The State of Application Security 2023 • Sebastian Brandes • GOTO 2023
Great. report for a Sunday morning about Application security from Sebastian, co-founder and CEO of the startup Heyhack. The report is quite practical in nature and it does not just talk about the basic concepts and give the results of the safety study. 2023 year (It's also very interesting.), but also demo top vulnerabilities:) The report consists of the following parts:
- Results of the study The authors examined almost automatically. 4 a million services 103 countries, more 8 Thousands of companies. For a deep dive in the results, the author recalls the base of CVSS (Common Vulnerability Scoring System) Evaluate the severity of vulnerabilities. This is to show that 3/4 organizations have known high-level vulnerabilities (7+). It is interesting to see the distribution of vulnerabilities by country. (Russia looks good enough at the general level or the authors didn’t really bash Russian services.) - Deep dive theme. -- File leaks - 29% of organizations still have data leaks (code, backups, keys, configurations,) -- Dangling DNS records Nearly a quarter of companies end up with dangling DNS records when the domain name remains delegated to an IP address that is no longer owned by the company. (For example, when the cloud extinguished the machines into which the subdomain was divided, and the delegation of the subdomain was not removed.). Actually, the author conducts a demo of how it can look and explains that such a hanging DNS record can be captured and further stolen session cookies or hung a fraud on a legitimate subdomain. -- Vulnerable ftp servers An example of a proFTP vulnerability 1.3.5 (CVE-2015-3306) and says that 1.5The percentage of companies surveyed have this vulnerability:) And then he runs a demo on how to exploit it. -- Cross-site scripting This is a type of attack, which consists in the introduction of malicious code into the page issued by the web system and the interaction of this code with the attacker’s web server. 4% of companies have known vulnerabilities of this kind and they are often tied to wordpress plugins, nginx modules, keycloak, drupal plugins and generally any plugins of known web applications. Here the author remembers OWASP (Open Worldwide Application Security Project) specifically OWASP Juice Shop A super-leaky application that has been specifically designed for training purposes. In fact, in his demo, the author actively uses it. Plus the demo is used BeEF The Browser Exploitation Framework Project. The demo looks very interesting and shows what vulnerabilities look like and what irresponsibility in security matters can lead to.
- Case analysis with Fortnite and EpicGames An example of how a combination of multiple vulnerabilities can break a system. In this case, it was the Fortnite app. The very vulnerability was found by the guys from Check Point and they have playful
- WAF and their partial ~~devil~~Usefulness - an explanation of how WAF works (web app firewall) And how they easily fall into errors such as false positive and false negative:)
In the end, the author describes the main conclusions:
- Don't rely on the WAF. We need to proactively address vulnerabilities and fix them before they lead to security incidents. Getting started on app security is easy.
Well, specifically for the vector of web attack, the following plan is proposed:
- Identify the attack surface (external domains) and understand vulnerable targets
- Fix DNS hanging records
- Update the servers. (Apache, Nginx, ...) Configure continuous testing of critical applications Work with developers and integrate security tools with them to address vulnerabilities Test newly found vulnerabilities and make sure they are fixed
- And keep working like this.
This is a very basic report, but with interesting statistics and practical tips for improving the situation.
#Security #SRE #SoftwareArchitecture #Software #Engineering #Management #Leadership #Processes #SystemThinking #SystemEngineering