Web App Scanners Miss Half of Vulnerabilities 68
seek3r sends news of a recent test of six web application security scanning products, in which the scanners missed an average of 49% of the vulnerabilities known to be on the test sites. Here is a PDF of the report. The irony is that the test pitted each scanner against the public test files of all the scanners. This reader adds, "Is it any wonder that being PCI compliant is meaningless from a security point of view? You can perform a Web app scan, check the box on your PCI audit, and still have the security posture of Swiss cheese on your Web app!" "NTOSpider found over twice as many vulnerabilities as the average competitor having a 94% accuracy rating, with Hailstorm having the second best rating of 62%, but only after extensive training by an expert. Appscan had the second best 'Point and Shoot' rating of 55% and the rest averaged 39%."
Not a surprise to me. (Score:5, Insightful)
> Web App Scanners Miss Half of Vulnerabilities
Well this is no surprise to me. Designing/testing secure systems is much more than scanning for vulnerabilities.
Scanning is only one of the tool to use to accomplish the goal.
Web apps make it so easy to be insecure. (Score:3, Insightful)
The web was clearly never designed to do even a fraction of what it is expected to do today. Now, neither were computers. But at least when it comes to hardware, we're willing to throw everything away and start from scratch. We don't seem able to do that with the web.
Basically everything about the web today is just one dirty hack upon another bunch of dirty hacks. SSL and TLS are a good example. JavaScript is another. Everything built on top of JavaScript, such as AJAX, is a huge hack. So it's no wonder tha
Re: (Score:2)
Slow down man ! ;-) One step at the time, I suggest that you start with this:
http://news.slashdot.org/comments.pl?sid=1540138&cid=31047988 [slashdot.org]
Re: (Score:1, Funny)
Even after well over a decade, PHP still makes is too damn easy to write code.
fixed that for you....
Re: (Score:3, Insightful)
It gets really annoying listening to people bash php when the primary attack vector is "programmers" who don't know how to code secure applications. SQL queries written via concatenation is 100%, absolutely 100% the fault of shitty coders, and has nothing, *nothing* t
Re: (Score:2)
I too am sick of PHP getting bashed all the time...And yes I'm a web developer who writes in PHP...
It's easy to write secure code and get the job done and I prefer it because it reminds me of C (my second language of choice).
Yes a lot of people write bad code in PHP, and I've seen my fair share of that...also a lot of people write freaking dangerous code in C.
Should we bash C for making overflows so easy a pitfall?
Because I've
Re: (Score:2)
Meh, well including myself, most ADO.Net programmers use parameterized queries because thats what Visual Studio spoon-feeds you. Nothing wrong with that. In PHP i'll concat to my hearts content in a text editor. Does PHP have an IDE that provides the same functionality (really, I don't know).
In the hands of the capable, either are worthwhile languages. What really gets you is when you don't first sanitize your inputs. You can screw that up in any language :-)
Re:The way we learn languages is the problem (Score:4, Interesting)
I'm going to take issue with this and say the problem is with the internet itself, RAD applications, businesses, and self-taught coders. Allow me to explain.
Half of the .NET code I write is copy/pasted from some other source, because the entire CLR is too complicated for a single person to understand. If I want to do a lookup table, there are a dozen ways to accomplish it, just using the objects provided by the runtime. I don't care how fast it is, unless it's called every page view, so I just google "C# lookup" and get piles of examples. Copy/paste, I'm done. Doesn't matter if it's from MSDN or a Microsoft blog or a random coder blog or wherever else, the code looks good and it works. I have no idea if the example failed to initialize some critical component.
My employer doesn't want to pay me to read, I am supposed to be providing output they can sell to clients/customers. So I don't get a lot of time set aside for training. The way I learned .NET was our tech lead opened up a team meeting and said "I think .NET is the way of the future, is there anyone opposed to going this way?" And the only real objection was it will take longer to produce the next version of our deliverables. Management was fine with that, so we took the leap.
