This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

OWASP Automated Threats to Web Applications

From OWASP
Revision as of 17:59, 12 June 2015 by Clerkendweller (talk | contribs) (Use cases added)

Jump to: navigation, search
Automated-threats-header.jpg

Automated Threats to Web Applications

The OWASP Automated Threats to Web Applications Project has completed a review of reports, academic and other papers, news stories and vulnerability taxonomies/listings to identify, name and classify these scenarios – automated by software causing a divergence from accepted behavior producing one or more undesirable effects on a web application, but excluding tool-based exploitation of single-issue vulnerabilities.. The initial objective was to produce an ontology providing a common language for developers, architects, operators, business owners, security engineers, purchasers and suppliers/ vendors, to facilitate clear communication and help tackle the issues. The project also intends to identify symptoms, mitigations and controls in this problem area. Like all OWASP outputs, everything is free and published using an open source license.

Two page summary project briefing as a PDF.

Description

Web applications are subjected to unwanted automated usage – day in, day out. Often these events relate to misuse of inherent valid functionality, rather than the attempted exploitation of unmitigated vulnerabilities. Also, excessive misuse is commonly mistakenly reported as application denial-of-service (DoS) like HTTP-flooding, when in fact the DoS is a side-effect instead of the primary intent. Some examples commonly referred to are:

  • Account enumeration
  • Click fraud
  • Comment spam
  • Content scraping
  • Data aggregation
  • Email address harvesting
  • Fake account creation
  • Password cracking
  • Payment card testing
  • Site crawling
  • Transaction automation

Frequently these have sector-specific names. Most of these problems seen regularly by web application owners are not listed in any OWASP Top Ten or other top issue list. Furthermore, they are not enumerated or defined adequately in existing dictionaries. These factors have contributed to inadequate visibility, and an inconsistency in naming such threats, with a consequent lack of clarity in attempts to address the issues.

Without sharing a common language between devops, architects, business owners, security engineers, purchasers and suppliers/vendors, everyone has to make extra effort to communicate clearly. Misunderstandings can be costly. The adverse impacts affect the privacy and security of individuals as well as the security of the applications and related system components.

Licensing

All the materials are free to use. They are licensed under the Creative Commons Attribution-ShareAlike 3.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

© OWASP Foundation

What Is This?

Information and resources to help web application owners defend against automated threats

What Isn't It?

  • Another vulnerability list
  • Threat modelling
  • Attack trees
  • Non web
  • Non application

Project Objective

This project brings together research and analysis of real world automated attacks against web applications, to produce documentation to assist operators defend against these threats. Sector-specific guidance will be available.

Project Leader

Colin Watson

Contributors

Please help and your name can appear here. The project needs web application owner's threat information and reviewers.

Related Projects

News and Events

  • [12 Jun 2015] Draft briefing sheet published
  • [20 May 2015] Meeting at project summit in Amsterdam
  • [12 May 2015] Discussion document published
  • [27 Apr 2015] Final summary of research published
  • [21 Apr 2015] Notice in OWASP Connector
  • [21 Apr 2015] Web Application Owner Survey published
  • [04 Apr 2015] Bibliography published
  • [02 Apr 2015] Scope and definitions published
  • [27 Feb 2015] Work underway on research

Classifications

New projects.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png
Project Type Files DOC.jpg


Automated Threats to Web Applications

Threat events to web applications undertaken using automated actions.

An attack that can be achieved without the web is out of scope.

