WEBVTT 00:05.730 --> 00:07.470 Hey everybody, thank you for coming. 00:07.610 --> 00:09.550 My name is Alex Stamos, and this is... 00:10.410 --> 00:13.070 My name is Alex Stamos, and this is Attacking Web Services. 00:13.070 --> 00:14.830 Is that a good volume for you guys? 00:14.930 --> 00:16.010 Okay, great. 00:16.510 --> 00:20.090 This is a session from 11 to 12.50-ish. 00:20.090 --> 00:21.570 We'll probably run a little bit early. 00:22.050 --> 00:25.670 But I'll be available for Q&A afterwards, and my email address is in here. 00:25.870 --> 00:28.830 So at any time, please feel free to drop me an email. 00:29.430 --> 00:31.810 Also, I want to make this an interactive thing. 00:31.810 --> 00:36.090 It's really hard to judge, especially when you do, like, background information, what people's backgrounds are. 00:36.110 --> 00:42.070 So please raise your hand, or if I don't notice, just yell out a question, if you have it at any time during the presentation, okay? 00:44.190 --> 00:46.170 So I was joking about the whole Cisco thing. 00:46.210 --> 00:49.910 Obviously, Cisco doesn't deploy any web service boxes, so... fortunately. 00:50.610 --> 00:51.630 So what are we going to talk about? 00:51.630 --> 00:53.170 I'm going to talk about who I am. 00:53.910 --> 00:55.650 My speaking partner, Scott, was supposed to be here. 00:55.650 --> 00:56.830 He did a lot of this work. 00:56.830 --> 01:02.710 I need to give him a shout-out, but I let him go to his engagement party so he doesn't get divorced because of DEF CON. 01:03.550 --> 01:17.930 So we'll talk about what we do, what web services are, where they're being used, talk about the basic technologies and new attacks that we're now seeing in the deployment of these technologies, as well as traditional attacks that we've lived with for a long time, 01:17.930 --> 01:25.070 especially, you know, traditional web applications that now can be retooled a bit to work in the web services XML world. 01:25.350 --> 01:27.390 And then we'll be doing a couple of demos. 01:27.390 --> 01:30.650 So it looks like the network's up for now, so we should be able to do a couple of those. 01:30.650 --> 01:33.190 If you want to play along, there's an URL in here. 01:33.590 --> 01:40.910 You can start downloading our software off the web and the 19 different Python packages you need to make it run. 01:41.090 --> 01:44.050 And if somebody actually gets it running, you can play along while we do the demo. 01:44.250 --> 01:47.010 And like I said, please interrupt at any time if you guys need something. 01:47.690 --> 01:49.330 So who are we, or I? 01:49.330 --> 01:51.010 I'm a founding partner of iSEC Partners. 01:51.790 --> 01:57.130 We're all ex-stakers, all wounded children from the at stake semantic merger. 01:57.490 --> 02:02.470 Based on the West Coast, we do consulting and research, mostly in application security. 02:04.030 --> 02:04.830 Why? 02:05.170 --> 02:06.330 What are we going to talk about? 02:06.330 --> 02:07.450 Well, we're talking about web services. 02:07.450 --> 02:08.230 And why is that important? 02:08.230 --> 02:10.210 Well, they're deployed all around us. 02:10.210 --> 02:15.950 It's kind of this stealth deployment that a lot of people don't realize, especially a lot of people in the security community. 02:15.990 --> 02:24.950 If you're in the enterprise security community, or if you're an enterprise developer, I'm sure you've heard the term SOAP or XML from a manager, or had to buy a book about it. 02:24.950 --> 02:27.410 But it's not something that there's been a lot of security research in. 02:27.850 --> 02:36.250 So, you know, we're not saying that this is definitely not the definitive talk that's going to be given on web services over the next decade. 02:36.250 --> 02:37.810 This is the first run through. 02:38.850 --> 02:40.170 We found some bugs. 02:40.170 --> 02:41.830 There's some interesting stuff going on. 02:41.830 --> 02:47.490 But really what we're trying to do is create interest about web services in the security community and kick off research by other people. 02:47.490 --> 02:49.330 Because there's a lot we don't know. 02:49.330 --> 02:52.270 There's tons of acronyms out there that need to be attacked. 02:52.350 --> 02:54.290 And we're looking for your guys' help. 02:54.950 --> 03:00.510 So, like I said before, the latest version of these slides is... the CD is way old. 03:01.470 --> 03:04.030 isecpartners.com slash defcon.html. 03:04.030 --> 03:07.970 If you go to isecpartners.com, you can click all the way through speaking engagements. 03:07.970 --> 03:16.030 And then there's a demo web service at wsdemo.isecpartners.com slash expathservice slash expathservice.asmx. 03:16.430 --> 03:24.930 I will concede right now that there's somebody in this room with a botnet that could destroy this machine and make the data center itself fall into the gaping maw of the earth. 03:24.930 --> 03:27.030 And I concede you're a bigger man than I. 03:27.030 --> 03:28.890 Please don't sin flood it or anything. 03:29.090 --> 03:31.310 I'd like people to be able to play around with it, okay? 03:33.330 --> 03:39.590 So, this talk is supposed to be not only talking about the security stuff, but we're going to try to do a background on the relevant technologies. 03:39.590 --> 03:43.130 Because, like I said, a lot of people, especially in the security community, haven't been exposed to them yet. 03:43.130 --> 03:45.550 It's not something that you get off a CD. 03:45.550 --> 03:46.970 It's not something that ships you through Dell. 03:46.970 --> 03:49.490 It's generally not something that you can download off a BitTorrent. 03:49.490 --> 03:51.950 And therefore, it's not something that gets researched very much. 03:53.010 --> 03:55.650 And so, we'll give a little background on that. 03:55.790 --> 04:00.770 Please let me know if you have any questions, because I don't want to spend too much time on that, especially for the people here who are experienced in web services. 04:01.050 --> 04:05.610 Then we're talking about some of the security risks that are associated with web services. 04:06.150 --> 04:11.090 A lot of them sound pretty much familiar, because a lot of technologies are familiar, or built upon older technologies. 04:11.830 --> 04:13.830 But there's lots of different things. 04:13.830 --> 04:24.710 Like I said, I think there's going to be a lot of stuff in the next several years, both attacks enabled through web services at applications that are insecure, or in the frameworks and technologies themselves. 04:24.830 --> 04:28.470 This is not a talk about the WS-security standards. 04:29.310 --> 04:35.270 That's a class of standards that does, like, encryption, allows you to do authentication and authorization, all that kind of stuff. 04:35.690 --> 04:37.350 They're pretty interesting. 04:37.350 --> 04:38.230 They do all kinds of stuff. 04:38.230 --> 04:40.510 They come in books 700 pages long. 04:40.510 --> 04:41.690 Nobody deploys them. 04:41.730 --> 04:43.070 So that's one reason not to talk about them. 04:43.070 --> 04:52.090 But they're also about things like being able to do legal signatures online using a web service, which has nothing to do with actually attacking or defending that application. 04:52.090 --> 04:58.310 Just because you have XML signing, digital signatures enabled, doesn't mean you can't attack it. 04:58.310 --> 05:04.270 Just as if you have SSL on your web application, and there's a little lock in Internet Explorer, it doesn't mean your application is secure. 05:04.270 --> 05:05.450 It's kind of the equivalent. 05:05.450 --> 05:09.170 So this isn't a talk about that, which is good, because you people would leave. 05:09.470 --> 05:10.950 So what are web services? 05:10.950 --> 05:21.150 It's a very overloaded term, mostly because you can get millions of dollars thrown at you by venture capitalists if you put the words web services and Indian programmers, like, in your prospectus. 05:21.870 --> 05:26.450 For our purposes, web services, our communication protocols, are based on XML. 05:27.050 --> 05:30.950 That's pretty much the only standard we'll be talking about that's universal. 05:30.950 --> 05:40.030 Lots of people do all kinds of weird web services, not like SOAP or any definitions, but just moving XML files around using HTTP or even SMTP, and they call it web services. 05:40.030 --> 05:40.890 That's fine. 05:40.890 --> 05:44.150 But for our purposes, we're talking about XML as the base language. 05:44.150 --> 05:55.510 They provide computer-to-computer communication, which is an important point to understand and kind of underlies a lot of the security issues, is that these are things that are not meant to be consumed by human beings, at least not initially. 05:55.510 --> 06:03.550 It's not like moving HTML over HTTP, where the goal of the HTML is to be rendered into something that a human being can read. 06:03.550 --> 06:08.850 A web service might be rendered into a GUI or something, but maybe not. 06:08.950 --> 06:20.070 And a lot of the technologies are based upon the idea that human beings don't have to be involved, which is both scary for programmers who want to be in their jobs, but it's also scary from a security standpoint. 06:20.630 --> 06:22.210 They use standard protocols. 06:22.210 --> 06:25.630 They're often controlled by the W3C, OASIS, and WSI. 06:25.690 --> 06:29.930 Web services, as a technology, has more acronyms than I've seen anywhere else. 06:29.930 --> 06:31.430 It is unbelievable. 06:31.430 --> 06:32.810 It's not my fault. 06:32.810 --> 06:34.250 I just want to say that up front. 06:34.270 --> 06:35.650 Blame Tim Berners-Lee. 06:35.690 --> 06:38.490 And they're designed to be platform- and transport-independent. 06:38.490 --> 06:49.250 Although a lot of these standards have been made by IBM, or one standard has been made by Microsoft, all of them are generally accepted and patent-free and able to be deployed by anybody. 06:49.250 --> 06:53.970 And that's kind of what makes them powerful and makes them so compelling. 06:54.510 --> 06:55.590 Why are they compelling? 06:55.590 --> 06:59.710 Well, these web services are based upon some pretty well-understood technologies. 06:59.710 --> 07:03.270 How many people here have ever edited or created an XML file? 07:03.710 --> 07:05.090 Right, a lot of people. 07:05.090 --> 07:05.690 Right. 07:06.390 --> 07:07.210 That's great. 07:07.210 --> 07:15.950 That doesn't mean that you've done web service programming, but you now have a basic knowledge that a lot of people inherited from the HTML world anyway to get into it. 07:16.170 --> 07:20.570 The adoption of web services has been very, very quick by large software vendors. 07:20.570 --> 07:30.910 The whole creation of these standard bodies has gone rid of the not-invented-here syndrome, so Microsoft and IBM are willing to implement it without either one of them taking credit for the other guy's invention. 07:30.910 --> 07:34.390 That's pretty unique in the software industry. 07:35.690 --> 07:44.030 One of the reasons they're compelling is that they're described as kind of a panacea for interoperability issues, both internal to the enterprise and externally, and we'll talk about some scenarios of that. 07:44.370 --> 07:48.150 But probably why they're most compelling is the magic pixie dust, right? 07:48.150 --> 08:06.190 This is the same magic security pixie that comes by when you plug your computer into the wall at Caesars, and it automatically gets an IP address, and then it's automatically able to talk to the gateway, even though it doesn't know the MAC address through this crazy little pixie dust protocol called ARP, 08:06.190 --> 08:06.610 right? 08:06.610 --> 08:14.370 It's all these magic pixie dust protocols that make things happen magically and automatically and without human intervention that create insecurities, right? 08:14.370 --> 08:22.550 Because there's nothing secure about plugging into any network in the world, and that's because everything has always been built to be easy, and easy is bad, right? 08:22.550 --> 08:26.830 If there's not a human being involved saying, yes, you're allowed to do that, then that's a bad thing. 08:26.830 --> 08:29.390 And there's tons of magic pixie dust in this. 08:29.390 --> 08:32.730 For example, this is a little, what, 10 or 12 lines of C-sharp. 08:33.130 --> 08:36.610 Open up anybody who has MSDN installed, open up Visual Studio right now. 08:36.610 --> 08:51.070 If you create a new project, you point it at something that has a web server, IS6 installed, and it's got ASP.NET activated, you set up that project, you copy and paste this into a file, you compile it, it will automatically compile the C-sharp into CLR, 08:51.070 --> 09:06.950 create an ASP page that corresponds with that C-sharp file, create a configuration file, create a web discovery document called a disco file, create a WSDL, which is that web service document link which we'll talk about, load all these up, if you have a UDDI server, 09:06.950 --> 09:22.170 it will automatically register with UDDI, and you'll now have a function that if somebody over the internet can send a message to IIS, which then hands it up to an XML parser, which hands it to a SOAP handler, which then finally hands it to a program which gives it a string, 09:22.170 --> 09:28.470 and then it goes all the way back down, with ten lines of programming, and there's then millions of lines of code running around it. 09:29.030 --> 09:33.210 That's a lot of magic pixie dust, and that's the kind of stuff that we'll be talking about today. 09:36.010 --> 09:41.250 Another reason that you see them all over the place is the value is really well understood by the pointy-haired bosses. 09:41.410 --> 09:45.050 This is just a little fake quote, but this is something that we actually see. 09:45.470 --> 09:50.670 I see a couple gray hairs and ponytails in here, so those are people that might actually know what Kix is. 09:50.670 --> 09:54.970 It's a crazy little programming language for mainframes, but you can't hire people that do it anymore, right? 09:54.970 --> 09:58.970 All those guys are retired after all the Y2K money they made. 09:58.990 --> 10:04.270 And so a lot of these enterprises have these IBM boxes from the 70s that their whole enterprises are running on. 10:04.490 --> 10:15.190 Now, it's their stock trading system, or your health records, or a bank, your bank account numbers, are all on a mainframe, and they can't hire people to talk to the mainframe. 10:15.190 --> 10:16.110 So what do you do? 10:16.110 --> 10:23.290 Well, you go buy some IBM products, because IBM is able to take machines they sold in the 70s and continually make money off of them. 10:23.290 --> 10:34.390 You go buy an IBM product and some IBM Global Services guys, and they come over and they put some WebSphere right in front of it, and they create this SOAP interface by which, just using XML and HTTP, you can talk to the mainframe. 10:34.430 --> 10:41.290 And now, I can get all these guys that have Learn Java in 30 Days books and have them write all my new enterprise applications to talk to the mainframe. 10:41.290 --> 10:43.970 Don't need to get any of those gray-haired ponytail guys. 10:44.090 --> 10:47.150 And that is very, very compelling to corporate management, right? 10:47.150 --> 10:49.390 Because they want to extend stuff and they don't want to spend money. 11:09.380 --> 11:11.180 Okay, so I have been told. 11:11.180 --> 11:13.000 I mean, this was all pre-arranged, obviously. 11:13.300 --> 11:16.520 This is issue number 13, numbered. 11:16.820 --> 11:17.400 Independent. 11:17.400 --> 11:17.920 I'm sorry. 11:17.920 --> 11:20.560 It's the last issue of Frack, numbered 13. 11:20.560 --> 11:21.820 They're individually numbered. 11:21.960 --> 11:25.420 It's still warm from the printing press, and it's incredible leet-ness. 11:25.420 --> 11:26.360 Come on. 11:29.020 --> 11:31.580 And it will be given to somebody in this room today. 11:31.620 --> 11:36.120 And I have to come up with a competition while I'm talking to you guys in my head about how we'll do that. 11:36.120 --> 11:39.420 So we'll have some kind of hacking competition at the end. 11:41.000 --> 11:42.320 Let me think about how we'll do it. 11:42.320 --> 11:45.060 But pay attention, because it'll have to do something with the slides, okay? 11:45.460 --> 11:46.440 Please don't mob me. 11:46.440 --> 11:47.140 Slow down. 11:47.140 --> 11:48.480 There's a lot of security guys here. 11:48.480 --> 11:52.100 I know you want it, but put it here so you guys can look at it. 12:03.270 --> 12:06.770 Okay, so now we're going to talk about what services are being used, right? 12:06.770 --> 12:08.450 Where are you going to run into it? 12:08.450 --> 12:15.450 Like I said, web services are not something that you consciously run into like you run into RPC and Windows, right? 12:15.450 --> 12:21.350 If you're a hacker and you use Windows and you've ever done a file transfer, you probably understand, like, ports 137, 139, Samba, and stuff. 12:21.350 --> 12:22.890 It's a technology you run into. 12:22.910 --> 12:36.110 But a lot of people in here have not run into web services, even though, most likely, everybody in here, either your credit report, your social security number, your tax information, your bank information, it's been moved over a web service protocol at one time or another. 12:36.490 --> 12:37.710 So where are they being used? 12:37.710 --> 12:38.470 Between companies. 12:38.470 --> 12:40.350 This is a big mover. 12:40.350 --> 12:42.290 This is the whole B2B thing, right? 12:42.290 --> 12:47.930 Which meant business-to-business, then it meant back-to-banking after the dot-com bust. 12:48.410 --> 12:50.250 But now, it means business-to-business again. 12:50.250 --> 12:51.910 And people are doing this using web services, right? 12:51.910 --> 12:56.170 We got a pass not invented here, so you can get your vendor to support it. 12:56.350 --> 12:58.630 And it gets rid of these stupid protocols that people invented. 12:58.630 --> 13:07.010 I mean, they're not stupid, but these incredibly complex, dense, binary protocols, like EDI and stuff, and all the X protocols that people have talked from company to company. 13:07.510 --> 13:10.690 You can get rid of those, and now you can write it in nice and easy XML. 13:10.690 --> 13:11.830 You can read it in English. 13:11.830 --> 13:12.570 It uses HTTP. 13:12.570 --> 13:13.490 Everybody knows how that works. 13:13.490 --> 13:14.750 It's based upon a web browser. 13:14.750 --> 13:17.990 Much easier for people to use than these old protocols to talk from business-to-business. 13:17.990 --> 13:25.570 A great example, the credit card companies have these weird, binary-packed, ultra-small formats for doing credit card clearing. 13:25.570 --> 13:27.690 Well, they're also moving to doing web service stuff. 