OWASP Thailand 2016 - Joomla Security

Joomla! Security

http://slideshare.net/akarawuth

...Security is a moving target, so today's expert might be tomorrow's victim...

http://slideshare.net/akarawuth

About Me

อัครวุฒิ ตำราเรียงAkarawuth Tamrareang

(JoomlaCorner)

[email protected]

twitter: @joomlacornerwww.marvelic.co.th

www.joomlacorner.com

Tel : 02-235-7629, 02-077-8366

- อุปนายกสมาคมศึกษาและพัฒนาโอเพ่นซอร์ส (OSEDA.or.th)- กรรมการผู้จัดการ Marvelic Engine Co.,Ltd.

www.marvelic.co.th

- Joomla! Bug Squad : joomla.org - Founder JoomlaCorner.com - กรรมการควบคุมจริยธรรม สมาคมผู้ดูแลเว็บไทย

- อดีตกรรมการบริหาร OpenSource Matters Inc. (Joomla Project)

- ผู้อำนวยการฝ่ายเทคโนโลยีสารสนเทศ สมาคมอาสาสมัครบรรเทาสาธารณภัยแห่งประเทศไทย

- ที่ปรึกษาสมาคมการดับเพลิงและช่วยชีวิต

mailto:[email protected]

http://www.Marvelic.co.th

http://www.joomlacorner.com

http://www.marvelic.co.th

Joomla! Website’s hacked?

Definition of “Hacker”• Someone who deliberately seeks to bypass a server’s

security • Black, grey, white hats • A hacked site is a broken/compromised site

• A skilled computer programmer • A hacked site is a tweaked and improved site

• A script kiddie • Junior hacker using other hacker’s tools and

techniques

Hack เพื่ออะไร?• โชว์ว่าทำได้ • ต้องการโจมตี • เพื่อการแสดงตัวตนในสังคมที่เขาอยู่ • เหตุผลทางการเมือง – hacktivism • เป้าหมายทางการเงิน

• Theft – steal ebooks, videos, games, online services etc • Sell data – user profiles, credit card details etc • Industrial sabotage - paid to break competitor sites • Set up zombie farms • Steal bandwidth • Host phishing pages • Collect passwords

เราจะรู้ได้อย่างไรว่าเว็บถูกแฮ็ก?

• Site trashed • Hacking message • High bandwidth use • Changed admin password • New user with admin rights • Server logs

Why do we care about computer security?

No ONE is SAFE!Type of site Motivation

Any site To see if they can To create mayhem Social standing Post political messages Zombie farms Steal bandwidth Host phishing pages

Any membership site Sell user profiles to marketers Obtain usernames and passwords

Some ecommerce sites Sell credit card details to thieves Sell order history and contact details to marketers

ทำไมถึงต้องกังวลเมื่อเว็บไซต์ถูกแฮ็ก?

เมื่อเว็บไซต์ถูกแฮ็กจะเป็นปัญหาใหญ่ต่อ • ชื่อเสียงของธุรกิจ • ลูกค้าโกรธ ไม่พอใจ • Site ถูกปิดโดยผู้ให้บริการโฮส • ธุรกิจเสียหาย • ข้อมูลถูกขโมย

source : https://blog.sucuri.net/2016/09/hacked-website-report-2016q2.html

https://blog.sucuri.net/2016/09/hacked-website-report-2016q2.html

ส่วนใหญ่ของเว็บไซต์ที่ถูก Hacked มาจาก misconfiguration, hosting ไม่ปลอดภัย หรือ

vulnerable code.

