java and oracle on security at app sec usa

speaker: Milton Smith

Open Ecosystem

  • JP (java community process
  • OpenJDK contirbutors including IBM and Apple

Security communications

  • RSS feed for security alert
  • (CPU) Critical Patch Update Advisories – for “normal” patches. Dates published a year in advance
  • eBlasts – emails
  • Blogs – Java PM blog

CVSS – common vulnerability scoring system

Added security track to JavaOne

Working on a platform is not the same as working an application. Current analysis tools don’t understand new syntax yet. Use tools where apply though.

Oracle considers Java to be strategic. Safety and security of Java is a top priority. Delayed Java 8 becuase security wasn’t ready.

Oracle is focusing on fixing applets (to limit attackers from using malicious applets), accelerating remediation and new security features.

Most vulnerabilities were in deployment and 2D because of applets. Interesting because don’t affect most people. And because applts are old.

Recent security features

  • Easy way to disable Java on different platforms (Java 7 update 1)
  • Java “best before” – Java should encourage updates. Baked date into binaries for knowing it is out of date once new CPU out (Java 7 update 10)
  • End user can adjust plugin security levels via slide (Java 7 update 10). Removed low and custom levels in update 21
  • Dynamic blacklisting support. Vendors call to say they learned released jars are vunlerable (java 7 update 21)
  • Signing sandboxed applications (java 7 update 21)
  • Enble stanadrdized revocation services – deal with stolen digital certs, now on by default (java 7 update 25)
  • Provide ability to lock JARs to specific servers or domains (java 7 update 25)
  • Turn off JRE out of date warnings – companies want to manage on own (java 7 update 40)
  • Add whitelisting for enterprise and partners – prevents 3rd party ads and spearfishing from exploiting (java 7 update 40)
  • Working on Java uninstaller to improve so adversaries can’t target older versions of Java as easily

Future

  • With the January Java 7 update 51 release, self/un-signed applets will be blocked by default. All applets written before update 25 won’t run by default. Can lower seurity to Medium to change defaults. Can still create a CA within a company

Oracle’s Secure Coding Guidelines

My take
I’m not sure what I was expecting, but this felt light and fuzzy. Or maybe I knew a lot of this. Or maybe I’m tired because there wasn’t a break and I didn’t choose to miss a session in order to take one. The charts were interesting. As were the new features.

what could go wrong – thinking differently about security at app sec usa

speaker: Mary Ann Davidson

The speaker is from Oracle. I’ve never seen a non-Java or database presentation from them. Even so, I was suprised Oracle doesn’t make her put the standard loong disclaimer on there.

“Translation” is a key skill – ask dumb questions, ask why something is a problem without being condescending
Policymakers need to undertstand issues to make good decision. [otherwise you get policies like “developers can’t use the internet at work”

Analogies help when work. Can be humorous if not
One Little Dutch Boy stops water in dyke. “If only we had 300K Little Dutch Boys” – they will all drown when the dam breaks.
Fridge on network. Forgot password “family of five starves to death, locked out of refrigerator”

Principled vs purist

  • World isn’t perfect. Neither is security.
  • Real metric is whether customers are protected. How fast you patch is less important; customers don’t like patches. Won’t apply if think will break something.

Economics

  • Systemic risk (housing meltdown) – cannot be mitigated. Think about how to avoid systemic risk. The internet was not designed for everything to be on it such as fridges. Doesn’t mean all advances are bad. Have discussions before taking risk
  • Efficient resource allocation – time, money and QUALIFIED people are always constrained. Opportunity cost. If make do something silly, will crowd out more valuable work.
  • Market incentive – One off patches are expensive. Would rather build something new.

Game theory – Prisoner’s Dilemma

  • Should someone defect and sell encryption code to another country? Hasn’t happened

Biology

  • Chemical signaling – what if systems could communicate under attack and update defenses
  • Deception – we have honeypots

Military

  • Network centric warfare – translate information advantage into competitive advantage. Time to live infomation advantage
  • This makes the network itself a battlefield that you need to defend
  • Atacker’s goal is to disrupt defenders ability to wage war and prevent use of IT
  • Tools need to be designed for your threat environment. Don’t want a watergun on the battlefield
  • Situational awareness – who on the network, friend or foe, what i over the hill, etc
  • Defend what is strategic; not everything

Education

  • Can’t start security education too early. “Look both ways before crossing the Internet” – don’t open attahments
  • Universities need to reflect building IT as infrastructure
  • Vendors must educate every CS grad in basiic security and spend millions fixing avoidable preventable desig and code defects
  • CS classes must embed and reinforce security – compared to structures in engineering. It’s part of the circulum, not a one off
  • Have red team/blue team as part of all CS classes
  • Accreditation bdies should force curricula change

Developers are personally responsible for code

OODA (observe, orient, decide, act

  • Stay agile.
  • Can targets be evolving to keep opponents off balance

Solve the right problem. Not everything is a tech problem

Oracle does security with coding standards, training classes, coding standards, checklists. Not optional. When acquire groups, need to start doing. Still have resistance, but have to for cost and brand damage.

My take on this
I liked this session. It’s hard to say what you learned because it is about thinking, but the points raised were good.

html5 security features at app sec usa

speaker: Johannes Ullrich

HTML 5 risky business or security toolchest at app sec usa

HTML 5 is

  • Collection of JavaScript APIs
  • Features to enable modern desktop like applications or support mobile devices
  • Your browser supports HTML 5 even if you don’t use it [well, pieces of it]

Authentication

  • Inclusive authentication – proof of identiy of user
  • Exclusive authentication – disprove the identify of the user – for example, IP address isn’t for authentication bu can be second level such as making sure in network after log in. Similarly can use GPS
  • Half factor – password or token – attack whichever is weaker

[I missed the part about local storage because I was focused on trying to connect to the internet – remember humans can’t really multi-task]

Login with touch

  • Circle fpart of image. Don’t circle faces. Everyone does that.
  • Android has connect the dots where you pick the pattern. Most people pick a common pattern ike the leter C

Biometrics

  • Can do videoconferncing with just HTML5
  • Could use faes, hand signals/gestures or fingerprint
  • Not there yet. Hard to use when insufficient light
  • Can only reognize about 100 different patterns right now for faces
  • Apple not giving access t fingerprint reader yet
  • Ok as second factor, but not ready for primary use. More of a gimmick than an authentication feature right now

Accelerometer

  • Can detect camera moving
  • Too much noise for authentication. Too hard to make same pattern repeatedly
  • Better for detecting whether walking or if on phone

Notifications

  • Only Safari has push notifications with browser closed
  • Local notifications widely supported. Good for finding out if have mail
  • Could use like SMS messages for security. “Someone else logged in as you”. Proactively notify users of security events.
  • Often have to accept acount sharing. Let user decide what to do

URLs:
caniuse.com – what browser support which features
authonthemove.com – has demo

My take
The client side hash is really interesting. It would be nice if browsers would help with/encourage that.