Case Notes from a Vulnerability Assessment of a Bank's Web Services

This session describes a systematic vulnerability assessment performed on the Web Services of a bank. The identity of the bank is not revealed.

The tests were performed in the context of compliance with Section 6 of the Payment Card Industry Data Security Standard (PCI-DSS). This stipulates that application code security is reviewed, and also recommends that a shielding solution is placed in front of the applications.

The session starts with a description of the business purpose of the bank’s Web Services. The tests were performed “blind”, so that over the course of the session, we find out about the physical architecture and make-up of the Web Services which are used to deliver the business value to the bank. Some of the information about the banks systems comes from output received from vulnerability probes, such as stack traces.

The taxonomy of tests is described, explaining how they fit into overall vulnerability assessment taxonomies. The battery of security tests is intended to be re-usable by the attendees in their own organization. The tests span XML content attack vectors, XML structural attacks, SOAP attacks, attacks which make use of SOAP attachments, and attacks which make use of REST architecture.

The assessment turned up a number of vulnerabilities. These includes vulnerability to malicious data being “smuggled” inside the XML data by means of covert channel techniques such as assigning data as “CDATA” to avoid parsing. A SQL Injection attack was also discovered. The discovered vulnerabilities are described.

The session also explains how the bank’s attempt to apply preventative security measures, such as SSL and XML Schema validation, actually proved to provide a false sense of security, and in fact introduced a number of security vulnerabilities of their own.

The session ends with recommendations for blocking the vulnerabilities which are discussed. A recommendation is provided to include protection against Web Services security vulnerabilities within the overall security framework, rather than treating Web Services security as an “island”. Following the session, the attendees will be able to assess their own Web Services applications for security, or “ask the right questions” to their organizations developers about the security measures which they are applying in their Web Services applications, including XML, SOAP, and REST style Web Services.