การทำ Joomla! ให้ปลอดภัย

• Server operating system

• Server Software

• PHP + MySQL

! Joomla

! Extensions

! Users and their behaviour

Joomla! Security Involves

1. Updating Your Server Operating System 2. Update your Server Software e.g. Apache, Nginx, IIS,

Litespeed etc 3. Update Your PHP & MySQL Server 4. Secure Your Server

Security Action plan

Joomla! SecurityServer ~ Security

1. The underlying Operating System must be updated 2. Updating the Webserver

e.g. Apache, Nginx etc 3. Updating the PHP and MySQL 4. Securing the Above 5. Installing additional Security layers

Joomla! SecurityServer ~ Security Hardening

1. Securing Apache Webserver Adding web headers to block XSS etc.<IfModule mod_headers.c>Header set X-XSS-Protection: "1; mode=block"Header set X-Content-Security-Policy: "allow 'self'; options inline-script; img$Header set Strict-Transport-Security: "max-age=43200; includeSubDomains"Header set Cache-Control: "max-age=3600, public, must-revalidate"Header set X-frame-options: "deny"Header set X-Content-Type-Options: "nosniff"#Header set X-Content-Security-Policy: "default-src 'self'"Header unset X-Powered-ByHeader unset X-Pingback</IfModule>

2. Hide Server Signature


3. Activating .htaccess override in Apache conf• .htaccess files

• [1] Activate the htaccess file in the Joomla root

• [1] Use an .htpasswd for the /administrator/ folder

• [3] Advanced .htaccess files


1. Hardening PHP with SUHOSIN 2. Use PHP Disable function

show_source, system, shell_exec, passthru, exec, phpinfo, popen, proc_open 3. Do not expose PHP Version expose_php = off 4. Use open_basedir (restriction file handling functions)


• Globally reset all files

• Owner – AccountUsername:AccountUsername chown -R user:group *

• Files – 644find . -type f -exec chmod 644 {} \;

• Folders – 755find . -type d -exec chmod 755 {} \;

Use suPHPPHP files are run under the user of the website instead of the Apache user


1. Hardening MySQL server 2. Disable access from outside (allow local connections) 3. Make sure using Password or after setup, run

mysql_secure_installation command

Joomla! SecurityServer ~ Additional Security Hardening

1. Add additional firewall e.g. CSF firewall 2. Add modsecurity firewall ~

apache module that helps to protect your website from various attacks. It is used to block commonly known exploits by use of regular expressions and rule sets

3. Install Malware detector such as maldet 4. Install rootkit detector 5. Install fail2ban / IDS (intrusion detector)

Joomla! SecurityUse CDN for security

1. Prevent DDOS 2. Stop Hackers 3. Secure website from attack

Joomla! Security Checklisthttps://docs.joomla.org/Security

Upgrade to the latest stable version of Joomla! as soon as possible. Download Joomla! from official sites only, such as JoomlaCode.org, and check the MD5 hash. Use Web Page Diagnostic Tools, i.e. Firefox Firebug, IE Web Developer Toolbar, Opera Dragonfly, etc. to ensure that all files were installed correctly.


Install official versions of Joomla!http://www.joomla.org/download.html

Install official Updates from Joomla!To avoid breaking your site, search the forums for reports of incompatible extensions before upgrading to a new version of Joomla.

http://www.joomla.org/download.html

http://joomlacode.org/

https://docs.joomla.org/How_to_determine_a_package_checksum

https://docs.joomla.org/Web_page_diagnostic_tools


Default administrator usernameChange the user name of the default admin user. This simple step effectively increases the security of this critical account 50% by modifying one of the two variables attackers must know to gain access.

Never use easy to guess passwords, avoid at no cost. e.g. admin123, passwords, 123456

Use mix characters (upper and lower case) with special characters. e.g F1$hn3Tw0Rk, use more than 8 digits

Administrator passwords


Limit superadminLess superadmin, mean less problem

Disable registration, if you are not running social sites, or if your website is limited to your employee

If you are not running Social site, disable registration


Protecting directories and filesAll configurable path must be rewritable Must never use chmod 777, chmod 755 is sufficient for directories and 644 for files. Use .htaccess to disable directories such as images and download from running php files.

# secure directory by disabling script execution AddHandler cgi-script .php .pl .py .jsp .asp .htm .shtml .sh .cgi Options -ExecCGI


Remove all unneeded files and extensionsAll unneeded and unused files and extensions must be remove

In general, do not leave any unneeded files (compressed or otherwise) on a public server. Each unused (and perhaps long forgotten) file is a potential security hole.


