IIS Security and Programming Countermeasures By Jason Coombs ([email protected]) Introduction This is a book about how to secure Microsoft Internet Information Services for administrators and programmers whose work includes a requirement for information security, a computer industry specialty field commonly referred to as infosec. In this book the terms information security and infosec are used interchangeably with the more friendly term data security. This is not a book about hacking, cracking, and the tools and techniques of the bad guys, the so-called black hat hackers. This book teaches computer professionals and infosec specialists how to build secure solutions using IIS. It is your duty to secure and defend networked information systems for the benefit of the good guys who are your end users, clients, or less technical coworkers. There is nothing you can do that will transform a programmable computer running Microsoft Windows from its vulnerable condition to an invulnerable one. Every general purpose programmable computer is inherently vulnerable because it is controlled by software and is designed to allow new software to be installed or executed arbitrarily. Network computing based on programmable general purpose computers will never be safe from an information security perspective. Eliminating the feature of general purpose programmability from a networked computer and replacing its software with firmware reduces but does not eliminate vulnerabilities. These are immutable realities of present day computing and, as always, reality represents your biggest challenge. Microsoft is in business to get as much of your money as possible using whatever means will work at a given moment and in this respect they know virtually no equal in the software business. Unfortunately, Microsoft truly does not care about security. You will see why in this book. To Microsoft, your possession of a microprocessor turns you into a customer, a source of potential profit. Just as your possession of a pair of eyeballs turns you into a potential customer for media giants who would sooner see you put in prison for violating arbitrary intellectual property laws than thank you sincerely for the money you've paid to them over the years, Microsoft will never do anything (willingly) that reduces its competitive position by reducing its access to your microprocessors or relinquishing some of its leverage over you. Never mind that these same corporations and media giants are responsible for laws such as the Digital Millennium Copyright Act (DMCA), that you may one day find yourself accused of violating based on something a microprocessor appears to have done over which you allegedly had control or authority, because of political contributions and special-interest lobbyist politics. Giving you real control over your computers is not in the best interest of capitalism nor law enforcement because such control would reduce profits and hinder prosecutions. If you don't think these issues are a part of the complex and volatile modern world of data security then you'll be surprised how a little knowledge of the subject will change your perceptions. Just remember that if it becomes difficult for Microsoft to execute code on your computers, it will become more difficult for them to extract money from your bank accounts by selling you more software. The business methods used by Microsoft have so badly compromised the safety of those who use Microsoft software that I've called publicly for Microsoft to give away, free of charge to all existing Microsoft customers, the latest build of Windows code that incorporates, for the first time, security remediations produced as a result of the Trustworthy Computing Initiative. These architectural security fixes are not just new features that you might like to have and may choose to pay for, they are the first attempt Microsoft has ever made to create a product that is safe to use and free from severe defects. That Microsoft has failed yet again to achieve a reasonable level of safety for its products will become apparent in the coming months, but this does not change the fact that Microsoft profited enormously by selling severely defective products in the past and owes a debt of apology to every person and business that has been harmed by their actions and inactions. We'll never see this apology in the real world, of course, just as we may never see Microsoft software that incorporates common sense security countermeasures. It is just not in Microsoft's best-interest to do what is in your best-interest, and this alone should cause you serious concern. Many other businesses draw a line that they choose not to cross, out of respect and care for their customers and for the benefit of the general public. Microsoft draws no such line, and it has thus become a despicable company run by despicable people. Information security is a constant process that never achieves its objective. Given this fact, many people choose to do something else with their time and money. People who faint at the sight of blood make poor surgeons. Likewise, computer programmers or administrators who insist that computers are inherently trustworthy under certain circumstances make terrible information security professionals. Before you can expect any computer system to be trustworthy you must abandon any hope you might have that a technological solution may exist and reconsider the criteria by which you judge a computer to be trustworthy. Technically, a computer can be considered trustworthy if it is provably under your exclusive control, performing only operations that are known or expected, and you are certain to detect any behavior or condition that would indicate otherwise. Your risk exposure to a computer can be considered reasonable if the computer is trustworthy and you are aware of, and prepared to respond to, incidents that may occur due to malfunction or malfeasance. Unlike a guide to black hat hacker mischief, and more applicable to daily programming or administration tasks than a guide for so-called white hat hackers who conduct penetration tests and employ hacking tools for the purpose of ensuring data security or discovering new vulnerabilities before malicious hackers do, IIS Security shows you where threats exist in data networks and information systems built around Microsoft IIS to enable threat comprehension but makes no effort to give detailed instructions on perpetrating exploits. There is plenty to read on the Internet on that subject. This book shows how to harden IIS and its hosted Web applications and services against attacks so that all known, and hopefully all possible, black hat exploits can be prevented with solid data security technology, secure Web application code, application-specific threat countermeasures, and a security policy appropriate to the level of protection required for each server box. IIS Security assumes that you are using IIS version 4, 5, 5.01, or 6.0 with an emphasis on versions 5 and 6. IIS versions 5 and 5.01 are only available for Windows 2000 or Windows XP Professional and IIS 6 only available in the Windows .NET Server OS family. Although some of the instructions in this book pertain specifically to one version of IIS and therefore imply use of a particular OS (NT 4, Win2k, XP or .NET Server) you will find the majority of the instructions relevant to your environment because Windows XP Professional and .NET Server share a common code base derived from Windows 2000 which in turn derives from Windows NT 4. Most of the Windows 2000-specific instructions also apply to members of the Windows .NET Server OS family if only in a historical context. You may not need to follow all of the instructions in this book if you are using Windows .NET Server and IIS 6 because much of the best practices knowledge, registry settings, and secure configuration options have been preconfigured for IIS 6 in the most secure locked-down setting. Consider historical Windows 2000 instructions to be informative if you need to lower security settings on your Windows .NET Server with IIS 6 rather than increase them. If you are still using a Windows NT 4 system with IIS 4, which include NT 4 derivatives such as BackOffice Server 4.5, you would realize a performance benefit for IIS if you were to upgrade, but IIS version 4 can be made as secure as newer versions and Microsoft does not plan to stop supporting version 4 nor stop releasing security hotfixes for it. If you do use IIS 4, the critical thing to understand is that unlike IIS 5 and 6, IIS 4 must not be used to host applications on behalf of multiple unrelated parties. IIS 4 can only be adequately secured for application hosting if the applications belong to a single organization. To securely host Web sites for multiple organizations under IIS 4 you must disable all dynamic content and application services, such as ISAPI extensions, and serve only static HTML content. Removing all active content and applications to achieve security is a drastic measure, and while this book can be used as a guide to dismantling programmability interfaces exposed by IIS, it assumes that your objective is to build, deploy, and manage secure applications around IIS not revert to serving static text and pictures. The bottom line is that if you host applications for other people, upgrade to Windows 2000 or Windows Server 2003. The sample code shown in this book, and there is no shortage of it, is not meant solely for computer professionals whose business cards bear the title of Programmer. Administrators will find the code useable as a basis for administrative scripting, and the code samples are tailored with this in mind. The boundaries between administrator and programmer have blurred recently with the release of new versions of Windows, the .NET Framework, and new programming platforms such as Windows Script Host that appeal to and solve problems for anyone who manages, uses, or programs Windows-based computers.