�ݺ�ߣ

The weak points in our systems
Are your dependencies getting you down?
Thomas Shone – Senior PHP Developer
PHP South Africa - Oct 2013

Copyright © 2012 Clickatell. All rights reserved.
About me
 Senior developer for Clickatell
 Work remotely from Grahamstown in the Eastern Cape
 I like to break things

The bare minimum we SHOULD be doing
 Preventing SQL injection and sanitizing user input
 Email and cellphone verification
– Mitigate social engineering against support team
 Salting and using strong hashing for passwords
– As of PHP 5.5, www.php.net/password will make this trivial
 Forgotten password resets done by email link
 Use OAuth or OpenID
 Two factor authentication
– High risk data
– Premium support verification
– Off-site staff authentication method

What the blogs haven't warned us about
 No coder is an island
 We all rely on:
– 3rd party libraries
– Frameworks
• Symfony
• Zend
– CMS packages
• Joomla!
• Wordpress
– E-Commerce software
• osCommerce
• Magento
– CRM software
• SugarCRM

So... time to come clean... I've done it too
 Perception
– Using a version of Smarty without vulnerabilities (3.1.12)
 Reality
– 4 versions of Smarty.
– Version 2.6.26 with 11 Vulnerabilities (7 critical)
 The other three were dependencies of another front end
system
 Developers had not updated Smarty since 2009 (the version
they are using was released in Dec 2005)

Lets get some real world data
 43 popular open source web applications, libraries and
frameworks.
 3,421 versions
 5.6 million files

Some graph explanation
Mean / Average
Median
The Doom Line

Insert the title of your
long presentation
names here
Enter your subtitle here
Some actual numbers please

Where does the blame lie?
 Wordpress and Joomla!
– Highly popular = Highly targeted.
– Fix released before the vulnerability disclosed
 Libraries not so well behaved
– Most of the libraries found where vulnerable
– OpenX had a backdoor in their code base
 Frameworks came off well
– No vulnerabilities for the versions found
Reference:
http://blog.sucuri.net/2013/08/openx-org-compromised-and-downloads-injected-with-a-backdoor.htm

long presentation
names here
Lets get a little ageist here

long presentation
names here
What's the sell by date

long presentation
names here
Lets just put those together

Some good news at least
 We were looking at the worst of the worst
– SMB with little technical knowledge
– Freelancer CMS deploy
 People will fix what they know is broken
– Growing awareness
– Emergence of auto update tools
– Software houses and freelances, up-sell those maintenance
contracts

long presentation
names here
How much has the situation improved

And for the developers
 Means of distributing 3rd party code is improving
– Composer
• Don't commit dependencies... specify
• Major release locking
• Simple update mechanism

@thomas_shone
www.shone.co.za
Questions?

�ݺ�ߣ

PHP SA 2013 - The weak points in our PHP projects

More Related Content

PHP SA 2013 - The weak points in our PHP projects