AppSensor Guide Application-Specific Real-Time Attack Detection & Response Version 48 (Draft)
Chapter 22 : Light Touch Retrofit
Download 11.95 Mb.
|
- Navigate this page:
- Description
- AppSensor scope
- Source code
- Implementation
- Related implementations
Chapter 22 : Light Touch RetrofitIntroductionIn this demonstration implementation, an application has been instrumented with custom-written code to show how AppSensor functionality can be retrofitted to an existing project. The implementation does not make use of any AppSensor Project’s library code (as described in the previous two chapters above). The application used in this example is the bulletin board application phpBB115, released under the GNU General Public License116. The implementation was performed in a manner that effected as little of the original code as possible. This demonstration implementation does not form part of the core development efforts within the OWASP AppSensor Project. DescriptionDetection points were added by the additional of minimal additional PHP code without altering the phpBB source code. Additional fields were added to some of the application’s database tables together with new tables for the event and attack stores. An existing phpBB feature which allows “banning” of submissions by individual users was utilized as one response by inserting records into the relevant database table; a second response was added external to the code base by using the host firewall to block IP addresses. Schematic Arrangement of Example Light Touch Retrofit to Existing Code 
AppSensor scopeThe following detection point and response action categories are included: List of Detection Point Categories Implemented in this Example Light Touch Retrofit
List of Response Categories Implemented in this Example Light Touch Retrofit
In this case, the response action function disabling utilizes phpBB’s inherent “block” functionality and application disabling is accomplished by blocking using the host network firewall level. In this implementation, it was accomplished by using the “netsh advfirewall firewall” command117 for Windows Firewall, but iptables could be used on *nix systems, and similarly for other operating systems; an external network device could also be used. Source codeThe phpBB bulletin board application can be downloaded at: https://www.phpbb.com/downloads/ PHPIDS as a blacklist input exception detection point. PHPIDS, default_filter.xml and converter.php can be downloaded from: https://phpids.org/downloads/ The additional database SQL scripts and PHP files can be downloaded at: ???TBC??? [check] This is proof of concept code and is neither optimized nor production-ready.
ConsiderationsThe PHP implementation of the event manager needs permissions to perform real-time changes to the host-based firewall. This could be changed to signal a separate network firewall instead. This implementation is no longer under development. Related implementationsNone. Directory: images -> archive images -> World-renowned vocal ensemble sweet honey in the rock images -> Peoples Voice Café History archive -> J. Welles Henderson Archives and Library archive -> The Heartbeat Beacon Abstract archive -> E9-1-1 Heartbeat Abstract archive -> HL7 Mobile Health Application Functional Framework; Consumer mhaFF, Release 1 (pi id: 1182) archive -> Opensfs benchmarking Working Group I/o survey Report archive -> Opensfs benchmarking Working Group I/o survey Report archive -> Need a computer and can't afford one? Download 11.95 Mb. Share with your friends:
| ||||||||||||||||||||||||||||||||||||||||||||||