Web & Cloud Security in the real world
•Download as PPTX, PDF•
3 likes•1,539 views
Presented as a keynote speaker at Dayananda Sagar College and event conducted by CompTIA.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Web & Cloud Security in the real world
Similar to Web & Cloud Security in the real world (20)
Recently uploaded
Recently uploaded (20)
Web & Cloud Security in the real world
- 1. Web & Cloud Security in the Real World Madhu Akula @madhuakula
- 2. Madhu Akula - Profile • Information Security Researcher • Chapter Lead & Speaker null • Acknowledged by US Department of Homeland Security. • Found bugs in Google, Microsoft, Yahoo, Adobe … etc. • Open Source Contributor • Interested in Automation & DevOps • Never ending learner ! www.madhuakula.com
- 3. This is for educational purpose only, I am not responsible for any illegal activities done by any one.
- 4. Let’s talk about Social Engineering
- 6. Fake Emails
- 7. Demo
- 8. Data Breaches in Wild http://www.idtheftcenter.org/ITRC-Surveys-
- 11. Common Web Attacks • Cross Site Scripting (XSS) • SQL Injection • Information Disclosure • Remote Code Execution Recent : • Cross Site Port Attacks • Reflected File Download • Etc…
- 12. SQL Injection • SQL Injection is one of the most used vectors when malicious people want to create a new botnet. • SQL injection occurs when untrusted data is sent to an interpreter as part of a command • It causes attacker to take control over the database
- 13. • SQL Injection Attack • Number plate to foil an automatic license plate scanner ! • An attack which allows SQL to be executed as part of the input
- 15. Cross Site Scripting • XSS flaw occurs whenever an application takes untrusted data and sends it to a web browser without proper validation and escaping. • XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect user to malicious sites.
- 16. Example • One of the most in-famous example is the MySpace Samy worm. In less than a day he got more a million friends and MySpace had to be shutdown. • A XSS bug occurring on the website registration page can enable theft of registration details. • There are many exploitation frameworks for this vulnerability like BEEF, Xenotics, etc.
- 17. Information Disclosure • Good security requires having a secure configuration defined and deployed for the applications, frameworks, application server, web server, database server, and platform.
- 18. Example Network Solutions were offering wordpress installation on a shared server. The main configuration file wp- config.php was world readable. It causes Mass hack of wordpress based websites.
- 19. Remote Code Execution An attacker's ability to execute any commands of the attacker's choice on a target machine or in a target process.
- 20. Recent Popular Zero Days • Java Deserialization Vulnerability • Venom Vulnerability • Beast Vulnerability • Poodle Vulnerability • Heartbleed Vulnerability • Shell Shock Vulnerability • Etc SSL Related
- 21. Demo
- 22. Let’s talk about Cloud
- 24. Threats Service Provider vs On-Premise https://www.rackspace.com/knowledge_center/whitepaper/alert-logic-state-of-cloud-security-report-
- 25. App Insecurity Scenario • App has Local File Inclusion bug • The AWS root credentials are being used • They are stored in a world readable file on the server • Attacker reads the credentials and starts multiple large instances to mine bitcoins • Victim saddled with a massive bill at the end of the month http://www.slideshare.net/akashm/security-in-the-cloud-workshop-
- 26. Infra Insecurity Scenario • MySQL Production database is listening on external port • Developers work directly on production database and requires SQL Management Software • They log in using the root user of MySQL Database server and a simple password • Attacker runs a bruteforce script and cracks the password, gains full access to the database. http://www.slideshare.net/akashm/security-in-the-cloud-workshop-
- 31. Data Insecurity Scenario • Database is getting backed up regularly. • Due to performance reasons, database wasn’t encrypted when initial backups were done. • Dev team moves to newer type SSDs and doesn’t decommission older HDDs. • Attacker finds older HDDs, does forensics for data recovery and sell the data for profit. http://www.slideshare.net/akashm/security-in-the-cloud-workshop-
- 32. 10 Steps for Cloud • Enumerate all the network interfaces • List all the running services • Harden each service separately based on best practices. • Secure remote access for server management(SSH, RDP) • Check operating system patch levels
- 33. • Harden networking parameters of the kernel (Linux) • Enable a host firewall • Do an inventory all user accounts on the server and audit them • Enable centralized logging • Enable encryption on disks, storage, etc.
- 34. Missuses of Cloud (Recent Attacks) http://thehackernews.c om/
- 36. Resources • null – null.co.in • Security Tube – securitytube.net • OWASP – owasp.org • CSA – cloudsecurityalliance.org • Google – Google.com
- 37. My info while I answer your questions Madhu Akula Information Security Researcher www.madhuakula.com Twitter : @madhuakula madhu.akula@hotmail.com | +91-9676865642
Editor's Notes
- Fake Emails & Expiations and Secure Emails
- [Mrs. Roberts receives a call from her son's school.] Caller: Hi, This is your son's school. We're having some computer trouble. Mrs. Roberts: Oh, dear - did he break something? Caller: In a way – Caller: Did you really name your son Robert'); DROP TABLE Students;-- ? Mrs. Roberts: Oh, yes. Little Bobby Tables, we call him. Caller: Well, we've lost this year's student records. I hope you're happy. Mrs. Roberts: And I hope you've learned to sanitize your database inputs.
- XSS, Command Injection, Security Misconfiguration