Nate's Stuff : Security

Encrypting Configuration Information for ASP.NET

Nathan Zaugg — Wed, 16 Jul 2008 22:11:22 GMT

Every company I consult with invariably has their own "security" assembly and they all have a hard-coded encryption key with the IV and the method to decrypt is right next to the method to encrypt. This is what I call marginal protection. Yes, it's encrypted and will probably get a security auditor off of your back but don't be fooled into thinking that you are protected! A similar thing is done with information in the database, but I'll cover how to do this on an upcoming post.

Why aren't you protected? The answer to this question is actually quite simple. If an attacker has access to download your web.config file (say, they brute forced a password on the FTP server) then there is nothing stopping them from downloading the your Security.dll which is responsible for decrypting the password. Once they have that library it's seconds, not minuets, before they have got the password.

One possible work around is to encrypt configuration sections of your web.config file using DPAPI as outlined in this MSDN How-to. This is immune to the download attack because the DPAPI uses encryption that is based on a machine or a user. Even if someone was able to download your web.config they would effectively have no way to decrypt that information.

What happens, though, if the attacker has the ability to upload files? Well, in theory, they may be able to grab that configuration in code which will, of course, be decrypted before it is returned. Ahh, but they don't even know what the name of the connection string (in the case of databases) is because the entire section was encrypted. However, they could guess it or get it from other code. By the way, you really shouldn't deploy the .cs files to production anyway; you should use the "publish website" option with the setting to not allow the site to be updated. If you follow all of the standards pretty closely your in good shape. Another great idea is to use Integrated Authentication for database access -- that way there is no password to steal!

The How to outlines 3 basic steps summarized below:

Identify the configuration sections to be encrypted

You may only encrypt the following:

<appSettings>. This section contains custom application settings. 
<connectionStrings>. This section contains connection strings. 
<identity>. This section can contain impersonation credentials. 
<sessionState>. The section contains the connection string for the out-of-process session state provider.

Choose Machine or User store

Use Machine store if this is a dedicated server with no other applications running on it or you want to be able to share this information with other applications running on this machine.
Use User store if the above does not match your situation and in a scenario in which the user has limited access to the server.

Encrypt your configuration file data

To encrypt using Machine Store, run the following command from a .NET command prompt:
aspnet_regiis.exe -pef "{ConfigSectionName}" {PhysicalDirectory} –prov "DataProtectionConfigurationProvider"
OR
aspnet_regiis.exe -pef "{ConfigSectionName}" -app "/{VirtualDirectory}" –prov "DataProtectionConfigurationProvider"
To encrypt using User Store:
Add the following section to your configuration file:

<configProtectedData> 
    <providers> 
        <add useMachineProtection="false" keyEntropy="" 
                name="MyUserDataProtectionConfigurationProvider" 
                type="System.Configuration.DpapiProtectedConfigurationProvider, 
                System.Configuration, Version=2.0.0.0, Culture=neutral, 
                PublicKeyToken=b03f5f7f11d50a3a" /> 
    </providers> 
</configProtectedData>

Open a command prompt using the user you plan to encrypt the file with. To do so, Right click on the Command Prompts shortcut, right click -> Run As. Or use the following command:

Runas /profile /user:domain\user cmd

Run the following command:
Aspnet_regiis -pe "connectionStrings" -app "/{VirtualDirectory}" -prov "MyUserDataProtectionConfigurationProvider"

It really is that simple! The great thing is that we don't have to do anything special in development to benefit from the encryption of the configuration sections.

References:

http://msdn.microsoft.com/en-us/library/ms998280.aspx

Connection Pooling vs Audit Logging

Nathan Zaugg — Thu, 26 Jun 2008 18:17:00 GMT

These past two weeks have been very exciting for me. I have gotten to be involved in some R&D for one of the companies that I consult for. I LOVE R&D! There is always a better way to do things and poking your head out from the sand every once in a while can be very beneficial!