13:27.710 --> 13:35.790 So, the credit card clear, when your order comes in, can talk to the bank, which can talk to the credit bureau, which can talk to the lender, and all this can happen over SOAP. 13:35.790 --> 13:41.050 And you can write it all in Java, and you don't have to buy a specific product for the credit card industry. 13:41.050 --> 13:44.730 You can just buy WebSphere or ASP.net and write it on top of that. 13:45.170 --> 13:47.890 Internal to companies, a lot of people like to hook their stuff up, right? 13:47.890 --> 13:51.410 I want my payroll system to work with my inventory system. 13:52.130 --> 13:56.130 Web services to connect those, instead of people having to understand each other's formats. 13:56.630 --> 13:58.930 In front of legacy systems, I already told you about this. 14:00.530 --> 14:02.610 Mainframes, AS400s, all that kind of stuff. 14:02.610 --> 14:07.270 Between tiers of web applications, and this is a really interesting one for some of the bugs we're talking about. 14:07.290 --> 14:14.190 A lot of people are moving towards using an XML data format on the back end. 14:14.190 --> 14:18.130 So if you do something on a web application, that XML data goes somewhere. 14:18.130 --> 14:32.110 Now, it might go to an XML-enabled database, which can mean anything from a database that can understand XML and put it into a normal table, to being transported somehow and then eaten up by a middle-tier software or something like that. 14:32.510 --> 14:41.350 This makes the X injections, and you might mean X star, there's different kinds of protocols here, injections into those protocols very interesting. 14:42.650 --> 14:46.010 And the way that most people have here, who here has used Google Maps? 14:46.710 --> 14:48.350 Who here has used Gmail? 14:49.070 --> 14:50.990 Right, so you guys have used web services. 14:50.990 --> 14:53.070 Those are AJAX applications. 14:53.270 --> 14:55.030 Asynchronous JavaScript and XML. 14:55.110 --> 14:59.570 They don't use SOAP or any of the heavy-duty web service, but it's still a web service. 15:00.310 --> 15:07.690 Really cool for people who haven't noticed, these are applications that allow you to do all kinds of interactive stuff without reloading the page constantly. 15:09.570 --> 15:14.790 Microsoft came out with Internet Explorer, has the ability to talk to what's called the XMLHTTP object. 15:15.190 --> 15:19.750 And now Mozilla now simulates that and stuff, even though it's obviously not ActiveX. 15:21.310 --> 15:23.470 Basically, I can give you an HTML page once. 15:23.470 --> 15:24.910 It has a bunch of JavaScript in it. 15:24.910 --> 15:29.350 That JavaScript talks to this object in the browser, which actually does all of its communication. 15:29.350 --> 15:32.610 And it's able to move XML files back and forth over HTTP. 15:32.650 --> 15:35.130 And it can do that without reloading, it can do it asynchronously. 15:35.130 --> 15:36.450 So it can do it multiple times. 15:36.450 --> 15:44.210 You scroll around in Google Maps, and it can spawn a bunch of these XMLHTTP objects to load up the address separately from loading up the pictures to loading up this and that. 15:44.210 --> 15:46.250 And it gives you a great end-user experience. 15:47.330 --> 15:50.770 A lot of people are using this enterprise as a replacement for thick clients. 15:50.890 --> 15:57.430 SAP doesn't want to have to ship an end-client for Macs and Linux and Windows. 15:57.430 --> 16:03.050 They'd rather ship something that just loads into Mozilla on all those platforms and allows you to have the same kind of user experience. 16:03.050 --> 16:08.190 Which, you know, the user experience kind of sucked in web applications because of reloading the backbone and stuff, and you can get rid of that. 16:08.610 --> 16:11.730 There are some definite interesting security issues with AJAX. 16:12.390 --> 16:13.770 We'll talk about that a bit. 16:13.770 --> 16:16.070 A lot of this stuff is also about the heavy-duty protocols. 16:17.550 --> 16:19.010 So what's the point of this? 16:19.370 --> 16:21.130 The code is broken free, right? 16:21.130 --> 16:25.070 One of the reasons people like web services is you do lots of powerful stuff over one port. 16:25.150 --> 16:27.770 Because back in the day, everybody put their whole enterprises on the internet. 16:27.810 --> 16:30.070 Then they herded this thing called a firewall. 16:30.290 --> 16:32.170 And they hired some firewall guys. 16:32.170 --> 16:33.550 And they paid Cisco some money. 16:33.550 --> 16:34.570 And they installed a firewall. 16:34.570 --> 16:40.670 And now, if you look at the outside of a normal corporation, you'll generally just see SMPP, HCP, HPS. 16:41.130 --> 16:44.030 Every once in a while, a Firewall 1 management port. 16:44.030 --> 16:48.150 But you don't see things like RPC open to the internet. 16:48.150 --> 16:50.330 Well, it's open to the internet again now. 16:50.450 --> 16:52.130 You're moving it over a different protocol. 16:52.130 --> 16:57.310 But now, with web services, you can move all this stuff over ports that people have had closed. 16:57.310 --> 16:59.790 And that's actually an advertisement for some of these products. 16:59.790 --> 17:01.810 Get around your firewall engineers. 17:02.030 --> 17:03.510 Buy our web service product. 17:03.790 --> 17:10.610 So, our new slogan is we poke holes in your firewall so you don't have to. 17:10.830 --> 17:12.470 Just set up your firewalls once. 17:12.470 --> 17:13.890 Fire your network engineers. 17:14.010 --> 17:15.690 Add all your functionality to a SOAP interface. 17:15.690 --> 17:16.430 And you're done. 17:17.790 --> 17:19.710 So, now we're going to talk about some of these technologies. 17:19.710 --> 17:21.630 Give you a little background in the attacks. 17:22.730 --> 17:23.890 So, XML. 17:24.010 --> 17:26.650 Everybody here kind of knows what XML is. 17:26.650 --> 17:31.210 It's this incredibly complex standard for representing all the data in the known universe. 17:31.210 --> 17:33.930 Which sounds like a really easy problem for them to tackle. 17:34.610 --> 17:37.950 Especially if it's supposed to be English readable on top of it. 17:37.950 --> 17:39.090 And it's very hard work. 17:39.090 --> 17:41.830 You've got things like binary data, internationalization. 17:42.270 --> 17:44.990 XML has internationalization built in from the beginning. 17:44.990 --> 17:47.470 Unicode 1.0 is the standard for XML. 17:47.470 --> 17:49.550 With XML 1.1, it would be Unicode 2.0. 17:49.550 --> 17:52.210 This makes internationalization attacks really interesting. 17:52.210 --> 17:53.410 Because we've seen these attacks before. 17:53.410 --> 17:56.190 Things like non-minimal UTF-8 encodings. 17:56.190 --> 17:59.830 Doing things like changing character sets to do like SQL injection and cross-site scripting. 17:59.870 --> 18:01.930 That's always been kind of stapled on. 18:01.930 --> 18:04.690 Because internationalization was stapled on to web apps. 18:04.750 --> 18:08.530 With web services, internationalization is from the beginning. 18:08.530 --> 18:14.230 And so, if you talk to something that understands XML, it probably understands all those character sets. 18:14.230 --> 18:15.610 You no longer have to get lucky. 18:15.610 --> 18:18.970 Like somebody installed the Japanese character set pack on the SQL server. 18:18.970 --> 18:20.470 Like you used to have to get. 18:20.470 --> 18:23.630 So, that's a really big deal for internationalization attacks. 18:23.630 --> 18:24.970 Which have been covered by other people. 18:24.970 --> 18:26.710 But definitely move over to web services. 18:26.870 --> 18:28.290 You have to represent meta-characters. 18:28.290 --> 18:30.870 You have to be able to define and validate how these documents are. 18:30.870 --> 18:31.470 Yada, yada. 18:31.470 --> 18:35.270 Because of the size of the product space, we've ended up with dozens and dozens of standards. 18:36.090 --> 18:38.490 And very few people understand a lot of them. 18:38.490 --> 18:40.430 And there's nobody who understands all of them. 18:40.970 --> 18:43.130 Which is a little different than web applications, right? 18:43.130 --> 18:47.930 Because it's pretty easy to understand both HTML and HTTP. 18:48.290 --> 18:50.310 Okay, I can understand how those work. 18:50.310 --> 18:52.770 I mean, I can't recite the RFCs. 18:52.770 --> 18:55.070 But it's almost impossible to do that with web services. 18:56.410 --> 18:58.670 There's a couple of basic strict rules. 18:58.830 --> 19:00.010 Why do you guys care about it? 19:00.010 --> 19:04.470 Well, when you're attacking a web service interface, you generally have to use legal XML. 19:05.150 --> 19:07.070 If you don't, you're just attacking the parser. 19:07.070 --> 19:07.770 And people have done that. 19:07.770 --> 19:10.890 People have already parked things that do all kinds of wacky stuff with XML. 19:10.970 --> 19:12.250 But people have done that before, right? 19:12.250 --> 19:16.270 What we're trying to get to is the applications behind that standard XML parser. 19:16.750 --> 19:18.730 I'm not going to walk you guys through how this works. 19:18.730 --> 19:22.290 But here's a simple element in XML attack, right? 19:22.290 --> 19:23.550 It's called the parent node. 19:23.550 --> 19:24.990 Those are called children nodes. 19:25.270 --> 19:27.030 Here's a full legal document. 19:27.030 --> 19:29.350 It does things like define the encoding. 19:29.370 --> 19:33.230 This is obviously Latin character set 1 for us English speakers. 19:33.230 --> 19:37.010 The default encoding for XML is UTF-8, which is great. 19:37.410 --> 19:40.490 This is the definition of a namespace. 19:40.490 --> 19:42.310 This XML document belongs to this namespace. 19:42.310 --> 19:43.210 So you can, like... 19:43.210 --> 19:51.190 If I had manufacturers shouldn't overlap with somebody else's namespace in an XML document, I also define a schema by which this can be... 19:51.190 --> 19:52.310 These pearls aren't real. 19:52.310 --> 19:53.950 Don't try to go grab them. 19:54.110 --> 19:56.250 A schema by which this document can be verified. 19:57.790 --> 19:59.850 Schemas are the way you verify documents. 19:59.850 --> 20:00.910 DTDs are the old way. 20:00.910 --> 20:01.930 It was a non-XML base. 20:01.930 --> 20:03.950 There's this weird thing with colons and stuff. 20:03.950 --> 20:08.390 The great thing with DTDs is there's a number of nasty attacks that have mostly been fixed. 20:08.390 --> 20:11.790 But as people come out with new XML parsers, they might be in there again. 20:11.850 --> 20:18.590 One of the attacks was to make a self-referencing DTD that could say, Oh yeah, I define a type B. 20:18.590 --> 20:22.210 And then B defines type C, which defines type D, which defines E. 20:22.210 --> 20:24.530 And then E defines something that has a subtype A. 20:24.530 --> 20:27.010 And you can get the DTD parsers to infinitely loop. 20:27.010 --> 20:31.970 You could also reference things that are external to the DTD, but most of these have been fixed already. 20:32.510 --> 20:34.990 XSDs, XML Schema Documents, are XML based. 20:34.990 --> 20:36.350 They're the new way of doing it. 20:36.490 --> 20:44.250 The important thing for security people to understand is that from a defense perspective, XML schemas can actually be very powerful. 20:44.250 --> 20:47.630 From an attacker standpoint, nobody uses them, so who cares? 20:51.890 --> 20:54.710 Like I said, they can prevent many of the attacks we're going to discuss. 20:54.990 --> 20:58.790 So if you are on the defense side, think about validating stuff with a strong schema. 20:59.090 --> 21:01.790 And don't do stupid stuff like having the all tag and stuff like that. 21:01.790 --> 21:02.750 We'll talk about that later. 21:03.290 --> 21:04.410 This is a schema. 21:05.310 --> 21:06.190 It's pretty readable. 21:06.190 --> 21:10.570 The only interesting thing here is I have a restriction that I have an element called year. 21:10.610 --> 21:13.290 I'm saying it has to be an integer and it has to be between these dates. 21:13.290 --> 21:17.070 This means I can't do SQL injection in the integer field. 21:17.090 --> 21:23.710 If I give it something that looks like a string, the XML parser itself is going to die before it ever gets close to the database. 21:24.410 --> 21:26.170 So here's a little bit of a protection. 21:27.010 --> 21:28.610 Most people don't do this kind of stuff. 21:28.630 --> 21:32.030 The magic pixie dust that we talked about generally doesn't include XML schemas. 21:35.050 --> 21:36.070 So parsing. 21:36.070 --> 21:38.250 So how do you... I get an XML document, how do I read it? 21:38.250 --> 21:39.650 There's kind of two standard ways. 21:39.650 --> 21:41.190 Both ways have security flaws. 21:41.190 --> 21:42.650 The first one is called SAX. 21:42.910 --> 21:45.030 Simple API for XML, I think it is. 21:45.090 --> 21:50.290 This is a step-by-step, stateless parser that expects you to store the state. 21:50.310 --> 21:53.970 It's kind of like a thing I say, go one more step, go one more step. 21:53.970 --> 21:54.830 Oh, you have children node? 21:54.830 --> 21:56.490 Okay, I want that child, I want that child. 21:56.490 --> 22:00.030 So when people use it, it's nice and it's lightweight, it's pretty easy to use. 22:00.070 --> 22:02.250 But it's not very powerful. 22:02.330 --> 22:08.250 And it has the downside of if you use a SAX parser, you have to track what data you've gotten. 22:08.250 --> 22:15.290 If I want to get out of that car, if I want to get manufacturer, I have to say car, okay, I got car, I want the child named manufacturer. 22:15.290 --> 22:19.190 It gives me manufacturer, and then I have to store it in a variable for myself. 22:19.430 --> 22:23.130 And there's an attack against that called XML injection that we'll talk about. 22:23.210 --> 22:25.910 And then the other one is DOM, Document Object Model. 22:25.910 --> 22:29.370 This is really powerful parsing, this is how most people do it in enterprise applications. 22:29.450 --> 22:32.110 And that turns out to be a bad thing from a denial of service standpoint. 22:32.110 --> 22:38.590 Because building, if I have a big XML document, what this means is it takes and it builds a data structure in memory that represents it. 22:38.770 --> 22:42.630 It represents all the nodes that are linked to all the child nodes, it's linked to this, it's linked to this. 22:42.630 --> 22:51.510 And each one of those nodes is an object in Java with its own garbage collection and all the information that gets wrapped around any variable in Java. 22:51.570 --> 22:54.130 So DOM has issues with denial of service. 22:54.590 --> 22:58.370 And then there's always a really bad idea, people make their own parsers with like regex and stuff. 22:58.370 --> 23:02.050 Don't do it, you can get an XML parser for every language, there's no reason to do it again. 23:02.050 --> 23:03.710 Because you'll probably screw it up. 23:04.950 --> 23:07.730 So an attack against X, XML injection. 23:07.730 --> 23:14.390 So this is a situation in which the attacker can control a string that gets put into an XML document. 23:14.490 --> 23:16.110 There's multiple ways this can happen. 23:16.110 --> 23:19.930 This can be an XML document that is standing in for like a database query. 23:19.930 --> 23:28.370 If I send, maybe it's my user login, and it puts the login information I give it, it puts it in the XML document and hands it off somewhere else to get parsed. 23:28.370 --> 23:32.230 Or it could be something like a document I upload, because that's how I upload data. 23:32.530 --> 23:33.810 It could be a lot of things. 23:33.810 --> 23:41.630 But anyway, if I can control text in it, and it's not being input filtered, I can put more XML tags in there. 23:41.630 --> 23:44.250 So in this situation, we have a user record. 23:44.250 --> 23:49.390 Let's say this is a bank, and I've created my user, because I have a bank account. 23:49.430 --> 23:53.970 And so I go in and I now create my web user, and it asks me for something like my email address. 23:53.970 --> 24:03.970 And so when I fill out my email address, I give it an email address, and then I close the email tag, and I create a new tag called unique ID. 24:04.570 --> 24:07.350 And then I say the email again, this is for the parser. 24:07.570 --> 24:09.330 Why did I put this unique ID in here? 24:09.330 --> 24:13.590 Well, this is in a situation where perhaps I have some knowledge of how the XML document is laid out. 24:13.590 --> 24:18.910 I know that there's a unique ID child node in there that defines what my ID is. 24:20.370 --> 24:23.890 This is like a unique ID that's used by the application itself. 24:24.390 --> 24:37.170 And so with a SACS parser, if I was writing a SACS parser to read this, generally, and remember, this is a fault with the application, not the parser itself, but we see it over and over again because people don't expect this, is you step through the document, 24:37.170 --> 24:40.190 and you go to user record, and you say, give me the first tag. 24:40.190 --> 24:42.910 And it says, okay, tag is unique ID, value is this. 24:42.910 --> 24:44.630 And so I write it to a temporary variable. 24:44.630 --> 24:46.670 And then I say name, and I write that to a variable. 24:46.670 --> 24:48.390 And I say email, and I write that to a variable. 24:48.390 --> 24:50.050 And I get to unique ID again. 24:50.050 --> 24:57.110 And because the parser itself isn't tracking the state, I'm just going through and have a switch statement that says, when I get this information, put it into a variable. 24:57.270 --> 24:59.990 I overwrite that information and put the zero back in. 25:00.690 --> 25:04.490 So who do you guys think user zero is on a web application? 25:04.990 --> 25:06.890 It's the admin, almost always, right? 25:06.890 --> 25:15.010 This is the same kind of, when you do SQL injection, you do OR 1 equals 1, it gets the first user in the table, and it always turns out to be either the developer or an admin. 25:15.030 --> 25:16.230 It's the same kind of problem. 25:16.230 --> 25:22.110 And so the SACS parser, if I step through like this and store it in variables, gives me a unique ID of zero. 25:22.410 --> 25:23.850 How do you defend against this? 25:23.850 --> 25:28.790 You can do an XML schema where you say you can only have one unique ID per user record. 25:28.810 --> 25:34.870 Or you can use a DOM parser, which you would specifically reference one of these, and it would probably check this one. 25:39.110 --> 25:40.310 No, oh, oh, I'm sorry. 25:40.310 --> 25:42.150 So this red, you're right, that's an excellent question. 25:42.150 --> 25:43.950 Why not do unique ID zero in the first place? 25:43.950 --> 25:46.350 This red area is the only part I control. 