We didn't sit down in a classroom and learn how things are supposed to be done. We didn't get a copy of something like Petzold's Windows bible, or Prosise MFC bible where it goes into depth about what you're doing and what things mean when the IDE puts junk in places for you. Visual Studio 2003 and above make it very easy for you to have no idea what you're doing, and still accomplish something. A quick google search can fill in all of the gaps so you have something functional.
The same with 'Learn X in 24 hours' or 'X for dummies', lots of code samples exclude error checking/handling. Oh yes, MSDN is full of these examples. Sometimes they suggest "error handling has been omitted for clarity", while sometimes it's just assumed. Other times the author has no idea they should be handling errors because it works for them.
So you have piles of coders learning on-the-fly, either because they can't afford the big book or because they have deadlines to meet. Copy/paste something without taking the time to fully understand what's happening, and you get potential problems. In short, easy access to code snippets makes you think you're able to do lots of cool stuff in a new language. Unless you take the time to understand everything you're running, every line of code, you're going to have problems at some point.
Why do you think people still make mistakes like putting form variables directly into SQL? The code snippets are out there, either in the corporate source control or on random blogs. Copy, paste, pwned.
An example, for those of you who wish to tl;dr me you can stop now.
I used MyGeneration templates to come up with database calls for our SQL database, which used Data Access Blocks or some kind of MS best practice to write functions which called stored procedures, so you could essentialy call stored procs exactly like any other function. It generates a call for every stored proc in the database, so you can make fundamental changes to the data structure, re-generate the data access library in a few seconds, and then fix the few calls where the parameters changed.
Very handy, except that the 'execute non-query' template had a bug in it, where the data connection never closed. We never had any problems with this app in production for 3 years. Suddenly in testing, we got a pooled connection exceeded timeout. Turns out the bug only shows up when the call happens most page views, when logging user visits in this case. Other non-query calls happened infrequently enough that they never exceeded the 100 connection default limit, live and in production for 3 years.
Our tech lead found MyGeneration, recommended it, and we used it ever since. Not until last month di
Re: (Score:2)
I wouldn't get a job there because they flat out wouldn't pay what I'm worth. You want someone who understands .NET completely, you're paying a lot more than for someone who "can code" in .NET. It is possible, but expensive, and that's my point.
The expense of learning has to be paid by one of:
The employee, raising the minimum salary the employee will accept
The new employer, raising expenses in the form of providing time set aside for training
The previous employer, by allowing the employee to fit in traini
Re: (Score:3, Informative)
Basically everything about the web today is just one dirty hack upon another bunch of dirty hacks. SSL and TLS are a good example. JavaScript is another. Everything built on top of JavaScript, such as AJAX, is a huge hack. So it's no wonder that it's so damn easy to write insecure web apps.
<Sarcasm>
...
Basically everything about the Internet today is just one dirty hack upon another bunch of dirty hacks. Ethernet and IP are good examples. TCP is another. Everything that does not limit itself inside a single OSI layer, such as PPPoE, all kinds of VPN and NAT, are huge hacks. So it's no wonder it's so damn easy to exploit remote machines over the Internet.
We need to throw it all away. Everyone routinely do this with their plastic bags. We now need to extend that practice to all Intern
Re:Web apps make it so easy to be insecure. (Score:5, Interesting)
Is that why I'm using a pipelined, out-of-order implementation of a 64-bit extension to a 32-bit extension of a 16-bit ISA?
I mean, shit, my Core 2 Duo supports everything from 128-bit vector instructions to segmented addressing. I have USB and PCI Express busses on my ThinkPad, but also CardBus/PCMCIA and a modem. I have Gigabit Ethernet but it is still compatible with 10Base-T. I have a DVI port (through the dock) but also a VGA port. My DVD-RW will read CDs which are 30 years old.
Re: (Score:1)
Every system is different (Score:2)
Take buffer overflows for example. You can build a generic tool to create buffer overflows by feeding in long messages but there is no generic way to exploit the overflow, because every system arranges its data differently.
BTW there is a typo in the summary pitted eah scanner
Re: (Score:3, Funny)
When I first quickly ran through the summary I read that as "I pity the scanner". After re-reading the summary it seems appropriate.
Re: (Score:2)
> I read that as "I pity the scanner".
Because they live in vain?
