252: Security Testing in 2019 with SecureGuild

Shall we play a game? How can I ask you that?

How about Global Thermonuclear war sign?

All right.

Hit it.

Welcome to the Test Talks podcast, the place to go to geek out on software testing. And now your host whose mission is to help you succeed with test automation, Joe Colantonio.

Hey, it's Joe. And welcome to another episode of Test Talks. Today we'll be talking all about security testing and why I think it's really important. So I'm going to give some reasons why I think it's important. There's some new topics in the news that really got me thinking about how important security is and it's becoming more and more important, I think as time goes on, but I see less and less folks even incorporating it into their software development lifecycle. I think there's a need for us to get more involved in security tests and I love to know what you think and in fact, I really need your help. I'm kicking around an idea to keep test hooks to just end to end functional automation type topics. We still would cover other topics like security and performance at a high level, but for more detailed topics around security testing or performance testing, I was thinking of spinning off the show into two other separate podcasts dedicated one to security testing called Secure Guild and the other to performance testing called Perf Guild. Of course I have limited time, so I want to make sure this is a good idea before I start having three podcasts that I release every week. So I'd love to get your opinion. Do you find any value hearing about the nitty gritty of security testing on the show or or performance testing just because I just assume people listening to the show are mainly people that really focus in on automation testing, end to end testing testing in general, but may not necessarily get into the weeds with topics like security testing and performance testing. So hey, let me know. Head on over to testtalks.com survey and you could take a five second survey just to let me know if a you would even listen to a podcast dedicated Security testing or. Or performance testing or if there's another topic you think this should be covered or if I should just keep everything under Test talks and keep it easy. It's up to you. Let me know. Would love to hear your opinion.

Test Talks is sponsored by the fantastic folks at Sauce Labs, the cloud based automated testing platform that eliminates the need to maintain your own selenium grid and test infrastructure. Try it for free today. Visit testalks.com and click on the sign up now link under the Homepage sponsor section.

So the three pieces of news I've seen recently that really got me thinking about security testing. The first one is hackers say they can remotely kill a car engine via Komis GPS app. So to me this is really scary because as we move towards more IoT type devices, I think we're going to see more and more of these type of exploits. And just imagine as cars become more they start self driving themselves. If hackers are able to actually hack into that software and be malicious about it and cause crashes, disasters, that's not a good thing. I think this is something that people may think of, may not even think about. They may think it's like, oh, that's not possible. But I think these type of situations are very real and I think they're going to become even more real as time goes on. So as I said, IOT been talking about IOT for a long time, but I really think eventually IOT really is going to take off and I think there's going to be a lot of these headless type technologies out there that because they're headless, people don't think about, hey, I wonder if people can exploit it. And actually, in fact, in one of my earliest episodes I spoke with Troy Hunt all about his costs on how to hack your API security test. And actually in his course, which is a pluralsight course, I highly recommend it, he actually goes over how easy it is to actually put a sniffer onto certain devices and be able to capture the traffic going back and forth between to capture the traffic going back and forth between the two devices. And because it was headless, he said a lot of developers don't even think about it because they think, oh, who's going to do this? But he actually shows them the cost, how easy it is to use a tool like Fiddler or wireshark to capture that traffic and see that people didn't even encrypt a lot of the information they were passing back and forth, which makes it very easy to hack those types of devices because security is not baked in from the beginning with the design. And so that is one major reason iot. And I think a lot of these headless devices gives us a false sense of security because there is no front end. We think no one's going to be able to look behind under the covers. And in fact, as Troy Hunt pointed out in episode 21, it's actually very easy to do.

Fiddler is a pretty popular tool among many developers and many of them use it for debugging. So that they can look at the HTTP request that the PC they're running it on is sending to a service or to a website. And what a lot of people don't know is that Fiddler can actually act as an HTTP proxy. So when you go into the settings in Fiddler, there's a Connections tab and you can say, allow remote connections. Now, as soon as you tick that guy, you can go to your iPad or any other device that you can configure a proxy on and tell it to use the IP address of your PC as a proxy. So effectively what's happening now is everything you do on that device is now routed through Fiddler. So just like you can open Fiddler and see all the requests from your PC, you can see all the requests from this external device. And that's how simple it is to actually find how the device is communicating with the backend. Now, the other thing that that then leads onto is that you can use other tools within Fiddler to probe away at the way the service is operating. So, for example, you can use Fiddler script to modify the request or modify the response. So in the course, I show how, when we log on and we get a response that indicates I'm not an administrator, what happens if we use Fiddler script to change that response and say, look, I am an administrator. How does the app respond differently? And is there a vulnerability in that?