25:46.350 --> 25:53.790 So I imagine this is a web form that's taking my information and putting it into an XML document where it stores all my information about my bank account. 25:53.790 --> 25:54.850 Does everybody understand that? 25:54.870 --> 25:59.090 So I can only control what's between these two tags, because it takes my data and puts it in. 25:59.090 --> 26:05.990 And as you see, I have to do the email twice so that there's not this hanging email tag out here, which will make it choke probably, right? 26:06.450 --> 26:13.990 So like I said, for defense, you can do an XML schema validation, or you can use a DOM parser, or you can go through and check to make sure that you don't get multiple inputs. 26:14.550 --> 26:17.970 This also works with XPath, which we'll talk about. 26:17.970 --> 26:25.870 So if I did this attack and somebody was trying to pull this information out using XPath, even with a DOM parser, the attack would probably work as well. 26:29.050 --> 26:30.830 So, which takes us to XPath. 26:30.970 --> 26:36.230 XPath is this very simple language by which people are supposed to be able to reference what's in an XML document. 26:36.490 --> 26:39.230 It's kind of a cross between direct relations and regex. 26:40.530 --> 26:42.710 XPath number one was supposed to be nice and simple. 26:42.710 --> 26:46.870 XPath one has like 20 pages of documentation, the standard. 26:46.870 --> 26:51.650 XPath two is something like 300 pages, and nobody's read them all yet, so I'm not sure what's in it. 26:51.650 --> 26:54.390 But it looks really scary, some of this stuff in two. 26:54.390 --> 26:56.350 But these attacks work on XPath one. 26:56.410 --> 26:58.150 So say this was our car example. 26:58.910 --> 27:02.770 XPath entries are something like, so I get this XML, this is part of it. 27:02.770 --> 27:07.370 I load it into a parser, and then I want to ask the parser for information from the XML document. 27:07.370 --> 27:13.770 And so, one of the things I might ask for is, let's say there's a bunch of car nodes, right, in this document. 27:13.770 --> 27:15.450 It's a big list of used cars. 27:15.810 --> 27:18.030 I want to return all of the children of the node. 27:18.030 --> 27:19.670 XPath queries always return a list. 27:19.670 --> 27:21.630 It might be, it's like MATLAB or something. 27:22.110 --> 27:25.790 It might be a list of one item, but it always returns a list, which is really interesting. 27:25.810 --> 27:30.590 Because if I just say car, it gives me all of them in a big list, all of these nodes. 27:30.690 --> 27:36.470 If I return, if I do slash car, that just gives me the root element, right, only the first one. 27:36.470 --> 27:40.790 If I do slash slash car, it does all the car elements in the document. 27:40.790 --> 27:43.750 I'm sorry, car, if you say just car, it's all the children of the car. 27:44.010 --> 27:48.870 Car slash slash color will give me all the color underneath car. 27:48.870 --> 27:51.370 And then the interesting one is when you can have conditionals. 27:51.450 --> 27:57.870 Give me search for car, and give it to me the list of cars where color equals blue, right. 27:57.870 --> 28:00.270 And you can actually do pretty complex queries in here. 28:00.270 --> 28:02.770 And as you can see, this is really, really cool, right. 28:02.770 --> 28:06.450 Because this makes it really easy to get information out of an XML document. 28:06.450 --> 28:09.130 Because this is a pretty easy to understand language. 28:09.130 --> 28:17.930 And if my document's not incredibly complex, this is much easier to use than doing all these, you know, Python or C sharp calls to the DOM parser. 28:18.690 --> 28:19.970 What's the downside? 28:20.690 --> 28:22.070 Well, we'll get to that in a second. 28:22.070 --> 28:23.510 So where do people use XPath? 28:23.510 --> 28:25.510 People often use it to talk to databases. 28:25.510 --> 28:31.470 It's starting to replace SQL in situations where people are storing XML data in a database. 28:31.830 --> 28:35.810 All of these, XPath is supported by all of these database servers. 28:35.810 --> 28:39.070 I think you need like SP3 or something for 2000. 28:39.070 --> 28:40.750 So what's the problem? 28:41.150 --> 28:50.710 Well, like our old friend SQL from SQL injection, XPath uses, puts data and the commands you want to do, puts the verb and the noun right next to each other. 28:50.710 --> 28:54.770 And those are delineated by our old friend, the single quote, right. 28:54.770 --> 29:01.230 So if I want to say, give me the car where the color is blank, I use the single quote to say this blank describes the car. 29:01.230 --> 29:03.030 That's not a command I want you to run. 29:03.030 --> 29:04.110 That's a description. 29:04.930 --> 29:09.390 Unlike SQL, there is no access control in XPath or XML documents. 29:09.450 --> 29:13.910 So generally, if you run an XPath query against an XML document, you can read everything in that document. 29:15.010 --> 29:20.250 That's good, right, because sometimes SQL injection just doesn't work because they have good database schema. 29:20.530 --> 29:22.110 That doesn't exist here. 29:22.110 --> 29:24.790 There's also no real safe way of using XPath, right. 29:24.790 --> 29:27.250 A lot of times we'll do a pen test, we won't find SQL injection. 29:27.250 --> 29:31.030 We'll say, hey, no SQL injection, congrats, you must be doing really good input filtering. 29:31.050 --> 29:32.510 And they'll be like, input what? 29:32.510 --> 29:35.110 And we'll say, well, why don't we have SQL injection? 29:35.110 --> 29:43.050 Well, it turns out, because they want things to run faster, they use prepared statements, where they call and distort procedures, and that's a nice secure way of doing it, and SQL injection doesn't work in that case. 29:43.050 --> 29:44.510 There's nothing like that for XPath. 29:44.510 --> 29:45.650 There's no secure way to call it. 29:45.650 --> 29:53.090 The way people always call it is you concatenate a bunch of strings together, and then you give that string to the parser, right, which is the bad way of using SQL. 29:53.090 --> 29:54.430 That's the only way to use XPath. 29:55.250 --> 30:04.630 So the outcome is if I can control any data that gets into an XPath statement, and I can get a quote in, I can return arbitrary data and access arbitrary stuff in the document itself. 30:05.490 --> 30:06.710 And here's the example. 30:07.190 --> 30:11.610 So, in this example, say it's this bank again, and I've created an XML document. 30:12.110 --> 30:15.470 You know, I don't need a database, right, because I'm a small bank. 30:15.470 --> 30:17.850 So I just keep a flat XML document of all my users. 30:17.850 --> 30:20.530 I've already been XML injected, so I fix that, right? 30:20.530 --> 30:23.150 Oh, I'm so stupid, I should have known that people could have gotten stuff in. 30:23.150 --> 30:30.530 And so I fixed it by going over to a DOM parser, a nice big complicated parser that you can't do XML injection against. 30:30.530 --> 30:36.510 But since it's so hard to use, I'm going to use XPath to get information out of it instead of stepping through it, step by step. 30:36.530 --> 30:42.830 And so one of the things that I have to do is when people log in, I have to go see if they're in this big flat XML file of users. 30:43.090 --> 30:44.590 Everybody with me so far? 30:45.010 --> 30:45.630 Okay. 30:45.790 --> 30:46.210 Yeah. 30:46.210 --> 30:47.490 Great hypothetical, huh? 30:48.110 --> 30:49.190 Real original. 30:49.270 --> 30:55.270 So I'm going to create an XPath statement, and then give it to my parser, and it's going to look up the user for me. 30:55.270 --> 31:02.950 And so I'm going to say, slash slash user, search for the user whose name is equal to Joe, and whose password is equal to let me in. 31:02.950 --> 31:07.870 And the two red things here are information that come from the web form, the login and the password field. 31:08.590 --> 31:09.530 Okay, that's fine. 31:09.530 --> 31:10.210 It works. 31:10.210 --> 31:15.870 This will return a list of all the users, right, because slash slash will be a list of all the users that match that. 31:15.870 --> 31:16.970 It's probably only one. 31:16.970 --> 31:17.850 It should be. 31:18.330 --> 31:20.790 But it does return a list, a list of one element. 31:23.170 --> 31:26.670 So now we come to our new canonical statement that we'll replace. 31:26.670 --> 31:29.110 If you're really, really cool, quote... 31:29.110 --> 31:30.950 What's the canonical SQL statement? 31:31.130 --> 31:32.970 This will be the first point for getting the book. 31:32.970 --> 31:33.950 Raise your hand. 31:34.270 --> 31:34.710 Yes, sir. 31:34.710 --> 31:35.350 Back there. 31:37.190 --> 31:38.590 And then what after it? 31:39.930 --> 31:40.990 Right, dash dash. 31:40.990 --> 31:43.350 It may be semicolon, dash dash, depending on that, right? 31:43.450 --> 31:45.370 So this is our new statement. 31:45.370 --> 31:47.230 Everybody memorize it, put it on t-shirts. 31:47.590 --> 31:49.270 I have to get money from the t-shirts. 31:49.270 --> 31:54.150 But I've actually seen that, like, on t-shirts, which is horrible about me and my social life. 31:55.730 --> 32:00.190 This is our new canonical statement that will tell us if XPath injection is working. 32:00.190 --> 32:02.450 Single quote, or one equals one. 32:02.450 --> 32:03.750 Hey, that sounds familiar. 32:04.090 --> 32:10.550 Or, single quote, single quote, that's not a double quote, that's two single quotes, equals one single quote. 32:10.550 --> 32:13.910 I know not everybody can see it, but download the PDF, it'll be in there. 32:14.610 --> 32:21.810 So what this does, is now I have, give me all the users whose name equals Joe, and my first single quote closes out the Joe string. 32:21.870 --> 32:26.550 Or, one equals one, which is a sylla... what's the word for something that's always true? 32:27.550 --> 32:28.190 Apology. 32:28.190 --> 32:29.010 It's apology. 32:29.010 --> 32:31.190 Something that's always true, so this always returns true. 32:31.190 --> 32:33.630 Or, quote quote equals quote quote. 32:33.630 --> 32:36.670 Why do I need that quote quote equals quote? 32:36.750 --> 32:37.490 Anybody? 32:38.810 --> 32:40.230 To get rid of the last quote, right. 32:40.230 --> 32:44.090 So I don't have, XPath doesn't have the ability to do comments in line, like SQL. 32:44.090 --> 32:52.670 So I can't use the dash dash, which we used for SQL injection to throw away the rest of the line, or a semicolon to make mine a statement, and then make the next one a different statement. 32:52.770 --> 32:55.750 I have to actually use what's in my application. 32:55.870 --> 33:02.890 And so the easy way to do that, I've got a single quote floating out there, is I create an empty string, and then I create another empty string using that single quote. 33:02.890 --> 33:09.070 So only the red stuff I control, that last black one is put in there by the application, but I neutralize it by doing this. 33:09.070 --> 33:10.370 End password, let me in. 33:10.370 --> 33:12.150 So, why does this work? 33:12.150 --> 33:13.630 Because it's an or or and. 33:13.850 --> 33:14.570 Anybody? 33:14.610 --> 33:15.930 Why would this work? 33:18.670 --> 33:21.570 Well, the end's not quoted out, the end's used, but, sorry? 33:23.110 --> 33:23.930 Operator precedence. 33:23.930 --> 33:26.690 Somebody took a first year CS class and hated it. 33:26.690 --> 33:27.430 Right, sir? 33:27.970 --> 33:29.490 Yes, operator precedence. 33:29.490 --> 33:32.050 The thing that bites you in your ass when you start CS. 33:32.370 --> 33:34.590 When you look at this, it first does the and. 33:34.590 --> 33:38.430 There's an implied parentheses around this. 33:38.430 --> 33:40.170 So the and is the first thing. 33:40.370 --> 33:43.190 Quote quote and pass equals let me in, so this turns to a not. 33:43.190 --> 33:48.150 But then we have false or true or false, which turns into true. 33:48.450 --> 33:53.010 And so, what this does is returns all of the users, because it's a tautology. 33:53.010 --> 33:54.350 It returns a list of all the users. 33:54.350 --> 33:55.850 Well, what use is that? 33:55.850 --> 33:59.070 Well, like I said, XPath, everything's a list. 33:59.070 --> 34:03.890 So if I'm using XPath to log somebody in, I have to take a list, and what do I have to do with it? 34:06.010 --> 34:09.590 Well, not to protect, but what do I have to do, like, just to use it normally? 34:09.590 --> 34:13.490 I have to ask for the first element, and then use that as the login, right? 34:13.610 --> 34:18.690 So, I just ask for the first element anyway, and the first guy who's returned becomes my login user. 34:19.410 --> 34:20.790 That make sense to everybody? 34:21.470 --> 34:22.010 Right? 34:22.010 --> 34:26.610 A lot of people yelled at me at Black Hat, because they're like, how could it work, because it returns multiple things? 34:26.610 --> 34:30.150 Well, you know, unlike SQL, in this situation, everything is a list. 34:30.150 --> 34:33.350 So I'm going to take this output and ask, what's the number one guy? 34:33.350 --> 34:35.710 And use that person, the first child, thank you. 34:37.210 --> 34:43.850 So if we want to get all super powerful, we can do things like now change and put more stuff in there. 34:43.850 --> 34:48.590 This is obviously much more useful if you have access to information with it, and you know how the XML is laid out. 34:48.590 --> 34:53.570 So this is an open source or commercial product that you can get your hands on, and you can figure out how the XML is laid out. 34:54.530 --> 34:59.550 And we can do things like create more rules, and change around the statement to do all kinds of cool stuff. 35:00.110 --> 35:00.910 And we'll do that. 35:00.910 --> 35:02.170 I'll show a demo of that later. 35:02.170 --> 35:09.810 So, like SQL injection, this requires some knowledge of the query, which makes it much easier if error messages are on. 35:10.270 --> 35:16.430 How many people in here are going to vote that they don't give you all the information by default in all the major web service stacks? 35:16.430 --> 35:17.590 Anybody want to take that bet against me? 35:17.590 --> 35:18.790 I'll give you ten to one odds. 35:19.590 --> 35:20.090 Nobody? 35:20.090 --> 35:21.030 Okay, that's true. 35:21.030 --> 35:25.970 The default is, give them all the information they need to make an XPath query, and we'll show you on the default ASP.NET. 35:26.910 --> 35:37.290 Even if you can't get access to it, Amit Klein, who used to be at Syncdome, I guess he's not there anymore, which is now Watchfire, which is now probably today it's Verisign, and tomorrow it'll be part of Time Warner. 35:37.290 --> 35:39.390 I don't know what's going on in the security industry while I'm here. 35:40.230 --> 35:44.230 But he wrote an excellent paper called Blind XPath Injection, drop that into Google and you'll find it. 35:44.470 --> 35:52.270 He claims he has a way of getting the entire XML document out bit by bit, by creating a conditional that's set on what the next character is. 35:52.270 --> 35:56.470 And so whether you log in or not is that one bit of covert channel you get out. 35:56.470 --> 36:05.170 Of course, they had a test of there's 40 characters after, and it took them two hours to get those 40 characters out, because you have to do all the logins and test all possible characters, but it's pretty cool. 36:06.690 --> 36:11.350 If anybody knows him, I'm trying to find him, have him release the tool, please, so we can play with it. 36:11.470 --> 36:15.870 But XPath 2 might give us a lot more ways of actually getting all that information out. 36:16.050 --> 36:20.590 XPath 2 does a lot of cool things, like you have the ability to reference outside documents. 36:20.590 --> 36:24.410 I can have tests that ask for information from an outside document, right? 36:24.410 --> 36:27.230 Like if this user is equal to the user in this. 36:27.610 --> 36:32.370 Now, the control of where that outside document comes from isn't really defined by the standard, right? 36:32.370 --> 36:37.090 That's going to have to be up to the people that write the implementation themselves. 36:37.210 --> 36:42.230 So how many people want to bet that at some point you're going to be able to get a document from your web server, right? 36:42.530 --> 36:45.990 And that way I'd probably be able to leak a bunch of information out about the rest of the XML. 36:46.610 --> 36:54.910 The future, if you guys want to be really, really elite and get the next T-shirt before this T-shirt, that's going to come out after this T-shirt, is XQuery injection. 36:54.950 --> 36:59.650 XQuery is a super set of XPath that is now the standard for talking to XML databases. 37:00.590 --> 37:05.030 And one of the really cool things it can do is you can reference a bunch of different documents and stuff. 37:05.850 --> 37:12.710 Downside is now people are actually building an access controller, and so boo-hoo, we won't be able to read everything, but that hasn't stopped us from SQL injection, right? 37:13.610 --> 37:18.030 And in this attack, and in a bunch of other attacks that we're talking about, our big friend is the cdata field. 37:18.030 --> 37:24.490 So I'm not going to talk about it in detail, but it's basically just a way that XML has built in to get nasty stuff into XML, right? 37:24.490 --> 37:30.230 Things in XML that you don't want it to interpret as part of the XML document, you put it in the cdata field, and it disappears. 37:30.390 --> 37:42.410 So I can put things like with single quotes and with brackets and all that kind of stuff into a cdata field, and that goes into the XML parser, and then when you ask the XML parser for the string, it gets rid of that cdata field for you. 37:42.410 --> 37:44.410 So the application never sees that you did that. 37:44.650 --> 37:48.890 There's also other escaping methods that work just as well, but the cdata field is so powerful and easy. 37:48.950 --> 37:49.990 It's the best way to do it. 37:50.210 --> 37:52.470 Once again, XML schema is for defense. 37:52.530 --> 37:54.350 You turn off cdata fields in XML. 37:58.840 --> 38:01.120 So any questions on the XPath injection? 38:01.520 --> 38:03.020 And soon to be expert. 38:03.140 --> 38:06.040 Okay, I'm going to demo that at the end, because it's a cool one. 38:06.240 --> 38:06.940 So SOAP. 38:07.260 --> 38:12.740 SOAP is a standard where all of these, like, really cool web service stuff, this is where a lot of the magic exists. 38:12.740 --> 38:17.960 It's a standard that defines how to move XML around, that can do remote procedure calls, that can do RPC calls. 38:18.920 --> 38:21.060 It's generally over HTTP, but it doesn't have to be. 38:23.520 --> 38:25.680 SOAP is defined by things called WSDLs. 38:26.060 --> 38:29.780 WSDLs are these really ugly documents that are never meant for human beings to read. 38:29.840 --> 38:32.100 They're meant for computers to read, and they're generated by computers. 