Nilesh Kumar

As a part of security assessment of cloud based apps/ infrastructure we always face a challenge in scanning the servers in the cloud. Few of them are: Obtaining/ managing credentials always an headache Not ideal for cloud solutions Requires target machines to be always online The limitations of the scanners: Traditional infrastructure scanners  such as Nessus are of not much use Sometimes the scanners does not report  vulnerabilities correctly due to many issues such as machines frequently go down while scan is in process, some firewall issues etc We need a solution which is rather than we scanning the target servers, it resides on the server and keep doing the scanning and sends the report back to the organization periodically. And here comes the concept of 'Agent based clod scanning'.  The benefits are: Rather than targeting the remote servers in the traditional approach, the agents installed on the servers keep on doing the scans and sends the peri...

Among many authentication modes for accessing resources over cloud, such as traditional authentication such as credentials, or muti-factor authentication, such as hardware tokens; the biggest issue is that they can be stolen, or mimicked. The traditional solutions available in market are mimicable and not fool proof, the hardware tokens, passwords etc. are easy to compromise. Also, the traditional approach towards the authentication process- first authentication via user credentials then use of any other mode of authentication such as hardware token- increases the attack surface. How about reversing the above approach- first people who can prove who they are (Biometric) only can access the Login page. This will decrease the risk significantly as the login page will be available to a very few set of people rather than whole bunch. So the steps are: Biometric authentication- adding ‘what- you- are- factor’ Raises the security bar to the highest level Challenging the tradition...

So, how does PCI-DSS affects our web application security testing or what to make sure the application is compliant with PCI, while doing the security testing. Here are few requirements which needs to be taken case while testing a web application which handles financial data such as credit card information. As the PCI guidelines itself maintains that the application must be tested on regular basis in "Requirement 11: Regularly test security systems and processes." But what should really we look for? The requirement 11 is tied back to other requirements Requirement 6.: 11.2.1 Perform quarterly internal vulnerability scans and rescans as needed, until all “high-risk” vulnerabilities (as identified in Requirement 6.1 ) are resolved. Scans must be performed by qualified personnel. 11.2.3 Perform internal and external scans, and rescans as needed, after any significant change. Scans must be performed by qualified personnel. 11.3 Implement a methodology for penetration t...

There could be some instances where in you need to scan your Android devices with scanners such as Nessus etc to look for insecure/ unnecessary ports, services and misconfigurations. There are two types of scanning- unauthenticated scan and authenticated scan. Unauthenticated scans are preatty simple, just provide the IP of the target to be scanned, but in case of an authenticated scan which is more comprehensive, you need to have some valid account created on the target device. So, how to run an authenticated scan on Android device? We don't have any IS level account on it. One way to accomplish this is to create an ssh server on the device. Once the server is installed, it is very basic to run ssh commands remotely such as we do using Putty. The steps are following: 1. Go ahead and download, install an ssh server. ssh servers such as SSHDroid, SSHelper etc can be installed. They can be installed via Google Play. One is here: https://play.google.com/store/apps/details?id=...

It's a very trivial mistake a lot of developers do. They don't pay much attention to this simple looking misconfigurations which can be a big risk to apps. Generally they put much attention on other best practices such as intents, permissions etc, but tend to ignore the debuggable and allowbackup settings. I came across various such mistakes. The app is debuggable, which means we can attach a debugger to the process and step through every single instruction and even execute arbitrary code in the context of app process. Similarly, allowbackup is used to determine if to allow the application to participate in the backup and restore infrastructure. This leads to potential data leakage. If not required, harden the configuration file by setting the values= “False” Reference: developer.android.com/guide/topics/manifest/application-element.html

This is a tricky situation as you can't see the page source to look for the tags such as embed etc. All you see is the entire page loads as Flash content and plugins like InspectElement will not work. I came across the similar scenario. So, this is how we can sort out this issue. Every browser has flash plugins to display flash contents in the browser itself. So, if we disable the plugin the browser won't be able to display it within and will attempt to download it on harddisk, which can be used for security analysis. Here how to do in case of Chrome. Just disable the plugin from the browser:

Where Wireshark fails, this great tool comes into rescue. Just came across it, wanted to share. It can sniff any interface that has got an IP address, including 127.0.0.1 (localhost/loopback): http://www.netresec.com/?page=Blog&month=2011-04&post=RawCap-sniffer-for-Windows-released