start	end	text
5730	9550	Hey everybody, thank you for coming. My name is Alex Stamos, and this is...
10410	14830	My name is Alex Stamos, and this is Attacking Web Services. Is that a good volume for you guys?
14930	21570	Okay, great. This is a session from 11 to 12.50-ish. We'll probably run a little bit early.
22050	25670	But I'll be available for Q&A afterwards, and my email address is in here.
25870	28830	So at any time, please feel free to drop me an email.
29430	33130	Also, I want to make this an interactive thing. It's really hard to judge,
33130	36090	especially when you do, like, background information, what people's backgrounds are.
36110	39970	So please raise your hand, or if I don't notice, just yell out a question,
39970	42070	if you have it at any time during the presentation, okay?
44190	46170	So I was joking about the whole Cisco thing.
46210	49910	Obviously, Cisco doesn't deploy any web service boxes, so... fortunately.
50610	53170	So what are we going to talk about? I'm going to talk about who I am.
53910	56830	My speaking partner, Scott, was supposed to be here. He did a lot of this work.
56830	59910	I need to give him a shout-out, but I let him go to his engagement party
59910	62710	so he doesn't get divorced because of DEF CON.
63550	67170	So we'll talk about what we do, what web services are, where they're being used,
67810	71890	talk about the basic technologies and new attacks that we're now seeing
71890	76030	in the deployment of these technologies, as well as traditional attacks
76030	79950	that we've lived with for a long time, especially, you know, traditional web applications
79950	85070	that now can be retooled a bit to work in the web services XML world.
85350	87390	And then we'll be doing a couple of demos.
87390	90650	So it looks like the network's up for now, so we should be able to do a couple of those.
90650	93190	If you want to play along, there's an URL in here.
93590	100910	You can start downloading our software off the web and the 19 different Python packages you need to make it run.
101090	104050	And if somebody actually gets it running, you can play along while we do the demo.
104250	107010	And like I said, please interrupt at any time if you guys need something.
107690	111010	So who are we, or I? I'm a founding partner of iSEC Partners.
111790	117130	We're all ex-stakers, all wounded children from the at stake semantic merger.
117490	122470	Based on the West Coast, we do consulting and research, mostly in application security.
124030	126330	Why? What are we going to talk about?
126330	128230	Well, we're talking about web services. And why is that important?
128230	130210	Well, they're deployed all around us.
130210	133750	It's kind of this stealth deployment that a lot of people don't realize,
133750	135950	especially a lot of people in the security community.
135990	139430	If you're in the enterprise security community, or if you're an enterprise developer,
139430	144950	I'm sure you've heard the term SOAP or XML from a manager, or had to buy a book about it.
144950	147410	But it's not something that there's been a lot of security research in.
147850	153870	So, you know, we're not saying that this is definitely not the definitive talk
153870	156250	that's going to be given on web services over the next decade.
156250	157810	This is the first run through.
158850	161830	We found some bugs. There's some interesting stuff going on.
161830	165590	But really what we're trying to do is create interest about web services in the security community
165590	167490	and kick off research by other people.
167490	169330	Because there's a lot we don't know.
169330	172270	There's tons of acronyms out there that need to be attacked.
172350	174290	And we're looking for your guys' help.
174950	180510	So, like I said before, the latest version of these slides is... the CD is way old.
181470	184030	isecpartners.com slash defcon.html.
184030	187970	If you go to isecpartners.com, you can click all the way through speaking engagements.
187970	192150	And then there's a demo web service at wsdemo.isecpartners.com
192150	196030	slash expathservice slash expathservice.asmx.
196430	199630	I will concede right now that there's somebody in this room with a botnet
199630	204930	that could destroy this machine and make the data center itself fall into the gaping maw of the earth.
204930	207030	And I concede you're a bigger man than I.
207030	208890	Please don't sin flood it or anything.
209090	211310	I'd like people to be able to play around with it, okay?
213330	216670	So, this talk is supposed to be not only talking about the security stuff,
216670	219590	but we're going to try to do a background on the relevant technologies.
219590	223130	Because, like I said, a lot of people, especially in the security community, haven't been exposed to them yet.
223130	226970	It's not something that you get off a CD. It's not something that ships you through Dell.
226970	229490	It's generally not something that you can download off a BitTorrent.
229490	231950	And therefore, it's not something that gets researched very much.
233010	235650	And so, we'll give a little background on that.
235790	238470	Please let me know if you have any questions, because I don't want to spend too much time on that,
238470	240770	especially for the people here who are experienced in web services.
241050	245610	Then we're talking about some of the security risks that are associated with web services.
246150	249470	A lot of them sound pretty much familiar, because a lot of technologies are familiar,
249470	251090	or built upon older technologies.
251830	253830	But there's lots of different things.
253830	257790	Like I said, I think there's going to be a lot of stuff in the next several years,
257790	262390	both attacks enabled through web services at applications that are insecure,
262390	264710	or in the frameworks and technologies themselves.
264830	268470	This is not a talk about the WS-security standards.
269310	272070	That's a class of standards that does, like, encryption,
272070	275270	allows you to do authentication and authorization, all that kind of stuff.
275690	278230	They're pretty interesting. They do all kinds of stuff.
278230	281690	They come in books 700 pages long. Nobody deploys them.
281730	283070	So that's one reason not to talk about them.
283070	288190	But they're also about things like being able to do legal signatures online using a web service,
288190	292090	which has nothing to do with actually attacking or defending that application.
292090	298310	Just because you have XML signing, digital signatures enabled, doesn't mean you can't attack it.
298310	302730	Just as if you have SSL on your web application, and there's a little lock in Internet Explorer,
302730	304270	it doesn't mean your application is secure.
304270	305450	It's kind of the equivalent.
305450	309170	So this isn't a talk about that, which is good, because you people would leave.
309470	310950	So what are web services?
310950	316170	It's a very overloaded term, mostly because you can get millions of dollars thrown at you by venture capitalists
316170	321150	if you put the words web services and Indian programmers, like, in your prospectus.
321870	326450	For our purposes, web services, our communication protocols, are based on XML.
327050	330950	That's pretty much the only standard we'll be talking about that's universal.
330950	334450	Lots of people do all kinds of weird web services, not like SOAP or any definitions,
334450	340030	but just moving XML files around using HTTP or even SMTP, and they call it web services.
340030	340890	That's fine.
340890	344150	But for our purposes, we're talking about XML as the base language.
344150	348270	They provide computer-to-computer communication, which is an important point to understand
348270	350910	and kind of underlies a lot of the security issues,
350910	355510	is that these are things that are not meant to be consumed by human beings, at least not initially.
355510	363550	It's not like moving HTML over HTTP, where the goal of the HTML is to be rendered into something that a human being can read.
363550	368850	A web service might be rendered into a GUI or something, but maybe not.
368950	373580	And a lot of the technologies are based upon the idea that human beings don't have to be involved,
374230	380070	which is both scary for programmers who want to be in their jobs, but it's also scary from a security standpoint.
380630	385630	They use standard protocols. They're often controlled by the W3C, OASIS, and WSI.
385690	389930	Web services, as a technology, has more acronyms than I've seen anywhere else.
389930	391430	It is unbelievable.
391430	395650	It's not my fault. I just want to say that up front. Blame Tim Berners-Lee.
395690	398490	And they're designed to be platform- and transport-independent.
398490	403430	Although a lot of these standards have been made by IBM, or one standard has been made by Microsoft,
403430	409250	all of them are generally accepted and patent-free and able to be deployed by anybody.
409250	413970	And that's kind of what makes them powerful and makes them so compelling.
414510	419710	Why are they compelling? Well, these web services are based upon some pretty well-understood technologies.
419710	423270	How many people here have ever edited or created an XML file?
423710	425690	Right, a lot of people. Right.
426390	429030	That's great. That doesn't mean that you've done web service programming,
429030	435950	but you now have a basic knowledge that a lot of people inherited from the HTML world anyway to get into it.
436170	440570	The adoption of web services has been very, very quick by large software vendors.
440570	444810	The whole creation of these standard bodies has gone rid of the not-invented-here syndrome,
444810	450910	so Microsoft and IBM are willing to implement it without either one of them taking credit for the other guy's invention.
450910	454390	That's pretty unique in the software industry.
455690	460090	One of the reasons they're compelling is that they're described as kind of a panacea for interoperability issues,
460090	464030	both internal to the enterprise and externally, and we'll talk about some scenarios of that.
464370	468150	But probably why they're most compelling is the magic pixie dust, right?
468150	474610	This is the same magic security pixie that comes by when you plug your computer into the wall at Caesars,
474610	481850	and it automatically gets an IP address, and then it's automatically able to talk to the gateway,
481850	486610	even though it doesn't know the MAC address through this crazy little pixie dust protocol called ARP, right?
486610	490770	It's all these magic pixie dust protocols that make things happen magically and automatically
490770	494370	and without human intervention that create insecurities, right?
494370	497650	Because there's nothing secure about plugging into any network in the world,
497650	502550	and that's because everything has always been built to be easy, and easy is bad, right?
502550	506830	If there's not a human being involved saying, yes, you're allowed to do that, then that's a bad thing.
506830	509390	And there's tons of magic pixie dust in this.
509390	512730	For example, this is a little, what, 10 or 12 lines of C-sharp.
513130	516610	Open up anybody who has MSDN installed, open up Visual Studio right now.
516610	523530	If you create a new project, you point it at something that has a web server, IS6 installed, and it's got ASP.NET activated,
523530	527930	you set up that project, you copy and paste this into a file, you compile it,
527930	536070	it will automatically compile the C-sharp into CLR, create an ASP page that corresponds with that C-sharp file,
536070	540590	create a configuration file, create a web discovery document called a disco file,
540590	544310	create a WSDL, which is that web service document link which we'll talk about,
544310	548930	load all these up, if you have a UDDI server, it will automatically register with UDDI,
548930	555410	and you'll now have a function that if somebody over the internet can send a message to IIS,
555410	559450	which then hands it up to an XML parser, which hands it to a SOAP handler,
559450	563430	which then finally hands it to a program which gives it a string, and then it goes all the way back down,
563430	568470	with ten lines of programming, and there's then millions of lines of code running around it.
569030	573210	That's a lot of magic pixie dust, and that's the kind of stuff that we'll be talking about today.
576010	581250	Another reason that you see them all over the place is the value is really well understood by the pointy-haired bosses.
581410	585050	This is just a little fake quote, but this is something that we actually see.
585470	590670	I see a couple gray hairs and ponytails in here, so those are people that might actually know what Kix is.
590670	594970	It's a crazy little programming language for mainframes, but you can't hire people that do it anymore, right?
594970	598970	All those guys are retired after all the Y2K money they made.
598990	604270	And so a lot of these enterprises have these IBM boxes from the 70s that their whole enterprises are running on.
604490	611550	Now, it's their stock trading system, or your health records, or a bank, your bank account numbers,
611550	615190	are all on a mainframe, and they can't hire people to talk to the mainframe.
615190	621310	So what do you do? Well, you go buy some IBM products, because IBM is able to take machines they sold in the 70s
621310	626230	and continually make money off of them. You go buy an IBM product and some IBM Global Services guys,
626230	630670	and they come over and they put some WebSphere right in front of it, and they create this SOAP interface
630670	634390	by which, just using XML and HTTP, you can talk to the mainframe.
634430	637670	And now, I can get all these guys that have Learn Java in 30 Days books
637670	641290	and have them write all my new enterprise applications to talk to the mainframe.
641290	643970	Don't need to get any of those gray-haired ponytail guys.
644090	647150	And that is very, very compelling to corporate management, right?
647150	649390	Because they want to extend stuff and they don't want to spend money.
669380	673000	Okay, so I have been told. I mean, this was all pre-arranged, obviously.
673300	677920	This is issue number 13, numbered. Independent. I'm sorry.
677920	681820	It's the last issue of Frack, numbered 13. They're individually numbered.
681960	685420	It's still warm from the printing press, and it's incredible leet-ness.
685420	686360	Come on.
689020	691580	And it will be given to somebody in this room today.
691620	694540	And I have to come up with a competition while I'm talking to you guys in my head
695000	699420	about how we'll do that. So we'll have some kind of hacking competition at the end.
701000	702320	Let me think about how we'll do it.
702320	705060	But pay attention, because it'll have to do something with the slides, okay?
705460	708480	Please don't mob me. Slow down. There's a lot of security guys here.
708480	712100	I know you want it, but put it here so you guys can look at it.
723270	726770	Okay, so now we're going to talk about what services are being used, right?
726770	728450	Where are you going to run into it?
728450	731790	Like I said, web services are not something that you consciously run into
731790	735450	like you run into RPC and Windows, right?
735450	738110	If you're a hacker and you use Windows and you've ever done a file transfer,
738110	741350	you probably understand, like, ports 137, 139, Samba, and stuff.
741350	742890	It's a technology you run into.
742910	745070	But a lot of people in here have not run into web services,
745070	749110	even though, most likely, everybody in here, either your credit report,
749110	751930	your social security number, your tax information, your bank information,
751930	756110	it's been moved over a web service protocol at one time or another.
756490	758470	So where are they being used? Between companies.
758470	762290	This is a big mover. This is the whole B2B thing, right?
762290	767930	Which meant business-to-business, then it meant back-to-banking after the dot-com bust.
768410	770250	But now, it means business-to-business again.
770250	771910	And people are doing this using web services, right?
771910	776170	We got a pass not invented here, so you can get your vendor to support it.
776350	778630	And it gets rid of these stupid protocols that people invented.
778630	782150	I mean, they're not stupid, but these incredibly complex, dense, binary protocols,
782150	787010	like EDI and stuff, and all the X protocols that people have talked from company to company.
787510	790690	You can get rid of those, and now you can write it in nice and easy XML.
790690	793490	You can read it in English. It uses HTTP. Everybody knows how that works.
793490	794750	It's based upon a web browser.
794750	797990	Much easier for people to use than these old protocols to talk from business-to-business.
797990	805570	A great example, the credit card companies have these weird, binary-packed, ultra-small formats for doing credit card clearing.
805570	807690	Well, they're also moving to doing web service stuff.
807710	813290	So, the credit card clear, when your order comes in, can talk to the bank, which can talk to the credit bureau,
813290	815790	which can talk to the lender, and all this can happen over SOAP.
815790	821050	And you can write it all in Java, and you don't have to buy a specific product for the credit card industry.
821050	824730	You can just buy WebSphere or ASP.net and write it on top of that.
825170	827890	Internal to companies, a lot of people like to hook their stuff up, right?
827890	831410	I want my payroll system to work with my inventory system.
832130	836130	Web services to connect those, instead of people having to understand each other's formats.
836630	838930	In front of legacy systems, I already told you about this.
