Hot answers tagged

81

The default solution would be to use cryptographic signatures. Have every technician generate a PGP keypair, publishing the public key and keeping the private key secure. When a technician made an analysis, they sign the result file with their private key. Now anyone who wants to verify the file can check the signature using the public key of the ...


68

Possible XML based attacks are: XML bomb (aka Billion LOLs attack). This is an XML file that uses a recursive custom entity type definition to attack a vulnerable XML parser. The XML bomb has a very small size on disk, but expands up to a huge size when parsed, potentially exhausting the available memory on the victims device. External entity type that may ...


27

Any form of digital signature will do. Here are a few pointers: For XML data, there is a digital signature standard (XMLSign). Unfortunately, this standard is rather poor and has an important security loophole (documents needs to be normalized through an XML transform before they can be signed. This is extremely hard to do securely since the transform ...


12

I'm a PHP 'newbie' if you may call me one. But having analyzed XML and XSLT libraries in the past for security vulnerabilities, and having recently done work on an application that uses quite a bit of XML, here's what I could think of: If it is possible to pass in a XSL transformation that causes execution of privileged code, you might have to find some ...


9

The XML syntax allows for automatic inclusion of other files, which can be on the same system, or even elsewhere (through a URL). See for instance this documentation. The attack would be conceptually a case where the attacker can add an "external entity reference" in a piece of XML which will be interpreted as XML by a machine (e.g. a Web server), with the ...


7

A parameter is a parameter: a data element (necessarily a character string, in the context of a URL) indexed by a formal name. What is done with that parameter on the server is entirely up to the server. We here enter the realm of suppositions. The parameter name "xmlPath" is suggestive of the parameter value being a path name for a file which uses XML. We ...


7

With a bit of digging around, I've found some evidence of recent activity on this subject: Functional Explanation of Changes in XML Encryption 1.1 (W3C Working Group Note 11 April 2013). There are a lot of changes in the XML Encryption 1.1, among others: Added Key Derivation Added Elliptic Curve Diffie-Hellman Key Agreement Added Algorithms Changed ...


6

Secure XML processing using DTD's and XSD's is tricky. You should ensure that the correct dtd's and xsd's are referenced for your use case before processing the xml file with a parser (and that mixed xml content is not added such as alternate xmlns, local dtd definitions in the xml, Entity expansions etc). As I heard on an OWASP podcast OWASP Podcast ...


6

I will outline the three main options and pros/cons of each. Store backups of the files in a secure location Pretty self-explanatory. The "secure location" can be a read-only medium (like CDs), or a network drive that everyone can read but only the supervisor can write to, or an online storage service (e.g. Dropbox) that makes it reasonably hard to forge ...


5

The primary risk in not syntax checking your XML is invalid parsing. If the software reading the XML can't handle invalid input, it might crash, do something unexpected, spontaneously explode (probably not), etc. Those situations can lead to security flaws - but if the software is brittle enough not to be able to handle invalid XML, it will very likely ...


5

According to Jager's and Somorovsky's paper "How to Break XML Encryption" (PDF), The W3C XML Encryption specification today marks the de-facto standard for data encryption in complex distributed applications. The use of XML as core data syntax, e.g. for major business, e-commerce, financial, healthcare, governmental and military applications, has ...


5

Actually, the whole WCF/SOAP security stack in .NET is based around these sets of standards for encryption and signing (if you are referring to what Thomas linked to). Message security with encryption uses it to encrypt the message. I have no hard evidence of it, but I believe its fairly well used in WCF-centric shops. We use it for our stuff. It's all ...


5

If they block HTML then it also makes sense to block XML because it can be transformed using XSLT into XHTML (the transformation is supported by all recent browsers passing the Acid3 test) which is pretty much (especially security-wise) like normal HTML.


3

Depending on your library you should be able to configure your parser to ignore entities.


3

So XXE is usually seen in areas of a site which accept user input. If by static site, you mean a site that purely responds to HTTP GET requests for documents hosted on a server, then there's not really anywhere for XXE to occur. The only scenario I could think of would be if the site processed a section of the URL or HTTP headers and included that as an ...


3

Well I can answer my own question now, at least in part. The application I was examining has a default instance of XmlPullParser with only FEATURE_PROCESS_NAMESPACES disabled. I was able to get the Billion Laughs entity attack to work. My issue what I was not putting the entity in the right child element of the expected XML response.


3

You didn't give us information about how the XML is used/parsed afterwards. Still I've got two points on this: By using something like http://host/file.xml?a=b%20x=y someone will be able to add an additional attribute depending on how you deal with the output, this might be a problem. Also some parsers take the first occurrence of an attribute, some the ...


3

Yes. By definition, allowing user interaction with additional software increases the Attack surface.


3

You cannot really test an ASN.1 parser for correction, because it is a complex piece of software and we do not know how to prove that a given piece of software is correct. What you can do is rely on a library with good repute. You might want to have a look at this question. Alternatively, reimplement it yourself; this is not very hard if you stick to a ...


2

Yes, of course. It's the same as a code review, or a deployment inspection. During CR, I would expect configuration files to be part of the code base that is examined; and during a deployment inspection, all configurations you can get your hands on should be opened up and examined. That also answers no.2 - explain to the manager that its part of the ...


2

Well, the first thing that comes to mind is that if you remove an external endpoint of an API that an application relies on, then yeah, it would probably break. :) More specifically it really depends on the application in question. If it only works over XMLRPC and it needs to connect from a different machine, then yes it will break if you remove the access. ...


2

Just to flesh this out a little past your original point about browsers. Usually XXE is an attack on the server-side, so a user viewing the site can get access to files outside of the webroot, to which they would not normally have access. The access and impact of the XXE depends on whether there are useful files findable by the attacker and also the ...


2

No idea how Microsoft internal tools interacts with the service. You'd have to ask them, and they won't tell you. A friend used to work in MSIT building said tools, and even he wouldn't tell me. However, there should be a sample in the Windows SDK that gets installed here (source: ...


2

for XXE please read: http://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution http://blog.h3xstream.com/2014/06/identifying-xml-external-entity.html i can confirm a similar attack worked on Java/Tomcat And then there is a Billion Laugh - Attack ( i think this was what Bruno referred to) http://en.wikipedia.org/wiki/Billion_laughs


2

I think it will be helpful if I add a comment to this answer, including the current state. Adaptive-Chosen Ciphertext Attacks: The attacks applied on XML Encryption are adaptive chosen-ciphertext attacks. In an adaptive chosen-ciphertext attack scenario the attacker takes the original ciphertext, modifies it, and sends to the server. He then evaluates the ...


2

The "level" of security for this really depends on what the XML files contain. If the XML files confidential data then you may want to explore further techniques than discussed here. The suggestion of using basic auth can work however there are many reasons why you should consider using a different authentication method which has been discussed in the ...


2

Take your xml file, and your favorite holiday photo. Concatenate the files and compute several hash values of the resulting file. The holiday picture ensures that it is extremely hard to produce a collision, even if the holiday photo file is public. Also, if you use several hash algorithms, it is unlikely that all of these will be broken under 10 years ...


2

Addressing vendor file-format security, expanding on what @Philipp says in the comments. I've had a poke around a vendor file format (not mass spec but near enough for these purposes). It was made a lot easier by having the software installed, but I'm no expert in these things. I could easily change metadata (extracting the metadata was my goal in the ...



Only top voted, non community-wiki answers of a minimum length are eligible