Keys Under Doormats: Problems and Solutions for Securely Storing Credentials in Web Applications

No ratings

Presented at GlobalAppSec-DC 2019 by

Dmitriy Craig

Encryption keys and passwords are truly "keys to the kingdom." Acquiring them allows attackers to open all kinds of doors, and yet developers are often careless about how they handle them. We often see passwords and keys hard coded in the application source, stored with minimal obfuscation in configuration files, and in plaintext in databases. As a result, they fall victim to reverse engineering and software vulnerabilities such as Path Traversal, XXE, Local File Inclusion, and others.To help illustrate these risks we review the most common methods of storing credentials in an application, and discuss best practices for storing them, such as using keystores.Once your secrets are properly secured, however, there is an important remaining issue -- how do you secure the Master Key? The security of this “key that secures other keys" (often referred to as the Key Encrypting Key or KEK) is critical to the security of the system. Would it not be vulnerable to the same issues we just tried to solve with keys and passwords? In our presentation we discuss preferred ways for securely storing KEKs, from hardware to software, and their relative costs.We propose several low cost ways for storing KEKs that any application can afford to implement, including what we believe is a novel approach that is resistant to remote attacks up to and including path traversal vulnerabilities where the attacker can obtain the contents of all relevant files. We then conclude by offering our open source library that helps to achieve that.