840530	842610	Mainframes, AS400s, all that kind of stuff.
842610	847270	Between tiers of web applications, and this is a really interesting one for some of the bugs we're talking about.
847290	854190	A lot of people are moving towards using an XML data format on the back end.
854190	858130	So if you do something on a web application, that XML data goes somewhere.
858130	865230	Now, it might go to an XML-enabled database, which can mean anything from a database that can understand XML and put it into a normal table,
865230	872110	to being transported somehow and then eaten up by a middle-tier software or something like that.
872510	881350	This makes the X injections, and you might mean X star, there's different kinds of protocols here, injections into those protocols very interesting.
882650	886010	And the way that most people have here, who here has used Google Maps?
886710	888350	Who here has used Gmail?
889070	890990	Right, so you guys have used web services.
890990	893070	Those are AJAX applications.
893270	895030	Asynchronous JavaScript and XML.
895110	899570	They don't use SOAP or any of the heavy-duty web service, but it's still a web service.
900310	907690	Really cool for people who haven't noticed, these are applications that allow you to do all kinds of interactive stuff without reloading the page constantly.
909570	914790	Microsoft came out with Internet Explorer, has the ability to talk to what's called the XMLHTTP object.
915190	919750	And now Mozilla now simulates that and stuff, even though it's obviously not ActiveX.
921310	923470	Basically, I can give you an HTML page once.
923470	924910	It has a bunch of JavaScript in it.
924910	929350	That JavaScript talks to this object in the browser, which actually does all of its communication.
929350	932610	And it's able to move XML files back and forth over HTTP.
932650	935130	And it can do that without reloading, it can do it asynchronously.
935130	936450	So it can do it multiple times.
936450	944210	You scroll around in Google Maps, and it can spawn a bunch of these XMLHTTP objects to load up the address separately from loading up the pictures to loading up this and that.
944210	946250	And it gives you a great end-user experience.
947330	950770	A lot of people are using this enterprise as a replacement for thick clients.
950890	957430	SAP doesn't want to have to ship an end-client for Macs and Linux and Windows.
957430	963050	They'd rather ship something that just loads into Mozilla on all those platforms and allows you to have the same kind of user experience.
963050	968190	Which, you know, the user experience kind of sucked in web applications because of reloading the backbone and stuff, and you can get rid of that.
968610	971730	There are some definite interesting security issues with AJAX.
972390	976070	We'll talk about that a bit. A lot of this stuff is also about the heavy-duty protocols.
977550	979010	So what's the point of this?
979370	981130	The code is broken free, right?
981130	985070	One of the reasons people like web services is you do lots of powerful stuff over one port.
985150	987770	Because back in the day, everybody put their whole enterprises on the internet.
987810	990070	Then they herded this thing called a firewall.
990290	992170	And they hired some firewall guys.
992170	993550	And they paid Cisco some money.
993550	994570	And they installed a firewall.
994570	1000670	And now, if you look at the outside of a normal corporation, you'll generally just see SMPP, HCP, HPS.
1001130	1004030	Every once in a while, a Firewall 1 management port.
1004030	1008150	But you don't see things like RPC open to the internet.
1008150	1010330	Well, it's open to the internet again now.
1010450	1012130	You're moving it over a different protocol.
1012130	1017310	But now, with web services, you can move all this stuff over ports that people have had closed.
1017310	1019790	And that's actually an advertisement for some of these products.
1019790	1021810	Get around your firewall engineers.
1022030	1023510	Buy our web service product.
1023790	1030610	So, our new slogan is we poke holes in your firewall so you don't have to.
1030830	1032470	Just set up your firewalls once.
1032470	1033890	Fire your network engineers.
1034010	1035690	Add all your functionality to a SOAP interface.
1035690	1036430	And you're done.
1037790	1039710	So, now we're going to talk about some of these technologies.
1039710	1041630	Give you a little background in the attacks.
1042730	1043890	So, XML.
1044010	1046650	Everybody here kind of knows what XML is.
1046650	1051210	It's this incredibly complex standard for representing all the data in the known universe.
1051210	1053930	Which sounds like a really easy problem for them to tackle.
1054610	1057950	Especially if it's supposed to be English readable on top of it.
1057950	1059090	And it's very hard work.
1059090	1061830	You've got things like binary data, internationalization.
1062270	1064990	XML has internationalization built in from the beginning.
1064990	1067470	Unicode 1.0 is the standard for XML.
1067470	1069550	With XML 1.1, it would be Unicode 2.0.
1069550	1072210	This makes internationalization attacks really interesting.
1072210	1073410	Because we've seen these attacks before.
1073410	1076190	Things like non-minimal UTF-8 encodings.
1076190	1079830	Doing things like changing character sets to do like SQL injection and cross-site scripting.
1079870	1081930	That's always been kind of stapled on.
1081930	1084690	Because internationalization was stapled on to web apps.
1084750	1088530	With web services, internationalization is from the beginning.
1088530	1094230	And so, if you talk to something that understands XML, it probably understands all those character sets.
1094230	1095610	You no longer have to get lucky.
1095610	1098970	Like somebody installed the Japanese character set pack on the SQL server.
1098970	1100470	Like you used to have to get.
1100470	1103630	So, that's a really big deal for internationalization attacks.
1103630	1104970	Which have been covered by other people.
1104970	1106710	But definitely move over to web services.
1106870	1108290	You have to represent meta-characters.
1108290	1110870	You have to be able to define and validate how these documents are.
1110870	1111470	Yada, yada.
1111470	1115270	Because of the size of the product space, we've ended up with dozens and dozens of standards.
1116090	1118490	And very few people understand a lot of them.
1118490	1120430	And there's nobody who understands all of them.
1120970	1123130	Which is a little different than web applications, right?
1123130	1127930	Because it's pretty easy to understand both HTML and HTTP.
1128290	1130310	Okay, I can understand how those work.
1130310	1132770	I mean, I can't recite the RFCs.
1132770	1135070	But it's almost impossible to do that with web services.
1136410	1138670	There's a couple of basic strict rules.
1138830	1140010	Why do you guys care about it?
1140010	1144470	Well, when you're attacking a web service interface, you generally have to use legal XML.
1145150	1147070	If you don't, you're just attacking the parser.
1147070	1147770	And people have done that.
1147770	1150890	People have already parked things that do all kinds of wacky stuff with XML.
1150970	1152250	But people have done that before, right?
1152250	1156270	What we're trying to get to is the applications behind that standard XML parser.
1156750	1158730	I'm not going to walk you guys through how this works.
1158730	1162290	But here's a simple element in XML attack, right?
1162290	1163550	It's called the parent node.
1163550	1164990	Those are called children nodes.
1165270	1167030	Here's a full legal document.
1167030	1169350	It does things like define the encoding.
1169370	1173230	This is obviously Latin character set 1 for us English speakers.
1173230	1177010	The default encoding for XML is UTF-8, which is great.
1177410	1180490	This is the definition of a namespace.
1180490	1182310	This XML document belongs to this namespace.
1182310	1183210	So you can, like...
1183210	1187630	If I had manufacturers shouldn't overlap with somebody else's namespace in an XML document,
1187630	1191190	I also define a schema by which this can be...
1191190	1192310	These pearls aren't real.
1192310	1193950	Don't try to go grab them.
1194110	1196250	A schema by which this document can be verified.
1197790	1199850	Schemas are the way you verify documents.
1199850	1200910	DTDs are the old way.
1200910	1201930	It was a non-XML base.
1201930	1203950	There's this weird thing with colons and stuff.
1203950	1208390	The great thing with DTDs is there's a number of nasty attacks that have mostly been fixed.
1208390	1211790	But as people come out with new XML parsers, they might be in there again.
1211850	1216430	One of the attacks was to make a self-referencing DTD that could say,
1216430	1218590	Oh yeah, I define a type B.
1218590	1222210	And then B defines type C, which defines type D, which defines E.
1222210	1224530	And then E defines something that has a subtype A.
1224530	1227010	And you can get the DTD parsers to infinitely loop.
1227010	1229750	You could also reference things that are external to the DTD,
1229750	1231970	but most of these have been fixed already.
1232510	1234990	XSDs, XML Schema Documents, are XML based.
1234990	1236350	They're the new way of doing it.
1236490	1239510	The important thing for security people to understand is that
1239510	1244250	from a defense perspective, XML schemas can actually be very powerful.
1244250	1247630	From an attacker standpoint, nobody uses them, so who cares?
1251890	1254710	Like I said, they can prevent many of the attacks we're going to discuss.
1254990	1258790	So if you are on the defense side, think about validating stuff with a strong schema.
1259090	1261790	And don't do stupid stuff like having the all tag and stuff like that.
1261790	1262750	We'll talk about that later.
1263290	1266190	This is a schema. It's pretty readable.
1266190	1270570	The only interesting thing here is I have a restriction that I have an element called year.
1270610	1273290	I'm saying it has to be an integer and it has to be between these dates.
1273290	1277070	This means I can't do SQL injection in the integer field.
1277090	1281450	If I give it something that looks like a string, the XML parser itself is going to die
1281450	1283710	before it ever gets close to the database.
1284410	1286170	So here's a little bit of a protection.
1287010	1288610	Most people don't do this kind of stuff.
1288630	1292030	The magic pixie dust that we talked about generally doesn't include XML schemas.
1295050	1296070	So parsing.
1296070	1298250	So how do you... I get an XML document, how do I read it?
1298250	1301190	There's kind of two standard ways. Both ways have security flaws.
1301190	1305030	The first one is called SAX. Simple API for XML, I think it is.
1305090	1310290	This is a step-by-step, stateless parser that expects you to store the state.
1310310	1313970	It's kind of like a thing I say, go one more step, go one more step.
1313970	1316490	Oh, you have children node? Okay, I want that child, I want that child.
1316490	1320030	So when people use it, it's nice and it's lightweight, it's pretty easy to use.
1320070	1322250	But it's not very powerful.
1322330	1328250	And it has the downside of if you use a SAX parser, you have to track what data you've gotten.
1328250	1335290	If I want to get out of that car, if I want to get manufacturer, I have to say car, okay, I got car, I want the child named manufacturer.
1335290	1339190	It gives me manufacturer, and then I have to store it in a variable for myself.
1339430	1343130	And there's an attack against that called XML injection that we'll talk about.
1343210	1345910	And then the other one is DOM, Document Object Model.
1345910	1349370	This is really powerful parsing, this is how most people do it in enterprise applications.
1349450	1352110	And that turns out to be a bad thing from a denial of service standpoint.
1352110	1358590	Because building, if I have a big XML document, what this means is it takes and it builds a data structure in memory that represents it.
1358770	1362630	It represents all the nodes that are linked to all the child nodes, it's linked to this, it's linked to this.
1362630	1371510	And each one of those nodes is an object in Java with its own garbage collection and all the information that gets wrapped around any variable in Java.
1371570	1374130	So DOM has issues with denial of service.
1374590	1378370	And then there's always a really bad idea, people make their own parsers with like regex and stuff.
1378370	1382050	Don't do it, you can get an XML parser for every language, there's no reason to do it again.
1382050	1383710	Because you'll probably screw it up.
1384950	1387730	So an attack against X, XML injection.
1387730	1394390	So this is a situation in which the attacker can control a string that gets put into an XML document.
1394490	1396110	There's multiple ways this can happen.
1396110	1399930	This can be an XML document that is standing in for like a database query.
1399930	1408370	If I send, maybe it's my user login, and it puts the login information I give it, it puts it in the XML document and hands it off somewhere else to get parsed.
1408370	1412230	Or it could be something like a document I upload, because that's how I upload data.
1412530	1413810	It could be a lot of things.
1413810	1421630	But anyway, if I can control text in it, and it's not being input filtered, I can put more XML tags in there.
1421630	1424250	So in this situation, we have a user record.
1424250	1429390	Let's say this is a bank, and I've created my user, because I have a bank account.
1429430	1433970	And so I go in and I now create my web user, and it asks me for something like my email address.
1433970	1443970	And so when I fill out my email address, I give it an email address, and then I close the email tag, and I create a new tag called unique ID.
1444570	1447350	And then I say the email again, this is for the parser.
1447570	1449330	Why did I put this unique ID in here?
1449330	1453590	Well, this is in a situation where perhaps I have some knowledge of how the XML document is laid out.
1453590	1458910	I know that there's a unique ID child node in there that defines what my ID is.
1460370	1463890	This is like a unique ID that's used by the application itself.
1464390	1469750	And so with a SACS parser, if I was writing a SACS parser to read this, generally,
1469750	1475670	and remember, this is a fault with the application, not the parser itself, but we see it over and over again because people don't expect this,
1475670	1480190	is you step through the document, and you go to user record, and you say, give me the first tag.
1480190	1482910	And it says, okay, tag is unique ID, value is this.
1482910	1484630	And so I write it to a temporary variable.
1484630	1486670	And then I say name, and I write that to a variable.
1486670	1488390	And I say email, and I write that to a variable.
1488390	1490050	And I get to unique ID again.
1490050	1494990	And because the parser itself isn't tracking the state, I'm just going through and have a switch statement that says,
1494990	1497110	when I get this information, put it into a variable.
1497270	1499990	I overwrite that information and put the zero back in.
1500690	1504490	So who do you guys think user zero is on a web application?
1504990	1506890	It's the admin, almost always, right?
1506890	1512070	This is the same kind of, when you do SQL injection, you do OR 1 equals 1, it gets the first user in the table,
1512070	1515010	and it always turns out to be either the developer or an admin.
1515030	1516230	It's the same kind of problem.
1516230	1522110	And so the SACS parser, if I step through like this and store it in variables, gives me a unique ID of zero.
1522410	1523850	How do you defend against this?
1523850	1528790	You can do an XML schema where you say you can only have one unique ID per user record.
1528810	1534870	Or you can use a DOM parser, which you would specifically reference one of these, and it would probably check this one.
1539110	1540310	No, oh, oh, I'm sorry.
1540310	1542150	So this red, you're right, that's an excellent question.
1542150	1543950	Why not do unique ID zero in the first place?
1543950	1546350	This red area is the only part I control.
1546350	1553790	So I imagine this is a web form that's taking my information and putting it into an XML document where it stores all my information about my bank account.
1553790	1554850	Does everybody understand that?
1554870	1559090	So I can only control what's between these two tags, because it takes my data and puts it in.
1559090	1565990	And as you see, I have to do the email twice so that there's not this hanging email tag out here, which will make it choke probably, right?
1566450	1570650	So like I said, for defense, you can do an XML schema validation, or you can use a DOM parser,
1570650	1573990	or you can go through and check to make sure that you don't get multiple inputs.
1574550	1577970	This also works with XPath, which we'll talk about.
