#something-awesome

Idea:

Understand and explain the OWASP compiled most critical security risk to web applications in a series of posts.

What is OWASP?

OWASP - Open Web Application Security Project, an online community working to contribute in the field of web application security. OWASP releases standard awareness documentation containing information about most critical security risk for developers and web application security.

Background:

I am a web developer by profession. Security is always a critical aspect to consider when developing any application, specially web-based application.

OWASP - Open Web Application Security Project is a go to place for web application security. I have always thought of going through the concepts thoroughly, but never got a chance to. I am taking this idea of something-awesome as an opportunity to go through the OWASP in details myself, do some research, and explain the concept in simpler terms with relevant examples where necessary.

This way I will involve myself in cyber security literacy, and build my security engineering skills, at the same time sharing with others in simpler language will help others learn without being overwhelmed.

Action Plan:

I will host a series of posts on “web application security 101″. This will act as security stepping stones for web-application development.

Every week I will be posting the concept, its implementations along with relevant examples where necessary.

Criteria

* Pass: At least a post on security topic from OWASP every week.

* Distinction : All OWASP Top 10 explained along with example where relevant.

Contingency Plan:

Despite the proposal stating that I was to make several dev blogs, the little amount of work, repeated breaks and time constraint in the end meant that I did not have time to write anything meaningful. This is the result of about 3-4 weeks of progress. GitHub link: https://github.com/Moop204/identity-manager Initial Start

Decided to start off making a Mozilla Firefox extension with WebExtensions API as it claims to offer easier portability between browsers and has significant documentation. Following the tutorials really opened up my eyes in terms of how easy it was to write an extension. It also reminded me of my intense hatred for javascript.

Going through the examples, the Menu demo seemed the most useful in making the skeleton. From there I decided to use the sidebar to hold most of the content so that more information would be easily accessible to the user. I also drew up a quick diagram of what I imagined the finished product would look like. [shifty skeleton menu]

[goal]

Bad Mistakes

After this point several assignments arrived which led to a pause in productivity. There was also several restarts of the project. The first was a move to using a React wrapper to avoid working with raw Javascript. This had to be reverted as the create-react-webextension was woefully outdated and not documented enough. After searching for related features of WebExtension, I found the Firefox Multi-Account Containers extension which seemed to achieve a lot of what I wanted to do. In particular it provided separation between tabs, associating each tab with a ‘container’ that held separate cookies.  As time was tight and it did not completely do everything I initially aimed for, I decided to extend it rather than develop an extension from scratch.

Pivoting

At this point the features expected to be implemented were the tracking ‘details’ for every identity. This was to be a key-value pair that could be compared across identities and notify users of similar information being used on different identities. This vastly reduced the scope into a manageable size with clear and simple goals.

Final Result

None of the technical implementations were completed. What was complete can be considered trivial. This was due to a heavy mismanagement of time. In terms of planning, too much time was spent researching on not very important details. In practice, work was not distributed throughout the several weeks where I had time to work on it. It led to most of the difficult and time consuming work to be left to be completed at the same time as mid semester exams and assignments.

Identity Manager Scope and Features

Most of the threats and issues mentioned in previous blog posts already have software that minimises or eliminates them or are outside the scope of this project.

ISP Logs – Outside the scope as it is collected by the gatekeepers of the internet and you have no access to them. Despite that the information provided by them can be minimised through the use of VPN to show a connection from you to the VPN rather than you to the website you intend to visit.

Cookies – Solutions exist for managing cookies including PrivacyBadger which determines which cookies are detrimental to your online experience and allows you to fine tune the cookies allowed. However the program may be able to manage the cookies in such a way that they are separate between identities.

Browser Fingerprinting – Solutions exist with the TOR browser that uses set window sizes to group together users and make it harder to identify individuals through browser fingerprinting.

IP Addresses – Solutions exist with the usage of VPNs, it is much harder to determine who requested what.  

HTTP/HTTPS – Solutions exists with the web extension HTTPS Everywhere which forces HTTPS on websites when you access them.

