pizza roulette - owasp€¦ · 05/02/2018 · ie 7/ vista ie8/xp no ie r ie 11 'win 7...

39

Pizza Roulette Catherine McIlvride and Fiona Sasse

Upload: others

Post on 13-Nov-2020

1 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Pizza RouletteCatherine McIlvride and Fiona Sasse

Page 2: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 3: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 4: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Starting Point

Page 5: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 6: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 7: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 8: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 9: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 10: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 11: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Pretending to know

what we are doing

Page 12: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Just a little

frustrated

Page 13: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

We tried!!!

Page 14: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Risk Profiles

Page 15: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 16: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 17: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 18: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

The following is a

depiction of the events

that occurred on the

night of 4th October

2017

Page 19: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 20: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 21: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

OWASP Top 10A1 Injection

A2 Broken Authentication and Session Management

A3 Sensitive Data Exposure

A4 XML External Entity (XXE)

A5 Broken Access Control

A6 Security Misconfiguration

A7 Cross Site Scripting

A8 Insecure Deserialization

A9 Using Components with Known Vulnerabilities

A10 Insufficient Logging & Monitoring

Page 22: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 23: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

A3 Sensitive Data Exposure

Page 24: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

A2 Broken Authentication and Session Management

A10 Insufficient Logging & Monitoring

Page 25: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

A7 Cross Site Scripting

Page 26: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Using order numbers to bring up other people's details

A5 Broken Access Control

Page 27: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

OWASP Top 10A1 Injection

A2 Broken Authentication and Session Management

A3 Sensitive Data Exposure

A4 XML External Entity (XXE)

A5 Broken Access Control

A6 Security Misconfiguration

A7 Cross Site Scripting

A8 Insecure Deserialization

A9 Using Components with Known Vulnerabilities

A10 Insufficient Logging & Monitoring

Page 28: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Things we learnt!!

Page 29: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Keep It Simple Stupid

KISS

Page 30: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Time!!!

Page 31: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Mentorship is a must

Page 32: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

So what now…..

Page 33: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 34: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 35: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 36: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 37: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Page 38: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

Massive Thanks To Kevin!

Page 39: Pizza Roulette - OWASP€¦ · 05/02/2018 · IE 7/ Vista IE8/XP No IE R IE 11 'Win 7 Protocols TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0 SSL3 INSECURE SSL 2 For TLS 1 tests, we currently

PowerPoint Presentation...Phase 2 IE/Edge will present warning message for SHA-1 signed TLS certificates in IE/Edge Planned to take effect in mid-2017 Phase 3 No date yet announced,

Tls Presentation

Asian Tyre Sourcingasiantyresourcing.com/products/Thunderer/Deestone_Moto_Catalog... · 125-12c 4 125-12c 8 tls tls 120/90-10 4 130/90-10 4 type tls tls type 4 tls 4 tls d7024 w.wm.'/h

ProScript TLS: Building a TLS 1.3 Implementation with a Verifiable … · 2019. 1. 22. · ProScript TLS: Building a TLS 1.3 Implementation with a Verifiable Protocol Model Karthikeyan

New port call Piraeus to TLS Services TLS ... - Arkas Hellas

Flex IR PTZ / Bubble PTZ · Web Browser IE 9 or above, Firefox, Chrome, Safari Security HTTPS, TLS, WS-Security, Certificate Management, Multi-Level Password Protection, IP address

Qualys CertView...TLS 1.0 / 1.1 • Chrome: Jan 2020 • Firefox/Safari: March 2020 • IE/Edge : First half of 2020 TLS 1.3 is faster and removes support for insecure features and

IE IL IE vrr vrr IE IE&

Best Practices and Applications of TLS/SSLhosteddocs.ittoolbox.com/symantecvsbestpracticesand... · 2013-11-13 · Best Practices and Applications of TLS/SSL 4 TLS vs. SSL TLS is

Using TLS for DNS Privacy in Practice · TLS BCP • UTA (Using TLS in Applications) WG produced RFC7525 this year - “BCP for TLS and DTLS” • Key recommendations - Protocol