1577970	1585870	So if I did this attack and somebody was trying to pull this information out using XPath, even with a DOM parser, the attack would probably work as well.
1589050	1590830	So, which takes us to XPath.
1590970	1596230	XPath is this very simple language by which people are supposed to be able to reference what's in an XML document.
1596490	1599230	It's kind of a cross between direct relations and regex.
1600530	1602710	XPath number one was supposed to be nice and simple.
1602710	1606870	XPath one has like 20 pages of documentation, the standard.
1606870	1611650	XPath two is something like 300 pages, and nobody's read them all yet, so I'm not sure what's in it.
1611650	1614390	But it looks really scary, some of this stuff in two.
1614390	1616350	But these attacks work on XPath one.
1616410	1618150	So say this was our car example.
1618910	1622770	XPath entries are something like, so I get this XML, this is part of it.
1622770	1627370	I load it into a parser, and then I want to ask the parser for information from the XML document.
1627370	1633770	And so, one of the things I might ask for is, let's say there's a bunch of car nodes, right, in this document.
1633770	1635450	It's a big list of used cars.
1635810	1638030	I want to return all of the children of the node.
1638030	1639670	XPath queries always return a list.
1639670	1641630	It might be, it's like MATLAB or something.
1642110	1645790	It might be a list of one item, but it always returns a list, which is really interesting.
1645810	1650590	Because if I just say car, it gives me all of them in a big list, all of these nodes.
1650690	1656470	If I return, if I do slash car, that just gives me the root element, right, only the first one.
1656470	1660790	If I do slash slash car, it does all the car elements in the document.
1660790	1663750	I'm sorry, car, if you say just car, it's all the children of the car.
1664010	1668870	Car slash slash color will give me all the color underneath car.
1668870	1671370	And then the interesting one is when you can have conditionals.
1671450	1677870	Give me search for car, and give it to me the list of cars where color equals blue, right.
1677870	1680270	And you can actually do pretty complex queries in here.
1680270	1682770	And as you can see, this is really, really cool, right.
1682770	1686450	Because this makes it really easy to get information out of an XML document.
1686450	1689130	Because this is a pretty easy to understand language.
1689130	1695150	And if my document's not incredibly complex, this is much easier to use than doing all these, you know,
1695150	1697930	Python or C sharp calls to the DOM parser.
1698690	1699970	What's the downside?
1700690	1702070	Well, we'll get to that in a second.
1702070	1703510	So where do people use XPath?
1703510	1705510	People often use it to talk to databases.
1705510	1711470	It's starting to replace SQL in situations where people are storing XML data in a database.
1711830	1715810	All of these, XPath is supported by all of these database servers.
1715810	1719070	I think you need like SP3 or something for 2000.
1719070	1720750	So what's the problem?
1721150	1728510	Well, like our old friend SQL from SQL injection, XPath uses, puts data and the commands you want to do,
1728510	1730710	puts the verb and the noun right next to each other.
1730710	1734770	And those are delineated by our old friend, the single quote, right.
1734770	1737890	So if I want to say, give me the car where the color is blank,
1737890	1741230	I use the single quote to say this blank describes the car.
1741230	1743030	That's not a command I want you to run.
1743030	1744110	That's a description.
1744930	1749390	Unlike SQL, there is no access control in XPath or XML documents.
1749450	1753910	So generally, if you run an XPath query against an XML document, you can read everything in that document.
1755010	1760250	That's good, right, because sometimes SQL injection just doesn't work because they have good database schema.
1760530	1762110	That doesn't exist here.
1762110	1764790	There's also no real safe way of using XPath, right.
1764790	1767250	A lot of times we'll do a pen test, we won't find SQL injection.
1767250	1771030	We'll say, hey, no SQL injection, congrats, you must be doing really good input filtering.
1771050	1772510	And they'll be like, input what?
1772510	1775110	And we'll say, well, why don't we have SQL injection?
1775110	1778370	Well, it turns out, because they want things to run faster, they use prepared statements,
1778370	1781390	where they call and distort procedures, and that's a nice secure way of doing it,
1781390	1783050	and SQL injection doesn't work in that case.
1783050	1784510	There's nothing like that for XPath.
1784510	1785650	There's no secure way to call it.
1785650	1788770	The way people always call it is you concatenate a bunch of strings together,
1788770	1793090	and then you give that string to the parser, right, which is the bad way of using SQL.
1793090	1794430	That's the only way to use XPath.
1795250	1799370	So the outcome is if I can control any data that gets into an XPath statement,
1799370	1804630	and I can get a quote in, I can return arbitrary data and access arbitrary stuff in the document itself.
1805490	1806710	And here's the example.
1807190	1811610	So, in this example, say it's this bank again, and I've created an XML document.
1812110	1815470	You know, I don't need a database, right, because I'm a small bank.
1815470	1817850	So I just keep a flat XML document of all my users.
1817850	1820530	I've already been XML injected, so I fix that, right?
1820530	1823150	Oh, I'm so stupid, I should have known that people could have gotten stuff in.
1823150	1826150	And so I fixed it by going over to a DOM parser,
1826230	1830530	a nice big complicated parser that you can't do XML injection against.
1830530	1836510	But since it's so hard to use, I'm going to use XPath to get information out of it instead of stepping through it, step by step.
1836530	1842830	And so one of the things that I have to do is when people log in, I have to go see if they're in this big flat XML file of users.
1843090	1844590	Everybody with me so far?
1845010	1847490	Okay. Yeah. Great hypothetical, huh?
1848110	1849190	Real original.
1849270	1855270	So I'm going to create an XPath statement, and then give it to my parser, and it's going to look up the user for me.
1855270	1862950	And so I'm going to say, slash slash user, search for the user whose name is equal to Joe, and whose password is equal to let me in.
1862950	1867870	And the two red things here are information that come from the web form, the login and the password field.
1868590	1870210	Okay, that's fine. It works.
1870210	1875870	This will return a list of all the users, right, because slash slash will be a list of all the users that match that.
1875870	1877850	It's probably only one. It should be.
1878330	1880790	But it does return a list, a list of one element.
1883170	1886670	So now we come to our new canonical statement that we'll replace.
1886670	1889110	If you're really, really cool, quote...
1889110	1890950	What's the canonical SQL statement?
1891130	1892970	This will be the first point for getting the book.
1892970	1893950	Raise your hand.
1894270	1895350	Yes, sir. Back there.
1897190	1898590	And then what after it?
1899930	1900990	Right, dash dash.
1900990	1903350	It may be semicolon, dash dash, depending on that, right?
1903450	1905370	So this is our new statement.
1905370	1907230	Everybody memorize it, put it on t-shirts.
1907590	1909270	I have to get money from the t-shirts.
1909270	1914150	But I've actually seen that, like, on t-shirts, which is horrible about me and my social life.
1915730	1920190	This is our new canonical statement that will tell us if XPath injection is working.
1920190	1922450	Single quote, or one equals one.
1922450	1923750	Hey, that sounds familiar.
1924090	1930550	Or, single quote, single quote, that's not a double quote, that's two single quotes, equals one single quote.
1930550	1933910	I know not everybody can see it, but download the PDF, it'll be in there.
1934610	1941810	So what this does, is now I have, give me all the users whose name equals Joe, and my first single quote closes out the Joe string.
1941870	1946550	Or, one equals one, which is a sylla... what's the word for something that's always true?
1947550	1949010	Apology. It's apology.
1949010	1951190	Something that's always true, so this always returns true.
1951190	1953630	Or, quote quote equals quote quote.
1953630	1956670	Why do I need that quote quote equals quote?
1956750	1957490	Anybody?
1958810	1960230	To get rid of the last quote, right.
1960230	1964090	So I don't have, XPath doesn't have the ability to do comments in line, like SQL.
1964090	1968670	So I can't use the dash dash, which we used for SQL injection to throw away the rest of the line,
1968670	1972670	or a semicolon to make mine a statement, and then make the next one a different statement.
1972770	1975750	I have to actually use what's in my application.
1975870	1978750	And so the easy way to do that, I've got a single quote floating out there,
1978750	1982890	is I create an empty string, and then I create another empty string using that single quote.
1982890	1987290	So only the red stuff I control, that last black one is put in there by the application,
1987290	1989070	but I neutralize it by doing this.
1989070	1990370	End password, let me in.
1990370	1993630	So, why does this work? Because it's an or or and.
1993850	1995930	Anybody? Why would this work?
1998670	2001570	Well, the end's not quoted out, the end's used, but, sorry?
2003110	2003930	Operator precedence.
2003930	2007430	Somebody took a first year CS class and hated it. Right, sir?
2007970	2009490	Yes, operator precedence.
2009490	2012050	The thing that bites you in your ass when you start CS.
2012370	2014590	When you look at this, it first does the and.
2014590	2018430	There's an implied parentheses around this.
2018430	2020170	So the and is the first thing.
2020370	2023190	Quote quote and pass equals let me in, so this turns to a not.
2023190	2028150	But then we have false or true or false, which turns into true.
2028450	2033010	And so, what this does is returns all of the users, because it's a tautology.
2033010	2035850	It returns a list of all the users. Well, what use is that?
2035850	2039070	Well, like I said, XPath, everything's a list.
2039070	2043890	So if I'm using XPath to log somebody in, I have to take a list, and what do I have to do with it?
2046010	2049590	Well, not to protect, but what do I have to do, like, just to use it normally?
2049590	2053490	I have to ask for the first element, and then use that as the login, right?
2053610	2058690	So, I just ask for the first element anyway, and the first guy who's returned becomes my login user.
2059410	2062010	That make sense to everybody? Right?
2062010	2064570	A lot of people yelled at me at Black Hat, because they're like,
2064570	2066610	how could it work, because it returns multiple things?
2066610	2070150	Well, you know, unlike SQL, in this situation, everything is a list.
2070150	2073350	So I'm going to take this output and ask, what's the number one guy?
2073350	2075710	And use that person, the first child, thank you.
2077210	2083850	So if we want to get all super powerful, we can do things like now change and put more stuff in there.
2083850	2087370	This is obviously much more useful if you have access to information with it,
2087370	2088590	and you know how the XML is laid out.
2088590	2091850	So this is an open source or commercial product that you can get your hands on,
2091850	2093570	and you can figure out how the XML is laid out.
2094530	2099550	And we can do things like create more rules, and change around the statement to do all kinds of cool stuff.
2100110	2102170	And we'll do that. I'll show a demo of that later.
2102170	2107450	So, like SQL injection, this requires some knowledge of the query,
2107450	2109810	which makes it much easier if error messages are on.
2110270	2116430	How many people in here are going to vote that they don't give you all the information by default in all the major web service stacks?
2116430	2118790	Anybody want to take that bet against me? I'll give you ten to one odds.
2119590	2121030	Nobody? Okay, that's true.
2121030	2124010	The default is, give them all the information they need to make an XPath query,
2124010	2125970	and we'll show you on the default ASP.NET.
2126910	2132050	Even if you can't get access to it, Amit Klein, who used to be at Syncdome, I guess he's not there anymore,
2132050	2137290	which is now Watchfire, which is now probably today it's Verisign, and tomorrow it'll be part of Time Warner.
2137290	2139390	I don't know what's going on in the security industry while I'm here.
2140230	2144230	But he wrote an excellent paper called Blind XPath Injection, drop that into Google and you'll find it.
2144470	2148330	He claims he has a way of getting the entire XML document out bit by bit,
2148330	2152270	by creating a conditional that's set on what the next character is.
2152270	2156470	And so whether you log in or not is that one bit of covert channel you get out.
2156470	2161870	Of course, they had a test of there's 40 characters after, and it took them two hours to get those 40 characters out,
2161870	2165170	because you have to do all the logins and test all possible characters, but it's pretty cool.
2166690	2171350	If anybody knows him, I'm trying to find him, have him release the tool, please, so we can play with it.
2171470	2175870	But XPath 2 might give us a lot more ways of actually getting all that information out.
2176050	2180590	XPath 2 does a lot of cool things, like you have the ability to reference outside documents.
2180590	2184410	I can have tests that ask for information from an outside document, right?
2184410	2187230	Like if this user is equal to the user in this.
2187610	2192370	Now, the control of where that outside document comes from isn't really defined by the standard, right?
2192370	2197090	That's going to have to be up to the people that write the implementation themselves.
2197210	2202230	So how many people want to bet that at some point you're going to be able to get a document from your web server, right?
2202530	2205990	And that way I'd probably be able to leak a bunch of information out about the rest of the XML.
2206610	2211870	The future, if you guys want to be really, really elite and get the next T-shirt before this T-shirt,
2211870	2214910	that's going to come out after this T-shirt, is XQuery injection.
2214950	2219650	XQuery is a super set of XPath that is now the standard for talking to XML databases.
2220590	2225030	And one of the really cool things it can do is you can reference a bunch of different documents and stuff.
2225850	2230570	Downside is now people are actually building an access controller, and so boo-hoo, we won't be able to read everything,
2230570	2232710	but that hasn't stopped us from SQL injection, right?
2233610	2238030	And in this attack, and in a bunch of other attacks that we're talking about, our big friend is the cdata field.
2238030	2244490	So I'm not going to talk about it in detail, but it's basically just a way that XML has built in to get nasty stuff into XML, right?
2244490	2250230	Things in XML that you don't want it to interpret as part of the XML document, you put it in the cdata field, and it disappears.
2250390	2256350	So I can put things like with single quotes and with brackets and all that kind of stuff into a cdata field,
2256350	2262410	and that goes into the XML parser, and then when you ask the XML parser for the string, it gets rid of that cdata field for you.
2262410	2264410	So the application never sees that you did that.
2264650	2268890	There's also other escaping methods that work just as well, but the cdata field is so powerful and easy.
2268950	2269990	It's the best way to do it.
2270210	2272470	Once again, XML schema is for defense.
2272530	2274350	You turn off cdata fields in XML.
2278840	2281120	So any questions on the XPath injection?
2281520	2283020	And soon to be expert.
2283140	2286040	Okay, I'm going to demo that at the end, because it's a cool one.
2286240	2292740	So SOAP. SOAP is a standard where all of these, like, really cool web service stuff, this is where a lot of the magic exists.
2292740	2297960	It's a standard that defines how to move XML around, that can do remote procedure calls, that can do RPC calls.
2298920	2301060	It's generally over HTTP, but it doesn't have to be.
2303520	2305680	SOAP is defined by things called WSDLs.
2306060	2309780	WSDLs are these really ugly documents that are never meant for human beings to read.
2309840	2312100	They're meant for computers to read, and they're generated by computers.
2312160	2316860	And the great part of them is that, as an attacker, as somebody who's scoping out an application,
2316860	2320140	the WSDL tells you everything you need to know to attack the application.