38:32.160 --> 38:40.140 And the great part of them is that, as an attacker, as somebody who's scoping out an application, the WSDL tells you everything you need to know to attack the application. 38:40.140 --> 38:45.640 So this is so much more powerful than we had for web application hacking, right? 38:45.640 --> 38:55.120 Because to do a web application hack, you have to start off playing with the application for days, using a user, trying everything, and then mapping it out and seeing all this functionality it has, right? 38:55.120 --> 38:57.660 With web services, they just tell you up front. 38:57.860 --> 39:00.160 They tell you, these are all the things I can do. 39:00.160 --> 39:02.960 These are all the things you can ask me to do on your behalf. 39:03.440 --> 39:07.200 Which is really, really cool, and it makes a lot of things a lot easier. 39:07.940 --> 39:13.860 Generally, asking for WSDL is as easy as adding a question mark WSDL at the end of a document. 39:14.100 --> 39:18.960 And we have a tool that will do this automatically for you, so you don't have to go through and do question mark WSDL over and over again. 39:20.500 --> 39:21.940 They define all this stuff. 39:21.940 --> 39:22.800 This is just for reference. 39:22.800 --> 39:23.660 You guys don't need to know. 39:23.660 --> 39:33.240 Basically, it defines something like, if I had a service that sold used cars, it would define how I ask you to sell me the car, and then your response to me, and what that means. 39:35.380 --> 39:36.760 There's no way you can read this. 39:36.760 --> 39:40.720 This is like a third of a single WSDL for a very simple eBay thing. 39:40.820 --> 39:42.980 It's incredibly complex and dense. 39:43.160 --> 39:44.500 What's good about that? 39:44.500 --> 39:49.320 That means that the developers that wrote that almost certainly never read the actual WSDL. 39:49.320 --> 39:51.280 The WSDLs are generally automatically generated. 39:51.280 --> 39:59.280 Like my thing I wrote before, if you write a bunch of stuff that's accessible through web services, and you turn it on, all of a sudden the WSDL is generated that tells somebody all those things. 39:59.280 --> 40:02.060 So they can point a web service at it and not have to talk to you about it. 40:02.060 --> 40:03.120 That's the whole idea. 40:03.720 --> 40:08.540 And so that often includes things like hidden debug messages, and I've actually seen this. 40:08.580 --> 40:15.540 This is a web application that was ported over to having web service support, and they had ported over all of their functionality. 40:15.660 --> 40:25.880 I think it had been on struts or something, and they ported out all this functionality over to web services, and one of the methods in the WSDL that obviously they had never read was make me admin. 40:25.880 --> 40:37.340 It was a debug call that the developers would have, just normal low rights users, could make that call, and they'd become the administrator of the service. 40:37.580 --> 40:41.000 Now, they had had that in the web application before, and it had never been attacked. 40:41.000 --> 40:41.300 Why? 40:41.300 --> 40:45.020 Because it was a parameter you had to put into a post. 40:45.100 --> 40:52.140 And that's not something that somebody might not... make me admin might not be something that you guess, and that you shove into every single parameter in every single post. 40:52.140 --> 40:53.560 But I didn't need to try anything. 40:53.560 --> 40:55.520 All I had to do was look at the WSDL, and it said it right there. 40:55.520 --> 40:56.520 Make me admin. 40:56.520 --> 41:00.020 It takes a user ID for which admin you want to become. 41:02.120 --> 41:04.960 That has always existed, and now it's just really, really simple. 41:04.960 --> 41:06.300 There's also all these cruft systems. 41:06.300 --> 41:10.460 Who here knows of a 1AM batch FTP job that they're embarrassed about? 41:11.040 --> 41:12.020 Come on. 41:12.340 --> 41:13.440 Yeah, right. 41:13.660 --> 41:16.640 It's unbelievable what's transferred over FTP in the middle of the night. 41:16.640 --> 41:19.300 If I was a router engineer, I'd be all over it. 41:19.480 --> 41:21.400 All this kind of stuff's getting moved over to web services. 41:21.400 --> 41:23.620 Nobody's ever thought about security for them before. 41:23.620 --> 41:28.000 Maybe they've been kind of hidden because you have to be on the right router at the right time to get the information. 41:28.060 --> 41:29.320 Now all you have to do is ask. 41:29.440 --> 41:32.760 And you can use something like UDI to say, hey, tell me all of your secret services. 41:32.820 --> 41:33.820 We'll talk about that. 41:34.520 --> 41:35.760 So what's your defense? 41:35.780 --> 41:37.520 You can manually review the WSDLs. 41:37.520 --> 41:45.560 Everybody should know what's in their WSDLs if they're broadcasting the world to make sure there's nothing in there that's supposed to be a private function or that you're really embarrassed is in there, like debug functionality. 41:45.960 --> 41:46.820 You can hand edit them. 41:46.820 --> 41:50.620 Like Google writes theirs by hand, I think, mostly for compatibility reasons. 41:50.620 --> 41:54.700 But the better part is don't have things like make me admin in your production app. 41:54.700 --> 41:56.580 Get rid of that before it gets out to production. 41:57.540 --> 41:59.960 So there's a number of different attacks with SOAP. 42:01.140 --> 42:11.380 One big one we'll talk about a lot, well, not a lot, but we've got a couple of slides on, is application-level denial of service through XML complexity. 42:11.380 --> 42:17.440 And SOAP obviously takes XML, but you're probably wondering, obviously I probably can't give SOAP arbitrary XML, right? 42:17.440 --> 42:23.620 Because maybe a method only wants... it says, you know, buy a car, and all it takes is the VIN number. 42:23.620 --> 42:24.640 It takes one string. 42:24.640 --> 42:27.820 How do I shove arbitrary XML into that one string? 42:27.920 --> 42:29.980 Well, there's fun things called SOAP headers. 42:30.060 --> 42:35.540 SOAP headers are part of the message that almost nobody ever uses, but everybody listens to and reads. 42:35.680 --> 42:40.680 And they're there because, you know, all these things like WS routing and all the encryption standards and stuff use them. 42:40.680 --> 42:45.520 You can put arbitrary XML in a SOAP header because there's no definition of what can and can't go in there. 42:45.520 --> 42:47.860 And that gets read and parsed by the application. 42:48.740 --> 42:50.800 You can also do some source routing sometimes. 42:50.800 --> 42:58.820 Sometimes people have multiple applications that are exposing to web services, and so they have to make a decision on where... who you talk to when your message comes in. 42:58.940 --> 43:03.160 Well, sometimes that decision comes from the header, and that can be set by the application itself. 43:03.160 --> 43:05.300 This is like a client that you downloaded or something. 43:05.300 --> 43:12.960 If you see something that looks like routing in the header, try other things that sound like they might be web services inside the application and see if you can get it bouncing off a different thing on the inside. 43:15.360 --> 43:17.860 SOAP has a lot of session management problems. 43:17.860 --> 43:19.020 It doesn't have session management. 43:19.020 --> 43:19.880 It's just like HTTP. 43:20.160 --> 43:22.340 You do a post, you get a response. 43:22.380 --> 43:23.200 That's it. 43:23.960 --> 43:26.540 That means people have to develop their own session management. 43:26.580 --> 43:29.120 A lot of people do dumb stuff like they use cookies, right? 43:29.120 --> 43:29.980 HTTP cookies. 43:29.980 --> 43:30.980 They still work. 43:31.060 --> 43:34.460 Obviously, it's on a browser on the other side, but somebody has to understand it. 43:34.540 --> 43:37.600 Well, what happens to that cookie once it hits the web server? 43:38.320 --> 43:39.740 It's stripped off, right? 43:39.740 --> 43:41.940 Like, this XML document's going somewhere. 43:42.140 --> 43:43.060 It's going to a mainframe. 43:43.060 --> 43:43.840 It's going to a database. 43:43.840 --> 43:45.320 That cookie doesn't go with it. 43:45.340 --> 43:54.440 And so this causes a lot of access control problems for people because they're setting these cookies, and they never see them actually where they're making decisions, like whose bank account can you transfer money out of, right? 43:56.140 --> 43:57.900 So, you know, that's an issue. 43:57.900 --> 44:00.280 There's also all the old classical state issues. 44:00.280 --> 44:02.300 A lot of people have to implement their own state mechanisms. 44:02.300 --> 44:03.960 They haven't had to do it for years, right? 44:03.960 --> 44:06.560 They've been able to use WebSphere's or ASP's little cookie. 44:06.580 --> 44:17.900 So they're kind of old at it, and they don't remember that doing things like counting up from 1,000 and then making the next user number 1,001 in that field is definitely a little bit guessable, right? 44:17.900 --> 44:21.500 As are things like counting up from 1,000 and doing a SHA-1 or something like that. 44:21.500 --> 44:24.960 So we see that all the time again with web services because people have to rule their own. 44:26.820 --> 44:28.420 So this is a SOAP message. 44:28.540 --> 44:29.040 Yada, yada. 44:29.040 --> 44:29.900 It's kind of generic. 44:29.980 --> 44:32.200 You don't want to be actually writing these by hand. 44:32.200 --> 44:34.500 They're really hard to write by hand to make them accurate. 44:34.600 --> 44:38.380 And I'll show a little free tool that you can download that does all the communication itself. 44:38.380 --> 44:39.800 Remember, we don't have a web browser here, right? 44:39.800 --> 44:47.380 When we're talking to a web service, it's expecting another computer to talk to it, so we don't automatically get something that has a GUI on it to put information in. 44:48.400 --> 44:51.620 And then you'll see in the demo, there's this thing called SOAP faults. 44:51.620 --> 44:54.320 If something breaks, it sends a fault back that has a string. 44:54.400 --> 44:57.180 So who here can find the interesting part of this? 44:59.320 --> 45:02.800 Right, so what do you think this is here? 45:03.580 --> 45:05.620 What does that look like that we've just talked about? 45:05.620 --> 45:08.580 That looks like an XPath query. 45:08.940 --> 45:12.820 This is the default functionality of ASP.NET 1.1 Service Pack 1. 45:13.460 --> 45:15.940 If XPath breaks, tell the user. 45:16.060 --> 45:19.620 Tell the user exactly the XPath string that broke and how it broke. 45:24.930 --> 45:27.410 So we'll demo all that in just a second. 45:27.410 --> 45:30.030 And then something I talked about was Web Services Download Service. 45:30.030 --> 45:33.970 This is, in my opinion, much, much, much, much, much more powerful. 45:33.970 --> 45:39.270 I'd rather have a good XML attack than a thousand bots on a botnet to do a SYNFLUD. 45:39.450 --> 45:39.910 Why? 45:39.910 --> 45:42.870 Because I have a huge, huge multiplier. 45:42.890 --> 45:50.470 I don't have a huge multiplier with a SYNFLUD now that somebody's got $100,000 arbor boxes or really nice net screens or something on the other side. 45:50.470 --> 45:55.170 But I get a huge, huge multiplier with an XML attack against an application. 45:55.250 --> 45:56.890 And I have to look for this advantage. 45:56.890 --> 46:00.950 And often this advantage... we've explored two different types. 46:00.950 --> 46:03.950 We're not releasing the code because it works too well. 46:03.950 --> 46:06.090 But it's pretty easy to recreate it yourself. 46:06.090 --> 46:12.090 But you either do attacks against the parser itself or against the application and its database backend. 46:12.090 --> 46:15.790 And against the parser itself, you get very large multipliers of CPU time and memory. 46:15.790 --> 46:21.150 If I can send you an XML document, how hard is that for me to send you a text document? 46:21.150 --> 46:22.950 It doesn't have to be dynamically generated. 46:22.950 --> 46:26.330 I don't have to use .NET to create this document. 46:26.530 --> 46:29.270 I only have to write it once and send it with a Perl script. 46:29.990 --> 46:31.430 So I send it once. 46:31.430 --> 46:33.230 OK, that's a couple cycles. 46:33.290 --> 46:35.530 I can probably do a couple thousand of those a second. 46:35.570 --> 46:42.350 When it gets to the other guy, he takes that document and he says, OK, well, you want me to download a schema and you want me to set the namespace. 46:42.350 --> 46:45.470 Now I'm going to build a model that represents this document. 46:45.470 --> 46:47.190 So I have the head node, which is A. 46:47.190 --> 46:48.590 And I have the child node that's B. 46:48.850 --> 46:50.710 Oh, and B has a child node called B. 46:50.710 --> 46:52.230 And B has a child node called B. 46:52.310 --> 46:54.030 And repeat that 100,000 times. 46:54.030 --> 46:56.350 And then close B off 100,000 times. 46:56.350 --> 47:04.710 And that guy builds an object in memory in some heavy-duty language like Java or C Sharp, where memory management isn't that easy anyway. 47:04.710 --> 47:05.770 It uses a lot of memory. 47:05.770 --> 47:10.870 And it builds this huge object that's 100,000 objects long and deep. 47:11.690 --> 47:13.670 That is a huge, huge advantage. 47:13.670 --> 47:16.990 And all that happens before it makes a decision what to do with it, right? 47:17.050 --> 47:17.970 This is just the parser. 47:17.970 --> 47:20.390 The application hasn't even seen that anything's happened yet. 47:20.390 --> 47:23.310 This is the magic pixie dust framework that's done all this work for you. 47:23.310 --> 47:24.590 Gives you a huge advantage. 47:24.590 --> 47:25.630 How big of an advantage? 47:25.630 --> 47:35.870 Well, we've taken down four enterprise-level hardware with a real, patched, good web services server with one of these laptops. 47:36.710 --> 47:38.150 CPU pegged them. 47:38.230 --> 47:41.870 And I don't think the CPU was actually from the parsing as well as the memory management. 47:41.910 --> 47:45.550 Because every time a message came in, it would build that DOM, and then it would destroy that object. 47:45.550 --> 47:46.830 And then do it again and again. 47:46.830 --> 47:53.330 Because we can get a couple thousand queries a second, or a couple thousand a second out of 20 threads of Perl. 47:53.770 --> 47:55.410 So that is really, really powerful. 47:55.410 --> 47:59.550 And that's, you know, it would take a lot more than one laptop to SYN flood those four boxes, right? 47:59.550 --> 48:01.090 Especially if they have a real load balancer. 48:01.370 --> 48:04.330 The other attack we've looked at is database connections, right? 48:04.390 --> 48:06.170 Database connections are coming from a pool. 48:06.170 --> 48:07.210 There's a limit of how much. 48:07.250 --> 48:09.250 They're pre-created, and then they're used. 48:09.250 --> 48:14.370 And they're usually not, like, even for sites that have millions of users, they're something like 200 or 500, right? 48:14.370 --> 48:17.050 Because they're only used when the query's going across. 48:17.330 --> 48:21.410 So, like we said, this WSDL tells you all the things that it can do, right? 48:21.410 --> 48:22.830 And you can do all of those things. 48:22.830 --> 48:23.790 It's stateless. 48:23.790 --> 48:28.530 You can do all those things as many times as you want, generally, unless they're doing something very smart. 48:29.230 --> 48:30.270 And so what do I do? 48:30.270 --> 48:31.350 I go through this WSDL. 48:31.350 --> 48:35.930 I find something that looks like it's a very heavy-duty thing that it has to look up in the database. 48:36.090 --> 48:40.370 Somebody name a query in which you have to read a big table, and you have to do it every time somebody asks you. 48:41.430 --> 48:42.490 Login, right? 48:42.570 --> 48:50.730 If I log into a machine, it's got a big list of users, and I give you a username, especially if it's randomized and you don't have it cached, you have to go ask the database, who's this user? 48:50.730 --> 49:01.030 And so to create these user requests with random usernames and passwords over and over again is not very heavy-duty, but it requires, it takes up one of these connections while it's asking that question over and over again. 49:01.030 --> 49:08.790 And this is a great thing against enterprise servers, because often, especially sites that have been DOSed before, they have 20 or 30 or 40 front-end web servers. 49:08.790 --> 49:10.490 How many database servers do they have? 49:11.350 --> 49:15.750 One or two in HA, or maybe two HA clusters, right? 49:15.750 --> 49:18.770 And that HA is probably cold failover, so they're not actually running. 49:19.910 --> 49:23.830 And it's not considered a failure when you use up all the database connections, right? 49:23.830 --> 49:26.730 That doesn't mean the box is broken, it just means that the queue is filled up. 49:26.730 --> 49:37.850 And so we've also done this against an enterprise system where there's a ton of web servers in the front, and two database servers in the back in an HA config, and with a couple of laptops, we choked the database server. 49:37.850 --> 49:43.890 The database server only had like 5% CPU used, but that connection pool was all used up, because we did something that took a lot of time. 49:43.890 --> 49:46.290 Why doesn't this get caught in normal testing? 49:46.290 --> 49:51.930 Well, in normal testing, you don't log in 100,000 times over a course of two minutes, right? 49:51.930 --> 49:53.470 That's not part of people's regression testing. 49:53.470 --> 49:55.650 You log in once, and then you do the heavy-duty stuff. 49:55.890 --> 50:03.450 And so that kind of application-level attack, while it's been doable with web applications, is really easy with SOAP, right? 50:03.450 --> 50:10.530 Because the login, all I have to do is change a little bit about the particulars, and maybe generate some random usernames, and my Perl script has destroyed the database. 50:13.190 --> 50:15.690 In either case, there's some important things to remember. 50:15.690 --> 50:17.970 You have to have a legal SOAP request, right? 50:17.970 --> 50:21.910 You don't want it thrown out before it hits the application, especially on the database side. 50:22.050 --> 50:23.890 And then speed is very important, too. 50:23.890 --> 50:36.710 We used multiple processes with multiple threads, but, you know, it is still a little heavy-duty compared to like a SYN flood, and obviously the attacker's position is given away. 50:36.870 --> 50:40.750 So that's a downside for the attackers, it's a good thing for the good guys, right? 50:40.750 --> 50:43.830 Because you have to use real TCP connections to move this stuff across. 