Glossary

Action
An act taken against an asset by a threat agent. Requires first that contact occurs between the asset and threat agent (Ref 1)
Application
Software that performs a business process i.e. not system software
A software program hosted by an information system (Ref 2)
Application layer
"Layer 7” in the OSI model (Ref 3) and “application layer” in the TCP/IP model (Ref 4)
Threat
Anything that is capable of acting in a manner resulting in harm to an asset and/or organization; for example, acts of God (weather, geological events, etc.); malicious actors; errors; failures (Ref 1)
Threat Agent
Any agent (e.g., object, substance, human, etc.) that is capable of acting against an asset in a manner that can result in harm (Ref 1)
Threat Event
Occurs when a threat agent acts against an asset (Ref 1)
Web
The World Wide Web (WWW, or simply Web) is an information space in which the items of interest, referred to as resources, are identified by global identifiers called Uniform Resource Identifiers (URI) (Ref 5)
The first three specifications for Web technologies defined URLs, HTTP, and HTML (Ref 6)
Web application
An application delivered over the web


Glossary references:

  1. Risk Taxonomy, Technical Standard, The Open Group, 2009
  2. NISTIR 7298 rev 2, NIST
  3. OSI model, Wikipedia
  4. TCP/IP model, Wikipedia
  5. Architecture of the World Wide Web, Volume One, W3C
  6. Help and FAQ, W3C

The following scenarios and organisation names are completely fictitious.

Defining application development security requirements

Cinnaminta SpA intends to build and launch a new multi-lingual and multi-currency ecommerce website. The development will be outsourced and Cinnaminta has been working on the functional design document. Amongst many other requirements, the application security specification requires that the website must not include any vulnerabilities identified in PCI DSS v3.1 Requirement 6.5, nor any other vulnerabilities that could affect the protection of payment cardholder data. Cinnaminta specifies that the website's payment functions must not be susceptible to the threat events OAT-001 Carding or OAT-010 Card Cracking defined in the OWASP Automated Threat Handbook. In addition the application must interact with the company's existing fraud detection system to counter OAT-012 Cashing Out. The requirements are specified in terms of these threat events, rather particular product and service categories. Development houses responding to the call for bids use the ontology to focus their answers to these aspects appropriately.

Sharing intelligence within a sector

Unlimited Innovations Inc develops and supports patient-facing software solutions to a range of healthcare providers, many of which participate in the National Health Service Cyber Intelligence Sharing Center (NHS-CISC). Unlimited Innovations already builds continuous monitoring capabilities into its software and decides to provide an optional enhancement so that customers could choose to share their misuse event data with each other, to benefit from the combined threat intelligence. Rather than sharing large quantities of low-level data, Unlimited Innovations aggregates information and broadcasts validated and categorised threat data amongst the participating organisations. Automation attacks are classified according to the threat events defined in the OWASP Automated Threat Handbook so that each receiving party understands the nature of the threat. Even organisations that do not want to take part in this information sharing can benefit, since their own categorised information is made available to internal business management in the form of an easy-to-comprehend monitoring dashboard. The information gathered can also be fed into their other business information management systems to help improve patient service.

Exchanging threat data between CERTs

National Computer Emergency Response Teams (CERTs) recognise that sharing of local information can contribute to worldwide prevention of cyber attacks. Despite advances in cooperation between CERTs, anything to increase continuity and interoperability such as standards for data exchange is encouraged. CERT Zog is concerned about the sparsity of application-specific data it receives, and also the classification of that data. It has a particular concern about attacks and breaches that affect sectors defined in Zog's 2015 national cyber security strategy. CERT Zog and its neighbour CERT Tarset agree to tag threat events using the OWASP Automated Threat Handbook to add greater context to existing solutions being used for threat data exchange between them. The programme also collects sector meta data, so that all organisations within these can benefit from the centralised intelligence.

Enhancing application penetration test findings

Specialist application security penetration testing firm Cherak Industries Pte Ltd works primarily for financial services companies in the banking and insurance sectors, and is looking to expand its business throughout Asia. Cherak has some innovative pen test result reporting systems which integrate with client software fault and vulnerability tracking systems, and it actively looks for methods to provide additional value to its clients. Cherak has identified that pen test clients would benefit from help to understand the effects of combinations of vulnerabilities, especially design flaws, and has decided to utilise the OWASP Automated Threat Handbook to define and explain the automation-related threats. The individual vulnerabilities were scored as normal using CVSSv2 and v3, the matching CWEs identified, and mitigations in place documented. In addition Cherak uses the threat events defined in the OWASP Automated Threat Handbook to help create a new section in the executive summary that explains how combinations of the issues found could lead to automation threats and the possible technical and business impacts. For example, an assessment for one client had identified weaknesses in authentication so that there is a risk of OAT-008 Credential Stuffing. The defined identifier was provided to the client so its technical staff could refer to additional information on the OWASP website.

