local disk.

1604
01:42:10,970 --> 01:42:13,450
In the... which are already written.

1605
01:42:13,450 --> 01:42:15,390
1.disco, 1.wsdl, 2.disco.

1606
01:42:16,850 --> 01:42:17,490
Wow.

1607
01:42:17,490 --> 01:42:18,150
Okay.

1608
01:42:23,170 --> 01:42:25,290
Okay, so it did one test.

1609
01:42:25,290 --> 01:42:27,870
While that's going, I'll show you one of those.

1610
01:42:40,510 --> 01:42:45,050
So this is one of the things that, when I ran it in my hotel room, it pulled down.

1611
01:42:45,050 --> 01:42:47,470
This is the WSDL for a census data.

1612
01:42:50,090 --> 01:42:58,150
So do you think the programmer read that whole thing before it got published to the internet looking for all the methods that he felt would be too dangerous to publish to everybody?

1613
01:43:02,600 --> 01:43:03,780
Probably not.

1614
01:43:07,040 --> 01:43:11,980
I'm not... I'm not going to... you... that's for you to explore yourself, sir.

1615
01:43:13,240 --> 01:43:15,060
So you can see it's doing some tests.

1616
01:43:15,060 --> 01:43:17,820
It's looking for... it's asking for question mark WSDLs.

1617
01:43:17,820 --> 01:43:19,300
It's asking for question mark DISCO.

1618
01:43:19,300 --> 01:43:24,000
It's also looking for default DISCO URLs, and it's about to find one.

1619
01:43:24,140 --> 01:43:26,520
And like I said, DISCO is like UDI.

1620
01:43:26,520 --> 01:43:27,580
It doesn't define a web service.

1621
01:43:27,580 --> 01:43:31,760
It defines the services you're publishing through a web server instead of running your UDF server.

1622
01:43:33,540 --> 01:43:35,720
Okay, so open questions or comments.

1623
01:43:35,720 --> 01:43:37,060
Is this useless?

1624
01:43:37,060 --> 01:43:38,760
Do you guys think you'll never run into this?

1625
01:43:41,300 --> 01:43:43,200
Any more questions for everybody?

1626
01:43:45,880 --> 01:43:47,080
Okay, well thank you very much.

1627
01:43:47,080 --> 01:43:47,940
We'll do Spot the Fed.