50:43.830 --> 50:45.830 But you don't have to listen to that connection, right? 50:45.830 --> 50:49.050 You can make a connection, send them the post, and then drop it. 50:49.050 --> 50:51.490 If you're using your own TCP stack, then just stop listening. 50:51.490 --> 50:57.250 Don't send a reset, let it respond, but you don't have to actually have that memory allocated to get the response. 50:57.250 --> 50:58.510 Makes it very, very efficient. 50:59.790 --> 51:04.230 We're also looking into ways to make it faster, like HTTP 1.1 pipelining. 51:04.230 --> 51:08.910 This is especially important with SSL, because I don't want to do an RSA transaction for every post I do. 51:08.910 --> 51:14.750 If I do pipelining, I just send them all up with like, create a pool of 20 or 30 TCP SSL connections, and send them up. 51:14.750 --> 51:15.850 Or things like XPath. 51:15.850 --> 51:18.930 Anybody hear about those crazy RegEx attacks? 51:19.350 --> 51:22.910 That you can do to null service by getting somebody to do a weird RegEx? 51:22.910 --> 51:24.670 That's really, really hard. 51:24.670 --> 51:32.850 Well, XPath, obviously if I can do arbitrary things in XPath, I can probably do things in my XPath injection that are really bad, even if I can't use it to own the application. 51:33.510 --> 51:35.710 Unfortunately, defense isn't very easy for this. 51:35.710 --> 51:41.730 For things like the SOAP header XML complexity, there's nothing you can do as an application developer in your application. 51:41.730 --> 51:47.490 Because like I said, the SOAP message comes in, even if it's not for you, you've never heard of it at your application. 51:47.490 --> 51:51.910 It's WebSphere, or it's Access Apache, or it's ASP.NET that's doing it for you. 51:52.810 --> 52:03.590 So the only defenses against that are something like, you have an XML firewall, this is one of the reasons they actually sell a couple boxes a year, that looks at them and has limitations on it. 52:03.590 --> 52:11.290 You can set your own limitations, like if you only do small messages, you use 50K messages, and you set that in Apache or IIS, and so that's important. 52:11.290 --> 52:15.430 There's no reason somebody should be able to upload a 20MB XML file to you, right? 52:16.090 --> 52:22.330 Or you can do something like write your own Apache filter, or work with something like Apache Mod Rewrite or Mod Proxy to look for this kind of stuff. 52:22.990 --> 52:24.770 SACS is not vulnerable, right? 52:24.770 --> 52:25.390 Yes, sir. 52:27.750 --> 52:28.870 Limiting RAID from source IP. 52:28.870 --> 52:30.430 So you could do it from source IP, of course. 52:30.430 --> 52:33.110 This is the problem everybody's running with other issues. 52:33.110 --> 52:38.410 In situations like an AOL situation, you might kill one of their 12 megaproxies, right? 52:38.570 --> 52:44.650 Or, you know, whatever Nippernet has like 15 ways it gets out to the internet or something like that. 52:44.650 --> 52:45.930 So, I mean, you could. 52:45.930 --> 52:46.990 Rate limit by source IP. 52:46.990 --> 53:02.930 The way to do it is you need to make them do work to ask you, so you need to have them ask you for a session ID, you generate a session ID randomly, don't put it in the database, just generate randomly in memory, give it to that person, and then have them send it back with the login information. 53:02.970 --> 53:06.690 And then you can check against the table in memory, which is much faster than going to the database. 53:06.770 --> 53:12.110 As for the XML stuff, you have to put a protection in front that looks for the complexity and stops it before it gets to the web server. 53:12.290 --> 53:14.350 Either that's a firewall or it's your own thing. 53:18.430 --> 53:19.550 Oh, right, and size. 53:19.550 --> 53:21.490 Yes, I do recommend limiting size. 53:21.530 --> 53:27.830 If you never have anything larger than 50K, set it to 75 or something, most people, almost nobody thinks about that, right? 53:27.830 --> 53:31.170 And by default, this stuff accepts up to like 20 or 30 meg posts and stuff. 53:31.170 --> 53:32.350 And that's when it gets really nasty, right? 53:32.350 --> 53:41.090 It takes a minute to, you know, it takes me 30 seconds or something to upload a 20 meg post over a 100 megabit connection, and then it takes a minute for it to parse it, right? 53:44.150 --> 53:47.030 XML firewalls are these... well, okay. 53:47.030 --> 53:49.590 So it's another venture capital term. 53:49.630 --> 53:51.390 So it's something that makes people venture capital. 53:51.390 --> 53:53.210 That's the basic definition. 53:53.310 --> 53:56.510 Generally, there are things that sell that look at XML. 53:56.510 --> 53:58.790 They're like application-level firewalls. 53:58.890 --> 54:01.770 A lot of the XML firewalls aren't created for security purposes. 54:01.990 --> 54:03.610 They're created to do stuff like routing. 54:03.750 --> 54:08.330 So if I have multiple web interfaces, web services, I can just put one box in front of them. 54:08.330 --> 54:09.570 It's kind of like a load balancer. 54:09.630 --> 54:11.670 And it says, oh, you want to talk to the mainframe. 54:11.830 --> 54:13.670 I will send that information to the mainframe. 54:13.730 --> 54:15.130 Oh, you want to talk to this database. 54:15.130 --> 54:16.330 I'll send the information to this database. 54:16.350 --> 54:22.210 But they now, because of security issues, they do things like they'll check for the complexity of the document before it comes through and not let it through. 54:22.210 --> 54:35.550 So kind of like Syncton's AppShield in front of web apps, XML firewalls or SILK firewalls or web service firewalls or whatever gets you the most money right now, whatever they're called, look at the request and filter it for things that might be dangerous. 54:35.550 --> 54:38.830 They'll also do things like look for SQL injection and XPath injection and things like that. 54:38.950 --> 54:40.290 I can't always recommend them. 54:40.470 --> 54:43.310 This is one of the only things that you can't fix yourself. 54:43.650 --> 54:45.310 If you have a SQL injection bug, fix it. 54:45.310 --> 54:54.930 Don't spend $100,000 for a hardware firewall that's now in your critical path that, if it turns out they didn't do the right thing with their TCP stack, somebody can DOS it anyway and take you down network-wise, right? 54:54.930 --> 54:56.450 Or it's something you have to pay to maintain. 54:57.590 --> 55:01.090 They're not things that you can just drop in front of your app and expect them to work. 55:01.950 --> 55:03.710 Anybody in here sell XML firewalls? 55:03.790 --> 55:05.110 Obviously we're not a vendor. 55:08.700 --> 55:09.460 Excuse me? 55:11.040 --> 55:12.940 I think Teros might do this kind of stuff. 55:12.940 --> 55:15.060 Forum Systems, Sarvega. 55:18.060 --> 55:21.240 Somebody come up with a prefix and postfix for a startup company. 55:22.520 --> 55:24.520 There's like 20 or 30 companies that do it. 55:24.520 --> 55:30.460 Like I said, they're mostly to do stuff like I want to do encryption on my web service and I don't want to write into my app, so the box will do it automatically. 55:30.460 --> 55:35.180 So any questions on the DOS? 55:35.180 --> 55:38.060 Like I said, we're not releasing them, but it's pretty easy for people to recreate them. 55:38.060 --> 55:40.680 You just need to build really complex but legal XML. 55:43.340 --> 55:45.560 Complex just means deep, right? 55:45.560 --> 55:50.340 If I have five root nodes that have 100,000 deep child nodes, right? 55:50.340 --> 55:56.320 It's not just the number of nodes, but it has to be the linkage between them for something like a DOM attack. 55:56.440 --> 55:58.020 That's a really, really powerful attack. 55:58.020 --> 55:59.120 It's pretty easy to recreate. 55:59.120 --> 56:02.620 Obviously there's no reason for us, it would not be a very ethical thing to release that. 56:05.120 --> 56:06.380 So discovery methods. 56:06.380 --> 56:07.740 We talked about WSDLs. 56:09.060 --> 56:10.600 I don't think we'll do it. 56:10.600 --> 56:11.980 Let's talk about this real fast. 56:11.980 --> 56:15.040 UDDI is another great discovery method, like a WSDL, what I talked about. 56:15.040 --> 56:16.800 It just defines one service, right? 56:16.800 --> 56:18.600 You ask for a service, how do I talk to you? 56:18.600 --> 56:20.880 How do you find that service in the first place? 56:20.880 --> 56:26.560 Well, there's this great thing called UDDI, which lists all the services that somebody's running, right? 56:26.740 --> 56:27.760 So... yes, sir. 56:29.380 --> 56:30.220 Yeah. 56:33.610 --> 56:34.450 No. 56:34.630 --> 56:35.130 No. 56:35.130 --> 56:38.830 They will not load... people learn their lesson off the DTD attacks. 56:38.830 --> 56:42.470 And they will not load off-site XSDs. 56:42.890 --> 56:43.890 By default. 56:43.930 --> 56:46.690 Certainly you can tell your XML parser that you want to. 56:47.830 --> 56:50.730 But, you know, I haven't seen anybody do that. 56:51.530 --> 56:52.050 Sure. 56:52.230 --> 56:52.970 Any other questions? 56:52.970 --> 56:54.170 I'm sorry on the DOS stuff. 56:57.190 --> 56:57.910 Okay. 56:58.130 --> 57:00.850 So UDDI is a way I can list all these web services. 57:01.030 --> 57:04.910 And you might think that nobody's deploying them, but I've seen a bunch of them, right? 57:04.910 --> 57:09.750 A lot of people are doing testing of web services right now, or they have two or three that their business partners use. 57:09.750 --> 57:12.910 And so they put a UDDI server, which is XML on top of HTTP. 57:13.150 --> 57:14.830 It's nothing very complex. 57:14.890 --> 57:21.230 There's a bunch of free Google for UDDI browser, and you can download free ones or use web applications that will do it free for you. 57:22.110 --> 57:34.710 And then they put these IP addresses out, and they tell their B2B partners, wow, you know, it's so hard to set up a VPN, so what we're going to do is we're going to give you our UDDI address, and then you guys can figure out how to hook up to them SSL is on, 57:34.710 --> 57:34.950 right? 57:34.950 --> 57:35.790 So use SSL. 57:35.790 --> 57:37.230 That's what we'll use instead of a VPN. 57:37.230 --> 57:40.590 And they expect people won't find these UDDI servers, right? 57:40.590 --> 57:45.310 Because if you do nmap-a, I think right now, it won't say this is a UDDI server, right? 57:45.310 --> 57:48.530 Because it's just a port 80, so you have to report 443. 57:49.970 --> 57:53.910 The great thing about UDDI is it tells you everything you need to know to attack a web service. 57:54.170 --> 57:57.390 And it tells you, if an enterprise is deploying it, everything they're deploying. 57:57.390 --> 58:01.670 Now, they don't have to list everything, but like I said, some of this stuff automatically lists. 58:01.690 --> 58:05.650 If you have a UDDI server, Visual Studio will automatically list it up for you, right? 58:06.510 --> 58:08.630 So how do I find UDDI servers? 58:08.730 --> 58:19.570 Well, IBM, Microsoft, SAP, and Nippon Telegraph and Telephone have very kindly stepped in and given us a nice searchable web interface that tells you UDDI servers that people have registered. 58:19.570 --> 58:21.270 So you guys see this hierarchy here? 58:21.270 --> 58:28.410 The whole idea is that, you know, I should be able to do a web service with another company without ever talking to somebody at that company. 58:28.410 --> 58:30.370 So first I go to a UBR. 58:30.470 --> 58:32.430 I search and I want to talk to SAP. 58:32.430 --> 58:33.750 I search for SAP. 58:33.910 --> 58:36.410 I see all the web services that they're listing. 58:38.230 --> 58:41.530 The UBR will tell me their UDDI server, if they have one. 58:41.570 --> 58:45.370 I talk to their UDDI server, and it has things like invoicing, right? 58:45.370 --> 58:48.490 Maybe I want to do... I've sold them some stuff, I want to invoice them. 58:48.990 --> 58:56.750 And so it says, the invoicing web service, this is the contact information for that person, and it exists at this URL. 58:56.750 --> 59:05.170 And so I go to that URL, I add a question mark WSDL, and the invoicing service tells me, OK, these are the nine things you can do with the invoicing service. 59:05.170 --> 59:08.250 And now I have the ability to do whatever I want to those different methods. 59:08.270 --> 59:10.230 So that's the tree, and that's how people envision it. 59:10.230 --> 59:14.070 Obviously, it makes things easy for businesses, but it also makes things easy for attackers. 59:14.070 --> 59:21.750 One of the really scary things is there's currently no real binding of somebody who's in the UBR really is that person, right? 59:21.770 --> 59:25.310 Like this next one, who here is going to trust this entry? 59:25.310 --> 59:26.650 Bank of China, right? 59:26.650 --> 59:30.770 There's no cryptographic protection saying this is the Bank of China, but here they are. 59:30.770 --> 59:37.250 They're listed in the UBR, and with a character set that I can't read in my browser because I don't have the Chinese character set, right? 59:37.250 --> 59:43.210 Now, people are working on these big PKIs by which you can authenticate web services, but people are fighting over the standards. 59:43.350 --> 59:44.610 Obviously, it's a lot of money. 59:44.610 --> 59:52.490 Just as it's a lot of money to be able to sign certificates for web apps, it's going to be a lot of money for web services because it's only corporations. 59:52.490 --> 59:53.810 It's very rarely individuals. 59:54.290 --> 59:57.710 And so, there's no good way of verifying this right now. 59:58.130 --> 01:00:01.770 So, we'll do a little walk through a UBR. 01:00:01.770 --> 01:00:04.590 Microsoft has the prettiest interface, so I think I'll use theirs. 01:00:06.130 --> 01:00:11.650 So, fortunately, Microsoft puts up a big barrier to keeping attackers from using a UBR. 01:00:12.670 --> 01:00:14.490 You have to be registered. 01:00:14.490 --> 01:00:16.590 What kind of registration do you think you need? 01:00:17.270 --> 01:00:18.610 A passport. 01:00:18.610 --> 01:00:24.070 So, I mean, if that restricts all attackers with a Hotmail account, I think we're all okay. 01:00:29.290 --> 01:00:35.210 I'm going to sign in first so you guys can't razz me with how short my passport is. 01:00:36.590 --> 01:00:38.350 Are any of the passport guys in here? 01:00:38.690 --> 01:00:40.090 Passport's great, by the way. 01:00:40.190 --> 01:00:41.710 Are any of the passport guys here? 01:00:48.640 --> 01:00:50.760 There are actually some really smart guys. 01:01:03.500 --> 01:01:06.720 Okay, well, I'm going to talk about something while this is loading. 01:01:07.860 --> 01:01:08.580 What? 01:01:08.580 --> 01:01:09.240 Sorry? 01:01:12.910 --> 01:01:13.870 Oh, wait, a book. 01:01:13.870 --> 01:01:14.650 Excellent. 01:01:14.950 --> 01:01:17.370 Yeah, because this is going real slow. 01:01:17.550 --> 01:01:20.190 Somebody's tossing Microsoft in the dustbin, probably, so... 01:01:20.190 --> 01:01:22.070 Okay, compensation. 01:01:24.510 --> 01:01:31.410 Okay, the first person who can raise their hand and give me the new canonical XPath gets the prize. 01:01:32.050 --> 01:01:32.830 Yes, sir. 01:01:39.000 --> 01:01:40.080 Er, next? 01:01:40.080 --> 01:01:41.960 The next, the injection attack itself. 01:01:41.960 --> 01:01:42.460 The string. 01:01:42.460 --> 01:01:43.200 Yes, sir. 01:01:45.780 --> 01:01:47.140 It's not a semicolon. 01:01:48.600 --> 01:01:50.240 Okay, I'm going to close my eyes. 01:01:50.240 --> 01:01:51.100 Oh, no, I'm not closing my eyes. 01:01:51.100 --> 01:01:52.360 I'm going to say yes. 01:01:52.360 --> 01:01:55.000 I'm going to say now and then everybody raise their hand and whoever's fastest. 01:01:55.100 --> 01:01:56.560 Jesus, there's no way to do this. 01:01:56.840 --> 01:01:57.380 Now. 01:01:58.900 --> 01:02:01.420 I think this gentleman was up there. 01:02:05.740 --> 01:02:06.340 Bam! 01:02:06.340 --> 01:02:07.620 You are the winner, sir. 01:02:07.700 --> 01:02:08.520 What is your name, sir? 01:02:08.520 --> 01:02:10.000 Come on up, get your prize. 01:02:11.720 --> 01:02:13.640 And he can't even see the slides. 01:02:13.640 --> 01:02:14.660 That is amazing. 01:02:17.760 --> 01:02:18.760 What's your name, sir? 01:02:19.500 --> 01:02:20.680 I've spotted the Fed. 01:02:20.680 --> 01:02:21.820 Mike, show them the shirt. 01:02:27.930 --> 01:02:30.130 Okay, that was perfect timing, Mike. 01:02:30.130 --> 01:02:32.650 Good work, because now I am logged into the UBR server. 01:02:32.650 --> 01:02:34.190 Now, I'm not trying to beat up a Microsoft. 01:02:34.190 --> 01:02:37.190 I'm just using them because they have the prettiest interface. 01:02:37.990 --> 01:02:39.730 And you don't have to really register. 01:02:39.730 --> 01:02:40.530 You just use Passport. 01:02:40.530 --> 01:02:43.490 But as I said, those four companies all run UBR nodes. 01:02:43.490 --> 01:02:44.830 They all sync up with each other. 01:02:44.830 --> 01:02:46.550 Right, so this is the same data from all of them. 01:02:46.550 --> 01:02:51.430 So, we can do things like we can register ourselves as users. 01:02:51.430 --> 01:02:53.590 We can publish ourselves. 01:02:53.610 --> 01:02:59.030 Like I said, when you publish yourself as Bank of America, nobody calls the Bank of America headquarters to make sure. 01:02:59.310 --> 01:03:01.930 A little information and stuff. 01:03:01.930 --> 01:03:03.430 Let's try the search field. 01:03:04.970 --> 01:03:06.630 What should we search for? 01:03:07.630 --> 01:03:08.930 Any... chase. 01:03:08.930 --> 01:03:09.570 Okay. 01:03:11.770 --> 01:03:13.910 Like a car chase, you mean. 01:03:13.910 --> 01:03:14.590 Right? 01:03:17.650 --> 01:03:19.530 Another cool thing is they've got all these... 01:03:19.530 --> 01:03:20.390 Well, it's not cool. 01:03:20.390 --> 01:03:21.870 It's actually incredibly boring. 01:03:21.870 --> 01:03:23.090 But it might be useful. 01:03:23.090 --> 01:03:26.710 Is that there's all these different ways you can categorize these web services that are all competing. 01:03:26.710 --> 01:03:28.290 Like the government has some. 01:03:28.290 --> 01:03:30.630 And then the visual studio has its own. 01:03:30.630 --> 01:03:31.690 All this kind of stuff. 01:03:31.690 --> 01:03:42.170 And eventually, when a lot of people are using it, you should be able to walk your way down this tree and find all the things that are important. 01:03:42.190 --> 01:03:43.870 Finance, that sounds like important. 01:03:56.100 --> 01:03:57.540 Okay, they say there's none. 01:03:57.540 --> 01:03:58.300 Okay. 01:03:58.680 --> 01:04:01.520 That doesn't mean that they've actually categorized everything. 01:04:07.660 --> 01:04:08.260 Let's see. 01:04:08.260 --> 01:04:10.320 Did anybody see where I searched my name on this? 01:04:12.980 --> 01:04:14.100 Maybe it's enterprise. 