2320140	2325640	So this is so much more powerful than we had for web application hacking, right?
2325640	2330480	Because to do a web application hack, you have to start off playing with the application for days,
2330480	2335120	using a user, trying everything, and then mapping it out and seeing all this functionality it has, right?
2335120	2337660	With web services, they just tell you up front.
2337860	2340160	They tell you, these are all the things I can do.
2340160	2342960	These are all the things you can ask me to do on your behalf.
2343440	2347200	Which is really, really cool, and it makes a lot of things a lot easier.
2347940	2353860	Generally, asking for WSDL is as easy as adding a question mark WSDL at the end of a document.
2354100	2358960	And we have a tool that will do this automatically for you, so you don't have to go through and do question mark WSDL over and over again.
2360500	2363660	They define all this stuff. This is just for reference. You guys don't need to know.
2363660	2368060	Basically, it defines something like, if I had a service that sold used cars,
2368060	2373240	it would define how I ask you to sell me the car, and then your response to me, and what that means.
2375380	2376760	There's no way you can read this.
2376760	2380720	This is like a third of a single WSDL for a very simple eBay thing.
2380820	2382980	It's incredibly complex and dense.
2383160	2389320	What's good about that? That means that the developers that wrote that almost certainly never read the actual WSDL.
2389320	2391280	The WSDLs are generally automatically generated.
2391280	2395020	Like my thing I wrote before, if you write a bunch of stuff that's accessible through web services,
2395020	2399280	and you turn it on, all of a sudden the WSDL is generated that tells somebody all those things.
2399280	2403120	So they can point a web service at it and not have to talk to you about it. That's the whole idea.
2403720	2408540	And so that often includes things like hidden debug messages, and I've actually seen this.
2408580	2412260	This is a web application that was ported over to having web service support,
2412760	2415540	and they had ported over all of their functionality.
2415660	2420580	I think it had been on struts or something, and they ported out all this functionality over to web services,
2420580	2425880	and one of the methods in the WSDL that obviously they had never read was make me admin.
2425880	2434420	It was a debug call that the developers would have, just normal low rights users,
2434420	2437340	could make that call, and they'd become the administrator of the service.
2437580	2441000	Now, they had had that in the web application before, and it had never been attacked.
2441000	2445020	Why? Because it was a parameter you had to put into a post.
2445100	2449440	And that's not something that somebody might not... make me admin might not be something that you guess,
2449440	2452140	and that you shove into every single parameter in every single post.
2452140	2455520	But I didn't need to try anything. All I had to do was look at the WSDL, and it said it right there.
2455520	2460020	Make me admin. It takes a user ID for which admin you want to become.
2462120	2464960	That has always existed, and now it's just really, really simple.
2464960	2470460	There's also all these cruft systems. Who here knows of a 1AM batch FTP job that they're embarrassed about?
2471040	2476640	Come on. Yeah, right. It's unbelievable what's transferred over FTP in the middle of the night.
2476640	2479300	If I was a router engineer, I'd be all over it.
2479480	2481400	All this kind of stuff's getting moved over to web services.
2481400	2483620	Nobody's ever thought about security for them before.
2483620	2488000	Maybe they've been kind of hidden because you have to be on the right router at the right time to get the information.
2488060	2489320	Now all you have to do is ask.
2489440	2492760	And you can use something like UDI to say, hey, tell me all of your secret services.
2492820	2493820	We'll talk about that.
2494520	2495760	So what's your defense?
2495780	2497520	You can manually review the WSDLs.
2497520	2499860	Everybody should know what's in their WSDLs if they're broadcasting the world
2499860	2502540	to make sure there's nothing in there that's supposed to be a private function
2502540	2505560	or that you're really embarrassed is in there, like debug functionality.
2505960	2506820	You can hand edit them.
2506820	2510620	Like Google writes theirs by hand, I think, mostly for compatibility reasons.
2510620	2514700	But the better part is don't have things like make me admin in your production app.
2514700	2516580	Get rid of that before it gets out to production.
2517540	2519960	So there's a number of different attacks with SOAP.
2521140	2526380	One big one we'll talk about a lot, well, not a lot, but we've got a couple of slides on,
2526380	2531380	is application-level denial of service through XML complexity.
2531380	2534080	And SOAP obviously takes XML, but you're probably wondering,
2534080	2537440	obviously I probably can't give SOAP arbitrary XML, right?
2537440	2543620	Because maybe a method only wants... it says, you know, buy a car, and all it takes is the VIN number.
2543620	2544640	It takes one string.
2544640	2547820	How do I shove arbitrary XML into that one string?
2547920	2549980	Well, there's fun things called SOAP headers.
2550060	2555540	SOAP headers are part of the message that almost nobody ever uses, but everybody listens to and reads.
2555680	2560680	And they're there because, you know, all these things like WS routing and all the encryption standards and stuff use them.
2560680	2565520	You can put arbitrary XML in a SOAP header because there's no definition of what can and can't go in there.
2565520	2567860	And that gets read and parsed by the application.
2568740	2570800	You can also do some source routing sometimes.
2570800	2573920	Sometimes people have multiple applications that are exposing to web services,
2573920	2578820	and so they have to make a decision on where... who you talk to when your message comes in.
2578940	2583160	Well, sometimes that decision comes from the header, and that can be set by the application itself.
2583160	2585300	This is like a client that you downloaded or something.
2585300	2587660	If you see something that looks like routing in the header,
2587660	2590340	try other things that sound like they might be web services inside the application
2590340	2592960	and see if you can get it bouncing off a different thing on the inside.
2595360	2597860	SOAP has a lot of session management problems.
2597860	2599020	It doesn't have session management.
2599020	2599880	It's just like HTTP.
2600160	2602340	You do a post, you get a response.
2602380	2603200	That's it.
2603960	2606540	That means people have to develop their own session management.
2606580	2609120	A lot of people do dumb stuff like they use cookies, right?
2609120	2609980	HTTP cookies.
2609980	2610980	They still work.
2611060	2614460	Obviously, it's on a browser on the other side, but somebody has to understand it.
2614540	2617600	Well, what happens to that cookie once it hits the web server?
2618320	2619740	It's stripped off, right?
2619740	2621940	Like, this XML document's going somewhere.
2622140	2623060	It's going to a mainframe.
2623060	2623840	It's going to a database.
2623840	2625320	That cookie doesn't go with it.
2625340	2627600	And so this causes a lot of access control problems for people
2627600	2629380	because they're setting these cookies,
2629380	2631580	and they never see them actually where they're making decisions,
2631580	2634440	like whose bank account can you transfer money out of, right?
2636140	2637900	So, you know, that's an issue.
2637900	2640280	There's also all the old classical state issues.
2640280	2642300	A lot of people have to implement their own state mechanisms.
2642300	2643960	They haven't had to do it for years, right?
2643960	2646560	They've been able to use WebSphere's or ASP's little cookie.
2646580	2648040	So they're kind of old at it,
2648040	2651260	and they don't remember that doing things like counting up from 1,000
2651640	2655260	and then making the next user number 1,001 in that field
2655260	2657900	is definitely a little bit guessable, right?
2657900	2661500	As are things like counting up from 1,000 and doing a SHA-1 or something like that.
2661500	2663360	So we see that all the time again with web services
2663360	2664960	because people have to rule their own.
2666820	2668420	So this is a SOAP message.
2668540	2669900	Yada, yada. It's kind of generic.
2669980	2672200	You don't want to be actually writing these by hand.
2672200	2674500	They're really hard to write by hand to make them accurate.
2674600	2676680	And I'll show a little free tool that you can download
2676680	2678380	that does all the communication itself.
2678380	2679800	Remember, we don't have a web browser here, right?
2679800	2683240	When we're talking to a web service, it's expecting another computer to talk to it,
2683240	2687380	so we don't automatically get something that has a GUI on it to put information in.
2688400	2691620	And then you'll see in the demo, there's this thing called SOAP faults.
2691620	2694320	If something breaks, it sends a fault back that has a string.
2694400	2697180	So who here can find the interesting part of this?
2699320	2702800	Right, so what do you think this is here?
2703580	2705620	What does that look like that we've just talked about?
2705620	2708580	That looks like an XPath query.
2708940	2712820	This is the default functionality of ASP.NET 1.1 Service Pack 1.
2713460	2715940	If XPath breaks, tell the user.
2716060	2719620	Tell the user exactly the XPath string that broke and how it broke.
2724930	2727410	So we'll demo all that in just a second.
2727410	2730030	And then something I talked about was Web Services Download Service.
2730030	2733970	This is, in my opinion, much, much, much, much, much more powerful.
2733970	2739270	I'd rather have a good XML attack than a thousand bots on a botnet to do a SYNFLUD.
2739450	2742870	Why? Because I have a huge, huge multiplier.
2742890	2747230	I don't have a huge multiplier with a SYNFLUD now that somebody's got $100,000 arbor boxes
2747230	2750470	or really nice net screens or something on the other side.
2750470	2755170	But I get a huge, huge multiplier with an XML attack against an application.
2755250	2756890	And I have to look for this advantage.
2756890	2760950	And often this advantage... we've explored two different types.
2760950	2763950	We're not releasing the code because it works too well.
2763950	2766090	But it's pretty easy to recreate it yourself.
2766090	2772090	But you either do attacks against the parser itself or against the application and its database backend.
2772090	2775790	And against the parser itself, you get very large multipliers of CPU time and memory.
2775790	2781150	If I can send you an XML document, how hard is that for me to send you a text document?
2781150	2782950	It doesn't have to be dynamically generated.
2782950	2786330	I don't have to use .NET to create this document.
2786530	2789270	I only have to write it once and send it with a Perl script.
2789990	2793230	So I send it once. OK, that's a couple cycles.
2793290	2795530	I can probably do a couple thousand of those a second.
2795570	2799350	When it gets to the other guy, he takes that document and he says,
2799350	2802350	OK, well, you want me to download a schema and you want me to set the namespace.
2802350	2805470	Now I'm going to build a model that represents this document.
2805470	2807190	So I have the head node, which is A.
2807190	2808590	And I have the child node that's B.
2808850	2810710	Oh, and B has a child node called B.
2810710	2812230	And B has a child node called B.
2812310	2814030	And repeat that 100,000 times.
2814030	2816350	And then close B off 100,000 times.
2816350	2821870	And that guy builds an object in memory in some heavy-duty language like Java or C Sharp,
2821870	2824710	where memory management isn't that easy anyway.
2824710	2825770	It uses a lot of memory.
2825770	2830870	And it builds this huge object that's 100,000 objects long and deep.
2831690	2833670	That is a huge, huge advantage.
2833670	2836990	And all that happens before it makes a decision what to do with it, right?
2837050	2837970	This is just the parser.
2837970	2840390	The application hasn't even seen that anything's happened yet.
2840390	2843310	This is the magic pixie dust framework that's done all this work for you.
2843310	2844590	Gives you a huge advantage.
2844590	2845630	How big of an advantage?
2845630	2854030	Well, we've taken down four enterprise-level hardware with a real, patched, good web services server
2854030	2855870	with one of these laptops.
2856710	2858150	CPU pegged them.
2858230	2861870	And I don't think the CPU was actually from the parsing as well as the memory management.
2861910	2865550	Because every time a message came in, it would build that DOM, and then it would destroy that object.
2865550	2866830	And then do it again and again.
2866830	2873330	Because we can get a couple thousand queries a second, or a couple thousand a second out of 20 threads of Perl.
2873770	2875410	So that is really, really powerful.
2875410	2879550	And that's, you know, it would take a lot more than one laptop to SYN flood those four boxes, right?
2879550	2881090	Especially if they have a real load balancer.
2881370	2884330	The other attack we've looked at is database connections, right?
2884390	2886170	Database connections are coming from a pool.
2886170	2887210	There's a limit of how much.
2887250	2889250	They're pre-created, and then they're used.
2889250	2892350	And they're usually not, like, even for sites that have millions of users,
2892350	2894370	they're something like 200 or 500, right?
2894370	2897050	Because they're only used when the query's going across.
2897330	2901410	So, like we said, this WSDL tells you all the things that it can do, right?
2901410	2902830	And you can do all of those things.
2902830	2903790	It's stateless.
2903790	2906890	You can do all those things as many times as you want, generally,
2906890	2908530	unless they're doing something very smart.
2909230	2910270	And so what do I do?
2910270	2911350	I go through this WSDL.
2911350	2915930	I find something that looks like it's a very heavy-duty thing that it has to look up in the database.
2916090	2918390	Somebody name a query in which you have to read a big table,
2918390	2920370	and you have to do it every time somebody asks you.
2921430	2922490	Login, right?
2922570	2925170	If I log into a machine, it's got a big list of users,
2925170	2928370	and I give you a username, especially if it's randomized and you don't have it cached,
2928370	2930730	you have to go ask the database, who's this user?
2930730	2936270	And so to create these user requests with random usernames and passwords over and over again is not very heavy-duty,
2936270	2941030	but it requires, it takes up one of these connections while it's asking that question over and over again.
2941030	2943030	And this is a great thing against enterprise servers,
2943030	2945910	because often, especially sites that have been DOSed before,
2945910	2948790	they have 20 or 30 or 40 front-end web servers.
2948790	2950490	How many database servers do they have?
2951350	2955750	One or two in HA, or maybe two HA clusters, right?
2955750	2958770	And that HA is probably cold failover, so they're not actually running.
2959910	2963830	And it's not considered a failure when you use up all the database connections, right?
2963830	2966730	That doesn't mean the box is broken, it just means that the queue is filled up.
2966730	2971450	And so we've also done this against an enterprise system where there's a ton of web servers in the front,
2971450	2974590	and two database servers in the back in an HA config,
2974590	2977850	and with a couple of laptops, we choked the database server.
2977850	2980850	The database server only had like 5% CPU used,
2980850	2983890	but that connection pool was all used up, because we did something that took a lot of time.
2983890	2986290	Why doesn't this get caught in normal testing?
2986290	2991930	Well, in normal testing, you don't log in 100,000 times over a course of two minutes, right?
2991930	2993470	That's not part of people's regression testing.
2993470	2995650	You log in once, and then you do the heavy-duty stuff.
2995890	3000530	And so that kind of application-level attack, while it's been doable with web applications,
3000530	3003450	is really easy with SOAP, right?
3003450	3006750	Because the login, all I have to do is change a little bit about the particulars,
3006750	3010530	and maybe generate some random usernames, and my Perl script has destroyed the database.
3013190	3015690	In either case, there's some important things to remember.
3015690	3017970	You have to have a legal SOAP request, right?
3017970	3021910	You don't want it thrown out before it hits the application, especially on the database side.
3022050	3023890	And then speed is very important, too.
