Security

From ICO wiki
Jump to navigationJump to search

Team page for Deploying IT Infrastructure Solutions.

Team Members

  • Sten Aus, Estonian Information Technology College
  • Matis Palm, Estonian Information Technology College
  • Sandra Suviste, Estonian Information Technology College
  • Markus Rintamäki, Vaasa University of Applied Sciences
  • Tomas Lepistö, Vaasa University of Applied Sciences
  • Mika Salmela, Vaasa University of Applied Sciences
  • Kęstutis Tautvydas, Vilnius University of Applied Sciences
  • Jurij Lukjančikov, Vilnius University of Applied Sciences

Goal

  • OWASP top 10
  • HACK DVWA
  • BackTrack, SamuraiCD (Last year experience)
  • Scanning and testing tools - Qualys SSL Labs
  • Acunetix Web Vulnerability Scanner v.8
  • SubGraph Vega
  • BEAST attack
  • RC4

Activity

Monday - 25.03.13

Things what we did that day

  • Lectures
  • Sumorobot programming
  • Dinner @ St Patricks

Tuesday - 26.03.13

Things what we did that day

  • Documentation!

A1 Injection - Sandra

A2 Broken Authentication and Session Management (was formerly A3) - Kestutis

A3 Cross-Site Scripting (XSS) (was formerly A2) - Kestutis

A4 Insecure Direct Object References - Markus

A5 Security Misconfiguration (was formerly A6)- Tomas

A6 Sensitive Data Exposure (merged from former A7 Insecure Cryptographic Storage and former A9 Insufficient Transport Layer Protection) - Mika

A7 Missing Function Level Access Control (renamed/broadened from former A8 Failure to Restrict URL Access) - Sten

A8 Cross-Site Request Forgery (CSRF) (was formerly A5) - Matis

A9 Using Known Vulnerable Components (new but was part of former A6 – Security Misconfiguration) - Jurij

A10 Unvalidated Redirects and Forwards - Sten


Problems what we faced:

  • Still need to get everyone a VM with DVWA running

Things what we plan to do:

  • Copy Paste documentation tasks to Wiki :)
  • Divide OWASP tasks

Wednesday - 27.03.13

Things what we did that day

  • Meeting with clients. It was very open-minded meeting. We got to know more about requirements.
  • Analysing the user needs. We discussed face to face with our client and mentor (Margus Ernits) what needs to be done in order to perform security testing. Also, we found some tools from the Internet, which we can use for testing purposes.
  • We divided roles and shared our areas of competences. Also, we agreed that one should not be doing always the same thing, so we can share our work with eachother.
  • Estonian ICT Presentation and Wireshark practice. Wireshark was more-less known for everyone in our team. Despite that fact, we all found something enjoyable and new from Antti's presentation and Wireshark.
  • Estonian members made Study Information System presentation to Finnish and Lithuanians. We talked about some potential vulnerabilities (such as VÕTA declaration, file upload, sending messages, voting system)

Problems what we faced:

  • As none of us have done security testing before, we have a lot to learn before we can actually do something. But I think with such a team as we are, it's nothing.

Things what we plan to do:

  • Estonian members are going to study last year's report and going to make a short overview to other members about it.
  • We are going to study OWASP Top 10 vulnerabilities and everyone of us is going to make a short presentation to others about what they have learned.
  • We are going to ask in demo (development) environment if they can open a new survey for us, new declaration period; Also we need teacher and demo accounts, in order to test teacher's side as well, because teachers have a little more access than students (grades, information about student etc).
  • In demo environment we are going to test new functions (what haven't been included in main environment, yet) - as there's some new functionality.

Thursday - 28.03.13

Things what we did that day

  • OWASP TOP 10 presentations: Everybody presented on their subjects + discussion (slides)
  • Discussed the schedule and to-do list for next days
  • Discussed some potential vulnerabilities of SIS
  • Made shared Googledoc to document the testing and to exchange information. Also we made Skype group in order to share files effectively and fast.
  • Prepared software for testing (Backtrack, Kali)

Problems what we faced:

  • There is a lot of information, we need to focus on something and just start. There is no such thing as start-line ("Start here and go this way"), we will just need to start and see what we will found.

Things what we plan to do:

  • Find attack examples for the vulnerabilities
  • Try them out on DVWA
  • Get familiar with Tamper Data, Kali and Backtrack
  • Familiarise ourselves with XSS, Injection, CSRF before testing SIS
  • See how to get authentication info from POST and GET

Security threat of a day

  • There are three environments of SIS. Live, demo and developer. We found out that developer environment is accesible with our live users and passwords. What's more -> developer environment has LIVE data!!! Like! Does that ring any bell to you? NEVER, we mean like NEVER use live data (data, grades, schedule, students, personal ID-s etc) in demo/developer environment!

Friday - 29.03.13

Things what we did that day

  • Learned how to perform attacks. We learned different attack methods and tried them out.
  • Learned how to use different automated tools. Automated tools are not very efficient to SIS, but still - there might pop up something interesting from the results. Results are saved for later analysis.
  • Talked about last year's experience. Tried if most of the security holes are patched or not.

Problems what we faced:

  • We need student access to developer environment
  • We need new survey and declaration period opened (we asked Margus, he promised to give our request to someone who can make it)

Things what we plan to do:

  • Analysis of the results needs to be done
  • Learn a little bit more about attacks
  • Create some attacks
  • Start to test simpler attacks to SIS

Security threats of the day:

  • One can see other student's exam plan just by chaning student_id value in the URL (you don't need to be logged in). You cannot see his/her name directly, but according to security holes now: See the schedule, just change ID - you get the name. Or if you are logged in, then you can go to "My data" and just change ID from the URL again.

For example: https://itcollege.dev.ois.ee/en/schedule/agenda?student_id=2322

Saturday - 30.03.13

Things what we did that day


Problems what we faced:


Things what we plan to do:


Sunday - 31.03.13

Things what we did that day


Problems what we faced:


Things what we plan to do:


Monday - 01.04.13

NB! April fools' day! Beware!

Things what we did that day


Problems what we faced:


Things what we plan to do:


Tuesday - 02.04.13

Things what we did that day


Problems what we faced:


Things what we plan to do:


Wednesday - 03.04.13

Things what we did that day


Problems what we faced:


Things what we plan to do:


Thursday - 04.04.13

Things what we did that day


Problems what we faced:


Things what we plan to do:


Friday - 05.04.13

Things what we did that day


Problems what we faced:


Things what we plan to do:


Saturday - 06.04.13

Departure! Bye bye!


Materials (slides etc)

More to come. Stay tuned!

Results

Summary of what we did and solution what we developed

Final documentation

Analysis

Solution

IP Feed-back

Feedback from XXXX

You have a hole here in WIKI. I can edit your feedback. Haha!

Feedback from Matis Palm

Feedback from Sandra Suviste

Feedback from Markus Rintamäki

Feedback from Tomas Lepistö

Feedback from Mika Salmela

Feedback from Kęstutis Tautvydas

Feedback from Jurij Lukjančikov

Retrieved from "https://wiki.itcollege.ee/index.php?title=Security&oldid=61987"