IBM Application Security Insider

Building Rich Internet Applications Models: Example of a Better Strategy

Crawling “classical” web applications is a problem that has been addressed more than a decode ago. Efficient crawling of web applications that use advanced technologies such as AJAX (called Rich Internet Applications, RIAs) is still an open problem. Crawling is important not only for indexing content, but also for building models of the applications, which is necessary for automated testing, automated security and accessibility assessments and in general for using software engineering tools. This paper presents a new strategy to crawl RIAs. It uses the concept of Model-Based Crawling (MBC) and introduces a new model, the “menu model”, which we show to be much simpler than previous models for MBC and more effective at building models than previously published methods. This method and others are compared against a set of experimental and real RIAs.

The SSRG research team will present these findings at ICWE 2013, 11 July@16:00, Aalborg, North Denmark.

Keywords: Crawling, RIAs, AJAX, Modeling

Suryakant Choudhary, Mustafa Emre Dincturk, Seyed Mirtaheri, Guy-Vincent Jourdan, Gregor Bochmann and Iosif Viorel Onut.
Building Rich Internet Applications Models: Example of a Better Strategy
in Proceedings of the 13th International Conference on Web Engineering (ICWE 2013), Aalborg, North Denmark, July 2013.
To be published in Lecture Notes in Computer Science by Springer.

Conference link: http://icwe2013.webengineering.org/
Accepted papers link: http://icwe2013.webengineering.org/accepted-full-papers
Link to the .pdf paper: http://ssrg.site.uottawa.ca/docs/ICWE2013.pdf

AppScan Enterprise v8.7 performance improvements

In March 2013, we released version 8.7 of AppScan. One of the focus areas for that release was to improve the scalability and performance of the enterprise components of the solution, specifically the AppScan Enterprise Server and AppScan Enterprise Dynamic Analysis Scanner. The Engineering team made some architecture changes, which  helped dramatically improve the performance and scalability of these components. In this blog entry, I'd like to provide an overview of these changes and their effect.

First, the Engineering team separated the database tables for storing information during the execution of a scan from the central AppScan Enterprise Server database and moved those tables into a local built-in database on the AppScan Enterprise Dynamic Analysis Scanner (DAST scan server).  In the previous versions of the product, the scan server wrote data into the AppScan Enterprise Server central database throughout the entire duration of the scan. This consumed a lot of resources on the database server which affected the Web UI performance and greatly limited the number of scans you could run simultaneously on a scan server. There were also latency concerns depending on where the scan server was located in relation to the database server. In version 8.7, scan data is written into a local built-in database on the scan server. Data is transferred to the central database on the AppScan Enterprise Server only at the end of a scan (in one batch). This improved the performance of the Web UI, enabled running more simultaneous scans on a single scan server and addressed the latency concerns when the scan server is located far from the database server.

Figures 1 and 2 for a depiction of the implemented architecture changes.

Another implementation change made by the Engineering team was removing the old encryption mechanism for protecting data "at-rest".  When deploying v8.7, we recommend that AppScan Enterprise administrators enable the Microsoft SQL Server Enterprise Edition (2008 and higher) built-in mechanism for data encryption, Transparent DATA Encryption (TDE), which provides much better performance.  Alternatively, administrators could use Encrypting File System which comes with Windows.

So here are the results of the efforts of the Engineering team:

• Web UI responsiveness has increased by approximately 50%
• Scan and reporting performance has increased by approximately 50%
• 4-5 scans can run at the same time on single DAST scan server
• DAST scan servers can be deployed remotely from central AppScan Enterprise Server

We hope that the improved robustness of these AppScan components will help enhance your overall experience with the product. 

 

Practical mobile app security scanning tips

Looking to do dynamic security testing of your mobile apps? Look no further!

In this hands-on article, learn how to use IBM Security AppScan Standard with mobile user agents, as well as emulators and actual devices for Android and iOS.

Continue reading: http://www.ibm.com/developerworks/library/se-testing/index.html

Research Awards for Project on Crawling Mobile and Rich Internet Applications

2012  IBM CAS Project of the Year: Efficient and Scalable Mapping of Mobile and Complex Rich Internet Applications for Automated Security Testing

The ability to “crawl” Web sites and Web applications is at the core of the Internet. Crawling is necessary to indexing, searching and security testing operations. With the rise of “Rich Internet Applications” (RIA) there is a tremendous gain in end-user experience, but it is becoming harder to automatically crawl these Web sites. Another recent evolution in computing is the move to everything mobile. Mobile applications are bound to replace desktop applications in the coming years. It is therefore critical to develop crawling tools adapted to this new paradigm.