01:04:16.060 --> 01:04:17.300 You're right, you're right. 01:04:17.820 --> 01:04:22.800 So I can provide... providers is like the English name of the company or enterprise or whoever it is. 01:04:26.700 --> 01:04:29.720 And I'm going to do something more general than chase because I'm not sure they're in here. 01:04:29.720 --> 01:04:32.120 I'm just going to do bank and we'll see what happens. 01:04:33.940 --> 01:04:38.280 There's not a huge number of people because there's not a huge number of people deploying them publicly. 01:04:39.220 --> 01:04:44.560 One of the things that our web... WSMAP, one of the tools that we're releasing. 01:04:44.700 --> 01:04:47.280 One of the functionalities we had to pull at the last minute. 01:04:50.320 --> 01:04:57.120 It's funny, if you buy like a learned web services book and it's got like an example how to do a UDDI registry, search for that thing. 01:04:57.120 --> 01:05:02.140 It's going to be like Acme Bank or something and there'll be hundreds of listings of all the people who have downloaded it and actually done it. 01:05:02.140 --> 01:05:03.480 Which tells you something about this. 01:05:04.100 --> 01:05:05.220 So, Ms. 01:05:05.220 --> 01:05:08.520 Matma Sharma is the contact. 01:05:08.880 --> 01:05:11.840 Here's her email and phone address that I'm not going to click through actually. 01:05:11.960 --> 01:05:17.260 But you put contact information in case you can't get all this magic pixie dust doesn't work and you actually have to call somebody. 01:05:18.980 --> 01:05:21.840 This is saying that Bank of America has a lending service. 01:05:22.760 --> 01:05:23.840 Oh, it's a... 01:05:27.940 --> 01:05:29.680 Oh, they use a local host. 01:05:29.680 --> 01:05:31.460 So, somebody's just been playing around. 01:05:31.720 --> 01:05:36.100 So, but if Port 18000 is now something very interesting to put in your NMAP scan. 01:05:36.100 --> 01:05:38.440 Right, when you look at the Bank of America. 01:05:38.440 --> 01:05:45.740 But if this was... if they're actually... if they're actually exposing this, then this would be an URL to something that's internet exposable. 01:05:45.740 --> 01:05:47.100 And then there'll be interface. 01:05:47.100 --> 01:05:49.580 There's different ways of defining how an interface works. 01:05:51.200 --> 01:05:53.660 Let's see what their interface model is. 01:05:53.660 --> 01:05:56.420 It's called... like I said, there's lots of acronyms. 01:05:56.700 --> 01:05:58.020 It's a T-Lender model. 01:05:58.020 --> 01:06:01.320 So, at this place, if they're publicly doing it, you'd probably have something like an URL. 01:06:01.320 --> 01:06:03.580 I think Bank of America had a WSDL URL. 01:06:07.680 --> 01:06:09.840 Ironically, not a... think of Lithuania. 01:06:09.940 --> 01:06:10.380 Awesome. 01:06:12.280 --> 01:06:15.600 We'll have like an URL that goes to a WSDL that points you directly to... 01:06:15.600 --> 01:06:18.300 Oh, something I forgot to mention about WSDLs that were in the slides. 01:06:18.320 --> 01:06:21.580 A WSDL gives you everything you need to know to attach to a service. 01:06:21.580 --> 01:06:24.020 So, that includes the location of it. 01:06:24.060 --> 01:06:24.440 Right? 01:06:24.440 --> 01:06:29.160 So, a WSDL text document, if it's just floating around, contains all the information. 01:06:29.280 --> 01:06:30.820 Like, this is what you can do. 01:06:30.820 --> 01:06:32.020 This is how you log in. 01:06:32.020 --> 01:06:33.240 This is how you transfer money. 01:06:33.240 --> 01:06:35.260 And this is exactly where the URL is. 01:06:35.260 --> 01:06:38.560 So, if you have a WSDL, you have everything you need to know to actually do the attack. 01:06:38.560 --> 01:06:38.760 Right? 01:06:38.760 --> 01:06:44.140 Because the location of the service, what platform it's running on, all that kind of stuff is contained in there. 01:06:44.820 --> 01:06:45.840 God, this is so slow. 01:06:45.840 --> 01:06:48.760 So, anyway, everybody can go play with this when they're on their fast connections. 01:06:48.760 --> 01:06:54.680 Uddi.microsoft.com or you search for UBR and you can play with other people's if you have a preferred vendor. 01:06:57.160 --> 01:06:57.900 Oh, yeah. 01:06:57.900 --> 01:06:58.920 All kinds of stuff. 01:07:00.140 --> 01:07:04.400 So, at this point, well, I guess I'll show you how the discovery works if I was actually going to do something nice. 01:07:07.660 --> 01:07:11.120 If I wanted to use a web service for legitimate purposes. 01:07:11.840 --> 01:07:18.680 There is a nice little program called WS Web Services Studio. 01:07:18.760 --> 01:07:24.880 It's distributed off of .net.com, which is like the Microsoft community site for .net developers. 01:07:24.880 --> 01:07:28.500 I think it's actually made by Microsoft but not supported, so they throw it on the cheap site. 01:07:28.640 --> 01:07:30.900 So, they don't have people calling the 800 number about it. 01:07:31.160 --> 01:07:32.600 It's a great little graphical interface. 01:07:32.600 --> 01:07:42.480 Like I said, you know, web services, unless somebody gives you the client or if it's something like an Ajax app, you don't have a nice gooey way of talking to it. 01:07:42.480 --> 01:07:43.860 So, it's a good thing for a developer. 01:07:43.860 --> 01:07:44.360 Yes , sir. 01:07:48.080 --> 01:07:50.980 Right, and Eclipse has a web service platform. 01:07:50.980 --> 01:07:54.660 I use XMLSpy, which is really expensive, but there's all kinds of really cool stuff, too. 01:07:56.120 --> 01:07:57.400 So, Web Services Studio. 01:07:57.400 --> 01:07:58.660 I think I've already gone to the bank. 01:08:00.800 --> 01:08:02.960 So, this is the studio. 01:08:04.120 --> 01:08:06.900 It does things like, like I said, you put a WSDL in there. 01:08:06.900 --> 01:08:08.780 It can either be on the internet and you ask for it. 01:08:08.780 --> 01:08:11.780 It can be local and then it'll figure out where it is from the local one. 01:08:12.680 --> 01:08:17.460 And I'm going to go back to the Bank of Lithuania. 01:08:18.180 --> 01:08:20.340 To the interest rates. 01:08:21.740 --> 01:08:22.700 Details. 01:08:28.310 --> 01:08:29.290 Ah, here we go. 01:08:29.290 --> 01:08:30.550 Here's the access point. 01:08:33.270 --> 01:08:34.430 ASM.ASMX. 01:08:34.430 --> 01:08:37.170 So, what platform do you guys think that is? 01:08:38.030 --> 01:08:39.150 Windows, right? 01:08:39.150 --> 01:08:40.470 It's probably ASP.NET. 01:08:41.510 --> 01:08:48.530 Although web services are supposed to be universally worked with each other, there's lots of little details and so it doesn't always work. 01:08:48.650 --> 01:08:52.910 In fact, one of our tools, you know, there's some problems. 01:08:52.910 --> 01:08:53.650 I'll demonstrate. 01:08:53.650 --> 01:08:55.450 There's some problems with the Python implementation. 01:08:55.590 --> 01:08:59.410 One of the problems is, you know, not a lot of people are doing web services person-to-person. 01:08:59.610 --> 01:09:02.090 They generally control the software on both sides. 01:09:02.090 --> 01:09:04.630 So, they use the same platform so these bugs don't get caught, right? 01:09:04.690 --> 01:09:07.370 So, it's good that this is a Windows 1. 01:09:07.550 --> 01:09:12.670 So, we'll just guess that they have WSDL generation on there. 01:09:13.710 --> 01:09:15.570 Looks like he was able to get it. 01:09:19.590 --> 01:09:21.290 This network is so slow. 01:09:24.820 --> 01:09:27.540 Is Kaminsky talking now and doing his weird network stuff? 01:09:27.540 --> 01:09:27.980 No. 01:09:28.660 --> 01:09:29.260 Last night. 01:09:29.260 --> 01:09:29.780 Okay. 01:09:30.100 --> 01:09:30.960 Was that good? 01:09:33.920 --> 01:09:34.840 Excuse me, sir? 01:09:36.880 --> 01:09:37.420 Really? 01:09:37.420 --> 01:09:38.940 He ended up at the hospital, Dan Kaminsky. 01:09:40.080 --> 01:09:40.800 Jesus. 01:09:40.800 --> 01:09:44.220 Okay, we're taking a collection in the memory of Dan Kaminsky. 01:09:46.940 --> 01:09:51.280 Unlike Dan Kaminsky, I actually don't put in applause, pauses in my presentation. 01:09:51.280 --> 01:09:52.520 Do you guys think I should do that? 01:09:52.900 --> 01:09:53.440 Let go. 01:09:53.440 --> 01:09:54.580 And that's a WSDL! 01:09:55.500 --> 01:09:56.360 Ta-da! 01:09:56.700 --> 01:09:57.560 Thank you. 01:09:57.700 --> 01:09:58.280 Thank you. 01:09:58.880 --> 01:10:01.980 So, this was able to grab the WSDL. 01:10:02.480 --> 01:10:05.780 And it's generated, like I said, it has all the information it needs to know on the service. 01:10:05.780 --> 01:10:06.900 These are different methods. 01:10:06.900 --> 01:10:11.380 This is just as if I was writing an application and I call a function that's defining my function. 01:10:11.380 --> 01:10:13.880 Just think of it as that, although it goes across the internet. 01:10:14.220 --> 01:10:24.340 In the web app world, these could be either parameters in a post, like transfer money or do this, or it could be the URLs themselves, like slash interest slash get money. 01:10:25.020 --> 01:10:30.840 So if I click on one of these, it tells me what was defined in the header and the body for each one of these. 01:10:31.020 --> 01:10:34.000 This has nothing, so that means it doesn't take any input. 01:10:34.900 --> 01:10:38.760 This one takes one string in the body. 01:10:38.900 --> 01:10:44.960 And so if I wanted to put a value in there, I could put it in there and say invoke. 01:10:44.960 --> 01:10:51.840 This is meant for legitimate users, so it won't let you do things other than what they define. 01:10:52.100 --> 01:10:57.740 But like I said, people sometimes don't check very well, so it might be very possible... 01:10:57.740 --> 01:11:10.200 One good way to do an attack on this would be to run Web Service Studio or Eclipse or XML Spy through WebScarab, watch the traffic that's legitimate, and then edit it byte by byte by byte. 01:11:10.200 --> 01:11:13.760 Remember, it's UTF-8, so it's two bytes per character if it's internationalized. 01:11:15.040 --> 01:11:18.760 Interest rate, interest rates by day, interest rates by date type, yada yada. 01:11:18.760 --> 01:11:24.620 So this one doesn't require anything to invoke it, so I'll invoke it, and I should get something back. 01:11:24.620 --> 01:11:35.120 So right now it's going across the internet, it used the WSDL to generate a message that it thinks these people are going to understand, and it sends it to them as an HTTP post and waits for the response, and here's the response. 01:11:35.620 --> 01:11:38.400 It's an XML document, it automatically parses it for us. 01:11:39.720 --> 01:11:42.800 Like I said, this is not how you're supposed to use this, right? 01:11:42.900 --> 01:11:47.860 If I was another bank and I wanted to get the interest rate, I'd have some application that would do this automatically and then give it to a user. 01:11:47.880 --> 01:11:52.520 Or if I was Bank of Lithuania, I'd create a nice little pretty GUI to do this for people, right? 01:11:52.520 --> 01:11:53.960 So that's why this is all ugly. 01:11:54.180 --> 01:11:56.440 Like I said, this isn't meant for human consumption. 01:11:57.180 --> 01:12:02.520 But here it gives us all the data that came back, we can say request response, and we'll actually see... 01:12:04.860 --> 01:12:12.620 SOAP messages have the envelope, the body, the header, we talked about the header, the envelope's required, it has things like what version of SOAP am I using, what's the namespace, stuff like that. 01:12:12.720 --> 01:12:15.840 And then the response, which is just an HTTP response. 01:12:16.720 --> 01:12:21.460 I love this, they tell us the exact service pack version of ASP.NET. 01:12:23.000 --> 01:12:29.260 And then a UTF-16 encoded XML document that gives all the input that comes back. 01:12:29.260 --> 01:12:37.180 Just like if I called in a program, if I called, give me an interest rate, and it had three things it returns, this will return everything even if it doesn't have information in there. 01:12:37.220 --> 01:12:38.340 And we're good to go. 01:12:38.340 --> 01:12:40.640 So, here's the WSDL, it's really ugly. 01:12:40.640 --> 01:12:42.220 You can see why people don't read them. 01:12:42.220 --> 01:12:46.200 For something that simple, right, it's all that WSDL. 01:12:46.520 --> 01:12:48.320 You have to define everything like four times. 01:12:49.220 --> 01:12:52.500 And you can see why that might be a place that people don't look. 01:12:57.580 --> 01:13:01.200 So, we'll do an attack and we'll use Web Service Studio for it. 01:13:01.200 --> 01:13:03.240 So, to wrap up before we get to the demo. 01:13:04.180 --> 01:13:05.940 Why do we have all these discovery methods? 01:13:05.940 --> 01:13:09.040 It's this thing called service-oriented discovery, more venture capital. 01:13:09.040 --> 01:13:12.940 It's amazing how much of the English language is based upon what can get you venture capital. 01:13:13.580 --> 01:13:15.080 Service-oriented architectures. 01:13:15.120 --> 01:13:18.520 The idea is that delayed binding of applications. 01:13:18.560 --> 01:13:33.180 If I'm Bank of America, and I know most of the banks in the world use some kind of standard thing to, say, clear checks, then I can, not even knowing who those other banks are, go to a registry, cryptographically check that that person is who they are, 01:13:33.180 --> 01:13:40.160 because it's signed by somebody I trust, find the web service to do the transfer, find how to talk to that web service and talk to it. 01:13:40.160 --> 01:13:42.860 And you can program their software to do all this, right? 01:13:43.140 --> 01:13:45.660 Lots of MagicPC dust, it's a little bit scary. 01:13:45.980 --> 01:13:52.740 But because this is so powerful, and because you can automate stuff to do things without humans ever involved, it's going to be very popular with people. 01:13:53.220 --> 01:13:55.560 Other than UBRs, there's some cool third-party registries. 01:13:55.560 --> 01:13:58.860 x-methods.net has a big list of fun services. 01:13:59.020 --> 01:14:00.980 A lot of these are by people who are just having fun. 01:14:00.980 --> 01:14:03.380 Things like census data by zip code and stuff like that. 01:14:03.380 --> 01:14:06.900 It's a good place to play around if you just want to learn about web services. 01:14:07.440 --> 01:14:10.240 And then there's this thing called Disco slash WS Inspection. 01:14:10.240 --> 01:14:12.160 Disco is a lightweight UDDI. 01:14:12.160 --> 01:14:17.580 Instead of running a whole server to tell you what my services are, I just have a text file you can read it in, an XML file. 01:14:17.580 --> 01:14:25.520 This was a Microsoft-specific thing that's becoming now WS Inspection, which is going to be a real standard to do this without running a whole other server to do it. 01:14:25.520 --> 01:14:27.920 Our tool will automatically look for Disco files for you. 01:14:28.280 --> 01:14:33.440 Like I said, a Disco file will automatically be deployed for you if you hit the compile button on Visual Studio. 01:14:36.540 --> 01:14:38.560 And so those are some of the new issues. 01:14:38.560 --> 01:14:41.280 The traditional attacks that we've always had still exist, right? 01:14:41.280 --> 01:14:46.700 Design flaws, the bad idea methods like we talked about, the same OWASP top 10 things. 01:14:46.700 --> 01:14:48.580 SQL injection still exists, right? 01:14:48.580 --> 01:14:53.860 Although some of these things are using XML on the back end, a lot of them are still using SQL. 01:14:54.160 --> 01:14:58.180 And so just as we had in web apps, SQL injection will work. 01:14:58.180 --> 01:14:59.540 I'm not going to talk about SQL injection. 01:14:59.540 --> 01:15:01.460 You can go find Dave Litchfield for that. 01:15:01.540 --> 01:15:04.120 The thing I will tell you is that the best way to do it is to... 01:15:04.120 --> 01:15:06.060 You have to escape those characters generally. 01:15:06.140 --> 01:15:14.640 You can use something like a CDATA block, put the entire SQL stream in it that will magically get transferred by the XML document into whatever the string is and then put into the query. 01:15:15.560 --> 01:15:17.660 Overflow is an unmanaged code, right? 01:15:17.800 --> 01:15:23.060 Managed code is the Microsoft term for things like Java and .NET that run in a virtual machine. 01:15:23.060 --> 01:15:28.340 Unmanaged code being something like I compile C++ for an x86 or a Spark, right? 01:15:28.340 --> 01:15:33.260 Well, there's a lot of... a lot of people have a lot of stuff written in C and C++ out there they still use. 01:15:33.260 --> 01:15:35.920 It still is the core of their stuff that they want to expose. 01:15:35.920 --> 01:15:42.040 And so all the vendors have cool ways of taking something that's compiled on my machine and making it web service accessible. 01:15:42.040 --> 01:15:44.060 One great one is called .NET Remoting. 01:15:44.060 --> 01:15:46.020 And again, I'm not beating up on Microsoft because they're bad. 01:15:46.020 --> 01:15:49.280 It's just theirs is the coolest and the easiest to use, right? 01:15:49.280 --> 01:15:54.820 If you have a COM object that works and, you know, it can be something... I think it has to support I Unknown. 01:15:54.840 --> 01:15:56.120 It's like the same standards. 01:15:56.120 --> 01:15:58.240 It has to be remotable like an ActiveX control. 01:15:58.240 --> 01:16:01.200 If you have a COM object, you can just click through. 01:16:01.200 --> 01:16:02.580 You don't have to write any code. 01:16:03.520 --> 01:16:05.520 And say, I like this COM object. 01:16:05.520 --> 01:16:07.900 I want these methods to be exposed to the world. 01:16:11.420 --> 01:16:17.940 And all of a sudden, now there's a web service with all these... takes all these inputs and gives it to a C++ program. 01:16:17.940 --> 01:16:22.580 Do you think that it goes and finds out what the limit on that stirring copy is? 01:16:22.580 --> 01:16:26.240 Or what the... I'm sorry, what the static buffer that goes to that stir copy is in that C++? 01:16:26.460 --> 01:16:27.280 Do you think it does that? 01:16:27.280 --> 01:16:28.040 No, it doesn't. 01:16:28.040 --> 01:16:28.240 Right? 01:16:28.240 --> 01:16:29.220 It just gives it the information. 01:16:29.220 --> 01:16:31.340 It just says a COM object can be called locally. 01:16:31.340 --> 01:16:35.100 And so it makes it really easy for people to take something that's local and remote it. 01:16:35.100 --> 01:16:36.900 So .NET Remoting, it's fun. 01:16:37.020 --> 01:16:39.760 See it in theaters near you in 2007, right? 01:16:39.760 --> 01:16:41.360 When people start really deploying it. 01:16:41.360 --> 01:16:45.320 It's a cheap way to do web services if you already have stuff written on the Windows platform. 01:16:45.420 --> 01:16:49.020 Java, you can do the same thing with like RMI and local calls and stuff. 01:16:49.120 --> 01:16:50.040 It's not as easy though. 01:16:50.040 --> 01:16:51.240 It's not just click, click, click. 