So that was Trey hunt from episode 21. You can hear the full episode@testtalks.com 21. The second item is a. A mysterious hacker gang is on the supply chain hacking spree. And basically what they've done is they broke into a developer network and they were able to hide malicious code within the apps and the software updates that the users already trust. So this happens to be supply chain software, but because it's software that people already trust. And also this happens a lot with open source. People may just download and install it without thinking that there's any, any issues with it. There's no security issues. But by doing this trick, by fooling people into thinking that what they're downloading is secure from a trusted source, they put in malicious malware into the code. And so they're able then to hack and do all kinds of very seedy things. So that's the second item. And the third one to me is really scary. And this is on TechCrunch. I just saw it maybe last week. So just four days ago, I was looking on TechCrunch and I saw an article on hackers went undetected in Citrix internal network for six months. Six months, they were able to hack in and do all kinds of things. Estimates are they were able to access maybe six terabytes of information. And that information contained things like passwords, Social Security numbers, financial information. So if you're a company, you know, this really kind of blows your credibility, especially if you have things in the cloud like Citrix. Exploits like this not only affect the brand of a company, but also could turn into layoffs if you work for those type of companies, because people might stop trusting that product or buying the product and therefore lost revenues and to make up for it could lead to layoffs and other side effects. So really scary stuff. And know even if you don't care about security per se, just for your self interest as a tester, I think it's a good idea to be concerned about it. So if you listen this far, you're probably thinking, okay, Joe, where are you going with this? Well, I'll be honest, what I'm going with this is for another online conference happening in just two weeks called Secure Guild. And one of the reasons why I put Secure Guild together is I felt like that there were limited resources online that people can go to talk all about security testing from a tester's perspective. And so that's why I put together SecureGuild, the first ever happening May 20th to the 21st. And as I told you in the previous episodes, I'm trying to feel my way around my flagship online conferences, Automation Guild. It's the biggest one. I think it's the biggest one in the world. It's bigger than a lot of the popular on site automation conferences. We have over 700 people the past three years, so it's pretty huge. And I love it. I want to put all my focus in on it. However, I think there are other areas, other niche areas that are underserved and really need a type of resource where people get together once a year to learn more about it, to keep themselves up to speed on what's going on in the industry for those particular niches. SecureGuild is the first time I'm doing it, so I'd love to know if you think it's an area you think should be addressed. So if you do think it should be addressed, just head on over to SecuraGuild.com and register. But I thought we'd go over some of the speakers, a few of their sessions to go over what you're going to learn. Like most Guild conferences, a lot of them are hands on. They show practical, actionable things that you can do. And these are experts, experts from owasp, from some big companies. And I thought we'd listen to a few of their sessions so you can get a feel for what type of content will be at the conference in two weeks and whether or not it's something you could benefit from, which I hope and think it is. And like I said, it's a topic I think we all should be concerned about. All right, so the first one is from Morgan Roman from DocuServe, and his topic is integrated security testing. It's a pretty cool session. He shows how to use Selenium. So your existing Selenium test how you can just hack it a little to be able to modify them and reuse them to test things like cross site scripting exploits. And I forgot to mention this, there is a another item of news talking about site vulnerabilities to xss, which can be used to phish googlebots and the common security vulnerability that's being exploited. Their technique, they're using cross site scripting. So Morgan's session actually is a great way to learn about how you can avoid those types of vulnerabilities in your own applications.

Hi, my name is Morgan Roman and I work as a security engineer at DocuSign. Today I'm going to introduce you to a very interesting methodology called integrated security testing. Integrated security testing is a powerful tool that I have used to find lots of interesting security bugs in any web application that I encounter. It's not only useful for finding the bugs, but it ensures that the bugs stay close. Mainly this works by taking an existing Selenium test or any other kind of test, and then adding a simple security payload to it and then adding some extra detection onto it. Now, this may seem complex, but we're going to make it very simple. First off, we're going to find one particular bug called cross site scripting and then we're going to go into details on how this works and there'll be a quick presentation about that. And then we're going to go back into the code and then modify things to then find this interesting bug. So let's get started.

Awesome. Thank you, Morgan, for that session. Like I said, I never knew you can use Selim to do this. So it really was a cool session for me that I'm going to try to take those techniques and bring them into my company to try to get started with security testing myself. So another common issue is firewall issues. So once again in the news, if you went to Security Week I think in February they talked about how Cisco informed customers that they become aware of a malicious attack attempting to exploit a recent patch vulnerability affecting the company's software. So I'm really excited to have security expert Francisca Buehler joining us to talk about testing your web application firewall and making it your friend.

Hi, my name is Franziska Buhler. Welcome to my session. Test your WAF and make it your friend. In today's session we are going to explore the WAF mod security with the OWASP core rule set and how it can be tested to avoid potential problems in production. But first of all, let me briefly introduce myself. I'm an architect working at Puzzle itc, a Swiss company. And my job is to add security everywhere for our customers and our company. That's why I'm very interested in web application firewalls and maybe also because I'm one of the co developers of the OWASP Coral set. A WAF is really a good thing. It protects you against web application attacks like those described by the OWASP top 10. But it can unfortunately also lead to false positives in production. Therefore, we have to test the WAF early in the development life cycle. But what do we have to test and how do we test? Which tests do we perform? That's what we are going to explore today.

Very cool. Thank you Francisca for that session. Another session we'll have is on Understanding the Most Common Security Coding Standards in Use Today by Arthur Hicken.