The objective of this research is to provide efficient and scalable crawling techniques that work on real life RIAs and mobile applications, and does so entirely automatically. It builds on the results of our previous research, but tackles the open problem that some RIA are simply too large to be crawled exhaustively.

 

The project was awarded by IBM with the "Project of the year 2012" distinction based on the following criteria:

• Excel as a research center for the advancements of applied science in research areas strategic to IBM
• Harvest and transfer results from advanced research to strategic products and initiatives
• Build and foster relationships among researchers, IBM and Customers
• Expose IBM developers to current research directions, and identify new and emerging technology issues for academic research.

The award was presented at CASCON 2012. The research is done in collaboration with University of Ottawa.

Find Security Vulnerabilities in Android Apps

Mobile security can be tested in a variety of ways. You can apply black box testing to test the server side logic that your mobile app is working with, as we've recently blogged about.

You can also apply static analysis to test the client side. The following short video shows exactly how that's done using IBM Security AppScan Source Edition:

 

For a more complete overview of mobile security, check out the webcast we've recently published.

 

Understanding AppScan Test Policies

IBM Security Appscan provides automated security scanning of web applications.

Did you know that you can apply test policies within IBM Security AppScan to cover particular aspects of the scan? Using the right policy produces optimal scanning results and reduces false positives.

In this great article, you can get an overview of IBM Security AppScan test policies, and learn which policy is optimal based on the type of application and its stage of development. The article also provides a side-by-side policy comparison that details each scan policy that is offered by the IBM Security AppScan tool.

Source: IBM developerWorks.

 

Have you scanned your mobile site for vulnerabilities yet?

Mobile sites - Resurrecting security risks

In today's world any self respecting web site must provide access to its services through a desktop browser as well as a mobile device. This basically means that there are two versions to every site, one for desktop users and one for mobile users. Are both secure? How do we know for sure?

First, let's take a quick look at some of the reasons why companies would prefer to have mobile users visit a mobile-based site instead of directing them to the original desktop site.

• Technologies - There are certain technologies that are not supported on a mobile device (e.g. Flash on iOS) that would have to be re-designed to meet smartphone requirements.
• User experience - The user experience is completely different. For example, take the hover action, a desktop user can hover over a certain area and have menus sliding this way and that. But on a mobile device hovering does not exist.

Top 5 Innovations Transforming Security Scanners

Like the web itself, security scanners are advancing at a fast pace. Here are the top 5 technologies that leading security professionals are applying to stay ahead of the curve:

5. XSS Analyzer

The "classic" black box approach for detecting XSS relies on sending a bulk of tests based on a “cheat sheet” of around a hundred different payloads. This is a reasonable approach for an automated tool, but it isn’t very sophisticated.

Mimicking a human attacker, XSS Analyzer is a learning system that follows a disciplined step-by-step approach. XSS Analyzer learns the defense patterns of an application, and finds ways to defeat those defenses. This allows XSS Analyzer to find vulnerabilities that could never be found automatically before, with higher accuracy and less time.

 

String Analysis in AppScan/JSA

Let's see how String Analysis is used to improve the accuracy of JSA. 

Consider the following real-world example:

var str = document.URL;
var url_check = str.indexOf('login.html');
if (url_check > -1) {
   result = str.substring(0,url_check);
   result = result + 'login.jsp' + str.substring((url_check+search_term.length), str.length);
   document.URL = result;
}

Any standard taint analysis would argue that this code is vulnerable to Open Redirect, since the value of the untrusted variable "str" flows into the assignment "document.URL = result"; this presumably allows an attacker to control the URL target of a redirect operation, which means that phishing is possible.

However, closer inspection reveals there is no vulnerability here: while part of the target URL can indeed be controlled by an attacker (the request parameters), the target hostname of the redirection is beyond the attacker's control.

So what could we do? 

What is String Analysis? A look at one of AppScan's breakthrough technologies

The best technologies are often the ones that you, as a user, never have to worry about. They work automatically, behind the scenes, making a product or service work better. With nothing to configure, nothing new to learn. They just work.

String Analysis is such a technology. If you think of it, it's a thing of beauty. Because String Analysis is actually one of the most complicated analysis technologies that IBM (or anyone) has ever developed in the world of static analysis.