Okay, so here is the story. You want to have auditing so you can log the user responsible for the change. It follows that you simply connect with that users credentials and now you have a great audit log! The problem is that if you have thousands of users (or maybe even less) you are going to start to experience a large number of connections on the server. [Image 1] This is because each user has their own connection pool that, even if it is going through a service, cannot be shared with any other user. A large number of connections is starting to really slow down your database so you decide to create a generic user account for the service. The problem is now our audit log will only show the service account as the person responsible for the change! [Figure 2]

Image 1

Image 2

So you have two ways in which you can fix this. First you can mandate that all changes to the data must happen through stored procedures. If we make sure that every stored procedure passes the user who is responsible for the DML changes then we can add our own audit records. The upside is that not only can we take full advantage of connection pooling and security is better using procs. The downside is that this can be intensive and the change log probably cannot be driven by triggers and we may have to come up with a complex and fallible process.

Alternatively, you can use a basic service account for the connection and connection pool and run the SQL 2005 / 2008 "EXECUTE AS LOGIN" command before any other DML statement. [Image 3] This is called User Context Switching and could be done automatically using a specialized command object. The only down side is that because SqlCommand is a sealed class we have to use composition rather than inheritance. This may also force us to create a compatible SqlDataAdapter but when all is said and done you have a system that is both scaleable and robust. These changes are also likely to be compatible with SQL Server 2008's CDC technology which can automatically log changes to a table.

-- TSQL TO CREATE A USER WITHOUT A LOGIN
-- AND USE USER CONTEXT SWITCHING
CREATE DATABASE [TestDB]
GO

USE [TestDB]
GO

-- Create the Service User
CREATE LOGIN [ServiceLogin] WITH PASSWORD = 'Uor80$23b91';
 CREATE USER [ServiceLogin] FOR LOGIN [ServiceLogin]
 GO

 -- If we ran this before then we need to drop this user
 DROP USER [nzaugg]
 GO

 -- Create a user without a login
 CREATE USER [nzaugg] WITHOUT LOGIN
 GO

-- Wade said this is backward, so I swaped it for him...although I'm not fully convinced!
 GRANT IMPERSONATE ON [nzaugg] TO USER::[ServiceLogin] 
 GO

 -- Switch User Context; Optionally Specify 'NO REVERT'
 -- If we run this in Query Editor with 'NO REVERT' the
 -- only way to go back to our original login is to reconnect!
 EXECUTE AS USER = 'nzaugg' --WITH NO REVERT
 GO

 -- Verify that we are now user 'nzaugg'
 SELECT user_name(), suser_name(), original_login()
 -- If we used 'WITH NO REVERT' on our EXECUTE AS statment
 -- We won't be able to revert and this will throw an exception
 REVERT
 GO

 -- Are we still 'nzaugg'?
 SELECT user_name(), suser_name(), original_login()
 -- DROP THE DATABASE
 DROP LOGIN [ServiceLogin]
 GO

 USE [master]
 GO

 DROP DATABASE [TestDB]
 GO

Remember, in order to do this all of these users must exist in the database. They must also have rights to perform the operation in the original DML statement. This is where users without logins come in handy (see code lines 18 & 21). The optional WITH NO REVERT will be handy for logging and will further secure our database.

Image 3

EXECUTE AS MSDN Paragraph

SQL Server 2005 Books Online (September 2007)

EXECUTE AS (Transact-SQL)

Sets the execution context of a session.

By default, a session starts when a user logs in and ends when the user logs off. All operations during a session are subject to permission checks against that user. When an EXECUTE AS statement is run, the execution context of the session is switched to the specified login or user name. After the context switch, permissions are checked against the login and user security tokens for that account instead of the person calling the EXECUTE AS statement. In essence, the user or login account is impersonated for the duration of the session or module execution, or the context switch is explicitly reverted. For more information about execution context, see Understanding Execution Context. For more information about context switching, see Understanding Context Switching.