Hello and welcome to Understanding the Most Common Security Coding Standards in Use Today. My name is Arthur Hicken. I'm also known as the Code Curmudgeon. I've been working at Parasoft for over 25 years on a whole bunch of different things around software development, development, security. A couple of fun things you might enjoy are my Halls of shame about SQL injection, Hall of Shame and the IoT hall of Shame. And I've got a Twitter feed, Facebook and all that other fun stuff. So let's dive right in. Now software security is more than just what we think about with system security. It's not antivirus, malware, firewalls, things like that. It's about building software correctly in the first place so so that it can't be penetrated. So to do that we use coding standards and static analysis is how you enforce coding standards. Now there's a lot of different kinds of static analysis and it's important to understand because some static analysis things are either runtime or similar to runtime. Some are what they call flow analysis. Or data flow analysis, where the application kind of simulates what's happening without actually executing. And then there's really preventative standards as well. So for an example on how this works, a runtime tool might find out that I have uninitialized memory because the application's running and I was monitoring it. A flow analysis tool will look at the code and pretend to execute it and say, oh, look here, you might be using some memory that's uninitialized. Now, it won't catch everything, and sometimes it's wrong, but it's pretty cool because it does a bunch of work for you without any effort. Now, the pattern methodology means that I'm going to create a rule in static analysis that doesn't allow memory to be uninitialized. So for example, my rule might say that when you declare a variable like an integer, that you must assign it as soon as you declare it. And that way it's never uninitialized. So just recognize that some coding standards are designed to detect problems, to look for bugs. Kind of an earlier testing and pen testing exercise and other static analysis strategies are designed to prevent problems by enforcing proper behavior rather than looking for improper behavior.

So to find out more about static analysis and how to incorporate it into your pipelines to help you developers find security issues earlier and earlier in the software development lifecycle. Really shifting left. You don't want to miss this session. Head over to secureguild.com and register today. And speaking about bringing tools, security tools into your pipeline, another awesome session we have is Hacker Tools for Developers and Testers Adding Security Tests into the Pipeline by Jamal Harris.

I'm a penetration tester at Digital Interruption and over the last few years I've been attending more QA testing events. These have been fantastic. And the one thing I quickly noticed was the amount of work being put into automation. Unfortunately, this hasn't quite happened yet in security. We do have some great tools, some fantastic business software that we use to help us with security testing, but they are very much tools for hackers by hackers, if that makes sense. They often have clunky UIs or sometimes archaic command line interfaces. So I believe that we need more hacker tools for developers and QA testers, which is the motivation behind this talk. We're going to see if we can take a tool that I use regularly for pen testing mobile applications. It's called Frida. And we're going to see how we can adapt it so that we can use it in a CI pipeline. I think this makes it more Useful for devs and the QA workflow. One of the disadvantages of a pen test is that a pen test is very much a point in time. We have the ability to say that this pentester found these vulnerabilities when they looked at this application at this point in time. And even if these vulnerabilities are fixed, there's no way to know whether they're going to be reintroduced at a later date. Unless, of course, we redo the pen test. The alternative is to try and build our own tools that will try and perform these checks when the application is built and plug these into some kind of build pipeline.

So you definitely want to check out Jamal's session at this year's Secure Guild to learn how to do that, how to add security testing into your pipeline. We also have sessions from some other awesome experts that can help you get up to speed with security testing. So not only do I think it's important for you to test security in your applications as a tester, but I also think for your career it's really important. If you go to the Bureau of Labor Statistics and look up, look up security analysts. The employment projection for security experts Is to grow 28% from 2016 to 2026, which is much faster than the average for all occupations. Demand for information security experts is expected to be very high. And these analysts will be needed to create innovative solutions to prevent hackers from stealing critical information or causing problems for computer networks. And so the reason why I bring that up is one of the sessions is by Dwayne Thomas and that is switching from QA to production security. And he goes over how he moved from QE to product security and what he did, the types of things he did to get up to speed with security testing in order to make that transition. Really great stuff. We also have sessions on other sessions on pipelines using static analysis to help you with security testing. We have Dr. Jared DeMont joining us in Ask Us Anything Roundtable on security testing. We have Hassan Yousaf talking about challenges in implementing and sustaining DevSecOps environments. We have a session on cloud security and myths around it by Vandana Verma. We also have Altaz Vellani talking about threat modeling at scale, moving from DevOps pipelines to to a risk driven enterprise. And we also have Dawood Ballou from Test Army Cyber Forces. So really great lineup. Check it out. I really think you can get value out of this conference that's going to help you with not only security for your software, but also your career. Check it out. Register now, head on over to secureguild.com and if you haven't already, make sure to head over to test talks.com and click on the sign up for a free trial link under the Exclusive Sponsor section to learn all about Sauce Labs awesome products and services. If you want to have another podcast separate from Test Talks, dedicated just to security testing, love to know your thoughts around that as well. So that's it for this episode of Test Talks. I'm Joe and my mission is help you succeed with creating automation awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Talks podcast. Head on over to www.testtalks.com for full show notes, amazing blog articles, and other automation awesomeness.