The program’s scope is usage within a web browser, with a focus on habits and the usage of social media. This aims to assist in the compartmentalisation of an online identity to allow a single person to have access to multiple identities without contamination .

This is hopefully achieved through the following features that deal with specific issues:

Account Management – Automates the logging on and signing off of accounts based on which online identity is in use. Removes the threat of contamination by which a person uses the wrong account to post which may allow others the link the two identities. An example from the 2019 Australian State Election can be seen above.

Enforced Separation – Compares given information across accounts and flags common details. Minimises cross contamination of identities such as in the case of Ross Ulbricht who used his gmail account to create accounts on public forums and lead to the authorities to further evidence to build their case against him.  

Content Warning – Identifying information, such as location and images, are highlighted and the user is reminded to check before they submit such information. This gets users to consider the impact of releasing that information to others which was not the case with Donald Trump’s visit to Iraq late last year where a video was released with the uncovered faces of special forces members.

While these features are most likely outside what is possible to complete within three weeks, they can be considered for future improvements.

Sync Accounts – Given a social media account, convert all the publicly available information into details about the account. Automates the collection of data so that no detail is missed.

Activity Tracking – Recording and visualising the activity of the user online. The amount of work required for this feature is high compared to its relevancy to the aim of the program.  

Sources:

Online Identity

Maintaining a truly anonymous presence online is difficult if you wish to interact with others. In addition to your software and hardware giving away information, the actions you do online also freely provide identifying information. As a result you end up taking on a identity regardless of what you do, however the extent to which that identity can be traced back to the real life you is the key issue.

Below are some components of an online identity. These are the more concrete aspects of an online identity and may be how your real identity may be exposed online.

Email

Used for communication directed at you. Often requires identifying information to set up such as phone numbers. Best made with an email service that asks for easily falsifiable information.

Due to the use of emails almost everywhere, emails should be disposable if they become compromised such as through leaked databases.

Credentials / Accounts

Grants access to your accounts online. Most of the time these accounts will form your identity online. Ensuring they are secure and only you have access is vital to securing your identity.

I.P. Address

Location of your device on the internet. Everything you interact with online has relatively easy access to your IP. It allows for the identification of your local area unless precautions are taken.

Personal Information

Anything that describes you as an individual. This information can be revealed directly, say by providing your location in a form, or indirectly through other actions such as being active at certain times of the day. This can extend out to include any expression of opinions and experiences as they build up a persona.

However in addition to these, online identities also build up a  reputation. The more involved an identity is involved in a community the stronger the reputation that they make for themselves. This allows them to exert influence upon others and obtain trust in an environment where anonymity still holds.  

Sources

https://matomo.org/wp-content/uploads/2012/01/How-to-remain-anonymous-online.pdf

Threats to Online Anonymity

With the advent of social networking, intelligence agencies across the world monitoring internet traffic and daily life becoming more and more interconnected with the online world it is becoming more difficult to hold any anonymity online. Due to the large scope of this topic, this report will be reduced to activities through a web browser which is one of the more common methods of  interaction over the internet.

Information about you is constantly leaking and available to much more than most would expect. Most of the time this transfer of information is invisible to the end user.

Metadata

Information surrounding the content that you provide or technology you use. Often these information includes time and location.

While metadata doesn’t contain the actual content, it can be used to establish patterns which can further identify personal information such as timezones (based on usage).

Geotags

Images may contain geographically identifying information in addition to the image itself. This can very accurately be used to determine if you were present at certain places.

Many images online are not scrubbed of this metadata, meaning they expose users locations.

ISP Logs

While what it logs and for how long varies between countries and individual ISPs, they all have the capability to record your internet activity and may be compelled by their respective government to provide information of that nature.

Cookies

They are the data websites send to your browser to store. This becomes a threat with third party cookies which can keep track of your presence across multiple sites. This allows them to make a profile of you which can be sold.  