References:

Downloads:

Connection Pooling Diagram

Cyber Security

Nathan Zaugg — Wed, 25 Jun 2008 19:54:00 GMT

When I seem to have re-occurring themes happen naturally I find that those are good things to blog about. Recently I was speaking with my brother (who has incessant adware problems) about Internet Safety and Cyber Security. A week or two ago I had a stimulating conversation with my friend Anthony about security, and this morning on the Diane Rehm Show there was a segment about Cyber Threats. In which one of the guests stated that he works on Banking systems and will not engage on Online Banking.

The first question anyone has is how wide-spread is this problem and does this really affect me. The answer is that this is wide-spread and it affects everyone whether you own a computer attached to the Internet or not. The scary part is that even the most pragmatic and Internet-savvy users can fall victim. Does this mean you or I should stop using the Internet altogether? Absolutely not. While anyone can fall victim to this kind of threat there are steps to take to greatly reduce your risk!

In this age of technology we have almost no limits to our technical abilities. Unfortunately, our attackers have this same ability.

Types of attacks:

Trojan Horses - A computer program that poses to be something useful but allows access to your system from the Internet.
Adware - A computer program that either tracks your usage and sells that information to marketers or pops adds up on your computer.
Spyware / Key-loggers - A program that "watches" what you do on your computer. They can record every keystroke and send that information to a scammer.
Worms - A special kind of program (which usually includes spyware or Trojan horses) that spreads its self -- usually through email or mapped network drives.
Proxy - A term used for an attack coming from a computer in which the user/operator has no idea about. This is a compromised computer system that a remote scammer has installed a Trojan horse on. This "bot" can now do anything it's owner wishes.
DOS - Denial of Service attack. This is an attack on a server which will render it unable to complete the task it for which it was designed.
DDOS - Distributed Denial of Service attacks. This type of attack usually involves overwhelming a web site to the point that it can not serve requests to legitimate customers. This usually involves a large amount of "bots" controlled by a single party and often controlled through a mechanism called IRC which is a lot like a chat room.
Buffer Overflow - this is a special type of attack that targets specific code. Basically if the scammer can pass a malformed piece of data to a function in code then they might craft it in such a way that it will execute part of the data. That allows the attacker to run any kind of code on your machine. Depending on the security of the process that was compromised (which is usually pretty high) they can take over your computer. Remember, any maliciously-crafted data can cause this including data they try to send to you on an unprotected Internet port or data that you requested from a malicious website. Simple things such as an image can contain a buffer overflow attack (and have in the past). This type of attack is not only limited to windows. It can be attributed to careless programming but can often be a weakness in the compiler itself.
Root Kits - This is a special kind of hacking technique which involves exploiting one small veunerability after another. This is typically on web servers who's upload function is unprotected or ones which have a buffer overflow exploit in place. Once a file is uploaded it is executed and causes a larger hole to be created. Eventually they can take control over that machine.
Email Scams - Email is where most of the bad stuff originates from. That is because it is cheap and easy to send mail and because it is often easy to harvest or guess an email address. It's far more difficult to get people to visit a malicious website.

Q & A:

Info: The terms virus's, adware, spyware, and worms can be safely summed by the term malware.
Q: Are Mac's really more secure than PC's?
A: Yes and No. Although the Mac has made a comeback the past few years it is still a very, very small percentage of the computers in the world. Because of this most every virus targets a PC running some version of Windows. However, this does not mean that your "safer" using a Mac. As Macs become more more popular more virus will be written to target them and they may have more success than targeting windows. Windows has gone a few rounds of cops and robbers where Macs have not. In my opinion, if you are buying a Mac simply because you think you are "more secure" than don't bother. A sense of false security is the most detrimental risk of all.
Q: Who is attacking me and why?
A: Attackers are generally part of 1 of 2 different types. People in it for personal gain and government-sponsored groups. There has been a very significant and organized amount of hacking coming from China which suggests that the Chinese government sponsors this type of activity. Much of their effort seems to be on mapping our resources around the net.
Q: I get a lot of email about stocks, what is that about?
A: This is the old pump & dump scam! They artificially inflate the price of "penny stock" that they own a large number of shares of. They send this email en masse telling people to buy lots an lots of this stock. Enough people buy that the stock price raises and the scammer sells the stock and allows it to tank. This kind of scam can be costly for both the business offering the stock and for those foolish enough to actually invest in it.
Q: Do people really fall for the emails claiming to be from their bank?
A: No, not really. The problem is that if just one in ten million *do* fall for this scam then it would have been worth it. They can send these phishing emails out at a rate of millions per minuet.
Q: Will the Internet ever become a safe place.
A: No. Like the game of cops and robbers this will likely play out forever. The programmer in me wants to believe that it is possible to have 100% secure software. The pragmatist in me knows that it may not ever be possible. However, overall I do tend to believe that it will get much better but will probably get much worse before that begins to happen.
Q: Does looking at porn on the Internet make me more susceptible to malware?
A: Absolutely! Porn and Malware go hand-in-hand!
Q: Does downloading "cracked" programs make me more susceptible to malware?
A: Absolutely! Crack sites, key sites, etc. are a Trojan horse delivery mechanism. Why do you think these people crack these apps? They do it to lure you there and take control of your computer.
Q: Can a virus really take control of my email?
A: Yes, it can but usually it doesn't have to. SMTP (the protocol in which mail is sent over the Internet) has absolutely no good way of verifying that you are who you say you are. If your computer is hacked then it's probably your email address book they are after.

Tips & Tricks:

Get a home firewall that uses NAT. You may already have this and not realize it but computer systems sitting behind NAT "invisible" to Internet scans which greatly helps keep your computers safe!
Let your computer update regularly! Make sure auto-update is turned on and working. If the computer needs to restart to apply a patch make sure that happens ASAP.
Install a software firewall. They will slow down your computer, I know, but they are a necessity today.
Let your virus scan run weekly
Own two computers (especially if you have kids). Use one for Internet banking, and Internet purchases, storing personal information and nothing else. Use the other one for everything else, keeping any kind of personal information off of this machine.
Use the least possible permissions you can for your user accounts.
Our school used a hardware device in which every time the computer is rebooted the state is restored to exactly the same state every time. This would be a really great tool for your general use computer. (I'll post a link when I can find one)
If you are at an Internet shopping site and you get a certificate error, leave now! That certificate error is the ONLY thing protecting you from a man-in-the-middle attack!
NEVER, NEVER, NEVER, NEVER, NEVER download or open an attachment you are not expecting! Even if it looks like it is from a person you trust! If it is from a person you trust verify it's contents before opening! They may have been sent this wonderful screen saver and wanted to share it with you. That's great and all but that screen saver is probably a worm! Also, they may not have actually sent it to you, the screen saver did it!
Do not download any executable file. Those include files that end with: .exe, .scr, .bat, .pif, .com, .dll, .ocx, .sys Also watch for the space trick where the filename is "myfile.zip .exe". Notice the spaces? You may not see those in Outlook or whatever else you are using.
Verify from the author any other types of download. Recently virus have been able to attach to innocent PDF files! The moral is that there really is no such thing as an innocent file!

Opinion:

Virus' are not easy to detect! Virus scanners use something called Heuristics to find virus's, adware, spyware, and worms.
Both client and server need a way to be independently authenticated by a trusted 3rd party, and if the trust can not be established then there must be no way to continue.
We need to phase out passwords! They are way too easy to predict and/or capture!
We need a way to positively identify (for computing purposes) every user on the Internet. This is the only way we can really develop trust relationships with other systems and the only way to end SPAM/Phishing.

Visit these links for more information:

Be careful out there!