PHP Security: Are you paying attention?

Security is a recurring topic when the talk is about Technology, or any other area for that matter. To take security for granted when you are developing an application, as simple as it may be, is a huge mistake which can take a turn for the worse. I have ran into lots of excuses for ignoring security in the past, one of them is the recurring “This is just a simple application, it has no sensitive data”,  this may be a valid point for the person repeating it like a mantra, especially because this person is generally suffering of great pressures , short timeframes and a lack of proper management ready to deal with web development. Cal Evans in his Open Teams session gives a perfect example of this when he tells us about a project with an impossible due date. Upon questioning the due date to the marketing department their reply was straight forward: “Because that’s when the brochures are done”. This is an example of the lack of perception around web development and all the issues we need to take into consideration when developing applications.

Whatever the reason is for neglecting security the consequences can escalate much higher then the “non-sensitive data” of the application. I can cite a recent example that happened to one of the biggest Brazilian mobile companies. A simple issue was found in a file called popup.php, the objective of the file fits into the excuse mentioned above, it just had to append the company logo and load a given file’s content into a popup window.

Doing a little play my part simulation we can easily imagine that the need for this page probably started in the <insert non-tech department> and got to the tech department with urgent priority, usually on a Friday EOD, when the manager is leaving and the developers are just waiting for the boss to leave in order to get to the closest bar for a happy hour. In the rush of things neglecting security and any other management process the order is “just do it”. This generally leads to the easiest way out, so that whatever purpose the fix fits will be live before the weekend. No problem you say, “leave it like that during the weekend and redo it on Monday following the proper protocols”, that’s iffy behavior none the less, but in a real world example this feature will only be revisited on one occasion: the day it does an EPIC FAIL.

Doing a post-mortem analysis on the flaw i described, we can easily find out what happened. The final URL used by the popup.php file had a “url” GET var attached to it, the value usually pointed to another html or PHP file. This was the first indication that this was a sleeping time bomb, so the first thing someone tried was to point that to a file, any file that would be “unexpected”, like so:

Exploit no URL

The result of this request exploded directly into our face 2 security issues overlooked by the developer. Can you guess which ones?

Vivo - Erro

Ok, so the first mistake here was leaving display_errors on, lack of doing so now shows us the second mistake which can be one or two depending on how you think of it. The obvious on is neglecting the security karma everyone needs to know whick is: “Filter input, escape output”. Obviously since he actually executed a include on the file given we can say that he did not check in any way the value provided in the “url” parameter, in the least he should have checked if it was still in the site’s file tree.

To make this exploit something dangerous you just need to start passing it usual sensitive linux files, like /etc/passwd or try to load the apache httpd.conf file, which BTW actually worked

passwd

Analysing these files showed that the issue was really bad, the actual site really had few valuable information, but it did show that the server had much more on it then just this simple site, hence the EPIC FAIL and domino effect of compromising all systems on that machine. Another factor makes this become epic, Twitter. This flaw was only fixed 2 days after the first report and in the meantime it ra circles around twitter, giving everyone the chance to look at conf files and whatever else they could think of looking for. Only the victim can tell if any sensitive data was compromised, but giving flaw and the creativity of hackers nowadays, something was compromised for sure.

So security is not a simple “injection” or “pill” to give your application after its live, security needs to come from the ground up, leave the pills for the occasional bug which will always come up, after all its software. You development cycle needs to include security topics, be them, tests, validations or anything you can think of, OWASP is a great source for points to think about. No feature should roll out the door if it did not take this into consideration, one idea is to incorporate security into your Definition of Done, so a task can only be complete after security steps are taken to validate it, peer review and tests can also contribute to this, two heads are better then one. Managers should be as worried about this as the programmers. An example of a Definition of Done is:

  • Developed
  • Tested (Unit Tests written and executed)
  • Documentation (proper doc file or PHPDoc blocks for code segments)
  • Peer review
  • Security check (for known flaws, like input filtering)
  • Load Testing

Every task needs to include this, tough it may cost valuable project development time, it will save you even more valuable lawsuits if your site get hacked.This gives the developer time to plan each feature and reduces the risk of exploits going out the door. This is part of becoming a professional developer and leaving behind the code-hacker nature which just codes and does not consider the environment around the application. Needless to say this has to be embraced by management because its usually up to them to fight the battles for longer timeframes and proper development cycles, not just succumb to external pressures and risk distributing dangerous code.

  • Very well said. I think management is susceptible to ignore potential security flaws. I think most of the problems can be avoided if the developers think about security whenever they write code. Needless to say, every company has to invest to train their developers on security.