Specifying service acquisition needs

Falstone Paradise Inc is concerned about malicious use of their portfolio of hotel and resort websites. The majority of the websites use a shared application platform, but there are some unique applications and a large number of other micro-sites, some of which use generic content management systems such as Wordpress and Drupal. Falstone Paradise has identified that its IT operations team are spending too much time dealing with the effects of automated misuse, such as cleaning up data, resetting customer accounts and providing extra capacity during attacks. Furthermore, the unwanted automation is also causing some instabilities leading to negative feedback from customers. Therefore Falstone Paradise decides to go out to the security marketplace to identify, assesses and select products or services that might help address these automation issues for all its websites. Their buying team work with their information technology colleagues to write the detailed requirements in an Invitation to Tender (ITT) document. This describes the types of attacks its web applications are receiving, the frequency of occurrence and magnitudes. These are defined according to the OWASP Automated Threat Handbook so that vendors do not misunderstand the requirements, each vendor's offering can be assessed against the particular automation threat events of concern.

Characterising vendor services

Better Best Ltd has developed an innovative technology to help gaming companies defend against a range of automated threats that can otherwise permit cheating and distortion of the game, leading to disruption for normal players. The solution can be deployed on premises, but is also available in the cloud as a service. But Better Best is finding difficulty explaining its solution in the market place, especially since it does not fit into any conventional product category. Better Best decide to use the terminology and threat events listed in the OWASP Automated Threat Handbook to define their product's capabilities. They hope this will provide some clarity about their offering, and also demonstrate how their product can be used to replace more than one other conventional security device. Additionally, Better Best writes a white paper describing how their product has been successfully used by one of their reference customers Hollybush Challenge Games to protect against OAT-006 Expediting, OAT-005 Scalping, OAT-016 Skewing and OAT-013 Sniping.


Introduction

The aim is to create a listing of vendor-neutral and technology agnostic terms that describe real-world automated threats to web applications, at a level of abstraction that application owners can relate to. These terms are threat events to web applications undertaken using automated actions.

The focus is on abuse of functionality - misuse of inherent functionality and related design flaws, some of which are also referred to as business logic flaws. There is almost no focus on implementation bugs. It is not that the latter are not the target for attacks, but there is much more knowledge published in that area with a greater agreement on terminology. All the scenarios identified must require the web to exist for the threat to be materialised. Many of the scenarios have impacts upon the organisation that owns or operates web applications, but some scenarios have impacts more focused on individuals or other bodies. An attack that can be achieved without the web is out of scope.

Completed:

In progress:

  • Work is currently underway on identifying automated threats to web applications, and determining the primary name used. This first part of the project intends to produce a consistent vocabulary for discussing the threats before moving onto other aspects
  • A briefing document has been produced to show a summary of the current ontology state
  • The primary terms are now being defined and described for the ontology

Comparison with other dictionaries, taxonomies and lists

OWASP WASC Web Hacking Incidents Database Project (WHID)

WHID classifies publicly known incidents using:

