Cyritex Security Lab | Effectiveness validation of RASP security products

▍What is RASP

RASP stands for Runtime Application Self-Protection, which is a new type of application security protection technology. This technology was listed as a key trend in the application security field in Gartner's 2014 application security report, and is also considered one of the excellent technologies to achieve endogenous security. It "injects" protection functions into applications to integrate with them, and by hooking a small number of critical functions, it observes the internal state of the program in real time during its execution. In recent years, it has been accepted and deployed by more and more enterprises, especially those with external business applications, which hope to use it to enhance defensive capabilities and reduce the defense layers to minimize the impact on applications. When suspicious behavior occurs in an application, RASP accurately identifies attack events based on the current context and provides real-time blocking, enabling the application to have self-protection capabilities without manual intervention.

RASP collects high-risk behaviors of Web applications in real-time, and improves detection accuracy through multiple security models such as signature rules, contextual semantic analysis, and third-party security product data correlation analysis.

Compared with traditional Web application security products, RASP filters out a large number of invalid attacks from a massive pool of attacks, focusing on discovering real known and unknown security threats. Not only that, when sending alarm information, RASP can clearly reconstruct the attack path at the code line level, which is of great help to vulnerability reproduction and remediation.

RASP technology can be applied in scenarios such as offensive and defensive drills, emergency vulnerability defense, and advanced threat defense. Since most applications are written in different languages, in the process of real application, RASP technology must ensure application performance while preventing it from being attacked. Especially when deployed to critical systems, there is a need to promptly verify the capability and effectiveness of RASP's defense rules.

▍A Brief Analysis of RASP Principles

1. RASP Defense Process

Once a Web application is integrated with RASP defense, RASP will set up defense points (via API Hooking) in critical APIs at the bottom of the Java language (such as file read/write, command execution APIs, etc.). Once an attacker sends a Web attack request, it will be monitored and intercepted by RASP, thus effectively defending against Web attacks.

The defensive capability of RASP is based on "behavior implementation". RASP will call the corresponding defense module according to the attack events triggered by Hook points (such as file read events, command execution events), instead of calling all defense modules at once like a traditional WAF.

2. RASP Agent Architecture Design

The RASP Agent consists of two core mechanisms (Agent mechanism, Hook mechanism) and three core modules (RASP Loader, RASP Context, and RASP Defense Module).

The Agent mechanism and Hook mechanism are necessary conditions for RASP to implement defense. RASP uses the Hook mechanism to defend Java classes that are vulnerable to attacks (such as Java SE, Web applications). When the defended class method is called, it will automatically trigger RASP's defense code.

▍Injecting RASP into the Target Machine

1. Experimental Environment

This experiment uses the Lexara target machine container (a secondary development open-source project), built with the SpringBoot technology stack and related vulnerable components (such as fastjson, log4j, etc.).

2. RASP Environment Deployment

1) Install and configure ElasticSearch and MongoDB databases.

-- Configure the connection methods in conf/app.conf

--

-- Then start the project with ./RASP-cloud to launch the management backend.

2) Add nodes

-- Different injection methods can be selected according to different environments

-- The target machine for this build is started using docker, and the following command can be used to build the target machine.

-- Other probe installation methods can be explored on your own.

3) Configure probe parameters

-- Note that the place with the IP in the above parameters is the backend address of OpenRASP, which cannot be filled in at will.

4) Start the application

-- The openRASP startup banner can be seen when the project starts

5) Successful OpenRASP injection

-- The target machine can be seen as added to the backend host list under host management.

▍Lexara Validation Verifies the Effectiveness of RASP Rules

Lexara Validation specifically adds validation rules for the target machine, making validation faster.

-- The rules are a collection of common Java vulnerabilities, and the two validate each other

Use rapid configuration in Lexara Validation to distribute the rules to the source robot and attack the target machine.

While the source attack end keeps attacking, the RASP management platform generates logs, where the attack payload sent by Lexara Validation can be viewed to see if it is a real and effective attack.

Further check the detailed content of the Lexara Validation rules to see if they match the attack logs recorded by OpenRASP.

-- The rules and returned response packets are shown in the figure below

-- Attack logs generated by openRASP at the corresponding time

-- The sent rules and the attacks recorded by openRASP can match up, confirming they are rules sent by the Lexara Validation robot.

According to the attack logs recorded in the RASP logs, it is easy to find that all the attack payloads distributed by Lexara Validation are real and effective attacks.

▍Synergistic Growth of Lexara Validation and RASP

In the future, we will face a complex and volatile internet security situation. Cyber security risks will grow exponentially, and large-scale, organized cyberattacks will bring more challenges. Cyber security technology needs to grow and develop non-stop to cope with the rapidly changing situation.

The security validation technology led by Lexara Validation is also constantly adapting to the rapidly developing trend of attack technologies, achieving mutual complementation and joint growth with RASP. Lexara Validation provides real-time, latest vulnerability rules and simulates attacks based on these rules. RASP refines its own rule library based on the different attacks received to cope with new attack techniques and vulnerabilities.

Reference Sources:

1. RASP Security Technology https://www.jRASP.com/guide/ 2. Java Web Security https://javasec.org/java-RASP/ 3. RASP Security Product: Baidu Open Source OpenRASP https://RASP.baidu.com/

4. WEB Program for Detection: Hello-Java-Sec https://github.com/j3ers3/Hello-Java-Sec