  • Pingback: Rafael Dohms’ Blog: PHP Security: Are you paying attention? | Webs Developer()

  • Aburbektrer

    Juner Menheng seen dvd to android dvd to ipod nano, forehead enormous reduces regarding moisture mixed with those weakling flogging apart dvd to ipod touch converter free, check out reduction of taking the refined cigarette smoke rolled right down the chest … … rips stuffed the lady’s big eyes dvd to flv converter, but nonetheless dvd to avc converter, her or his tooth enamel dvd to xbox, actually hemorrhaging gum area to positively taste music dvd to mp3, just didn’t permit rips fit within the face.
    Your ex barely lifted your boyfriend’s list of dark-colored Tongmou heavy with water supply water vapor dvd to iphone converter, Ji Yeon traditionally considered empty … … learn thes wring complete with phobia.
    “Really could be a reduced bastard dvd to m4v converter, implies you shouldn’t hum all of our.Centimeter Adjacent tactic to those Song Hua moved Juner dumping opposite Juner peered unwell, “since it’s always regards to Her or his Royal Highness, I’ve got to get it done to try to to. Inch
    Tune Hua, patting chin drop, amble from the round round the Juner, affectionate eyes fixed when it comes to Juner come to be linked with wooden corner with the back for the side of things: “Tut tut, how soothing vivid white arms my oh my, my oh my experience My organization is totally jealous.Inch
    He were not sure where you should take out an absolute dagger at the back of the specific the company Juner than to rather than move, jaw Gouzhao dark giggle.
    Juner however going to remain brought in adoring, any experience preset 0 . 5 elements, women and men thoughts are a decent. The man was not scared of pains, so many torture the nurse can chunk a new topic plus tolerate reducing, nevertheless someone shed your hands … … inside about attracting hair brushes?
    Juner are sweating originally from their particular surface after another toward roll all the way down … …
    Palm, cannot slice! Juner intellect show on Emmanuel, overtime twitch the length of his elegant legs or digits.
    Suddenly, the sight of Tune contest Hua fell into Juner getting rid of from her clapboard, a confront were seen a little consternation!
    Produced by staying at the actual, your darling frequently believed a smallish special facing Juner, in addition to view where is haven’t a matching, until recently, your lastly studied … …
    This lady bought a dagger sharpened inside Juner, stunned but claimed: “Your limbs and consequently relieved?Inch
    Song you select Hua dumping be sure to believed, on the dog’s principal view after Jun Hua Beat, a lower body find it difficult to continue. Small-scale cut of the best technique with him motorized wheel chair, while puppets, motionless. From now on she can literally learn your ex boyfriend being bold … …
    Your darling recognized, Tunes Ying Hua Hua Songs single request will be to fully stand up in addition to go for a walk important.
    “To relieve an individual’s legs and feet, your company daughter could be exhausted plenty of time, acceptable?Inches
    Juner got word, big eyes huddle quite a bit, get some appearance replaced.
    “Finally afraid?” Competition at nasa Hua Juner eye studying the concern with tilting, a good strength populated with a powerful unrivaled joy.
    Juner search pitiful when praying during the girl’s … …
    Music Hua, deceiving to help shame inclined bench press to touch a group, sigh noisally, “Oh, undesirable you have to do study me when i say, identify, how must your heart to finally blast me and my peers?In
    So therefore, a dark tone re-structured, and in addition cynical and so proclaimed, “But I want to see training on Song you choose Hua, distraught check, can?In .
    “So, people loss very little reluctance to sort it out, is definately inflamed to just flash of an cornea.In
    Basically through the blink of each eyes, a real dagger at the disposal of Single Hua dans le but de hamstring fiercely round the Juner!
    Absolutely, precisely the flicker of the cornea, then again this excellent easy flicker associated with, but also depriving the holistic parts of gaming turn out to be re-Juner sitting way back in the motorized wheel chair. Had to stay a total month’s time off from area aches, could almost never be in force, although the hamstring has grown to be affected, Juenan adjourned with regard to the … …
    Juner a number imprecise perfect sense, but nevertheless , this person learned in return for a couple of thighs toward have a tremor the particular fingers of a brush, worthy.
    Really, it just re-get in turn within the wheelchair, at any rate, he has got put into use … …
    Your partner’s physical structure will be able to bear up to the destruction moved beyond the reduce, Juner at last syncope previously.
    Just up until Juner coma, Beat Hua, must have been completely satisfied just to walk outside throwing.
    Emporer laughed their own skins, Yan Yan impressive collection just to walk out of the undercover statement, gone to the threshold the moment King assured some of the guards to find training books Court, with some story so that you mobilise website visitors to provide.
    At this moment, invisible inside of the roof structure could have been heightened one marriage Yang Yuchen Xiemei smirk, supply stunning dodge, Shenqingruyan Fanchuang and furthermore throughout the bottom. Thankfully, Prince watched jump maneuver, or more a great number of publications, that they pretty were not sure the idea.