Browser Fingerprinting

Using the combination of several browser preferences to produce a unique identification of a user. This is akin to composite keys in databases as there is a very small chance that there is someone else who will have the exact same browser setting. This is also used to create a profile based on your usage with its effectiveness based on how unique your profile is.

Content

This is the information you personally input and actively choose to give away. This can be used to identify you personally as well as compared with online aliases which can be connected back to you.  

Social Media

It is almost inevitable that identifying information will be released if you exist on social media. Social media will attempt to collect your information at every step and if you do not pay close attention you will end up giving it to them.

It is extremely easy to give away personally identifiable information as there are no external warnings or immediate consequence. However the consequences are lasting as once information is exposed on the internet it is very difficult to remove.  

HTTP

Connections using HTTP are not encrypted, allowing the content of the packets you send to be readable to anyone who intercepts it. This is problematic when private information such as credentials are submitted.

Sites of Interest

Panopticlick – Determines how unique your browser fingerprint is

https://firstpartysimulator.org/

Sources

https://pixelprivacy.com/resources/browser-fingerprinting/

https://www.privacyrights.org/consumer-guides/online-privacy-using-internet-safely

https://matomo.org/wp-content/uploads/2012/01/How-to-remain-anonymous-online.pdf

https://www.eff.org/encrypt-the-web

Something Awesome Proposal

Alias Manager

A browser extension for individuals to simply, quickly and effectively switch to and from aliases (online identity) as well as separate them to assist in preventing contamination.

Potential features: - Refresh IP/VPN service/other tracking features when switching - Track habits (visiting websites, usage hours, how long per website, form inputs) locally - Notifying users who wish to break the habit - Present tracked habits - Automated logging out when switching aliases

Plan

Week 3 - Report How are users tracked + Tracking over time/between websites

Week 4 - Report What are the contingencies/countermeasures to stop tracking + Features of tool

Week 5 - Dev Blog + Skeleton Code Initial planning documentation (estimates for each feature, breakdown of features)

Week 6 - Dev Blog + Half Features Completed Progress + Major changes to plans

Week 7 - Dev Blog + Feature Complete Implemented Features + Bug List

Week 8 - Dev Blog Bug Fixes + Usability + Reflection on process and result

Variations

Contingency

Pre-Week 5 (Research) Write the missed report in the following week, with an additional section on how the two reports relate to each other.

Post-Week 5 (Implementation) Explain what has to be reduced/changed in order to fit the missed time. Update estimates and schedules.

Pivot Strategy

Week 6 acts allows for the flexibility to reduce the planned features with an explanation if it doesn't go to plan.

Extensions

Deep analysis on extent of Australian government's tracking of citizens and non-citizens. (Report) Add automated activities (run alias at the same time/timed while you use the internet) (Implementation)

Goals/Rubric

Dev Blog/Report Writing

Expectations 2-4 pages per report, including documentation 2 sources minimum per report

Pass General outline of task with some documentation (images, videos, git repo). Writeup of reports and dev blogs.

Credit Explanation of task, goal, challenges with consistant documentation. Writeup of reports and dev blogs

Distinction Detailed explanation of task, goal, challenges, how it relates back to security, sourcing and consistent documentation.Writeup of reports and dev blogs

High Distinction Detailed explanation of task, goal, challenges, how it relates back to security, quality sourcing and consistent documentation.Writeup of reports and dev blogs with additional video run-through explaining how code enforces security/purpose.

Organisation

Expectations Documentation stored in Google Drive Link provided in report for week 4/5

Pass Has a plan.

Credit Detailed schedule exists with documentation.

Distinction Detailed schedule exists with most deliverables given on time.

High Distinction Detailed schedule which is updated constantly with most deliverables given on time.

Implementation

Expectations Host source code on Github Link provided in report for week 5/6

Pass Usable on at least one browser, with some features included

Credit Usable on at least one browser, achieves most of the features proposed at least technically (50%+)

Distinction Usable on at least one browser, most features achieved and intuitive interface