TLS-450/TLS-450PLUS Consoles - Veeder

TLS Documentation

TLS-N: Non-repudiation over TLS Enabling Ubiquitous ... · TLS-N: Non-repudiation over TLS Enabling Ubiquitous Content Signing Hubert Ritzdorf, Karl Wüst, Arthur Gervais, Guillaume

Cancer Trials Support Unit - Welcome to the CTSU … Trials Support Unit November 22, 2016 Enabling TLS 1.1 and 1.2 on IE Revision 1.0 Enabling TLS 1.1 and 1.2 on IE

2016 TLS 1.3 - NDSS SymposiumRSA1 RSA2 Bleichenbacher‘s Agack The diﬃculty of prevenng such aacks (example) 23 TLS 1.3 RSA2 Server S TLS 1.3 TLS 1.0 (Backwards compability ) RSA1

Naam: - Collegiate...dr ie v ie r t ie n f ie ts d ie p t ie r m ie r d ie r s ie k d ie f p ie p s ie n br ie f pap ie r w ie n ie ie PIEP! PIEP! sounds like “ i ” in English

TLS BEST PRACTICES - digicert.comcertificate management best practices—so you can avoid becoming a statistic. ... • SSL v3 • TLS 1.0 • TLS 1.1 Instead, enable TLS 1.2 and TLS

Presentazione Gilbarco Assopetroli...TLS-350 migrazionea TLS4 / TLS-450PLUS TLS-450 migrazionea TLS-450PLUS-CONFIDENTIAL - Confidential – No permission to copy or distribute t his

More on SSL/TLS. Internet security: TLS TLS is one of the more prominent internet security protocols. TLS is one of the more prominent internet security

SSM3 and SSM4 - Stuart Equipment...Stuart® Catalogue Page 101 SSL3 Rockers, lab scale, SSL3 and SSL4 These rockers have large platforms able to accommodate a number of samples, ideal

tls tandem etethertrust.com/wp-content/uploads/2015/11/tls-tandem.pdf · 2015. 11. 16. · TLS-Tandem main idea. • The opening of TLS session is fully managed by a Java CardTM

IEX Bulletin VOlUME 5 India... · 07bUll Power Market Update: February’18 bUllETIN llET IE IE lETIN IE IE IE IE IE IE IE IE bUllETIN bUllETIN bUllETIN IE bUll bUllETIN ll bUll 08bUll

Demystifying TLS

Electronic Supplementary Information · (AU) Control SQS SSL1 SSL3 SSL1 + SSL3 0 5 10 15 20 25 30 35 40 45 50 Pacific Blue Mean Fluorescence (AU) Fig. S9 Mean fluorescence of control,

ACompleteLogistics&SupplyChainCompany - TLS …tlsfreight.com/files/TLS-Profile.pdf · Introduction:-• TLS Freight forwarding is a private limited company. We are operational in

DB2 for z/OS: Configuring TLS/SSL for Secure Client/Server ... · SSL and TLS protocols (SSL V2, SSL V3, TLS V1.0, TLS V1.1, and TLS V1.2 as of this writing) including a robust set

Aluminium TLS Preset Torque Screwdrivers TLS

WHAT IS TLS WEIGHT LOSS SOLUTION? - Market America · WHAT IS TLS WEIGHT LOSS SOLUTION? TLS ... *Individuals following TLS Weight Loss Solution as part of a healthy diet and exercise

The OpenSSL 1.1 Audit · 2017. 9. 6. · GCM AUTH ECDSA RSA . Real-world Apache/Nginx TLS PROTOCOL SSL v1 SSL v2 SSL v3 TLS 1.0 TLS 1.1 TLS 1.2 TLS 1.3 CIPHER NULL DES 3DES RC4 Twofish

Component Manufacturer / Model · Component Manufacturer / Model . Veeder-Root TLS-350 Series, including but not limited to TLS-350, TLS-350 Plus, TLS-350R, Red Jacket ProMax, Gilbarco

Kernel TLS and hardware TLS offload in FreeBSD 13 by ... TLS and... · 5-20% CPU reduction in Netflix unencrypted workloads Describes a TLS record entirely, including TLS header,

Performance Analysis of TLS Web Serversbrecht/servers/readings-new2/tls-web-server… · Performance Analysis of TLS Web Servers • 41 Fig. 1. TLS offers an abstraction of secure