Installing Joomla! Extensions1. Always backup 2. Check for extension vulnerabilities 3. Download from trusted site 4. Check code quality of the extensions 5. Test on development site 6. Remove junk 7. Avoid encrypted code

Joomla! SecurityHow to secure Joomla!

เปิดใช้งาน SEF เพื่อสร้างเว็บไซต์ที่มี URL ที่ง่ายต่อการค้นหา ทั้งยังช่วยสร้างความปลอดภัยทำให้ผู้ไม่หวังดีทราบเครื่องมือที่ใช้ในการพัฒนาเว็บได้ยากขึ้น โดยเข้าไปตั้งค่า SEF ได้ที่ Site >> Global Configurationบน tab Site เลือก “Yes” ในหัวข้อ Search Engine Friendly URLs

Enable Search Engine Friendly (SEF)


Two-Factor Authentication is a login method whereby a person has to provide his/her user name, password and a random generated OTP (One Time Password).

OTP is six numeric digit code, generated by cryptographic functions in a short interval. Even if a hacker was to guess your Joomla Administrator username and password correctly, they would still require the OTP to login.

To enabled Two-Factor Authentication requires Joomla 3.2.0 or higher. 1.Login into the Administration area. 2.Click on Components >> Post-installation Messages. 3.Click on Enable two-factor authentication. 4.Install a Google Authenticator compatible client for your device.

Implement 2 factor Authentication

http://en.wikipedia.org/wiki/Google_Authenticator#Implementation



www.yubico.com


Trying to inject spam content onto your site Targets Joomla core forms and extension forms

Use captcha to fight against automated spammers


Use security extensions


Disable FTP access from Joomla!

• If a hacker can obtain your FTP password, they can login as you, bypassing almost every security barrier.

• FTP passwords are stored unencrypted in your FTP program!

• FTP authentication details pass unencrypted to the server!

• There are several common FTP apps that store their passwords in a standard location with a standard name!


Make sure to check for Joomla!/extensions Update


Preparing for the Worst

Are you ready?


Preparing for the Worst

1. Site monitoring 2. Joomla site backups3. Restoring a hacked site

Joomla! Security Site monitoring

• Diagnostics• Site down

• Home page content changes

• Mod_security logs (shows attempts)

• Bandwidth use

• Spam blacklisting

• [3] Searching and browsing server logs• Site Monitoring• https://uptimerobot.com • http://www.monitor.us• https://watchful.li• https://myjoomla.com

https://myjoomla.com

Joomla! Security Joomla! Backup

How to backup? 1. Manual backup through command line. (database) 2. Using extensions such as Akeeba Backup, EJB and XCloner

What to backup?1. All files 2. Images or docs

REMEMBER TO TEST YOUR BACKUP

https://developer.joomla.org/security.html

https://docs.joomla.org/What_version_of_Joomla!_should_you_use

• Secure Administrator Login with strong password

• ทำการ Backup เป็นประจำ

• Use secret key to login into Joomla Administration

add secret key to access administrator URL. เช่นใช้ jSecure & kSecure

http://extensions.joomla.org/extensions/access-a-security/site-security/login-protection

• Are you using latest secure version of Joomla?

การดูแลให้ Joomla! มีความปลอดภัย (1)

• Enable Search Engine Friendly (SEF)

• Delete unwanted & avoid third party un-identified developer’s extension

• Scan your website (http://sitecheck.sucuri.net)

• ImplementTwo-FactorAuthentication

การดูแลให้ Joomla! มีความปลอดภัย (2)

Google Webmaster Tools

Q & Awww.marvelic.co.th

www.joomlacorner.com

https://www.facebook.com/akarawuth email : [email protected]

Tel : 02-235-7629, 02-077-8366

...Security is a moving target, so today's expert might be tomorrow's victim...

http://www.Marvelic.co.th

OWASP Thailand 2016 - Joomla Security

Technology

Transcript of OWASP Thailand 2016 - Joomla Security