Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Does Your Vulnerability Scanner Speak Portuguese? SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Does Your Vulnerability Scanner Speak Portuguese?

Rodrigo Montoro and Joaquim Espinhara did an interesting test, and like so many interesting tests, it is actually pretty obvious in hindsight: They looked at different vulnerability scanners, and checked how they behave if a web site is coded in a language other then English [1]. The quick answer: They pretty much fail. The presentation is looking at a couple of open source and commercial scanners, and threw in snort as an IDS. Turns out all of the scanners (and snort) have issues recognizing evidence of vulnerabilities (like SQL error messages) if the language is changed to anything but english.

Lessons?

- don't just trust your vulnerability scanner. A "clean bill" from a basic vulnerability scanner doesn't mean you have no vulnerabilities.
- watch your error logs while the scan is in progress. You may find a lot more evidence of problems that way, in particular if you are not very forthcoming on error messages.
- configure your scanner (and in the case of snort: your IDS) correctly. Maybe adjust your server configuration to make it easier for the scanner to find problems.
- and yes... a web site written in Klingon is likely much more difficult to hack, but also not that useful (they don't pay!)
 

On a similar note: Some sites use different code for different language versions of the site. In this case, it is very important to test all language versions, which may not be easy.

[1] http://www.slideshare.net/spookerlabs/lost-in-translation-blackhat-brazil-2014

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn

I will be teaching next: Defending Web Applications Security Essentials - SANS San Francisco Spring 2020

Johannes

3693 Posts
ISC Handler
I could see how this would be difficult with languages that require special characters, such as Chinese languages.
Alex

6 Posts
We have 2 videos demo used as PoC

IDS Bypass https://vimeo.com/112510848
Web Scanner bypass https://vimeo.com/112972649

Thanks for helping spread the word.
Alex
1 Posts

Sign Up for Free or Log In to start participating in the conversation!