Re: (Score:2)
So we should probably be thankful that "web app scanners catch half of vulnerabilities".
Re: (Score:2)
> buffer overflows for example
What do you mean ? The platform we use checks for array/buffer bounds on any access to them. We also use a persistence tool that is pretty good at preventing SQL injections.
It sure beats scanning on the efficiency level ;-))
Re: (Score:2)
SQL injection is only one half of web security, though. The other big threat Cross Site Scripting/Request Forgery.
Output filtering is a lot harder to keep track of than database queries (even with a good templating system) since data must be filtered in different ways: Some stuff may contain any markup including document-level elements, script/stylesheet inclusion, other data may only contain local formatting markup (emphasis, etc.) and still other stuff has to be escaped entirely...
The cat and mouse game. (Score:3, Interesting)
No vulnerability scanner will ever detect 100% of the vulnerabilities possible. They're still very useful, however, because no website is going to have 100% of all the vulnerabilities possible.
Think of it another way. If your website has only 1 vulnerability and the scanner detects it, then it's 100% effective.
If your website has only 1 vulnerability and no scanner detects, score 1 for the bad guys. The cat and mouse game continues.
Re: (Score:1)
If your website has only 1 vulnerability and no scanner detects, then it's 100% ineffective. The cat and mouse game continues.
FTFY
Re: (Score:2)
Let's say 50 years later RSA is found to be completely insecure. So mathematically anything based on RSA, depending on RSA or containing RSA has at least 1 vulnerability. Yet today it's impossible for any security scanner to tell whether somebody's SSL has that particular vulnerability or not. But as it stands, as long as that vulnerability is not known by anyone, nobody can exploit it. So you can't say the security scanner is n% ineffective because it doesn't detect a vulnerability.
Beside
Re: (Score:3, Insightful)
> If your website has only 1 vulnerability and no scanner detects, score 1 for the bad guys.
except that the "bad guys" mostly use scanners to discover holes ;-))
So interestingly enough, holes detectable with scanners are more exploited.
Re:The cat and mouse game. (Score:4, Informative)
From what I recall doing this for sites that handled credit card processing (me being in the tested side), those tests are pretty much worthless.
If you had 1 vulnerability, you'd get pages of false positives or irrelevant information. I recall a particular 10 page report we got back that we were advised to fix or we'd fail on. The only item to fix was the version of the web server was just one behind current. The changelog indicated that it was to fix a vulnerability on a different platform, so it was completely unrelated to us. We'd frequently have points marked off because we couldn't be pinged or portscanned. I'd have to open the firewall up to them, just to be scanned. Our security would identify an attempted port scan as a hostile action, and react by dropping all traffic from them. Sorry my security stopped your scanning, but that's the intention of it. {sigh}
After opening the firewall to them, and changing the version number on the web server (there were reasons we couldn't do the trivial upgrade), we passed with flying colors.
For them, they were interested in the version numbers handed off by the server, not what they actually were. For example, if it was Apache, we could have it report Apache version 9.9.9, and that would have made us pass on that part without fail for years.
Re: (Score:2)
Re: (Score:2)
You're very correct on that.
For a while, I was doing that with a few things, including Apache and the Linux kernel. There were pieces I needed that didn't progress, so I handled my own backporting of various things. That was a long time ago, and those problems were resolved in more current versions, so it hasn't been necessary for years.
But, if you're using say mod_ssl to handle your SSL on Apache, and you're still in the 1.3.x tree, you'd now be scored down. A
Re:The cat and mouse game. (Score:4, Insightful)
I had a chance to see the outputs of a few of these scanners run against a particular open source content management system. Not one of them found an actual, confirmable vulnerability. But one found over 9,000 false positives. All found a fair number of false positives. Even if could find real vulnerabilities, digging though all those false positives to find a real one is a really daunting task.
What I find works better than these scanners is hand audits by someone who knows what they are looking for. It's most definitely an intensive task, but let me ask you. What's more a better use of time, an expert doing a hand audit who may find vulnerabilities that the scanner didn't), or the expert digging through all 9000 of those "results" trying to figure which, if any, are real? I assert that the best use is going to be a combination of the two. Just don't put your faith in either one...