01:16:51.840 --> 01:16:53.560 Mistakes in authorization and authentication. 01:16:53.940 --> 01:16:57.180 Because SOAP is stateless, people have to rule their own, right? 01:16:57.180 --> 01:17:04.100 It's very possible that there are methods out there that you find from the WSDL that don't require you, that don't properly check your access control before they do something. 01:17:04.100 --> 01:17:07.560 They take a parameter like, I want to transfer money from this bank account to this bank account. 01:17:07.560 --> 01:17:09.760 They don't check whose bank accounts those are. 01:17:11.120 --> 01:17:13.860 Like I said before, the auto-discovery mechanisms make this great. 01:17:13.860 --> 01:17:17.140 Because you no longer have to go look for this stuff that's kind of crusty in the web application. 01:17:17.140 --> 01:17:18.480 You just ask the WSDL. 01:17:18.620 --> 01:17:22.360 And like, they're sometimes named really stupid things like, make me admin, right? 01:17:23.140 --> 01:17:24.160 Cross-site scripting. 01:17:24.160 --> 01:17:28.500 Now, like I said, this is not something, SOAP isn't something that you eat with your web browser, right? 01:17:28.500 --> 01:17:33.900 So if I get cross-site scripting coming back in XML, it's not going to run as script. 01:17:34.380 --> 01:17:40.340 But, and this is the big but, there's a lot of situations in which there's a web interface also in these applications. 01:17:40.400 --> 01:17:45.220 And so cross-site scripting is also still doable, it's just you're not attacking the web service itself. 01:17:45.220 --> 01:17:48.260 The exception to this being AJAX, right? 01:17:48.660 --> 01:17:50.500 The downside is it's not easy. 01:17:51.380 --> 01:17:53.840 I mean, I guess it's an upside because we're all good people in this room. 01:17:53.840 --> 01:17:56.440 The downside for the bad guys is it's not easy. 01:17:56.440 --> 01:18:02.680 Because I have to write something that, you know, in AJAX, like in Google Maps, it takes some XML data and then it makes it presentable. 01:18:02.680 --> 01:18:08.900 So I have to figure out probably exactly how that's happening to write cross-site scripting script that'll actually run when it's transferred. 01:18:08.900 --> 01:18:17.820 That being said, unless they're doing filtering on their side before the information gets to me, it might be possible for me to do input through an AJAX interface one place and pop it out somewhere else. 01:18:17.940 --> 01:18:22.400 Another thing we've seen is a lot of these web services, there's a human in the loop somewhere, right? 01:18:22.400 --> 01:18:32.340 If I go transfer money at a bank and I have to put a memo field in there about what my transfer's about, I put that field in, I make sure the transfer's gonna die, I call up the customer service rep. 01:18:32.640 --> 01:18:33.820 Hello, how can we help you? 01:18:33.820 --> 01:18:36.140 We're, you know, dumbassbank.com. 01:18:36.620 --> 01:18:37.720 What can we do for you? 01:18:37.740 --> 01:18:40.280 Well, you know, my transfer's not working out. 01:18:40.280 --> 01:18:42.320 Can you pull my file up and see what it is? 01:18:42.320 --> 01:18:43.460 Well, sure, give us your social. 01:18:43.520 --> 01:18:45.820 They pull it up, it's a web interface, boom. 01:18:46.300 --> 01:18:46.920 Their own. 01:18:47.320 --> 01:18:49.240 Obviously, that's a pretty sophisticated attack. 01:18:49.240 --> 01:18:53.220 It requires some possible inside knowledge, but maybe not. 01:18:53.220 --> 01:19:06.860 And if this is, you know, if you have an IE0 day, or the way people patch IE in IE, you know, 90 day or something, in most enterprises, right, people are still writing IE5 and stuff, then you might get root control of their box. 01:19:09.580 --> 01:19:13.320 So, any questions on those attacks before we kind of move into the wrap-up and then the demo? 01:19:13.320 --> 01:19:15.460 I'm sorry that I know it's a lot of talking in a row. 01:19:15.460 --> 01:19:16.120 Yes, sir. 01:19:31.810 --> 01:19:33.950 Right, did everybody hear that? 01:19:34.050 --> 01:19:37.630 That Apache Access allows you to take pre-written Java and just drop it in. 01:19:37.630 --> 01:19:38.990 Yes, Access is great, too. 01:19:38.990 --> 01:19:46.410 Apache Access, if you guys want to play with web services and you don't like Microsoft, Apache, the Apache project has their own web service framework, works with Java, it's very nice. 01:19:46.510 --> 01:19:47.730 We're playing with that, too. 01:19:47.730 --> 01:19:53.710 I know, I'm saying, I'm beating up on Microsoft here because of the demos written in Microsoft, but this is stuff that everybody does. 01:19:53.850 --> 01:19:54.810 So, thank you, sir. 01:19:54.810 --> 01:19:55.990 That's a good point. 01:19:56.750 --> 01:19:59.330 So, we have a couple of tech tools that I'll show you. 01:19:59.330 --> 01:20:07.530 One's really cool, the one that Scott wrote, the one I wrote is kind of crappy, but I'll pretend that I wrote the one that Scott wrote. 01:20:07.550 --> 01:20:10.610 The cool one is WizBang, that's how we pronounce it. 01:20:10.610 --> 01:20:12.230 It is a SOAP fuzzer. 01:20:12.510 --> 01:20:15.890 It doesn't fuzz the SOAP implementation, it fuzzes the application behind it. 01:20:15.890 --> 01:20:17.610 It takes a WSDL, right? 01:20:17.610 --> 01:20:23.270 And, you know, you can go and buy, like, SPI Dynamics and SyncDyn and all these, like, attack tools, attack web apps. 01:20:23.270 --> 01:20:28.730 The really hard part that those guys have to tackle in writing those is actually the discovery of the attack surface, right? 01:20:28.730 --> 01:20:31.730 For us, the discovery of the attack surface is easy because we ask it. 01:20:31.730 --> 01:20:37.670 And unless they're really smart and they're manually editing the WSDLs, the WSDL will most likely represent the actual attack surface. 01:20:38.270 --> 01:20:42.670 If it's not automatically generated to the WSDL, it's probably not callable remotely. 01:20:42.730 --> 01:20:52.330 And so, it takes a WSDL, creates a nice little proxy, looks up what the types are, like, this is a string, this is an integer, and it does nasty things depending on that type, it's all extensible. 01:20:53.390 --> 01:21:01.050 It supports SOAP responses and faults, gives you a nice little interface, I'll demo it, and, well, not a nice little interface, it gives you output in a webpage. 01:21:02.070 --> 01:21:08.170 And the future work we're looking at right now, it only works with RPC-style SOAP for all the really hardcore SOAP people in here. 01:21:08.170 --> 01:21:14.230 It doesn't do doc lit because of a bug in Python's implementation of SOAPy, but we're working on it. 01:21:14.230 --> 01:21:16.130 We're going to resubmit a patch to them and get it fixed. 01:21:16.130 --> 01:21:20.130 So, once we get the libraries fixed, it should support almost all web services. 01:21:20.270 --> 01:21:27.370 Oh, here's Jesse Burns, my partner, who has also helped Scott in writing this and who is always tragically late. 01:21:27.370 --> 01:21:34.210 But not on consulting projects, he's never late on consulting projects for all those people with... 01:21:34.210 --> 01:21:35.750 Wait, I'll do a Dan Kaminsky. 01:21:35.810 --> 01:21:36.370 Jesse! 01:21:36.370 --> 01:21:37.430 Ta-da! 01:21:38.850 --> 01:21:39.710 Thank you. 01:21:39.790 --> 01:21:41.010 Thank you very much. 01:21:41.010 --> 01:21:59.070 And then the other tool that Jesse helped with, that's pretty cool, it's OK, takes a WebScarab as input, we use WebScarab a lot now, it's a really good product, WebAttackProxy is probably the most you know, it's open source, OS does it, there's this guy named Rogan in South America, 01:21:59.070 --> 01:21:59.530 right? 01:22:00.010 --> 01:22:01.210 I don't know where he is. 01:22:01.770 --> 01:22:03.550 South Africa, I'm sorry, he's not South American. 01:22:03.550 --> 01:22:04.850 That's it, he's EA, right? 01:22:05.490 --> 01:22:08.130 Who works on it, and Jesse submitted patches and stuff. 01:22:08.130 --> 01:22:11.050 Jesse likes to run it in Eclipse, in debug mode, like in real time. 01:22:11.050 --> 01:22:12.990 He's pretty hardcore about that. 01:22:13.630 --> 01:22:19.570 But anyway, it's really cool, and we use it a lot, and WizMap is not really for finding web services that are out there. 01:22:19.570 --> 01:22:24.790 WizMap is useful for situations in which I have something that already talks over a web service. 01:22:24.790 --> 01:22:28.730 So, maybe I... let me think of something. 01:22:28.930 --> 01:22:37.190 So, back in the B2B, when I was talking about places web services are being used, there's a point on the slide about OFX, which is the standard... anybody here use Quicken or Money? 01:22:37.690 --> 01:22:41.430 OK, you're not going to raise your hands, but there are people in here who use Quicken or Money to manage their money. 01:22:41.430 --> 01:22:42.530 There's nothing wrong with that. 01:22:42.530 --> 01:22:49.870 I'm just saying that OFX is the standard by which it talks to banks when you say, update my account, and it gets your American Express information. 01:22:49.970 --> 01:22:51.050 That's called OFX. 01:22:51.050 --> 01:22:54.110 The next version of OFX is based on SOAP, right? 01:22:54.110 --> 01:22:55.530 So, say I have a client like that. 01:22:55.530 --> 01:23:00.350 I have something that's been shipped to me, and uses a web service on the back end, and I want to reverse engineer it. 01:23:00.350 --> 01:23:11.570 So, I'll put WebScarab... I'll set my HCD proxy, put WebScarab on it, and watch that traffic, because it goes up from Quicken up to Chase and MBNA and American Express and stuff, right? 01:23:11.570 --> 01:23:13.190 Those don't go through Quicken. 01:23:13.530 --> 01:23:16.650 Intuit just tells Quicken where to find those people, and then they go find it, right? 01:23:16.650 --> 01:23:18.270 And that's all over SOAP. 01:23:18.330 --> 01:23:34.650 And so, say I want to actually, you know, research that communication channel, then I'll record it in WebScarab logs, and I'll run WISMAP, and WISMAP will go through and find all of the things I called, as well as the implied directories, and try a bunch of web service discovery requests, 01:23:34.650 --> 01:23:38.010 looking for WSDLs and disco files and stuff, and then write them out to the disk. 01:23:38.010 --> 01:23:46.450 So, I don't have to manually go through and find the things that are actually web services or not, and they'll find all the implied web services, and maybe they don't want their disco files out there, or they just don't know that when they hit compile, 01:23:46.450 --> 01:23:47.610 it automatically goes out there. 01:23:47.690 --> 01:23:48.470 Stuff like that. 01:23:49.050 --> 01:23:51.830 Future work, something we had to pull at the last minute because it wasn't working. 01:23:51.970 --> 01:23:57.390 We're trying to get to find UDDI servers when you get a SIPR range, or maybe even an NMAP XML file, right? 01:23:57.390 --> 01:24:06.470 Because they are web servers, you have to do kind of a Nickto kind of thing, where you get a UDDI, where you look at a web server and you ask it, you know, for different URLs that mean that it's a UDDI server. 01:24:06.510 --> 01:24:15.690 That's going to be very powerful, because like I said, there are enterprises out there that have these exposed, just don't tell people about it, don't register them in UDRs, just tell their partners about it. 01:24:16.510 --> 01:24:29.990 And then hopefully one day we'll integrate it with WSBANE, so you can run it against, you know, the people that you have a legal ability to pen test against, and then you can restrict it based on a reg X to only be within their domain, and it will go find the web services and then automatically attack them, 01:24:29.990 --> 01:24:33.770 you run it overnight, and then, you know, your two-week engagement's done in an hour and a half. 01:24:35.710 --> 01:24:47.870 Okay, tying it all together, I think we kind of talked about this, I can go to a UBR, I can test UDDI server, ask for the services, I go ask, you know, dumbbank.com, give me all your web services, I ask that service, give me your WSDL, it gives me the WSDL, 01:24:47.870 --> 01:24:58.170 I look at the dangerous methods, I run WSBANE to try all of those, I find an XML injection, I use XML injection to change the user ID, and I become whoever I want. 01:25:00.720 --> 01:25:05.220 So a question here is, are the old bugs still relevant? 01:25:05.220 --> 01:25:13.860 A lot of people here would argue that OWASP Top 10 was never relevant, or that OWASP Top 10 is actually saying that OWASP Top 4 in ten different ways, but it turns out that it is, right? 01:25:13.860 --> 01:25:15.860 These are still bugs that exist in our world. 01:25:15.960 --> 01:25:24.020 You still have to validate input, access control is still a problem, authentication and session management is a problem, like I said, SOAP doesn't give that to you, you have to think about it yourself. 01:25:24.600 --> 01:25:30.520 Cross-site scripting, less of a problem, but a problem if there's ever a web interface, and certainly a problem in AJAX applications. 01:25:31.180 --> 01:25:38.800 Injection flaws, buffer overflows, things like .NET remoting make that kind of stuff a reality, because people might get lazy and not rewrite their stuff. 01:25:39.420 --> 01:25:45.920 Injection flaws, SQL injection, XPath injection, this is worse now, because we've added all these new protocols that are spoke on the back end, so we have new things to try. 01:25:46.900 --> 01:25:50.620 Fortunately, almost all of those things use a single quote, so it makes fuzzing really easy for them. 01:25:52.080 --> 01:25:55.200 Insecure storage, denial of service, insecure configuration management. 01:25:55.200 --> 01:25:57.960 I think we've proved that denial of service is still a pretty big issue. 01:25:59.600 --> 01:26:01.580 So, the conclusion before we get to the demo. 01:26:02.840 --> 01:26:06.040 Web services are very powerful, they're easy to use, they're fun to use. 01:26:06.040 --> 01:26:13.020 It's fun to go out and get a book and write 20 lines of code, and have it do something like get me census data, and then plot it onto a map. 01:26:13.020 --> 01:26:14.320 That's really, really cool. 01:26:14.440 --> 01:26:17.240 But, because of all that, they're really, really dangerous. 01:26:18.920 --> 01:26:21.520 Especially because of the ease of use on the developer side. 01:26:22.840 --> 01:26:25.160 There's a lot of security work that needs to be acquired. 01:26:25.180 --> 01:26:30.460 These people are writing these web wiz security standards, but I don't think a lot of security people are looking at them. 01:26:30.600 --> 01:26:32.380 And so, those things need to be inspected. 01:26:32.560 --> 01:26:35.580 We need better attack tools from everybody to help develop. 01:26:36.140 --> 01:26:40.020 We GPL'd our web service stuff, so we're looking for people to help us with that stuff. 01:26:40.880 --> 01:26:44.380 I guess we'll start a source code project or something, so you can do that. 01:26:45.040 --> 01:26:47.280 We need people to find the best practices for development. 01:26:47.420 --> 01:26:50.380 Nobody knows how to write secure web services, that's one of the problems here. 01:26:50.500 --> 01:26:56.000 You can go and buy 20 books now on writing a secure web app, but you can't buy one on writing a secure web service. 01:26:56.060 --> 01:27:00.660 You buy all the books that say securing web services, it's all about the encryption and stuff like that. 01:27:00.660 --> 01:27:05.200 That's not a bad thing, that's something people care about, but it has nothing to do with injection attacks and stuff like that. 01:27:05.200 --> 01:27:14.940 And then we need for people to settle up and stop getting greedy and build this PKI infrastructure before people start deploying and moving my credit reports over these systems. 01:27:16.400 --> 01:27:19.280 And then on our shameless plug slide, we are hiring. 01:27:19.280 --> 01:27:22.640 If you are a researcher or a consultant, please have your resume to career size. 01:27:23.600 --> 01:27:25.340 And a shout out to all these people. 01:27:25.500 --> 01:27:29.000 I mean, sorry, I'm a professional, it's not a shout out, it's a thank you. 01:27:32.020 --> 01:27:35.180 My brothers want me to know how many people here know Leroy Jenkins. 01:27:36.540 --> 01:27:37.260 Okay. 01:27:38.960 --> 01:27:40.140 That's a pretty good number. 01:27:41.220 --> 01:27:43.440 Okay, any questions before we get into the demonstration? 01:27:45.180 --> 01:27:46.040 Yes, sir. 01:27:58.050 --> 01:28:00.750 That's an excellent point, and I'm sorry I glossed over that. 01:28:00.750 --> 01:28:02.170 It was in the slide, but I didn't say it. 01:28:02.170 --> 01:28:12.650 Yes, the right thing to do is if you're a web service, you're putting out on the internet, and you don't want anybody in the world to talk to it, you just want partners to email them the WSDL, yes. 01:28:13.210 --> 01:28:16.990 Turn off the auto mechanisms to publish the WSDLs and just email them. 01:28:17.150 --> 01:28:19.070 That's the best protection against that kind of stuff. 01:28:19.070 --> 01:28:20.470 Makes it much harder. 01:28:20.470 --> 01:28:24.750 If you don't have the WSDL, there aren't built in stuff in SOAP just to ask for all the methods, right? 01:28:24.750 --> 01:28:26.110 That's the method that's supported. 01:28:26.150 --> 01:28:26.930 And people do that. 01:28:26.930 --> 01:28:33.870 If you guys, if you go drop Google Maps into WebScarab and find out what web service they're talking to and ask it for a WSDL, it's not going to give you one. 01:28:33.910 --> 01:28:35.450 So there's certainly people that understand that. 01:28:35.450 --> 01:28:49.130 That's also something, because if you don't want people using your service, if the way you get people to use your service is to mail them a WSDL, or you don't want people scraping it, like eBay and stuff, so that they make money off of your work, then that's something you can do too. 01:28:49.570 --> 01:28:53.010 Google API is probably one of the coolest web service interfaces out there. 01:28:53.270 --> 01:28:54.790 See Johnny Long's talk. 01:28:56.090 --> 01:29:01.310 Any other questions before we move on to me messing up the demonstration and you people laughing? 01:29:03.370 --> 01:29:04.050 Okay. 01:29:04.130 --> 01:29:06.530 I'm really sorry that there's so much talking in a row. 01:29:06.690 --> 01:29:09.110 We've got to get better at putting lots of demos in there. 01:29:09.110 --> 01:29:09.670 I'm sorry. 01:29:12.890 --> 01:29:14.690 So here we have a... 01:29:20.800 --> 01:29:22.820 I don't know if I can do this in 800x600. 01:29:23.800 --> 01:29:26.020 A virtual PC of Windows 2003. 