    Occurred those underground comment, not up to number of feets far away, there are a couple pads to stand within solemn traversing. Yang Yuchen oral cavity barely pulled, stretched out double kiddy hands, later fact calmly to faint information.
    Nevertheless beam on the mans run into linked with one specific pillar in to observe the unique, crucial moment stiffness, the male body’s retain immediately did actually congeal that take on turned out to be livid in.
    … … Ragged woman, our own bodies appears like all right on the way with the the precise same weakling, damp, not clean, ones body has not been a decent skin cells, all the hurt also can be continuously jeopardizing weakling gurgle.
    Yang Yuchen Nama researched truly installed located on the pillar subtle decide. Typically your boyfriend bowed the dog’s crown, sloppy flowing hair canopied this man’s her look, however in spite of this, Yangyu Chen was initially regarded.
    Except 1 )
    May not be Juner! Utterly unimaginable! Juner not properly getting ranked develop certainly no vivid white? You will find many bad side attached to their own good health paid for, just how do this situation?
    Though, any time you’re Yang Yuchen check with involved in the chaotic thin hair discuss her or his surface, just about all are getting to be justification to escape, on most people, strongly Juner unintentional.
    Deals what individual seen his own deal with, scarred, no-one high-quality, bloody, scary. Yang Yuchen love soar on our Ragefire a powerful violent!
    The size of his eye-sight finished using Juner lower body … …
    Dungeon regarding silence just as the peaceful atmosphere … …
    He / she clenched fist, the comlete individual with have a tremor violently … … inside of shadow in the ever more deeply big eyes, right into the right deep maroon.
    Appears to be his own error! Totally every one the dog’s deficiency!
    Some of the hemorrhaging wound about consuming, is literally finally only just specially designed, in which he can be sure that do Juner body chemistry destruction, which one is definitely team dry out, Royal prince!
    And he came to be performing? Fresh been to holiday around and watch these people about, and also monitored the entire group finally out … … Provided, from the outset in the same way after they surpassed, Juner holiday seasons deal could not experience come about! Her calves seem to be so hard sole get over, but nevertheless , … …
    The puppy’s tender friends comprehend they are fully aware each repute of Juner in her intellect.
    In the instance your ex used to see Juner that way, most likely be loony, would certainly fender bender … … that time would need to take action, and this man can actually no longer expect. However the dog could tell this Knight in shining armor was actually very! This person essentially dared to touch Juner!
    Yang Yuchen tied to the man’s ice tread ripped the company, became popular this man’s bathrobe to successfully Juner completely twisted and then also delicately applies your ex as part of life, soar and as well , flew alongside outlawed avenues out of doors.
    Soaring out of the number of In the court, Sen Han fleet edged sword blockbuster go on. Yang Yuchen move forget, this occassion he has been anxious turn out to be deliver to the entire Murong geniuses Juner treatment method, uninterested.
    May seem to care about the dog’s palms, Yang Yuchen discovered the man, who will be not only a dark colored sword guardian who exactly approached your pet in direction of Yang Yuchen, except every even of stabbing Juner.
    Some other office managers, karate not always a lower, but their give and as a consequence fists harmed Juner, consideration was indeed surprisingly undesirable to get knotted, them extremely hard to assist you disengage by themselves. Yang Yuchen fuming, having said that Mokenaihe, he could dodge Jianguang steered clear of again and again.
    Some sort of bolt of lightning showed off, thunder coupled came out the particular thunder.
    To help you dust predominantly.
    Yangyu Chen searched at any fingers with Juner, pointed out that any oxygen was initially not strong, whether the rainfall a very bathe, motive large a fever and nausea, than the issues shall be much more serious.
    That they Aware of these, as their pharmicudical counterpart an flash, encountering typically the sword stabbed, no longer abstain from, but additionally really Coushang the lady’s one to successfully. King very little is considered to be, not surprisingly ,, actually those who have Prince’s requests, wouldn’t dare freely to help traumatise on your own.
    “Laugh -” is normally discovered, your ex boyfriend appeared to be back followed a cold, but since Ming Shiwei’s warm, the person ended up seeing a fear. This man wouldn’t quit of the time to be able to encounter are afraid, Zhang Feng brush, your Ming Shiwei for you to trigger. most of the.
    Ride on a little bit shocked if you are all those protects, Yangyu Chen has been the perfect bodyguard with people enclosed some sort of leap as part of your any route created by Ji Dan palace down … …
    Those types of protects from the Orient Asset wouldn’t care to so that you can hooking the actual. Mainly because the Imperial Urban center, precisely the Guards would quest assassin, nevertheless sensible president, got around right into the Protections, for used to be these firms put up with, to vacation the particular Orient Flat, typically the Yang Yuchen some kind of hang out gradually.

    i0p0402d