1
00:00:01,240 --> 00:00:03,790
Hello. My name is David Berry, and welcome

2
00:00:03,790 --> 00:00:05,840
to this course on Protecting Against XML

3
00:00:05,840 --> 00:00:07,670
External Entity and Deserialization

4
00:00:07,670 --> 00:00:10,440
Attacks in ASP.NET and ASP.NET Core

5
00:00:10,440 --> 00:00:13,500
Applications. When we think of attacks on

6
00:00:13,500 --> 00:00:15,720
websites and applications, we often think

7
00:00:15,720 --> 00:00:17,700
about things like SQL injection,

8
00:00:17,700 --> 00:00:19,890
cross‑site request forgery, or attacks

9
00:00:19,890 --> 00:00:22,580
against our authentication layer. However,

10
00:00:22,580 --> 00:00:24,520
there are other avenues of attack into our

11
00:00:24,520 --> 00:00:26,910
applications, and these can occur anytime

12
00:00:26,910 --> 00:00:29,730
our application has to read in XML or JSON

13
00:00:29,730 --> 00:00:33,380
or binary data and deserialize that data.

14
00:00:33,380 --> 00:00:35,440
These attacks can occur against any .NET

15
00:00:35,440 --> 00:00:37,770
application, whether .NET Core or .NET

16
00:00:37,770 --> 00:00:39,770
Framework, and they can occur against any

17
00:00:39,770 --> 00:00:42,540
type of application, not just web

18
00:00:42,540 --> 00:00:45,375
applications and APIs. In this course,

19
00:00:45,375 --> 00:00:47,000
we're going to talk about three such

20
00:00:47,000 --> 00:00:48,930
attacks and what you need to do to secure

21
00:00:48,930 --> 00:00:51,620
your applications from these attacks, two

22
00:00:51,620 --> 00:00:53,730
of which were on the OWASP Top 10 list for

23
00:00:53,730 --> 00:00:57,280
2017. The first attack we will discuss

24
00:00:57,280 --> 00:00:59,060
comes in at number four on the list, and

25
00:00:59,060 --> 00:01:00,960
is known as an XML External Entities

26
00:01:00,960 --> 00:01:03,170
attack. This attack seeks to exploit

27
00:01:03,170 --> 00:01:06,170
vulnerabilities in XML processors to read

28
00:01:06,170 --> 00:01:08,710
internal files and URLs from your system

29
00:01:08,710 --> 00:01:11,630
and exfiltrate that data. The second

30
00:01:11,630 --> 00:01:13,430
attack we will talk about is known as an

31
00:01:13,430 --> 00:01:16,410
XML Bomb, or Billion Laughs attack. This

32
00:01:16,410 --> 00:01:18,425
attack is not part of the OWASP Top 10,

33
00:01:18,425 --> 00:01:19,940
and it's been around for a number of

34
00:01:19,940 --> 00:01:22,300
years. And what it seeks to do is to use

35
00:01:22,300 --> 00:01:24,660
up all the memory in an application in a

36
00:01:24,660 --> 00:01:27,900
Denial of Service attack. The third attack

37
00:01:27,900 --> 00:01:29,600
we will discuss is an Insecure

38
00:01:29,600 --> 00:01:31,850
Deserialization attack, and this attack is

39
00:01:31,850 --> 00:01:34,150
listed at number eight on the OWASP Top 10

40
00:01:34,150 --> 00:01:36,510
list. This attack seeks to take advantage

41
00:01:36,510 --> 00:01:38,520
of insecure deserialization of data,

42
00:01:38,520 --> 00:01:41,520
whether JSON, XML, or binary data, to

43
00:01:41,520 --> 00:01:43,410
execute malicious code that the attacker

44
00:01:43,410 --> 00:01:45,520
has included in the document against the

45
00:01:45,520 --> 00:01:48,780
application. The good news is that while

46
00:01:48,780 --> 00:01:50,590
each of these attacks is serious, the

47
00:01:50,590 --> 00:01:52,370
modern versions of .NET have been

48
00:01:52,370 --> 00:01:55,040
configured in a secure by default manner.

49
00:01:55,040 --> 00:01:57,740
That is, if you use classes like XmlReader

50
00:01:57,740 --> 00:02:00,510
to read in and deserialize some XML data,

51
00:02:00,510 --> 00:02:02,750
the behavior of this class today is secure

52
00:02:02,750 --> 00:02:05,480
by default. There was a time when this was

53
00:02:05,480 --> 00:02:07,870
not true, and the default usage of some of

54
00:02:07,870 --> 00:02:09,310
these classes would result in a

55
00:02:09,310 --> 00:02:11,950
vulnerability. But today, the default is a

56
00:02:11,950 --> 00:02:15,050
secure mode of operation. With that being

57
00:02:15,050 --> 00:02:17,690
the case, you might ask yourself, why even

58
00:02:17,690 --> 00:02:19,990
learn about these attacks then? Well,

59
00:02:19,990 --> 00:02:23,360
there are three reasons. One, learning

60
00:02:23,360 --> 00:02:25,030
about these attacks helps us drive home

61
00:02:25,030 --> 00:02:26,700
the point about how important it is to

62
00:02:26,700 --> 00:02:28,800
keep your applications up to date on one

63
00:02:28,800 --> 00:02:31,205
of the latest versions of .NET. At the

64
00:02:31,205 --> 00:02:32,970
time of this recording, this is version

65
00:02:32,970 --> 00:02:35,660
4.8 for the .NET Framework and either

66
00:02:35,660 --> 00:02:39,420
version 2.1 or 3.1 for .NET Core. If you

67
00:02:39,420 --> 00:02:41,470
have old applications running on a version

68
00:02:41,470 --> 00:02:44,880
of .NET before version 4.52, you're going

69
00:02:44,880 --> 00:02:46,800
to be vulnerable by default, so you'll

70
00:02:46,800 --> 00:02:47,690
want to make sure to get those

71
00:02:47,690 --> 00:02:51,000
applications updated. Second, you might

72
00:02:51,000 --> 00:02:52,700
have an application that relies on some of

73
00:02:52,700 --> 00:02:54,390
the features that are exploited in these

74
00:02:54,390 --> 00:02:57,090
attacks. If this is the case, you want to

75
00:02:57,090 --> 00:02:58,990
learn how to remediate your code so that

76
00:02:58,990 --> 00:03:00,950
you can use these features in a secure

77
00:03:00,950 --> 00:03:04,030
manner. Finally, it is just good practice

78
00:03:04,030 --> 00:03:06,800
to learn all you can about secure coding.

79
00:03:06,800 --> 00:03:08,520
Just being aware of the various attack

80
00:03:08,520 --> 00:03:10,440
vectors and threats to your application

81
00:03:10,440 --> 00:03:12,930
helps you write more secure code. A

82
00:03:12,930 --> 00:03:14,900
developer who is well versed in all of the

83
00:03:14,900 --> 00:03:17,120
threats against their application is less

84
00:03:17,120 --> 00:03:19,460
likely to unintentionally or unwittingly

85
00:03:19,460 --> 00:03:21,890
use a feature in an insecure manner and

86
00:03:21,890 --> 00:03:24,760
open up a vulnerability. So with that,

87
00:03:24,760 --> 00:03:26,760
let's get right to it and talk about XML

88
00:03:26,760 --> 00:03:31,000
External Entity attacks and how you can defend against them.

