Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

9/30/2014
07:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

How A Major Bank Hacked Its Java Security

Deutsche Bank London helped create a new application self-defense tool to lock down and virtually patch its Java-based enterprise applications -- even the oldest ones.

Deutsche Bank AG London has what many large enterprises have: numerous internal applications based on various versions of Java, many of which are older and can't be patched nor updated. So the bank helped develop a tool that sits below the application to detect and prevent attacks and apply virtual patches.

The bank, a subsidiary of Deutsche Bank AG, made the move after it inventoried its hundreds of internal applications and discovered a mix of old and new versions of Java, some of which were legacy applications that had become increasingly difficult to patch or update. Oracle's Java infamously has been riddled with security vulnerabilities, and Java client machines have become a favorite target of attackers.

"We [had] uncovered a large degree of variance of Java deployed in the bank's infrastructure," Hussein Badakhchani, vice president of Deutsche Bank London, says in an exclusive interview with Dark Reading today. His application group teamed up with IT security to determine how to secure the large number of legacy Java applications running at the bank.

The initial goal was to convert its applications -- everything from payments to training apps -- to a new platform-as-a-service the bank had built based on Java Virtual Machine (JVM). "We wanted to move away from DIY to a managed service" for enterprise applications. "The question becomes 'If you can't decommission an application and you can't operate it [or update its Java version], what can you do with it?'"

The bank worked with security vendor Waratek to create a tool that runs within JVM and efficiently secures legacy Java applications. Call it application self-defense: The result was a software solution that uses what Gartner analyst Joseph Feiman calls a "self-protecting" application approach, or Runtime Application Self Protection (RASP). According to Feiman, RASP detects and blocks attacks, and it operates in the application's runtime environment.

"Modern security fails to test and protect all apps. Therefore, apps must be capable of security self-testing, self-diagnostics and self-protection," he writes in a new Gartner Maverick Research report on RASP. Gartner predicts that 25% of web and cloud applications will become self-protecting by 2020; fewer than 1% operate that way today.

It's a natural fit, according to security expert Dan Kaminsky. "The JVM -- and CLR [Common Language Runtime] and even the various JS [JavaScript] engines -- are designed to detect many errors. Why not instrument them for security and see what comes up?" Kaminsky says. "Over time, the languages and platforms we use increasingly support securing the applications we write on top of them. More importantly, the cost of that security diminishes as the platform shoulders more of the burden."

Kaminsky, chief scientist at WhiteOps, says it's not so much about Java's security problems as it is about looking at a way to apply security to multiple different applications, at scale.

"Traditional WAFs [web application firewalls] can often be somewhat distant from the platforms they're securing" says Kaminsky, who also serves as a technical adviser to Prevoty, a competitor to Waratek in the RASP space. "What if there was deeper integration? What if the WAF didn't have to guess what the end application saw, what if it could ask… or if it was alerted in case of problems?"

Deutsche Bank London had battled the headache of off-cycle patching for zero-day vulnerabilities that occur outside its orchestrated, regular quarterly patching cycles. "Problems arise from unscheduled patching events for zero-day exploits," Badakhchani says.

The new RASP approach provides virtual patching to the bank's Java-based applications, so the bank doesn't have to deal with out-of-band patching. Even the regular patching cycle can be disruptive. "To try to remedy every vulnerability, when you have 600 business applications, the amount of work you need to do in standard patching is extremely expensive." It involves, among other things, "hiring teams of developers" to decode patches.

It works like this: An attack that attempts to exploit or employ a Java process, such as a SQL injection attempt, cannot execute. "If an attack gets past our security, for example, and tries to make a call to a Java process, it won't be allowed to. We'll be alerted to an intrusion," he says. The tool can detect known and unknown attacks.

"It's [like] placing a firewall within the application in the JVM itself," Badakhchani says.

Like any security layer, there's a convenience or performance tradeoff. He says the RASP tool comes with a performance tradeoff in about 10% of the bank's applications. "It's not that significant… The benefits from the security side outweigh" that, he says.

Badakhchani, along with Waratek director of client security solutions Prateep Bandharangshi, will present their work today at the Oracle JavaOne conference in San Francisco.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
aws0513
50%
50%
aws0513,
User Rank: Ninja
10/1/2014 | 8:57:16 AM
I like it, but will wait for peer review.
From what is described in the article, this sounds like a good idea.
However, I am still holding back on final judgement until the Java community weighs in.
In particular, I am curious what kind of testing they did to get to the 10% performance impact measurement.

Like I said, I like what I am hearing here, but feel it is necessary to have peer review for validation of the approach.  I suspect/hope the same techniques could be applied to other programming languages as well.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
10/1/2014 | 9:20:19 AM
Re: I like it, but will wait for peer review.
Good points, @aws0513. I think application "self-defense" is an intriguing approach, and there are still some unanswered questions, for sure. It sounds like this approach could ultimately replace or integrate more deeply with the WAF and some other tools if these functions are built-in and the application itself could do the job. I thought Dan Kaminsky shed some nice perspective on this.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/13/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-14300
PUBLISHED: 2020-07-13
The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in th...
CVE-2020-14298
PUBLISHED: 2020-07-13
The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the co...
CVE-2020-15050
PUBLISHED: 2020-07-13
An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Traversal.
CVE-2020-10987
PUBLISHED: 2020-07-13
The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.
CVE-2020-10988
PUBLISHED: 2020-07-13
A hard-coded telnet credential in the tenda_login binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device.