Re: (Score:2)
Any scanner that returned over 9,000 false positives is clearly a joke. So you ignore it and run a better scanner.
I've dealt with scans for credit card purposes and for the most part I thought they were pretty good. Yes, there was the occasional false positive. So you provide some explanatory information and then you get passed. False positives are preferable to false negatives.
It's simply unrealistic to expect these scans to yield perfect results. Despite that, I believe they're useful.
Whitehat Security (Score:1)
Re:Whitehat Security (Score:5, Funny)
> There seems to be a little bit of a disconnect between the sales force and the operations team
No kidding, I can't believe that such a company exists ;-)))
Re: (Score:2)
"their", "Their", "THEIR"!
Sorry, my annoyance level kept rising each time I saw it. Had to scream it in CAPS.
Re: (Score:1)
Re: (Score:1)
Its best if you loose you're anger.
PCI compliant is meaningless? (Score:1)
"Is it any wonder that being PCI compliant is meaningless from a security point of view?"
Where's that quote from? I can't find it on either the page or in the PDF...
Re: (Score:3, Informative)
Where's that quote from? I can't find it on either the page or in the PDF...
It's the submitter's opinion. And it's quite accurate: no such standardized set of requirements can guarantee security, because security is much more complicated than the simple kinds of rules that you can include in them. PCI compliance gives the illusion of security where it may well not actually exist at all.
Re: (Score:1)
And it's quite accurate: nothing can guarantee security.
FTFY. There is no perfect security. I don't know anyone that says PCI compliance guarantees you are secure. But it is an indication of the controls you have in place protecting cardholder data.
For instance, hiring a licensed, bonded plumber doesn't guarantee they won't screw something up. But your chances of a good outcome are a lot better.
Re: (Score:1)
Try a little harder, the attribution is just before it (apparently that is the submitters opinion).
PCI Still Important (Score:4, Interesting)
The key message here is that simply testing your web site with a vulnerability scanner doesn't make it secure. Well, duh.
PCI is still important because before the guidelines, most people weren't scanning their web sites at all. Even when they knew how - they couldn't convince management it was worth the trouble, time, dollars, and so on. And without scans, the number of discovered web vulnerabilities approaches 0%.
PCI isn't just about scanning your website, either. There's hundreds of things you have to do to secure everything from the physical layer up to the application layer. And having PCI be required to process credit cards makes everything much more secure. I'm talking about small businesses so cheap they don't want to put LOCKS on the doors between the outside world and the servers holding your plain-text, unencrypted credit card numbers, and who don't have the expertise to set up a web camera on their own building.
You might not like PCI, it might be inconvenient, but it's necessary to protect the general public.
Disclaimer: I am an information security professional.
Re:PCI Still Important (Score:4, Interesting)
You might not like PCI
The only thing I don't like about PCI is the acronym they chose.
Re: (Score:1, Interesting)
Scanning vendors are quite good at discovering non-issues such as the availability of "weak" SSL ciphers and known problems in technology stacks. They are unfortunately useless when it comes to discovery of application level security problems.
Its all just a big scam where people pay lots of money to companies who mis-represent actual PCI compliance requirements, hit their servers with Nessus and print out a security audit pass certificate the company can hang on their wall. Its about as useful and seedy a
scanners == scammers (Score:2)
A vendor will sell you, or often give you a free trial of, their vulnerability scanning tool. They will then turn right around and sell you a tool that is supposed to fix those problems. Does anyone else see a problem with that? One reason I prefer the FOSS tools going back to Nmap and SATAN is that they do what real intruders try to do, not what some marketing department wants them to do as a way to scare you into buying stuff.
Being "compliant" with a standard is meaningless (Score:2)
At least when it comes to security. By the time any standard is published and a test suit is assembled, the whole threat scenario has changed by 180 degrees. We're dealing here with an industry that has a half-life period of its knowledge of about 3 months. Not the usual 2-3 years anywhere else in IT.
Don't be compliant. Either get up to speed with curent security problems or hire someone who does. Standards are worth jack, at least from a security point of view (they're still quite valuable to get contracts
Re: (Score:2)
Don't be compliant.