3023890	3026650	We used multiple processes with multiple threads,
3027410	3032230	but, you know, it is still a little heavy-duty compared to like a SYN flood,
3032230	3036710	and obviously the attacker's position is given away.
3036870	3040750	So that's a downside for the attackers, it's a good thing for the good guys, right?
3040750	3043830	Because you have to use real TCP connections to move this stuff across.
3043830	3045830	But you don't have to listen to that connection, right?
3045830	3049050	You can make a connection, send them the post, and then drop it.
3049050	3051490	If you're using your own TCP stack, then just stop listening.
3051490	3057250	Don't send a reset, let it respond, but you don't have to actually have that memory allocated to get the response.
3057250	3058510	Makes it very, very efficient.
3059790	3064230	We're also looking into ways to make it faster, like HTTP 1.1 pipelining.
3064230	3068910	This is especially important with SSL, because I don't want to do an RSA transaction for every post I do.
3068910	3074750	If I do pipelining, I just send them all up with like, create a pool of 20 or 30 TCP SSL connections, and send them up.
3074750	3078930	Or things like XPath. Anybody hear about those crazy RegEx attacks?
3079350	3082910	That you can do to null service by getting somebody to do a weird RegEx?
3082910	3084670	That's really, really hard.
3084670	3090150	Well, XPath, obviously if I can do arbitrary things in XPath, I can probably do things in my XPath injection that are really bad,
3090150	3092850	even if I can't use it to own the application.
3093510	3095710	Unfortunately, defense isn't very easy for this.
3095710	3101730	For things like the SOAP header XML complexity, there's nothing you can do as an application developer in your application.
3101730	3107490	Because like I said, the SOAP message comes in, even if it's not for you, you've never heard of it at your application.
3107490	3111910	It's WebSphere, or it's Access Apache, or it's ASP.NET that's doing it for you.
3112810	3116730	So the only defenses against that are something like, you have an XML firewall,
3116730	3120090	this is one of the reasons they actually sell a couple boxes a year,
3120090	3123590	that looks at them and has limitations on it.
3123590	3127690	You can set your own limitations, like if you only do small messages, you use 50K messages,
3127690	3131290	and you set that in Apache or IIS, and so that's important.
3131290	3135430	There's no reason somebody should be able to upload a 20MB XML file to you, right?
3136090	3140690	Or you can do something like write your own Apache filter, or work with something like Apache Mod Rewrite or Mod Proxy
3140690	3142330	to look for this kind of stuff.
3142990	3145390	SACS is not vulnerable, right? Yes, sir.
3147750	3150430	Limiting RAID from source IP. So you could do it from source IP, of course.
3150430	3153110	This is the problem everybody's running with other issues.
3153110	3158410	In situations like an AOL situation, you might kill one of their 12 megaproxies, right?
3158570	3164650	Or, you know, whatever Nippernet has like 15 ways it gets out to the internet or something like that.
3164650	3166990	So, I mean, you could. Rate limit by source IP.
3166990	3171010	The way to do it is you need to make them do work to ask you,
3171010	3174190	so you need to have them ask you for a session ID,
3174190	3177310	you generate a session ID randomly, don't put it in the database,
3177310	3179990	just generate randomly in memory, give it to that person,
3179990	3182930	and then have them send it back with the login information.
3182970	3186690	And then you can check against the table in memory, which is much faster than going to the database.
3186770	3190230	As for the XML stuff, you have to put a protection in front that looks for the complexity
3190230	3192110	and stops it before it gets to the web server.
3192290	3194350	Either that's a firewall or it's your own thing.
3198430	3201490	Oh, right, and size. Yes, I do recommend limiting size.
3201530	3204930	If you never have anything larger than 50K, set it to 75 or something,
3205810	3207830	most people, almost nobody thinks about that, right?
3207830	3211170	And by default, this stuff accepts up to like 20 or 30 meg posts and stuff.
3211170	3213690	And that's when it gets really nasty, right? It takes a minute to, you know,
3213690	3218510	it takes me 30 seconds or something to upload a 20 meg post over a 100 megabit connection,
3218510	3221090	and then it takes a minute for it to parse it, right?
3224150	3227030	XML firewalls are these... well, okay.
3227030	3229590	So it's another venture capital term.
3229630	3233210	So it's something that makes people venture capital. That's the basic definition.
3233310	3236510	Generally, there are things that sell that look at XML.
3236510	3238790	They're like application-level firewalls.
3238890	3241770	A lot of the XML firewalls aren't created for security purposes.
3241990	3243610	They're created to do stuff like routing.
3243750	3248330	So if I have multiple web interfaces, web services, I can just put one box in front of them.
3248330	3251670	It's kind of like a load balancer. And it says, oh, you want to talk to the mainframe.
3251830	3253670	I will send that information to the mainframe.
3253730	3256330	Oh, you want to talk to this database. I'll send the information to this database.
3256350	3260070	But they now, because of security issues, they do things like they'll check for the complexity of the document
3260510	3262210	before it comes through and not let it through.
3262210	3265370	So kind of like Syncton's AppShield in front of web apps,
3265370	3270410	XML firewalls or SILK firewalls or web service firewalls or whatever gets you the most money right now,
3270410	3271670	whatever they're called,
3272350	3275550	look at the request and filter it for things that might be dangerous.
3275550	3278830	They'll also do things like look for SQL injection and XPath injection and things like that.
3278950	3280290	I can't always recommend them.
3280470	3283310	This is one of the only things that you can't fix yourself.
3283650	3285310	If you have a SQL injection bug, fix it.
3285310	3289450	Don't spend $100,000 for a hardware firewall that's now in your critical path
3289850	3292470	that, if it turns out they didn't do the right thing with their TCP stack,
3292470	3294930	somebody can DOS it anyway and take you down network-wise, right?
3294930	3296450	Or it's something you have to pay to maintain.
3297590	3301090	They're not things that you can just drop in front of your app and expect them to work.
3301950	3303710	Anybody in here sell XML firewalls?
3303790	3305110	Obviously we're not a vendor.
3308700	3309460	Excuse me?
3311040	3312940	I think Teros might do this kind of stuff.
3312940	3315060	Forum Systems, Sarvega.
3318060	3321240	Somebody come up with a prefix and postfix for a startup company.
3322520	3324520	There's like 20 or 30 companies that do it.
3324520	3327760	Like I said, they're mostly to do stuff like I want to do encryption on my web service
3327760	3330460	and I don't want to write into my app, so the box will do it automatically.
3330460	3335180	So any questions on the DOS?
3335180	3338060	Like I said, we're not releasing them, but it's pretty easy for people to recreate them.
3338060	3340680	You just need to build really complex but legal XML.
3343340	3345560	Complex just means deep, right?
3345560	3350340	If I have five root nodes that have 100,000 deep child nodes, right?
3350340	3356320	It's not just the number of nodes, but it has to be the linkage between them for something like a DOM attack.
3356440	3359120	That's a really, really powerful attack. It's pretty easy to recreate.
3359120	3362620	Obviously there's no reason for us, it would not be a very ethical thing to release that.
3365120	3367740	So discovery methods. We talked about WSDLs.
3369060	3371980	I don't think we'll do it. Let's talk about this real fast.
3371980	3375040	UDDI is another great discovery method, like a WSDL, what I talked about.
3375040	3378600	It just defines one service, right? You ask for a service, how do I talk to you?
3378600	3380880	How do you find that service in the first place?
3380880	3386560	Well, there's this great thing called UDDI, which lists all the services that somebody's running, right?
3386740	3387760	So... yes, sir.
3389380	3390220	Yeah.
3393610	3398830	No. No. They will not load... people learn their lesson off the DTD attacks.
3398830	3402470	And they will not load off-site XSDs.
3402890	3406690	By default. Certainly you can tell your XML parser that you want to.
3407830	3410730	But, you know, I haven't seen anybody do that.
3411530	3414170	Sure. Any other questions? I'm sorry on the DOS stuff.
3417190	3417910	Okay.
3418130	3420850	So UDDI is a way I can list all these web services.
3421030	3424910	And you might think that nobody's deploying them, but I've seen a bunch of them, right?
3424910	3429750	A lot of people are doing testing of web services right now, or they have two or three that their business partners use.
3429750	3434830	And so they put a UDDI server, which is XML on top of HTTP. It's nothing very complex.
3434890	3437770	There's a bunch of free Google for UDDI browser,
3437770	3441230	and you can download free ones or use web applications that will do it free for you.
3442110	3445750	And then they put these IP addresses out, and they tell their B2B partners,
3445750	3451770	wow, you know, it's so hard to set up a VPN, so what we're going to do is we're going to give you our UDDI address,
3451770	3454950	and then you guys can figure out how to hook up to them SSL is on, right?
3454950	3457230	So use SSL. That's what we'll use instead of a VPN.
3457230	3460590	And they expect people won't find these UDDI servers, right?
3460590	3465310	Because if you do nmap-a, I think right now, it won't say this is a UDDI server, right?
3465310	3468530	Because it's just a port 80, so you have to report 443.
3469970	3473910	The great thing about UDDI is it tells you everything you need to know to attack a web service.
3474170	3477390	And it tells you, if an enterprise is deploying it, everything they're deploying.
3477390	3481670	Now, they don't have to list everything, but like I said, some of this stuff automatically lists.
3481690	3485650	If you have a UDDI server, Visual Studio will automatically list it up for you, right?
3486510	3488630	So how do I find UDDI servers?
3488730	3494650	Well, IBM, Microsoft, SAP, and Nippon Telegraph and Telephone have very kindly stepped in
3494650	3499570	and given us a nice searchable web interface that tells you UDDI servers that people have registered.
3499570	3501270	So you guys see this hierarchy here?
3501270	3506610	The whole idea is that, you know, I should be able to do a web service with another company
3506610	3508410	without ever talking to somebody at that company.
3508410	3512430	So first I go to a UBR. I search and I want to talk to SAP.
3512430	3516410	I search for SAP. I see all the web services that they're listing.
3518230	3521530	The UBR will tell me their UDDI server, if they have one.
3521570	3525370	I talk to their UDDI server, and it has things like invoicing, right?
3525370	3528490	Maybe I want to do... I've sold them some stuff, I want to invoice them.
3528990	3535090	And so it says, the invoicing web service, this is the contact information for that person,
3535090	3536750	and it exists at this URL.
3536750	3539330	And so I go to that URL, I add a question mark WSDL,
3539330	3545170	and the invoicing service tells me, OK, these are the nine things you can do with the invoicing service.
3545170	3548250	And now I have the ability to do whatever I want to those different methods.
3548270	3550230	So that's the tree, and that's how people envision it.
3550230	3554070	Obviously, it makes things easy for businesses, but it also makes things easy for attackers.
3554070	3559130	One of the really scary things is there's currently no real binding of somebody who's in the UBR
3559130	3561750	really is that person, right?
3561770	3565310	Like this next one, who here is going to trust this entry?
3565310	3566650	Bank of China, right?
3566650	3570770	There's no cryptographic protection saying this is the Bank of China, but here they are.
3570770	3574990	They're listed in the UBR, and with a character set that I can't read in my browser
3574990	3577250	because I don't have the Chinese character set, right?
3577250	3581070	Now, people are working on these big PKIs by which you can authenticate web services,
3581070	3583210	but people are fighting over the standards.
3583350	3584610	Obviously, it's a lot of money.
3584610	3588730	Just as it's a lot of money to be able to sign certificates for web apps,
3589590	3592490	it's going to be a lot of money for web services because it's only corporations.
3592490	3593810	It's very rarely individuals.
3594290	3597710	And so, there's no good way of verifying this right now.
3598130	3601770	So, we'll do a little walk through a UBR.
3601770	3604590	Microsoft has the prettiest interface, so I think I'll use theirs.
3606130	3611650	So, fortunately, Microsoft puts up a big barrier to keeping attackers from using a UBR.
3612670	3614490	You have to be registered.
3614490	3616590	What kind of registration do you think you need?
3617270	3618610	A passport.
3618610	3624070	So, I mean, if that restricts all attackers with a Hotmail account, I think we're all okay.
3629290	3635210	I'm going to sign in first so you guys can't razz me with how short my passport is.
3636590	3638350	Are any of the passport guys in here?
3638690	3640090	Passport's great, by the way.
3640190	3641710	Are any of the passport guys here?
3648640	3650760	There are actually some really smart guys.
3663500	3666720	Okay, well, I'm going to talk about something while this is loading.
3667860	3669240	What? Sorry?
3672910	3674650	Oh, wait, a book. Excellent.
3674950	3677370	Yeah, because this is going real slow.
3677550	3680190	Somebody's tossing Microsoft in the dustbin, probably, so...
3680190	3682070	Okay, compensation.
3684510	3691410	Okay, the first person who can raise their hand and give me the new canonical XPath gets the prize.
3692050	3692830	Yes, sir.
3699000	3700080	Er, next?
3700080	3703200	The next, the injection attack itself. The string. Yes, sir.
3705780	3707140	It's not a semicolon.
3708600	3710240	Okay, I'm going to close my eyes.
3710240	3711100	Oh, no, I'm not closing my eyes.
3711100	3712360	I'm going to say yes.
3712360	3715000	I'm going to say now and then everybody raise their hand and whoever's fastest.
3715100	3716560	Jesus, there's no way to do this.
3716840	3717380	Now.
3718900	3721420	I think this gentleman was up there.
3725740	3727620	Bam! You are the winner, sir.
3727700	3728520	What is your name, sir?
3728520	3730000	Come on up, get your prize.
3731720	3733640	And he can't even see the slides.
3733640	3734660	That is amazing.
3737760	3738760	What's your name, sir?
3739500	3740680	I've spotted the Fed.
3740680	3741820	Mike, show them the shirt.
3747930	3750130	Okay, that was perfect timing, Mike.
3750130	3752650	Good work, because now I am logged into the UBR server.
3752650	3754190	Now, I'm not trying to beat up a Microsoft.
3754190	3757190	I'm just using them because they have the prettiest interface.
3757990	3759730	And you don't have to really register.
3759730	3760530	You just use Passport.
3760530	3763490	But as I said, those four companies all run UBR nodes.
3763490	3764830	They all sync up with each other.
3764830	3766550	Right, so this is the same data from all of them.
3766550	3771430	So, we can do things like we can register ourselves as users.
3771430	3773590	We can publish ourselves.
3773610	3779030	Like I said, when you publish yourself as Bank of America, nobody calls the Bank of America headquarters to make sure.
3779310	3781930	A little information and stuff.
3781930	3783430	Let's try the search field.
3784970	3786630	What should we search for?
3787630	3788930	Any... chase.
3788930	3789570	Okay.
3791770	3793910	Like a car chase, you mean.
