Speaker: Shane Jahnke CS 6910 – Advanced System Security & Design ModSecurity Speaker: Shane Jahnke CS 6910 – Advanced System Security & Design

Outline Motivation Introduction to ModSecurity ModSecurity Rules Potential Problems ReDoS CS5260 Midterm Exam Conclusions 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

Motivation Familiar with the Apache Web Server Reverse proxy support Interest in securing web and application servers Over 70% of attacks carried over web application level These attacks could include web attacks, cross-site scripting attacks, SQL injections attacks, and so on. 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

What is ModSecurity? Open source web application firewall (WAF) ModSecurity Provides: Protection from a range of attacks against web applications HTTP traffic monitoring Real-time analysis Maintained by Breach Security Apache Software License v2 Commercial licenses available with support contracts 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

Deployment Options Embedded into existing web server Apache module and directives Other web server ports in the works Network-based deployment Apache-based reverse proxy Protects any number of web, application, and database servers Apache is the what ModSecurity was developed for. It is built as a standard Apache module and has a entire library of directives. Some of the ports include ModSecurity for Java, Nginx, Oracle and Microsoft platforms. Otherwise network-based deployment is an option. This can be done using an Apache-based proxy. 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

ModSecurity Rules Bundled with Open Web Application Security Project (OWASP) Core Rules Provide generic protection from unknown vulnerabilities found in web applications Well documented for step-by-step deployment Updated from project website Several rules are regular expressions Commercial Rules available from Trustware SpiderLabs 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

Core Rules Content Provide generic web application protection: HTTP Protection Real-time Blacklist Lookups Web-based Malware Detection HTTP Denial of Service Protections Common Web Attacks Protection Automation Detection Integration with AV Scanning for File Uploads Tracking Sensitive Data Trojan Protection Identification of Application Defects Error Detection and Hiding HTTP Protection – detects violations of the HTTP protocol Real-time Blacklist Lookups – utilizes 3rd party IP Reputation Web-based Malware Detection – identifies malicious web content by checking against Google Safe Browsing API HTTP Denial of Service Protections – defends against HTTP Flooding and Slow HTTP DoS Attacks Common Web Attacks Protection – detects common web application security attack Automation Detection – Detects bots, crawlers, scanners and other surface malicious activity Integration with AV Scanning for File Uploads – detects malicious file uploads Tracking Sensitive Data – tracks credit card usage and blocks leakage Trojan Protection – detects access to Trojan horses Identification of Application Defects – alerts on application misconfigurations Error Detection and Hiding – disguises error messages sent by the server 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

Potential Problems May introduce false positives Example: CS5260 Midterm Exam Vulnerable to Regular expression Denial of Service (ReDoS) attack A ReDoS attack is when a regular expression implementation reaches extreme situations that cause them to work very slowly. This can grow exponentially related to input size. 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

Regular Expression DoS Problematic Regex naïve algorithm Build Nondeterministic Finite Automata (NFA) Transition until end of input Several “next” states Deterministic algorithms to get to all states Regex: ^(a+)+$ Payload: aaaaX 24=16 paths Payload: aaaaaaaaaaaaaaaaX 216=655536 From Checkmarx Source Code Analysis Technologies slides in the PDF. A NFA is a finite state machine where each pair of state and input symbol there may be several possible next states. 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

Evil Regular Expressions Regex is “evil” if it gets stuck on crafted input Pattern Contains: Grouping with repetition Inside the repeating group Repetition Alternation with overlapping 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

Evil Regex Examples Examples (a+)+ ([a-zA-Z]+)* (a|aa)+ (a|a?)+ (.*a){x} | for x > 10 Payload*: “aaaaaaaaaaaaaaaaaaaaaaaa!” *payload length depends on pattern and system used All the above are susceptible to the input payload. 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

CS5260 Midterm Exam Critical Messages “/etc/” causing WEB_ATTACK/FILE_INJECTION “content” causing WEB_ATTACK/XSS “ having t” causing WEB_ATTACK/SQLI 403 Access Denied returned when “Anomaly Score Exceeded” Mystery Error Rule execution error - PCRE limits exceeded (-8): (null) Possible ReDoS Protection? PCRE stands for Perl Compatible Regular Expressions. PCRE is a library written in C to support Perl-based regular expressions without the need for Perl. Known application that use PCRE are PHP, Postfix, and Nmap. 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

PCRE Limits Many forums suggested increasing the default value from 1000 to 150,000 2.5.12 Release Notes indicate that PCRE was reduced impact of ReDoS on poorly written regex rules 2.5.13 “bug” addressed to indicate which rule PCRE limit was exceeded 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

Conclusions ModSecurity is a viable solution for securing web servers and/or acting a reverse proxy ReDoS attacks appear to be mitigated using PCRE limits when evaluating regular expressions 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

Questions? 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

References ModSecurity Apache Documentation, http://www.modsecurity.org/documentation/modsecurity-apache/2.5.0/html-multipage/introduction.html#N10024 ApacheCon Europe ‘08 ModSecurity, http://www.modsecurity.org/documentation/ApacheCon_Europe_2008-Web_Intrusion_Detection_with_ModSecurity.pdf OWASP Core Rule Set, https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project Regular Expression DoS, by Alex Roichman and Adar Weidamn, 2009. https://www.owasp.org/images/3/38/20091210_VAC-REGEX_DOS-Adar_Weidman.pdf ModSecurity 2.5.12 Release Notes, http://www.apachelounge.com/viewtopic.php?t=3389 PCRE Issue, https://www.modsecurity.org/tracker/browse/MODSEC-135 11/15/2018 CS6910 Spring 2012 - Shane Jahnke

Speaker: Shane Jahnke CS 6910 – Advanced System Security & Design ModSecurity Speaker: Shane Jahnke CS 6910 – Advanced System Security & Design