ColdFusion Security Michael Smith President TeraTech, Inc ColdFusion, Database & VB custom development

Introduction n ColdFusion security n Keeping hackers out n While still letting users and friendly apps in

ColdFusion Security Here is what we will be covering: n System software u OS-> FW -> WS -> DB -> CF n Page parameter validation n User Authentication n Security Resources

1.1 System software n a) Operating System/Webserver  Delete guest and administrator NT server userids (create a user name for administrator)  Get latest Service Packs  Patch ::$DATA and %20 source holes  Use IIS or Website directory security, possibly with CFAuth too.  Clean up the /CGI-BIN directory - dangerous sample scripts

1.2 System software n b) Database  Store database in separate directory from web root or PC.  Move from Access to SQL server – better security features  user ids and passwords that are hard to guess  Delete guest and sa userids  Only give the read/update/delete rights that you need.  Use stored procedures

1.3 System software n c) Firewall  Keeps bad IP packets out  By default keep it out  Prevents hackers from moving from machine to machine  Only open ports that are required - eg for SQL server  Prevent/Record Denial of Service  Proxy access to HTTP  Can get in way of development

1.4 System software n d) ColdFusion  Remove CFDOC dir from live servers  Remove Start/Stop page  Turn off CFDIRECTORY, CFFILE, CFCONTENT, CFOBJECT  Remove any unused CFX and CF tags  Use a dedicated server

2: Page Validation n URL and Form parameters used in SQL u SELECT * FROM EMP WHERE ID = #USERID# u Extra SQL commands 0FROM%20MyCustomerTable u | VBA functions - shell() n Use VAL() on parameters or check for ‘ and | n Encrypt Variables

3.1: Authentication n Stateless web - any page can call another - this is good for open sites n Hacker pages call your page with false data n Use CGI. HTTP_REFERER to control who calls you n Use CGI. CF_TEMPLATE_PATH application.cfm control what is run. n Encrypting code n NT auth or LDAP

3.2: Authentication u Protected Header code In your application.cfm or header.cfm to be included in every page. Your protected links here

3.3: Error handling n Never display default CF errors - gives out SQL information n error to admin n Don’t explain why attempt failed n Standard processing time

4: Resources n ecurityzone/ n Tools you could use to analyze your NT servers u u n NTSecurity

Real Hacks n This spring several commercial ColdFusion sites were hacked or shutdown due to the CFDOCs hole. n Security is hard because a hacker only needs one window to be open to get in while the poor webmaster must work on closing dozens of holes.

What Security Means n Security is a way of thinking - how can they get in... n Get patches and read security bulletins - today’s secure system may be tomorrow's hack! n More knowledge is power - don’t keep security secret!

Next Steps n Conduct a security audit u Download Michael Dinowitz’s MunchkinLand.cfm to test your site for holes u Remove CFDOCS n Change database configuration and passwords n Validate pages n Authenticate pages