3793910	3794590	Right?
3797650	3799530	Another cool thing is they've got all these...
3799530	3800390	Well, it's not cool.
3800390	3801870	It's actually incredibly boring.
3801870	3803090	But it might be useful.
3803090	3806710	Is that there's all these different ways you can categorize these web services that are all competing.
3806710	3808290	Like the government has some.
3808290	3810630	And then the visual studio has its own.
3810630	3811690	All this kind of stuff.
3811690	3822170	And eventually, when a lot of people are using it, you should be able to walk your way down this tree and find all the things that are important.
3822190	3823870	Finance, that sounds like important.
3836100	3837540	Okay, they say there's none.
3837540	3838300	Okay.
3838680	3841520	That doesn't mean that they've actually categorized everything.
3847660	3848260	Let's see.
3848260	3850320	Did anybody see where I searched my name on this?
3852980	3854100	Maybe it's enterprise.
3856060	3857300	You're right, you're right.
3857820	3862800	So I can provide... providers is like the English name of the company or enterprise or whoever it is.
3866700	3869720	And I'm going to do something more general than chase because I'm not sure they're in here.
3869720	3872120	I'm just going to do bank and we'll see what happens.
3873940	3878280	There's not a huge number of people because there's not a huge number of people deploying them publicly.
3879220	3884560	One of the things that our web... WSMAP, one of the tools that we're releasing.
3884700	3887280	One of the functionalities we had to pull at the last minute.
3890320	3897120	It's funny, if you buy like a learned web services book and it's got like an example how to do a UDDI registry, search for that thing.
3897120	3902140	It's going to be like Acme Bank or something and there'll be hundreds of listings of all the people who have downloaded it and actually done it.
3902140	3903480	Which tells you something about this.
3904100	3908520	So, Ms. Matma Sharma is the contact.
3908880	3911840	Here's her email and phone address that I'm not going to click through actually.
3911960	3917260	But you put contact information in case you can't get all this magic pixie dust doesn't work and you actually have to call somebody.
3918980	3921840	This is saying that Bank of America has a lending service.
3922760	3923840	Oh, it's a...
3927940	3931460	Oh, they use a local host. So, somebody's just been playing around.
3931720	3936100	So, but if Port 18000 is now something very interesting to put in your NMAP scan.
3936100	3938440	Right, when you look at the Bank of America.
3938440	3945740	But if this was... if they're actually... if they're actually exposing this, then this would be an URL to something that's internet exposable.
3945740	3949580	And then there'll be interface. There's different ways of defining how an interface works.
3951200	3953660	Let's see what their interface model is.
3953660	3956420	It's called... like I said, there's lots of acronyms.
3956700	3958020	It's a T-Lender model.
3958020	3961320	So, at this place, if they're publicly doing it, you'd probably have something like an URL.
3961320	3963580	I think Bank of America had a WSDL URL.
3967680	3970380	Ironically, not a... think of Lithuania. Awesome.
3972280	3975600	We'll have like an URL that goes to a WSDL that points you directly to...
3975600	3978300	Oh, something I forgot to mention about WSDLs that were in the slides.
3978320	3981580	A WSDL gives you everything you need to know to attach to a service.
3981580	3984440	So, that includes the location of it. Right?
3984440	3989160	So, a WSDL text document, if it's just floating around, contains all the information.
3989280	3993240	Like, this is what you can do. This is how you log in. This is how you transfer money.
3993240	3995260	And this is exactly where the URL is.
3995260	3998760	So, if you have a WSDL, you have everything you need to know to actually do the attack. Right?
3998760	4004140	Because the location of the service, what platform it's running on, all that kind of stuff is contained in there.
4004820	4005840	God, this is so slow.
4005840	4008760	So, anyway, everybody can go play with this when they're on their fast connections.
4008760	4014680	Uddi.microsoft.com or you search for UBR and you can play with other people's if you have a preferred vendor.
4017160	4018920	Oh, yeah. All kinds of stuff.
4020140	4024400	So, at this point, well, I guess I'll show you how the discovery works if I was actually going to do something nice.
4027660	4031120	If I wanted to use a web service for legitimate purposes.
4031840	4038680	There is a nice little program called WS Web Services Studio.
4038760	4044880	It's distributed off of .net.com, which is like the Microsoft community site for .net developers.
4044880	4048500	I think it's actually made by Microsoft but not supported, so they throw it on the cheap site.
4048640	4050900	So, they don't have people calling the 800 number about it.
4051160	4052600	It's a great little graphical interface.
4052600	4058280	Like I said, you know, web services, unless somebody gives you the client or if it's something like an Ajax app,
4059940	4062480	you don't have a nice gooey way of talking to it.
4062480	4063860	So, it's a good thing for a developer.
4063860	4064360	Yes, sir.
4068080	4070980	Right, and Eclipse has a web service platform.
4070980	4074660	I use XMLSpy, which is really expensive, but there's all kinds of really cool stuff, too.
4076120	4078660	So, Web Services Studio. I think I've already gone to the bank.
4080800	4082960	So, this is the studio.
4084120	4086900	It does things like, like I said, you put a WSDL in there.
4086900	4088780	It can either be on the internet and you ask for it.
4088780	4091780	It can be local and then it'll figure out where it is from the local one.
4092680	4097460	And I'm going to go back to the Bank of Lithuania.
4098180	4100340	To the interest rates.
4101740	4102700	Details.
4108310	4109290	Ah, here we go.
4109290	4110550	Here's the access point.
4113270	4114430	ASM.ASMX.
4114430	4117170	So, what platform do you guys think that is?
4118030	4119150	Windows, right?
4119150	4120470	It's probably ASP.NET.
4121510	4125250	Although web services are supposed to be universally worked with each other,
4125250	4128530	there's lots of little details and so it doesn't always work.
4128650	4132910	In fact, one of our tools, you know, there's some problems.
4132910	4133650	I'll demonstrate.
4133650	4135450	There's some problems with the Python implementation.
4135590	4139410	One of the problems is, you know, not a lot of people are doing web services person-to-person.
4139610	4142090	They generally control the software on both sides.
4142090	4144630	So, they use the same platform so these bugs don't get caught, right?
4144690	4147370	So, it's good that this is a Windows 1.
4147550	4152670	So, we'll just guess that they have WSDL generation on there.
4153710	4155570	Looks like he was able to get it.
4159590	4161290	This network is so slow.
4164820	4167540	Is Kaminsky talking now and doing his weird network stuff?
4167540	4167980	No.
4168660	4169260	Last night.
4169260	4169780	Okay.
4170100	4170960	Was that good?
4173920	4174840	Excuse me, sir?
4176880	4178940	Really? He ended up at the hospital, Dan Kaminsky.
4180080	4180800	Jesus.
4180800	4184220	Okay, we're taking a collection in the memory of Dan Kaminsky.
4186940	4191280	Unlike Dan Kaminsky, I actually don't put in applause, pauses in my presentation.
4191280	4192520	Do you guys think I should do that?
4192900	4193440	Let go.
4193440	4194580	And that's a WSDL!
4195500	4196360	Ta-da!
4196700	4197560	Thank you.
4197700	4198280	Thank you.
4198880	4201980	So, this was able to grab the WSDL.
4202480	4205780	And it's generated, like I said, it has all the information it needs to know on the service.
4205780	4206900	These are different methods.
4206900	4211380	This is just as if I was writing an application and I call a function that's defining my function.
4211380	4213880	Just think of it as that, although it goes across the internet.
4214220	4219180	In the web app world, these could be either parameters in a post, like transfer money or do this,
4219180	4224340	or it could be the URLs themselves, like slash interest slash get money.
4225020	4230840	So if I click on one of these, it tells me what was defined in the header and the body for each one of these.
4231020	4234000	This has nothing, so that means it doesn't take any input.
4234900	4238760	This one takes one string in the body.
4238900	4244960	And so if I wanted to put a value in there, I could put it in there and say invoke.
4244960	4251840	This is meant for legitimate users, so it won't let you do things other than what they define.
4252100	4257740	But like I said, people sometimes don't check very well, so it might be very possible...
4257740	4266700	One good way to do an attack on this would be to run Web Service Studio or Eclipse or XML Spy through WebScarab,
4266700	4270200	watch the traffic that's legitimate, and then edit it byte by byte by byte.
4270200	4273760	Remember, it's UTF-8, so it's two bytes per character if it's internationalized.
4275040	4278760	Interest rate, interest rates by day, interest rates by date type, yada yada.
4278760	4284620	So this one doesn't require anything to invoke it, so I'll invoke it, and I should get something back.
4284620	4290780	So right now it's going across the internet, it used the WSDL to generate a message that it thinks these people are going to understand,
4290780	4295120	and it sends it to them as an HTTP post and waits for the response, and here's the response.
4295620	4298400	It's an XML document, it automatically parses it for us.
4299720	4302800	Like I said, this is not how you're supposed to use this, right?
4302900	4307860	If I was another bank and I wanted to get the interest rate, I'd have some application that would do this automatically and then give it to a user.
4307880	4312520	Or if I was Bank of Lithuania, I'd create a nice little pretty GUI to do this for people, right?
4312520	4316440	So that's why this is all ugly. Like I said, this isn't meant for human consumption.
4317180	4322520	But here it gives us all the data that came back, we can say request response, and we'll actually see...
4324860	4329000	SOAP messages have the envelope, the body, the header, we talked about the header, the envelope's required,
4329000	4332620	it has things like what version of SOAP am I using, what's the namespace, stuff like that.
4332720	4335840	And then the response, which is just an HTTP response.
4336720	4341460	I love this, they tell us the exact service pack version of ASP.NET.
4343000	4349260	And then a UTF-16 encoded XML document that gives all the input that comes back.
4349260	4353940	Just like if I called in a program, if I called, give me an interest rate, and it had three things it returns,
4353940	4357180	this will return everything even if it doesn't have information in there.
4357220	4358340	And we're good to go.
4358340	4362220	So, here's the WSDL, it's really ugly. You can see why people don't read them.
4362220	4366200	For something that simple, right, it's all that WSDL.
4366520	4368320	You have to define everything like four times.
4369220	4372500	And you can see why that might be a place that people don't look.
4377580	4381200	So, we'll do an attack and we'll use Web Service Studio for it.
4381200	4383240	So, to wrap up before we get to the demo.
4384180	4385940	Why do we have all these discovery methods?
4385940	4389040	It's this thing called service-oriented discovery, more venture capital.
4389040	4392940	It's amazing how much of the English language is based upon what can get you venture capital.
4393580	4395080	Service-oriented architectures.
4395120	4398520	The idea is that delayed binding of applications.
4398560	4401720	If I'm Bank of America, and I know most of the banks in the world
4402340	4406460	use some kind of standard thing to, say, clear checks,
4406460	4409140	then I can, not even knowing who those other banks are,
4409140	4413180	go to a registry, cryptographically check that that person is who they are,
4413180	4415980	because it's signed by somebody I trust,
4415980	4418020	find the web service to do the transfer,
4418020	4420160	find how to talk to that web service and talk to it.
4420160	4422860	And you can program their software to do all this, right?
4423140	4425660	Lots of MagicPC dust, it's a little bit scary.
4425980	4431040	But because this is so powerful, and because you can automate stuff to do things without humans ever involved,
4431040	4432740	it's going to be very popular with people.
4433220	4435560	Other than UBRs, there's some cool third-party registries.
4435560	4438860	x-methods.net has a big list of fun services.
4439020	4440980	A lot of these are by people who are just having fun.
4440980	4443380	Things like census data by zip code and stuff like that.
4443380	4446900	It's a good place to play around if you just want to learn about web services.
4447440	4450240	And then there's this thing called Disco slash WS Inspection.
4450240	4452160	Disco is a lightweight UDDI.
4452160	4454740	Instead of running a whole server to tell you what my services are,
4454740	4457580	I just have a text file you can read it in, an XML file.
4457580	4461480	This was a Microsoft-specific thing that's becoming now WS Inspection,
4461480	4465520	which is going to be a real standard to do this without running a whole other server to do it.
4465520	4467920	Our tool will automatically look for Disco files for you.
4468280	4473440	Like I said, a Disco file will automatically be deployed for you if you hit the compile button on Visual Studio.
4476540	4478560	And so those are some of the new issues.
4478560	4481280	The traditional attacks that we've always had still exist, right?
4481280	4486700	Design flaws, the bad idea methods like we talked about, the same OWASP top 10 things.
4486700	4488580	SQL injection still exists, right?
4488580	4493860	Although some of these things are using XML on the back end, a lot of them are still using SQL.
4494160	4498180	And so just as we had in web apps, SQL injection will work.
4498180	4501460	I'm not going to talk about SQL injection. You can go find Dave Litchfield for that.
4501540	4504120	The thing I will tell you is that the best way to do it is to...
4504120	4506060	You have to escape those characters generally.
4506140	4509520	You can use something like a CDATA block, put the entire SQL stream in it
4509520	4514640	that will magically get transferred by the XML document into whatever the string is and then put into the query.
4515560	4517660	Overflow is an unmanaged code, right?
4517800	4523060	Managed code is the Microsoft term for things like Java and .NET that run in a virtual machine.
4523060	4528340	Unmanaged code being something like I compile C++ for an x86 or a Spark, right?
4528340	4533260	Well, there's a lot of... a lot of people have a lot of stuff written in C and C++ out there they still use.
4533260	4535920	It still is the core of their stuff that they want to expose.
4535920	4542040	And so all the vendors have cool ways of taking something that's compiled on my machine and making it web service accessible.
4542040	4544060	One great one is called .NET Remoting.
4544060	4546020	And again, I'm not beating up on Microsoft because they're bad.
4546020	4549280	It's just theirs is the coolest and the easiest to use, right?
4549280	4554820	If you have a COM object that works and, you know, it can be something... I think it has to support I Unknown.
4554840	4558240	It's like the same standards. It has to be remotable like an ActiveX control.
4558240	4561200	If you have a COM object, you can just click through.
4561200	4562580	You don't have to write any code.
4563520	4567900	And say, I like this COM object. I want these methods to be exposed to the world.
4571420	4577940	And all of a sudden, now there's a web service with all these... takes all these inputs and gives it to a C++ program.
4577940	4582580	Do you think that it goes and finds out what the limit on that stirring copy is?
4582580	4586240	Or what the... I'm sorry, what the static buffer that goes to that stir copy is in that C++?
4586460	4588040	Do you think it does that? No, it doesn't.
4588040	4591340	Right? It just gives it the information. It just says a COM object can be called locally.
4591340	4595100	And so it makes it really easy for people to take something that's local and remote it.
4595100	4596900	So .NET Remoting, it's fun.
4597020	4599760	See it in theaters near you in 2007, right?