How stupid is this? PCI is a set of minimum requirements. It is all stuff that any competent admin would have done even without the standard. If you are as cool, as you apparently think you are, you will be compliant with zero work.
Re: (Score:2)
Ok, maybe I should have written "don't try to be compliant, try to be secure". I thought I'd get a reply like that one right the moment I hit submit...
Yeah, yeah, I'll use preview more now, promised.
What I wanted to express is that managers usually don't care for security. The ONLY reason my last company finally implemented bare minimum security was that they needed a certificate to get a fat contract. There was literally no other motivation for them. And, again, they only did the bare minimum of what was e
missed the point (Score:2)
This guy is trying to hype his own findings a bit too much. Removing half of the vulnerabilities is actually really good! If you happen to remove the vulnerability that some mass-defacement takes advantage of, you really did ad a lot of value by using the imperfect scanning tool.
One of the most common and least helpful fallacies about security is that something is either secure or it is not. Nothing is 100% secure. Removing half of the vulnerabilities is a huge improvement over removing none.
App scanners don't make you secure (Score:2, Insightful)
Scanners exist because people want scanners, and so people can sell a product labelled "security scanner". And get a feel-good (false) sense that everything is secure when the scanner reports no issues.
This idea started with the general idea of vulnerability scanner, tools designed to scan hosts for open ports, check software versions, and try exploits against known issues.
The problem with all of them is they can only detect anticipated vulnerabilities.
Unknown vulnerabilities are not properly detect
Re: (Score:2)
A quicker fix would be to get the vendors to share their corpus of vulnerabilities, probably through the Owasp group. That way at least, they'd all get a complete picture of vulnerabilities to scan for, and they might improve. Right now, it seems the resources applied to getting the vulnerabilities in are so minute, compared to the amounts of effort performed by two groups:
a) hackers trying to find vulnerabilities that had been unknown before
b) the people paying for their service's expectations(I used to
Simple fix: double the reported value (Score:3, Funny)
What is it about again? (Score:1)
I read TFA because summary does not make sense only to find out that TFA does not make sense.
"Hold still while we scan you" (Score:3, Informative)
My favorite from a past employer - one of these PCI scanning companies asked us to take down our iptables rules for a set time period while they scanned us. That's right, they wanted us to be less secure while they checked how secure we were.
We were eventually able to get an ip range from them, but not until we fought them a bit. They *would not* do the scan unless we took down our firewall. I wanted to just REJECT everything but 80 and 443 and not tell them, but the higher-ups told me to play along.
Anyway - the whole idea felt really ... wrong. And they didn't point out anything useful, either.
Re: (Score:2)
Well, I can sorta see their point in saying 'You have to give us the permissions of the least restrictive IP you have'.
But it's actually still dumb. The only IPs in my firewalls (Besides the mail server which has temp blocks for spammers) are the IPs of my other servers, so I can restrict specific things to them.
The only two that I can think of are access to the mysql port (So other servers can use a database), and access to a special mail submission port without any other security on it. (So my web serve
firewall was down (Score:2)
The Six Dumbest Ideas in Computer Security [ranum.com]
Let me introduce you to the six dumbest ideas in computer security. What are they? They're the anti-good ideas. They're the braindamage that makes your $100,000 ASIC-based turbo-stateful packet-mulching firewall transparent to hackers. Where do anti-good ideas come from? They
one of these PCI scanning companies (Score:2)
> one of these PCI scanning companies asked us to take down our iptables rules for a set time period while they scanned us
Can you gave examples of companies that scan companies in the manner you describe. My understanding is that to achieve PCI compliance, you fill in a bunch of forms. I mean Heartland Payment Systems were PCI compliance, and look what happened to them.
and, again, this is only against their own tests (Score:2)
being PCI compliant is meaningless (Score:2)
> being PCI compliant is meaningless from a security point of view? You can perform a Web app scan, check the box on your PCI audit, and still have the security posture of Swiss cheese on your Web app!"
Print this out and stick it on the wall, for the next time your PHB starts waffling on about compliance .. :)