  • attack methods e.g. ARP spoofing, abuse of functionality, account compromise, administration error, automation, backdoor, banking trojan, brute force, clickjacking, code injection, content injection, content spoofing, credential/session prediction, cross site request forgery (CSRF), cross-site scripting (XSS), denial of service, directory traversal, domain hijacking, DNS hijacking, forceful browsing, HTTP response splitting, hidden parameter manipulation, hosting malicious code, information leakage, insufficient authentication, known vulnerability, local file inclusion (LFI), malvertising, malware, malware injection, mass assignment, misconfiguration, OS commanding, parameter manipulation, path traversal, phishing, predictable resource location, process automation, redirection, remote file inclusion (RFI), rogue 3rd party app, scaping, search engine poisoning, shell injection, social engineering, stolen credentials, SQL injection, unintentional information disclosure, weak password recovery validation, worm
  • weakness e.g. abuse of functionality, application misconfiguration, directory indexing, improper filesystem permissions, improper input handling, improper output handling, information leakage, insecure indexing, insufficient anti-automation, insufficient authentication, insufficient authorization, insufficient entropy, insufficient password recovery, insufficient process validation, insufficient session expiration, insufficient transport layer protection, misconfiguration, predictable resource location, weak password
  • outcome account hijacking, account takeover, botnet participation, chaos, credit card leakage, data loss, defacement, DDoS attacks, DNS hijacking, DNS redirection, disinformation, disclosure only, downtime, extortion, fraud, information warfare, leakage of information, link spam, loss of sales, malware distribution, monetary loss, phishing, planting of malware, service disruption, session hijacking, spam, spam links, stolen credentials, worm

Plus other/various/unknown.

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC is a dictionary and classification taxonomy of known attacks on software. Its primary classification structures are:

  • Domains of attack (3000) - Social Engineering (403), Supply Chain (437), Communications (512), Software (513), Physical Security (514), Hardware (515)
  • Mechanism of Attack (1000) - Gather Information (118), Deplete Resources (119), Injection (152), Deceptive Interactions (156), Manipulate Timing and State (172), Abuse of Functionality (210), Probabilistic Techniques (223), Exploitation of Authentication (225), Exploitation of Authorization (232), Manipulate Data Structures (255), Manipulate Resources (262), Analyze Target (281), Gain Physical Access (436), Malicious Code Execution (525), Alter System Components (526), Manipulate System Users (527)

The following academic, open source, commercial and news sources were used in the research on automated threats to web applications. OWASP is a worldwide not-for-profit charitable organization focused on improving the security of software. We operate under a vendor neutral policy and we do not endorse products or services.

in E-Commerce Fraud, ThreatMetrix, 2013 http://info.threatmetrix.com/rs/threatmetrix/images/Five_Trends_eCommerce_Fraud_WP.pdf



This page is in the process of creation

How do you define "web", "application" and "automated threat"?
See the definitions in the project's glossary.
What is an "ontology"?
An ontology is a set of types, properties, and relationship. These together define a subject description language. This particular ontology is meant to represent what automated threats real world owners observe affecting their web applications in usual operations.
Isn't this another bug (vulnerability) list?
Answer
I thought "XYZ" already did that?
Answer
How can I help?
Answer

Contributors

Colin Watson

Can you help? The project is looking for information on the prevalence and types of automated threats seen by web application owners in the real world. This will be used to refine and organise the information gathered from research papers, whitepapers, security reports and industry news. Please use the project's mailing lists to keep up-to-date with what's going on, and to contribute your ideas, feedback, and experience:

To share information confidentially, you can email the project leader directly: Colin Watson.

Roadmap

The project's roadmap was updated in June 2015.

Q1 2015

  • Feb 2015: Define scope and terminology Done
  • Mar 2015: Research prior work and reports about automated threats to web applications to create bibliography Done

Q2 2015

  • Apr 2015: Assess threats/attacks and create ontology Done
  • Apr 2015: Application owner interviews and creation of initial project outputs, to refine model Done
  • May 2015: Publication of outputs and request for review/data Done
  • May 2015: Summit session and survey at AppSec EU Done
  • Jun 2015 Review
  • Jun 2015 Write ontology document
  • Jun Write 2-page project briefing
  • Jun Publish project briefing
  • Jul 2015: Publish v1.0 ontology

Q3 2015

  • Jul-Sep 2015: Gathering of additional contributions, updates to outputs, and translations.