Security Attacks

1. Security Attacks CS 795

2. Buffer Overflow Problem • Buffer overflows can be triggered by inputs that are designed to execute code, or alter the way the program operates. This may result in erratic program behavior, including memory access errors, incorrect results, a crash, or a breach of system security. Thus, they are the basis of many software vulnerabilities and can be maliciously exploited. • Programming languages commonly associated with buffer overflows include C and C++, which provide no built-in protection against accessing or overwriting data in any part of memory and do not automatically check that data written to an array (the built-in buffer type) is within the boundaries of that array. Bounds checking can prevent buffer overflows. • Video: https://www.youtube.com/watch?v=iZTilLGAcFQ • Buffer overflow • Analysis of Buffer Overflow Attacks

3. General Guidelines For all user input, follow these guidelines: • Use validation controls whenever possible to limit user input to acceptable values. • Always be sure that the value of the IsValid property is true before running your server code. A value of false means that one or more validation controls have failed a validation check. • Always perform server-side validation even if the browser is also performing client-side validation, to guard against users bypassing client-side validation. Do not use only client-side validation logic. • Always re-validate user input in the business layer of your application. Do not rely on the calling process to provide safe data.

4. SQL Injection Attacks A SQL injection attack attempts to compromise your database (and potentially the computer on which the database is running) by creating SQL commands that are executed instead of, or in addition to, the commands that you have built into your application. • Stop SQL Injection Attacks Before They Stop You • SQL Injection attacks: Are you safe? • Manipulating Microsoft SQL Server Using SQL Injection To avoid SQL injection attacks, follow these guidelines: * Do not create SQL commands by concatenating strings together, especially strings that include input from users. Instead, use parameterized queries or stored procedures. * If you are creating a parameterized query, use parameter objects to establish the values for the parameters.

5. Script Injection Attack • Script injection   A script injection attack attempts to send executable script to your application with the intent of having other users run it. A typical script injection attack sends script to a page that stores the script in a database, so that another user who views the data inadvertently runs the code. • http://www.asp.net/mvc/videos/mvc-2/how-do-i/preventing-javascript-injection-attacks • Video: https://www.youtube.com/watch?v=dbcO97ZHy9Q • Securing Data Access

6. Script Injection To avoid script injection attacks, follow these guidelines: * Encode user input with the HtmlEncode method, which turns HTML into its text representation (for example, <b> becomes &ltb&gt;), and helps prevent the markup from being executed in a browser. * When using parameter objects to pass user input to a query, add handlers for the data source control's pre-query events and perform the encoding in those events. For example, handle the SqlDataSource control's Inserting event, and in the event, encode the parameter value before the query is executed. * If you are using the GridView control with bound fields, set the BoundField object's HtmlEncode property to true. This causes the GridView control to encode user input when the row is in edit mode. * For controls that can be put into edit mode, it is recommended that you use templates. For example, the GridView, DetailsView, FormView, DataList, and Login controls can display editable text boxes. However, except for the GridView control (see the previous point), the controls do not automatically validate or HTML-encode the user input. Therefore, it is recommended that you create templates for these controls, and in the template, include an input control such as a TextBox control and add a validation control. In addition, when extracting the value of the control, you should encode it.

7. Cross-site Scripting Attack • Video: https://www.youtube.com/watch?v=_Z9RQSnf8-g • Video: https://www.youtube.com/watch?v=r79ozjCL7DA • http://www.acunetix.com/websitesecurity/xss.htm • http://www.cgisecurity.com/xss-faq.html • http://www.imperva.com/resources/glossary/cross_site_scripting.html • Cross-Site Scripting Vulnerabilities • Cross site scripting / XSS - How to find & fix it