4599760	4601360	When people start really deploying it.
4601360	4605320	It's a cheap way to do web services if you already have stuff written on the Windows platform.
4605420	4609020	Java, you can do the same thing with like RMI and local calls and stuff.
4609120	4611240	It's not as easy though. It's not just click, click, click.
4611840	4613560	Mistakes in authorization and authentication.
4613940	4617180	Because SOAP is stateless, people have to rule their own, right?
4617180	4620220	It's very possible that there are methods out there that you find from the WSDL
4620220	4624100	that don't require you, that don't properly check your access control before they do something.
4624100	4627560	They take a parameter like, I want to transfer money from this bank account to this bank account.
4627560	4629760	They don't check whose bank accounts those are.
4631120	4633860	Like I said before, the auto-discovery mechanisms make this great.
4633860	4637140	Because you no longer have to go look for this stuff that's kind of crusty in the web application.
4637140	4638480	You just ask the WSDL.
4638620	4642360	And like, they're sometimes named really stupid things like, make me admin, right?
4643140	4644160	Cross-site scripting.
4644160	4648500	Now, like I said, this is not something, SOAP isn't something that you eat with your web browser, right?
4648500	4653900	So if I get cross-site scripting coming back in XML, it's not going to run as script.
4654380	4660340	But, and this is the big but, there's a lot of situations in which there's a web interface also in these applications.
4660400	4665220	And so cross-site scripting is also still doable, it's just you're not attacking the web service itself.
4665220	4668260	The exception to this being AJAX, right?
4668660	4670500	The downside is it's not easy.
4671380	4673840	I mean, I guess it's an upside because we're all good people in this room.
4673840	4676440	The downside for the bad guys is it's not easy.
4676440	4682680	Because I have to write something that, you know, in AJAX, like in Google Maps, it takes some XML data and then it makes it presentable.
4682680	4688900	So I have to figure out probably exactly how that's happening to write cross-site scripting script that'll actually run when it's transferred.
4688900	4693160	That being said, unless they're doing filtering on their side before the information gets to me,
4693160	4697820	it might be possible for me to do input through an AJAX interface one place and pop it out somewhere else.
4697940	4702400	Another thing we've seen is a lot of these web services, there's a human in the loop somewhere, right?
4702400	4708180	If I go transfer money at a bank and I have to put a memo field in there about what my transfer's about,
4708180	4712340	I put that field in, I make sure the transfer's gonna die, I call up the customer service rep.
4712640	4716140	Hello, how can we help you? We're, you know, dumbassbank.com.
4716620	4720280	What can we do for you? Well, you know, my transfer's not working out.
4720280	4723460	Can you pull my file up and see what it is? Well, sure, give us your social.
4723520	4726920	They pull it up, it's a web interface, boom. Their own.
4727320	4733220	Obviously, that's a pretty sophisticated attack. It requires some possible inside knowledge, but maybe not.
4733220	4740240	And if this is, you know, if you have an IE0 day, or the way people patch IE in IE, you know, 90 day or something,
4740880	4746860	in most enterprises, right, people are still writing IE5 and stuff, then you might get root control of their box.
4749580	4753320	So, any questions on those attacks before we kind of move into the wrap-up and then the demo?
4753320	4756120	I'm sorry that I know it's a lot of talking in a row. Yes, sir.
4771810	4777630	Right, did everybody hear that? That Apache Access allows you to take pre-written Java and just drop it in.
4777630	4782010	Yes, Access is great, too. Apache Access, if you guys want to play with web services and you don't like Microsoft,
4782010	4786410	Apache, the Apache project has their own web service framework, works with Java, it's very nice.
4786510	4791670	We're playing with that, too. I know, I'm saying, I'm beating up on Microsoft here because of the demos written in Microsoft,
4791670	4795990	but this is stuff that everybody does. So, thank you, sir. That's a good point.
4796750	4799330	So, we have a couple of tech tools that I'll show you.
4799330	4807530	One's really cool, the one that Scott wrote, the one I wrote is kind of crappy, but I'll pretend that I wrote the one that Scott wrote.
4807550	4812230	The cool one is WizBang, that's how we pronounce it. It is a SOAP fuzzer.
4812510	4815890	It doesn't fuzz the SOAP implementation, it fuzzes the application behind it.
4815890	4823270	It takes a WSDL, right? And, you know, you can go and buy, like, SPI Dynamics and SyncDyn and all these, like, attack tools, attack web apps.
4823270	4828730	The really hard part that those guys have to tackle in writing those is actually the discovery of the attack surface, right?
4828730	4831730	For us, the discovery of the attack surface is easy because we ask it.
4831730	4837670	And unless they're really smart and they're manually editing the WSDLs, the WSDL will most likely represent the actual attack surface.
4838270	4842670	If it's not automatically generated to the WSDL, it's probably not callable remotely.
4842730	4849410	And so, it takes a WSDL, creates a nice little proxy, looks up what the types are, like, this is a string, this is an integer,
4849410	4852330	and it does nasty things depending on that type, it's all extensible.
4853390	4857950	It supports SOAP responses and faults, gives you a nice little interface, I'll demo it,
4857950	4861050	and, well, not a nice little interface, it gives you output in a webpage.
4862070	4868170	And the future work we're looking at right now, it only works with RPC-style SOAP for all the really hardcore SOAP people in here.
4868170	4874230	It doesn't do doc lit because of a bug in Python's implementation of SOAPy, but we're working on it.
4874230	4876130	We're going to resubmit a patch to them and get it fixed.
4876130	4880130	So, once we get the libraries fixed, it should support almost all web services.
4880270	4887370	Oh, here's Jesse Burns, my partner, who has also helped Scott in writing this and who is always tragically late.
4887370	4894210	But not on consulting projects, he's never late on consulting projects for all those people with...
4894210	4896370	Wait, I'll do a Dan Kaminsky. Jesse!
4896370	4897430	Ta-da!
4898850	4901010	Thank you. Thank you very much.
4901010	4905950	And then the other tool that Jesse helped with, that's pretty cool, it's OK,
4905950	4911730	takes a WebScarab as input, we use WebScarab a lot now, it's a really good product,
4912450	4915750	WebAttackProxy is probably the most you know, it's open source, OS does it,
4915750	4921210	there's this guy named Rogan in South America, right? I don't know where he is.
4921770	4924850	South Africa, I'm sorry, he's not South American. That's it, he's EA, right?
4925490	4931050	Who works on it, and Jesse submitted patches and stuff. Jesse likes to run it in Eclipse, in debug mode, like in real time.
4931050	4932990	He's pretty hardcore about that.
4933630	4939570	But anyway, it's really cool, and we use it a lot, and WizMap is not really for finding web services that are out there.
4939570	4944790	WizMap is useful for situations in which I have something that already talks over a web service.
4944790	4948730	So, maybe I... let me think of something.
4948930	4952530	So, back in the B2B, when I was talking about places web services are being used,
4952530	4957190	there's a point on the slide about OFX, which is the standard... anybody here use Quicken or Money?
4957690	4961430	OK, you're not going to raise your hands, but there are people in here who use Quicken or Money to manage their money.
4961430	4966670	There's nothing wrong with that. I'm just saying that OFX is the standard by which it talks to banks
4966670	4969870	when you say, update my account, and it gets your American Express information.
4969970	4974110	That's called OFX. The next version of OFX is based on SOAP, right?
4974110	4977130	So, say I have a client like that. I have something that's been shipped to me,
4977130	4980350	and uses a web service on the back end, and I want to reverse engineer it.
4980350	4985530	So, I'll put WebScarab... I'll set my HCD proxy, put WebScarab on it, and watch that traffic,
4985530	4991570	because it goes up from Quicken up to Chase and MBNA and American Express and stuff, right?
4991570	4993190	Those don't go through Quicken.
4993530	4996650	Intuit just tells Quicken where to find those people, and then they go find it, right?
4996650	4998270	And that's all over SOAP.
4998330	5003570	And so, say I want to actually, you know, research that communication channel,
5003570	5006950	then I'll record it in WebScarab logs, and I'll run WISMAP,
5006950	5012110	and WISMAP will go through and find all of the things I called, as well as the implied directories,
5012110	5016550	and try a bunch of web service discovery requests, looking for WSDLs and disco files and stuff,
5016550	5018010	and then write them out to the disk.
5018010	5021370	So, I don't have to manually go through and find the things that are actually web services or not,
5021370	5024910	and they'll find all the implied web services, and maybe they don't want their disco files out there,
5024910	5027610	or they just don't know that when they hit compile, it automatically goes out there.
5027690	5028470	Stuff like that.
5029050	5031830	Future work, something we had to pull at the last minute because it wasn't working.
5031970	5037390	We're trying to get to find UDDI servers when you get a SIPR range, or maybe even an NMAP XML file, right?
5037390	5040450	Because they are web servers, you have to do kind of a Nickto kind of thing,
5040450	5043430	where you get a UDDI, where you look at a web server and you ask it, you know,
5043430	5046470	for different URLs that mean that it's a UDDI server.
5046510	5050950	That's going to be very powerful, because like I said, there are enterprises out there that have these exposed,
5050950	5053790	just don't tell people about it, don't register them in UDRs,
5053790	5055690	just tell their partners about it.
5056510	5058730	And then hopefully one day we'll integrate it with WSBANE,
5058730	5064430	so you can run it against, you know, the people that you have a legal ability to pen test against,
5064430	5067630	and then you can restrict it based on a reg X to only be within their domain,
5067630	5071030	and it will go find the web services and then automatically attack them, you run it overnight,
5071030	5073770	and then, you know, your two-week engagement's done in an hour and a half.
5075710	5077790	Okay, tying it all together, I think we kind of talked about this,
5077790	5081350	I can go to a UBR, I can test UDDI server, ask for the services,
5081350	5084930	I go ask, you know, dumbbank.com, give me all your web services,
5084930	5087870	I ask that service, give me your WSDL, it gives me the WSDL,
5087870	5091810	I look at the dangerous methods, I run WSBANE to try all of those,
5091810	5096710	I find an XML injection, I use XML injection to change the user ID,
5096710	5098170	and I become whoever I want.
5100720	5105220	So a question here is, are the old bugs still relevant?
5105220	5107860	A lot of people here would argue that OWASP Top 10 was never relevant,
5107860	5112120	or that OWASP Top 10 is actually saying that OWASP Top 4 in ten different ways,
5112120	5115860	but it turns out that it is, right? These are still bugs that exist in our world.
5115960	5119080	You still have to validate input, access control is still a problem,
5119080	5121280	authentication and session management is a problem, like I said,
5121280	5124020	SOAP doesn't give that to you, you have to think about it yourself.
5124600	5128460	Cross-site scripting, less of a problem, but a problem if there's ever a web interface,
5128460	5130520	and certainly a problem in AJAX applications.
5131180	5136620	Injection flaws, buffer overflows, things like .NET remoting make that kind of stuff a reality,
5136620	5138800	because people might get lazy and not rewrite their stuff.
5139420	5142140	Injection flaws, SQL injection, XPath injection, this is worse now,
5142140	5144740	because we've added all these new protocols that are spoke on the back end,
5144740	5145920	so we have new things to try.
5146900	5149040	Fortunately, almost all of those things use a single quote,
5149040	5150620	so it makes fuzzing really easy for them.
5152080	5155200	Insecure storage, denial of service, insecure configuration management.
5155200	5157960	I think we've proved that denial of service is still a pretty big issue.
5159600	5161580	So, the conclusion before we get to the demo.
5162840	5166040	Web services are very powerful, they're easy to use, they're fun to use.
5166040	5169480	It's fun to go out and get a book and write 20 lines of code,
5169480	5173020	and have it do something like get me census data, and then plot it onto a map.
5173020	5174320	That's really, really cool.
5174440	5177240	But, because of all that, they're really, really dangerous.
5178920	5181520	Especially because of the ease of use on the developer side.
5182840	5185160	There's a lot of security work that needs to be acquired.
5185180	5187860	These people are writing these web wiz security standards,
5187860	5190460	but I don't think a lot of security people are looking at them.
5190600	5192380	And so, those things need to be inspected.
5192560	5195580	We need better attack tools from everybody to help develop.
5196140	5200020	We GPL'd our web service stuff, so we're looking for people to help us with that stuff.
5200880	5204380	I guess we'll start a source code project or something, so you can do that.
5205040	5207280	We need people to find the best practices for development.
5207420	5210380	Nobody knows how to write secure web services, that's one of the problems here.
5210500	5213780	You can go and buy 20 books now on writing a secure web app,
5213780	5216000	but you can't buy one on writing a secure web service.
5216060	5218940	You buy all the books that say securing web services,
5218940	5220660	it's all about the encryption and stuff like that.
5220660	5222880	That's not a bad thing, that's something people care about,
5222880	5225200	but it has nothing to do with injection attacks and stuff like that.
5225200	5228260	And then we need for people to settle up and stop getting greedy
5228260	5231460	and build this PKI infrastructure before people start deploying
5231460	5234940	and moving my credit reports over these systems.
5236400	5239280	And then on our shameless plug slide, we are hiring.
5239280	5242640	If you are a researcher or a consultant, please have your resume to career size.
5243600	5245340	And a shout out to all these people.
5245500	5249000	I mean, sorry, I'm a professional, it's not a shout out, it's a thank you.
5252020	5255180	My brothers want me to know how many people here know Leroy Jenkins.
5256540	5260140	Okay. That's a pretty good number.
5261220	5263440	Okay, any questions before we get into the demonstration?
5265180	5266040	Yes, sir.
5278050	5280750	That's an excellent point, and I'm sorry I glossed over that.
5280750	5282170	It was in the slide, but I didn't say it.
5282170	5285550	Yes, the right thing to do is if you're a web service,
5285550	5289150	you're putting out on the internet, and you don't want anybody in the world to talk to it,
5289150	5292650	you just want partners to email them the WSDL, yes.
5293210	5296990	Turn off the auto mechanisms to publish the WSDLs and just email them.
5297150	5299070	That's the best protection against that kind of stuff.
5299070	5300470	Makes it much harder.
5300470	5304750	If you don't have the WSDL, there aren't built in stuff in SOAP just to ask for all the methods, right?
5304750	5306110	That's the method that's supported.
5306150	5306930	And people do that.
5306930	5312030	If you guys, if you go drop Google Maps into WebScarab and find out what web service they're talking to
5312030	5313870	and ask it for a WSDL, it's not going to give you one.
5313910	5315450	So there's certainly people that understand that.
5315450	5317910	That's also something, because if you don't want people using your service,
5317910	5321890	if the way you get people to use your service is to mail them a WSDL,
5321890	5324850	or you don't want people scraping it, like eBay and stuff,
5324850	5329130	so that they make money off of your work, then that's something you can do too.