01:29:26.140 --> 01:29:27.620 It's got a web service on it. 01:29:27.740 --> 01:29:33.820 The exact same web service is currently running on wsdemo.isecpartners.com if you're online right now and you want to play with it. 01:29:33.820 --> 01:29:38.660 Or if you go home and you want to try some of these tools, you're welcome to do a tax. 01:29:38.660 --> 01:29:41.820 I'm letting you do a tax against wsdemo.isecpartners.com. 01:29:41.960 --> 01:29:44.100 It's going to be the only site that's going to say that. 01:29:44.940 --> 01:29:48.460 So like we talked about before, there's this cool thing called WS Studio. 01:29:48.980 --> 01:29:53.600 I'm going to point it at the web service. 01:29:54.340 --> 01:29:55.780 It's very, very simple. 01:29:58.120 --> 01:29:59.580 No, I don't want to do it today. 01:30:02.180 --> 01:30:05.160 It's got one user, or one method. 01:30:05.420 --> 01:30:06.400 LogonUser, right? 01:30:06.400 --> 01:30:08.640 So this is simulating maybe Word Bank. 01:30:08.640 --> 01:30:11.760 And the first thing you need to do is log in before you get your account balance and stuff. 01:30:12.000 --> 01:30:14.760 And it takes a string username and a string of password. 01:30:15.620 --> 01:30:18.400 So say I've been hired to pentest this. 01:30:18.540 --> 01:30:19.580 What am I going to do first? 01:30:19.580 --> 01:30:21.780 And let's pretend this is one of those more complicated ones. 01:30:21.780 --> 01:30:24.100 There's hundreds and hundreds and hundreds of methods here. 01:30:24.820 --> 01:30:28.800 I want to see if there are any vulnerabilities. 01:30:28.800 --> 01:30:32.880 And so I'm going to do that using 01:30:45.100 --> 01:30:47.300 WSBANE to do the initial. 01:30:47.300 --> 01:30:56.620 So we're big on documentation and GUIs because we're privately funded and we have no venture capital. 01:30:56.800 --> 01:30:58.580 If you want GUIs, go to Foundstone. 01:30:59.060 --> 01:31:00.840 They excel at that kind of stuff. 01:31:02.300 --> 01:31:03.920 So WSBANE, you give it an URL. 01:31:03.920 --> 01:31:05.060 This isn't descriptive enough. 01:31:05.060 --> 01:31:07.060 You have to give it an URL that gives it a WSDL. 01:31:07.120 --> 01:31:09.320 It can also point to a local file. 01:31:10.860 --> 01:31:14.820 So I am going to give it the URL of the WSDL I grabbed. 01:31:15.140 --> 01:31:16.340 WSDL hashtags. 01:31:17.620 --> 01:31:22.280 This is why our partner Himanshu, who spoke at Black Hat, he video records all his demos. 01:31:22.280 --> 01:31:25.060 Which I'm starting to really appreciate how smart that is. 01:31:29.010 --> 01:31:30.990 That's not a real demo if it's videotaped? 01:31:31.150 --> 01:31:32.390 Right, okay. 01:31:33.750 --> 01:31:38.070 Because I spend an hour and a half convincing you I'm smart and then I can't type. 01:31:52.110 --> 01:31:53.170 Excuse me, sir? 01:31:54.030 --> 01:31:55.150 Oh, yes. 01:31:55.510 --> 01:31:58.900 Thank you. 01:31:59.340 --> 01:32:00.700 Is that a little more readable? 01:32:02.980 --> 01:32:03.920 Okay, great. 01:32:03.920 --> 01:32:06.840 So, I'm running it with an URL that should give me a WSDL. 01:32:08.320 --> 01:32:09.260 Okay, I run it. 01:32:09.260 --> 01:32:10.300 It pulls down the WSDL. 01:32:10.300 --> 01:32:11.740 I didn't know that happened real fast. 01:32:11.760 --> 01:32:13.020 It runs a bunch of tests. 01:32:13.020 --> 01:32:19.440 It does this by looking up in an XML file it has, which I'll show you in a second, the type, you know, in a SOAP you define types. 01:32:19.440 --> 01:32:21.940 You can do simple types, which are things like string and number. 01:32:21.940 --> 01:32:25.040 You define complex types, which means you define a type. 01:32:25.040 --> 01:32:31.100 It can actually be an XML document itself and stuff like that, if you want to do really cool extensible stuff, or binaries. 01:32:31.760 --> 01:32:33.680 We don't support those yet, just simple types. 01:32:33.680 --> 01:32:35.620 That covers probably 90% of web services. 01:32:35.720 --> 01:32:40.160 So it looks up what the type is, like a string, and it looks up in the XML file the things we want to try. 01:32:40.300 --> 01:32:41.280 And it tries those things. 01:32:41.280 --> 01:32:43.400 These are all the things that get tried on that one method. 01:32:43.640 --> 01:32:45.240 And then it reads the response. 01:32:45.240 --> 01:32:47.700 And this response, coming back from the SOAP message, is made pretty. 01:32:48.000 --> 01:32:49.840 And here we have something that says SOAP fault. 01:32:50.820 --> 01:32:53.600 So I click here, and it gives me what actually ran. 01:32:54.040 --> 01:32:56.820 So, outbound, here's my HTTP headers. 01:32:56.880 --> 01:32:58.840 I set the SOAP action header. 01:32:59.820 --> 01:33:02.240 Kind of glossed over this, but there may be... 01:33:02.240 --> 01:33:09.200 We have seen vulnerabilities in being able to set the SOAP action header to different than actually what the method is in the SOAP message. 01:33:09.780 --> 01:33:10.980 So that would be a checkbook. 01:33:11.300 --> 01:33:13.780 And then, within the body, we say logon user. 01:33:13.900 --> 01:33:15.660 The namespace is this namespace. 01:33:15.660 --> 01:33:17.680 This is the encoding metadata. 01:33:17.860 --> 01:33:20.960 And then these are supposed to be... they're not indented, but they're children to this. 01:33:21.040 --> 01:33:23.280 The username and the password strings. 01:33:23.660 --> 01:33:24.940 And what was our username here? 01:33:24.940 --> 01:33:25.800 Anybody see it? 01:33:26.440 --> 01:33:27.700 It's a single quote. 01:33:28.280 --> 01:33:30.000 And the password was default. 01:33:30.740 --> 01:33:33.200 And so the response was... 01:33:33.940 --> 01:33:35.200 To find this XML document... 01:33:35.980 --> 01:33:37.520 Oh, I threw an exception. 01:33:37.520 --> 01:33:40.280 Okay, this is a fault, because it's a SOAP fault. 01:33:41.060 --> 01:33:44.680 Gives me the nice little system trace of all the things I've got called. 01:33:44.680 --> 01:33:47.500 Now, this is like... 01:33:47.500 --> 01:33:52.720 50 lines of C-sharp that's running on the other side. 01:33:52.720 --> 01:33:57.380 Look at all of the methods that get called in a row to parse that. 01:33:57.380 --> 01:33:58.200 Look at this. 01:33:59.100 --> 01:34:00.060 That's all... 01:34:00.060 --> 01:34:04.080 Every one of those is a function that we went through to call this. 01:34:04.080 --> 01:34:06.780 There's a lot of pixie dust there, right? 01:34:08.540 --> 01:34:10.520 And then it gives me... 01:34:18.420 --> 01:34:20.420 Actually, we'll do this the pretty way, which is... 01:34:20.420 --> 01:34:23.080 If I got this, I would do it myself, then. 01:34:23.220 --> 01:34:24.880 In this, so I'll try it. 01:34:25.100 --> 01:34:27.140 I'll say my password... 01:34:27.140 --> 01:34:28.460 My username to quote. 01:34:33.430 --> 01:34:34.490 Oh, exception. 01:34:34.490 --> 01:34:35.790 This isn't a local exception. 01:34:35.790 --> 01:34:37.950 It just passes through a SOAP fault. 01:34:37.950 --> 01:34:40.290 That's an exception on your side, and I go to request response. 01:34:45.710 --> 01:34:47.270 Yeah, that's not what it's supposed to say. 01:34:50.530 --> 01:34:51.290 Yeah. 01:34:51.290 --> 01:34:52.330 Thank you. 01:34:52.330 --> 01:34:55.490 Right, I need to have something in the password so it doesn't... 01:35:00.520 --> 01:35:01.640 Ah, thank you. 01:35:01.940 --> 01:35:03.360 So, I get a SOAP fault back. 01:35:03.360 --> 01:35:05.080 Server is unable to process a request. 01:35:06.720 --> 01:35:08.340 And what does that look like to you? 01:35:09.800 --> 01:35:10.560 XPath. 01:35:10.760 --> 01:35:13.280 So, what was it, sir, that I'm going to try next? 01:35:13.280 --> 01:35:14.500 The winner of crack? 01:35:18.250 --> 01:35:19.270 That's correct. 01:35:21.830 --> 01:35:23.650 Let's give a round of applause for that. 01:35:23.650 --> 01:35:24.410 Ta-da! 01:35:25.350 --> 01:35:26.430 Thank you, sir. 01:35:27.770 --> 01:35:28.430 Single quote. 01:35:28.430 --> 01:35:29.090 Or. 01:35:29.130 --> 01:35:30.890 One equals one. 01:35:31.070 --> 01:35:31.830 Or. 01:35:31.830 --> 01:35:32.950 Single quote, single quote. 01:35:32.950 --> 01:35:34.190 That's not a double quote. 01:35:34.250 --> 01:35:35.290 Equals. 01:35:35.330 --> 01:35:36.270 Single quote. 01:35:39.170 --> 01:35:40.750 Spaces are a significant answer. 01:35:42.570 --> 01:35:44.090 Oh-ho-ho-ho. 01:35:44.890 --> 01:35:52.550 I assume the pauses in his human communication between words were meant to represent the symbol also known as a space. 01:35:52.710 --> 01:35:55.010 When encoded in UTF-8, so. 01:35:55.030 --> 01:35:56.710 We'll let him keep the frack. 01:35:59.130 --> 01:36:04.050 And string result successfully logged in on user ID 3, Henry Ackerman. 01:36:04.390 --> 01:36:05.770 So, that was an XPath injection. 01:36:05.830 --> 01:36:07.910 Why was it this user? 01:36:07.910 --> 01:36:09.850 What's special about this user, do you think? 01:36:10.710 --> 01:36:12.450 He's the last guy, right? 01:36:12.450 --> 01:36:17.930 So, when they referenced the list, they probably asked for the last thing in the list, right? 01:36:17.930 --> 01:36:19.990 Which you do with a negative one in Python. 01:36:19.990 --> 01:36:23.850 So, they asked for index negative one, and you can either ask for the first thing or the last thing. 01:36:23.850 --> 01:36:26.230 Generally, I should get the same thing, right? 01:36:26.230 --> 01:36:27.910 And they asked for the last thing in the list. 01:36:27.910 --> 01:36:29.970 Maybe they went to this talk and they thought it was enough. 01:36:29.970 --> 01:36:33.130 They weren't paying attention to this part, just the last hour and a half. 01:36:33.130 --> 01:36:38.190 And they thought it was enough just to ask, you know, not ask for the first one, because that first person might be a user. 01:36:38.190 --> 01:36:39.910 So, I'm logged in, and this is good. 01:36:39.910 --> 01:36:41.750 But nobody wants to stop here, right? 01:36:41.750 --> 01:36:46.050 This is where you stop if you're like a real second tier hacker, right? 01:36:46.070 --> 01:36:47.170 Oh, yes. 01:36:47.230 --> 01:36:48.350 I'm throwing it out there. 01:36:48.350 --> 01:36:49.070 That's right. 01:36:49.070 --> 01:36:49.990 I said it. 01:36:51.530 --> 01:36:53.350 So, what do I want to do? 01:36:54.650 --> 01:37:00.950 Right, I could do user ID equals one, but although I do know how the XML file is laid out, that's kind of cheating. 01:37:01.610 --> 01:37:03.050 What's another way to do it? 01:37:03.690 --> 01:37:05.570 So, let's go back to our string. 01:37:09.550 --> 01:37:11.010 Let's say it is pretty close. 01:37:11.010 --> 01:37:12.410 It's not exactly the string, right? 01:37:12.410 --> 01:37:22.610 We did see what the string was, but just because we know what the injection string was doesn't mean we know exactly what's in the XML document, right? 01:37:22.610 --> 01:37:26.610 Unless it references it, right, in that path, the XPath string. 01:37:26.790 --> 01:37:31.670 And so, this bottom one, what else could I do other than ask for user ID equals one? 01:37:31.670 --> 01:37:33.810 It's actually simpler than that. 01:37:34.910 --> 01:37:36.210 Name equals admin. 01:37:36.230 --> 01:37:36.950 Yes. 01:37:37.030 --> 01:37:44.990 Right, I can just do name equals or quote, quote, quote, quote, and get rid of the or one equals one because I want them to match the first one, right? 01:37:44.990 --> 01:37:47.130 So, I don't make it a full tautology anymore. 01:37:47.130 --> 01:37:51.470 I make it a tautology only if the name is equal to who I want it to be. 01:37:51.470 --> 01:37:53.010 Does everybody understand that? 01:37:54.090 --> 01:37:59.310 So, I am going to... let's say I've tried admin. 01:37:59.530 --> 01:38:00.590 It didn't work. 01:38:00.930 --> 01:38:05.030 And I know these people wish they were programming on Unix, right? 01:38:05.030 --> 01:38:06.690 So, they used the word root. 01:38:06.710 --> 01:38:09.610 And I've now successfully logged in as user ID zero, name root. 01:38:10.410 --> 01:38:11.450 Ta-da! 01:38:11.490 --> 01:38:12.170 Sorry. 01:38:13.270 --> 01:38:18.150 If it works for Dan Kaminsky, he comes back every year to Black Hat in DEF CON. 01:38:18.150 --> 01:38:20.190 So , if it works for him, it's going to work for me, right? 01:38:20.550 --> 01:38:22.230 So, does everybody understand what we did here? 01:38:22.470 --> 01:38:24.570 This was an XPath injection, XPath 1. 01:38:24.610 --> 01:38:28.910 This could work with either an XML flat file in the back end or a quote, unquote, XML database. 01:38:28.950 --> 01:38:33.150 This exact same query string would work in an XQuery, right? 01:38:33.230 --> 01:38:41.270 Because, like I showed before, XQuery, I mean, the simplest way to do it is all you have to do is to find the document you're looking up, which is the same as a table, right? 01:38:42.450 --> 01:38:43.410 No questions on that? 01:38:43.410 --> 01:38:43.950 Yes, sir. 01:38:47.250 --> 01:38:48.230 Of course, yeah. 01:38:53.270 --> 01:38:56.430 How do I use that to map out the tables in the database or the XML file? 01:38:56.430 --> 01:38:58.570 That is harder. 01:38:59.790 --> 01:39:00.990 We're not there yet. 01:39:01.070 --> 01:39:01.630 You're right. 01:39:02.330 --> 01:39:07.270 Emmett Klein worked on that, and the way he found to get it out was only through logging or logging off. 01:39:07.270 --> 01:39:10.430 He was not able to get error messages out that contained enough information, right? 01:39:10.430 --> 01:39:13.990 Like, the traditional way of SQL is that there's SQL statements that you can do. 01:39:27.700 --> 01:39:29.760 You're going to go Karl Rove style on them? 01:39:37.660 --> 01:39:38.380 Okay. 01:39:43.300 --> 01:39:44.220 I'm sorry. 01:39:46.800 --> 01:39:48.280 It's probably doable. 01:39:48.460 --> 01:39:51.140 We don't have that answer yet, and that's something that we'll be working on. 01:39:51.260 --> 01:39:53.400 Emmett Klein does it through that binary. 01:39:53.400 --> 01:39:56.040 I think now with XPath 2, there might be better ways of doing it. 01:39:56.040 --> 01:40:04.220 You might be able, because you can reference external links, it might be possible for me to reference something and then make the rest of the XML document look like it's part of the URL, right? 01:40:04.220 --> 01:40:07.120 It's like people do cross-site scripting with an image tag to get a cookie out. 01:40:07.120 --> 01:40:09.900 When it hits my log, I might be able to get it out of a log. 01:40:10.000 --> 01:40:10.780 I'm not sure. 01:40:11.480 --> 01:40:14.260 Klein looked into doing it with error messages, and he wasn't able to do it. 01:40:14.720 --> 01:40:18.060 Still, I mean, the guy's disappeared off the face of the planet, so if anybody knows him, have him email me. 01:40:18.060 --> 01:40:19.320 I'd love to see what he was doing. 01:40:19.480 --> 01:40:20.240 But you're right. 01:40:20.360 --> 01:40:25.420 In SQL Injection, there are the 19 commands you can probably do in a row that's with the error messages. 01:40:25.420 --> 01:40:28.980 You can map out the... not the tables, but the nodes. 01:40:30.820 --> 01:40:35.460 Okay, well, since we've got a second, I'm just going to do a quick demo of WISMAP. 01:40:38.630 --> 01:40:43.030 Well, since I learned to set it up without you guys seeing it. 01:40:44.210 --> 01:40:46.350 Okay, so this is WISMAP. 01:40:52.100 --> 01:40:53.460 Python's compiling it. 01:40:54.200 --> 01:40:55.900 Shoot, that's going to be hard to see. 01:40:58.330 --> 01:41:05.470 So, if you run it with "-h", it says you can do all these things, ask for WSDLs, ask for DISCOs, store them locally, verbose. 01:41:05.470 --> 01:41:07.030 I'm going to ask it to do everything. 01:41:07.030 --> 01:41:12.130 I'm running in a directory with a WebScarab conversation log. 01:41:12.130 --> 01:41:15.210 Although, if you have it in a sub-directory, that's fine, too. 01:41:15.950 --> 01:41:18.810 It'll search all the directories for WebScarab logs. 01:41:19.030 --> 01:41:20.710 Anybody... who here uses WebScarab? 01:41:21.770 --> 01:41:22.550 Decent number. 01:41:22.550 --> 01:41:24.070 I recommend you guys use it. 01:41:25.670 --> 01:41:28.290 Anyway, as you can see, there's no "-u", anymore. 01:41:28.290 --> 01:41:31.750 We had to pull that out, which is one of the great tragedies of my life. 01:41:32.130 --> 01:41:32.810 Sorry. 01:41:32.810 --> 01:41:42.990 And I'll run wismap.py-wsdls-discos, write out the files, and do it verbosely. 01:41:43.170 --> 01:41:51.850 And I just generate these logs by kind of cheating and going to things that I thought would have different types of web services. 01:41:51.850 --> 01:41:54.910 Although, I didn't know all of them, but I knew these were different web services I would go to. 01:41:54.910 --> 01:41:57.310 Like I said, this is not useful for blind. 01:41:57.310 --> 01:42:01.010 This is useful for reverse engineering something that uses web services. 01:42:01.470 --> 01:42:10.170 And if the network actually worked here at DEF CON, you would see that it would find multiple WSDLs and DISCOs here and then write them to the local disk. 01:42:10.970 --> 01:42:13.450 In the... which are already written. 01:42:13.450 --> 01:42:15.390 1.disco, 1.wsdl, 2.disco. 01:42:16.850 --> 01:42:17.490 Wow. 01:42:17.490 --> 01:42:18.150 Okay. 01:42:23.170 --> 01:42:25.290 Okay, so it did one test. 01:42:25.290 --> 01:42:27.870 While that's going, I'll show you one of those. 01:42:40.510 --> 01:42:45.050 So this is one of the things that, when I ran it in my hotel room, it pulled down. 01:42:45.050 --> 01:42:47.470 This is the WSDL for a census data. 01:42:50.090 --> 01:42:58.150 So do you think the programmer read that whole thing before it got published to the internet looking for all the methods that he felt would be too dangerous to publish to everybody? 01:43:02.600 --> 01:43:03.780 Probably not. 01:43:07.040 --> 01:43:11.980 I'm not... I'm not going to... you... that's for you to explore yourself, sir. 01:43:13.240 --> 01:43:15.060 So you can see it's doing some tests. 01:43:15.060 --> 01:43:17.820 It's looking for... it's asking for question mark WSDLs. 01:43:17.820 --> 01:43:19.300 It's asking for question mark DISCO. 01:43:19.300 --> 01:43:24.000 It's also looking for default DISCO URLs, and it's about to find one. 01:43:24.140 --> 01:43:26.520 And like I said, DISCO is like UDI. 01:43:26.520 --> 01:43:27.580 It doesn't define a web service. 01:43:27.580 --> 01:43:31.760 It defines the services you're publishing through a web server instead of running your UDF server. 01:43:33.540 --> 01:43:35.720 Okay, so open questions or comments. 01:43:35.720 --> 01:43:37.060 Is this useless? 01:43:37.060 --> 01:43:38.760 Do you guys think you'll never run into this? 01:43:41.300 --> 01:43:43.200 Any more questions for everybody? 01:43:45.880 --> 01:43:47.080 Okay, well thank you very much. 01:43:47.080 --> 01:43:47.940 We'll do Spot the Fed.