Speaker:
- Elisa Heymann Pignolo, University of Wisconsin – Madison
Abstract:
Securing your network is not enough! Every service that you deploy is a window into your data center from the outside world, and a window that could be exploited by an attacker.
This tutorial is relevant to anyone wanting to learn about minimizing security flaws in the software they develop or manage. We share our experiences gained from performing vulnerability assessments of critical software. You will learn skills critical for software developers and analysts concerned with security.
Dependency analysis tools – tools that find weaknesses in the software supply chain – are the first line of defense in assessing the security of a software project. These tools can catch flaws in the packages and libraries a program depends upon, and that affects the safety of the application. This tutorial is also relevant to anyone wanting to learn how to use these automated dependency analysis tools to minimize security flaws in the software they develop or manage.
We will provide all the required software, installed and configured, on a Virtual Machine.
The tutorial will start with some basic vocabulary presenting terms that will help the attendees focus the key concepts being taught. This will include such terms as attack surface, impact surface, vulnerability, exploit, and mitigation.
We will continue with a section on Thinking Like an Attacker (“owning the bits”) to get the attendees in the right mind set. The first major technical area of our tutorial is a presentation of the most common vulnerabilities found in middleware and services. Descriptions of each type of vulnerability will be presented with examples. The examples will show how each type of vulnerability occurs within code, pointing out how common usage patterns for system library routines, kernel calls, and common programming techniques can result in a vulnerability. The coding examples are presented in Java, C/C++, Python and Perl.
Along with the description of the vulnerabilities, we will show how the vulnerabilities can be mitigated or eliminated through the use of specific programming and design techniques. An important part of our discussion of each vulnerable technique is a description of the thought processes used by the attacker in developing an exploit.
The second technical area of our tutorial is a presentation about dependency analysis tools. Recognizing the importance of software dependences, software supply chain risk management, and generating a software “bill of materials”, we have added this new topic. We will introduce different kind of dependency tools, describe how these tools work, and discuss their output and limitations. We will also show how different tools produce different results, and that despite what vendors say, there is no a single tool that works the best for all applications. In this tutorial we will use both open source and commercial tools.
The last part of the tutorial will be devoted to hands-on exercises. The attendees will exploit three specific vulnerabilities on WisClick, an application we developed for teaching secure programing. Participants will exploit the vulnerabilities, and then will identify where in the code the vulnerabilities are. Then attendees will use three different dependency analysis tools (open source and commercial) to learn about vulnerable dependencies on the software stack of WisClick.