5329570	5333010	Google API is probably one of the coolest web service interfaces out there.
5333270	5334790	See Johnny Long's talk.
5336090	5341310	Any other questions before we move on to me messing up the demonstration and you people laughing?
5343370	5346530	Okay. I'm really sorry that there's so much talking in a row.
5346690	5349670	We've got to get better at putting lots of demos in there. I'm sorry.
5352890	5354690	So here we have a...
5360800	5362820	I don't know if I can do this in 800x600.
5363800	5366020	A virtual PC of Windows 2003.
5366140	5367620	It's got a web service on it.
5367740	5371920	The exact same web service is currently running on wsdemo.isecpartners.com
5371920	5373820	if you're online right now and you want to play with it.
5373820	5376600	Or if you go home and you want to try some of these tools,
5376600	5378660	you're welcome to do a tax.
5378660	5381820	I'm letting you do a tax against wsdemo.isecpartners.com.
5381960	5384100	It's going to be the only site that's going to say that.
5384940	5388460	So like we talked about before, there's this cool thing called WS Studio.
5388980	5393600	I'm going to point it at the web service.
5394340	5395780	It's very, very simple.
5398120	5399580	No, I don't want to do it today.
5402180	5405160	It's got one user, or one method.
5405420	5406400	LogonUser, right?
5406400	5408640	So this is simulating maybe Word Bank.
5408640	5411760	And the first thing you need to do is log in before you get your account balance and stuff.
5412000	5414760	And it takes a string username and a string of password.
5415620	5418400	So say I've been hired to pentest this.
5418540	5419580	What am I going to do first?
5419580	5421780	And let's pretend this is one of those more complicated ones.
5421780	5424100	There's hundreds and hundreds and hundreds of methods here.
5424820	5428800	I want to see if there are any vulnerabilities.
5428800	5447300	And so I'm going to do that using WSBANE to do the initial.
5447300	5456620	So we're big on documentation and GUIs because we're privately funded and we have no venture capital.
5456800	5458580	If you want GUIs, go to Foundstone.
5459060	5460840	They excel at that kind of stuff.
5462300	5463920	So WSBANE, you give it an URL.
5463920	5465060	This isn't descriptive enough.
5465060	5467060	You have to give it an URL that gives it a WSDL.
5467120	5469320	It can also point to a local file.
5470860	5474820	So I am going to give it the URL of the WSDL I grabbed.
5475140	5476340	WSDL hashtags.
5477620	5482280	This is why our partner Himanshu, who spoke at Black Hat, he video records all his demos.
5482280	5485060	Which I'm starting to really appreciate how smart that is.
5489010	5490990	That's not a real demo if it's videotaped?
5491150	5492390	Right, okay.
5493750	5498070	Because I spend an hour and a half convincing you I'm smart and then I can't type.
5512110	5513170	Excuse me, sir?
5514030	5515150	Oh, yes.
5515510	5518900	Thank you.
5519340	5520700	Is that a little more readable?
5522980	5523920	Okay, great.
5523920	5526840	So, I'm running it with an URL that should give me a WSDL.
5528320	5530300	Okay, I run it. It pulls down the WSDL.
5530300	5531740	I didn't know that happened real fast.
5531760	5533020	It runs a bunch of tests.
5533020	5536860	It does this by looking up in an XML file it has, which I'll show you in a second,
5536860	5539440	the type, you know, in a SOAP you define types.
5539440	5541940	You can do simple types, which are things like string and number.
5541940	5545040	You define complex types, which means you define a type.
5545040	5547880	It can actually be an XML document itself and stuff like that,
5547880	5551100	if you want to do really cool extensible stuff, or binaries.
5551760	5553680	We don't support those yet, just simple types.
5553680	5555620	That covers probably 90% of web services.
5555720	5557780	So it looks up what the type is, like a string,
5557780	5560160	and it looks up in the XML file the things we want to try.
5560300	5561280	And it tries those things.
5561280	5563400	These are all the things that get tried on that one method.
5563640	5565240	And then it reads the response.
5565240	5567700	And this response, coming back from the SOAP message, is made pretty.
5568000	5569840	And here we have something that says SOAP fault.
5570820	5573600	So I click here, and it gives me what actually ran.
5574040	5576820	So, outbound, here's my HTTP headers.
5576880	5578840	I set the SOAP action header.
5579820	5582240	Kind of glossed over this, but there may be...
5582240	5585700	We have seen vulnerabilities in being able to set the SOAP action header
5585700	5589200	to different than actually what the method is in the SOAP message.
5589780	5590980	So that would be a checkbook.
5591300	5593780	And then, within the body, we say logon user.
5593900	5595660	The namespace is this namespace.
5595660	5597680	This is the encoding metadata.
5597860	5600960	And then these are supposed to be... they're not indented, but they're children to this.
5601040	5603280	The username and the password strings.
5603660	5605800	And what was our username here? Anybody see it?
5606440	5607700	It's a single quote.
5608280	5610000	And the password was default.
5610740	5613200	And so the response was...
5613940	5615200	To find this XML document...
5615980	5617520	Oh, I threw an exception.
5617520	5620280	Okay, this is a fault, because it's a SOAP fault.
5621060	5624680	Gives me the nice little system trace of all the things I've got called.
5624680	5627500	Now, this is like...
5627500	5632720	50 lines of C-sharp that's running on the other side.
5632720	5637380	Look at all of the methods that get called in a row to parse that.
5637380	5638200	Look at this.
5639100	5640060	That's all...
5640060	5644080	Every one of those is a function that we went through to call this.
5644080	5646780	There's a lot of pixie dust there, right?
5648540	5650520	And then it gives me...
5658420	5660420	Actually, we'll do this the pretty way, which is...
5660420	5663080	If I got this, I would do it myself, then.
5663220	5664880	In this, so I'll try it.
5665100	5667140	I'll say my password...
5667140	5668460	My username to quote.
5673430	5675790	Oh, exception. This isn't a local exception.
5675790	5677950	It just passes through a SOAP fault.
5677950	5680290	That's an exception on your side, and I go to request response.
5685710	5687270	Yeah, that's not what it's supposed to say.
5690530	5691290	Yeah.
5691290	5692330	Thank you.
5692330	5695490	Right, I need to have something in the password so it doesn't...
5700520	5701640	Ah, thank you.
5701940	5703360	So, I get a SOAP fault back.
5703360	5705080	Server is unable to process a request.
5706720	5708340	And what does that look like to you?
5709800	5710560	XPath.
5710760	5713280	So, what was it, sir, that I'm going to try next?
5713280	5714500	The winner of crack?
5718250	5719270	That's correct.
5721830	5723650	Let's give a round of applause for that.
5723650	5724410	Ta-da!
5725350	5726430	Thank you, sir.
5727770	5729090	Single quote. Or.
5729130	5731830	One equals one. Or.
5731830	5734190	Single quote, single quote. That's not a double quote.
5734250	5736270	Equals. Single quote.
5739170	5740750	Spaces are a significant answer.
5742570	5744090	Oh-ho-ho-ho.
5744890	5748450	I assume the pauses in his human communication between words
5748450	5752550	were meant to represent the symbol also known as a space.
5752710	5755010	When encoded in UTF-8, so.
5755030	5756710	We'll let him keep the frack.
5759130	5764050	And string result successfully logged in on user ID 3, Henry Ackerman.
5764390	5765770	So, that was an XPath injection.
5765830	5767910	Why was it this user?
5767910	5769850	What's special about this user, do you think?
5770710	5772450	He's the last guy, right?
5772450	5775650	So, when they referenced the list,
5775650	5777930	they probably asked for the last thing in the list, right?
5777930	5779990	Which you do with a negative one in Python.
5779990	5781730	So, they asked for index negative one,
5781730	5783850	and you can either ask for the first thing or the last thing.
5783850	5786230	Generally, I should get the same thing, right?
5786230	5787910	And they asked for the last thing in the list.
5787910	5789970	Maybe they went to this talk and they thought it was enough.
5789970	5793130	They weren't paying attention to this part, just the last hour and a half.
5793130	5794890	And they thought it was enough just to ask, you know,
5794890	5798190	not ask for the first one, because that first person might be a user.
5798190	5799910	So, I'm logged in, and this is good.
5799910	5801750	But nobody wants to stop here, right?
5801750	5806050	This is where you stop if you're like a real second tier hacker, right?
5806070	5809070	Oh, yes. I'm throwing it out there. That's right.
5809070	5809990	I said it.
5811530	5813350	So, what do I want to do?
5814650	5819850	Right, I could do user ID equals one, but although I do know how the XML file is laid out,
5819850	5820950	that's kind of cheating.
5821610	5823050	What's another way to do it?
5823690	5825570	So, let's go back to our string.
5829550	5832410	Let's say it is pretty close. It's not exactly the string, right?
5832410	5837190	We did see what the string was, but just because we know what the injection string was
5837190	5842610	doesn't mean we know exactly what's in the XML document, right?
5842610	5846610	Unless it references it, right, in that path, the XPath string.
5846790	5851670	And so, this bottom one, what else could I do other than ask for user ID equals one?
5851670	5853810	It's actually simpler than that.
5854910	5856950	Name equals admin. Yes.
5857030	5862470	Right, I can just do name equals or quote, quote, quote, quote, and get rid of the or one equals one
5862470	5864990	because I want them to match the first one, right?
5864990	5867130	So, I don't make it a full tautology anymore.
5867130	5871470	I make it a tautology only if the name is equal to who I want it to be.
5871470	5873010	Does everybody understand that?
5874090	5880590	So, I am going to... let's say I've tried admin. It didn't work.
5880930	5885030	And I know these people wish they were programming on Unix, right?
5885030	5886690	So, they used the word root.
5886710	5889610	And I've now successfully logged in as user ID zero, name root.
5890410	5892170	Ta-da! Sorry.
5893270	5898150	If it works for Dan Kaminsky, he comes back every year to Black Hat in DEF CON.
5898150	5900190	So, if it works for him, it's going to work for me, right?
5900550	5902230	So, does everybody understand what we did here?
5902470	5904570	This was an XPath injection, XPath 1.
5904610	5908910	This could work with either an XML flat file in the back end or a quote, unquote, XML database.
5908950	5913150	This exact same query string would work in an XQuery, right?
5913230	5921270	Because, like I showed before, XQuery, I mean, the simplest way to do it is all you have to do is to find the document you're looking up, which is the same as a table, right?
5922450	5923950	No questions on that? Yes, sir.
5927250	5928230	Of course, yeah.
5933270	5936430	How do I use that to map out the tables in the database or the XML file?
5936430	5938570	That is harder.
5939790	5941630	We're not there yet. You're right.
5942330	5947270	Emmett Klein worked on that, and the way he found to get it out was only through logging or logging off.
5947270	5950430	He was not able to get error messages out that contained enough information, right?
5950430	5953990	Like, the traditional way of SQL is that there's SQL statements that you can do.
5967700	5969760	You're going to go Karl Rove style on them?
5977660	5978380	Okay.
5983300	5984220	I'm sorry.
5986800	5991140	It's probably doable. We don't have that answer yet, and that's something that we'll be working on.
5991260	5996040	Emmett Klein does it through that binary. I think now with XPath 2, there might be better ways of doing it.
5996040	6004220	You might be able, because you can reference external links, it might be possible for me to reference something and then make the rest of the XML document look like it's part of the URL, right?
6004220	6007120	It's like people do cross-site scripting with an image tag to get a cookie out.
6007120	6010780	When it hits my log, I might be able to get it out of a log. I'm not sure.
6011480	6014260	Klein looked into doing it with error messages, and he wasn't able to do it.
6014720	6018060	Still, I mean, the guy's disappeared off the face of the planet, so if anybody knows him, have him email me.
6018060	6020240	I'd love to see what he was doing. But you're right.
6020360	6025420	In SQL Injection, there are the 19 commands you can probably do in a row that's with the error messages.
6025420	6028980	You can map out the... not the tables, but the nodes.
6030820	6035460	Okay, well, since we've got a second, I'm just going to do a quick demo of WISMAP.
6038630	6043030	Well, since I learned to set it up without you guys seeing it.
6044210	6046350	Okay, so this is WISMAP.
6052100	6053460	Python's compiling it.
6054200	6055900	Shoot, that's going to be hard to see.
6058330	6065470	So, if you run it with "-h", it says you can do all these things, ask for WSDLs, ask for DISCOs, store them locally, verbose.
6065470	6067030	I'm going to ask it to do everything.
6067030	6072130	I'm running in a directory with a WebScarab conversation log.
6072130	6075210	Although, if you have it in a sub-directory, that's fine, too.
6075950	6078810	It'll search all the directories for WebScarab logs.
6079030	6080710	Anybody... who here uses WebScarab?
6081770	6084070	Decent number. I recommend you guys use it.
6085670	6091750	Anyway, as you can see, there's no "-u", anymore. We had to pull that out, which is one of the great tragedies of my life.
6092130	6092810	Sorry.
6092810	6102990	And I'll run wismap.py-wsdls-discos, write out the files, and do it verbosely.
6103170	6111850	And I just generate these logs by kind of cheating and going to things that I thought would have different types of web services.
6111850	6114910	Although, I didn't know all of them, but I knew these were different web services I would go to.
6114910	6121010	Like I said, this is not useful for blind. This is useful for reverse engineering something that uses web services.
6121470	6130170	And if the network actually worked here at DEF CON, you would see that it would find multiple WSDLs and DISCOs here and then write them to the local disk.
6130970	6135390	In the... which are already written. 1.disco, 1.wsdl, 2.disco.
6136850	6138150	Wow. Okay.
6143170	6147870	Okay, so it did one test. While that's going, I'll show you one of those.
6160510	6165050	So this is one of the things that, when I ran it in my hotel room, it pulled down.
6165050	6167470	This is the WSDL for a census data.
6170090	6178150	So do you think the programmer read that whole thing before it got published to the internet looking for all the methods that he felt would be too dangerous to publish to everybody?
6182600	6183780	Probably not.
6187040	6191980	I'm not... I'm not going to... you... that's for you to explore yourself, sir.
6193240	6197820	So you can see it's doing some tests. It's looking for... it's asking for question mark WSDLs.
6197820	6204000	It's asking for question mark DISCO. It's also looking for default DISCO URLs, and it's about to find one.
6204140	6211760	And like I said, DISCO is like UDI. It doesn't define a web service. It defines the services you're publishing through a web server instead of running your UDF server.
6213540	6218760	Okay, so open questions or comments. Is this useless? Do you guys think you'll never run into this?
6221300	6223200	Any more questions for everybody?
6225880	6227940	Okay, well thank you very much. We'll do Spot the Fed.