Complex Security Policy? A Longitudinal Analysis of Deployed - - PowerPoint PPT Presentation

▶
complex security policy a longitudinal analysis of
SMART_READER_LITE
LIVE PREVIEW

Complex Security Policy? A Longitudinal Analysis of Deployed - - PowerPoint PPT Presentation

Jan 25, 2023 558 likes •879 views

Complex Security Policy? A Longitudinal Analysis of Deployed Content Security Policies Sebastian Roth , Timothy Barron, Stefano Calzavara, Nick Nikiforakis & Ben Stock Network and Distributed System Security Symposium (NDSS '20) Cross-Site

slide-1
SLIDE 1

Complex Security Policy? A Longitudinal Analysis of Deployed Content Security Policies

Network and Distributed System Security Symposium (NDSS '20)

Sebastian Roth, Timothy Barron, Stefano Calzavara, Nick Nikiforakis & Ben Stock

slide-2
SLIDE 2

2 NDSS 2020 – Sebastian Roth – Complex Security Policy?

Cross-Site Scripting (XSS)

2 . H T T P G E T R e q u e s t v u l n . c

  • m

3 . H T T P R e s p

  • n

s e

  • 1. XSS Payload

https://vuln.com?pl=<script src=evil.com>

  • 4. HTTP GET Request evil.com
  • 5. HTTP Response of evil.js
slide-3
SLIDE 3

3 NDSS 2020 – Sebastian Roth – Complex Security Policy?

Content Security Policy (CSP)

2 . H T T P G E T R e q u e s t v u l n . c

  • m

3 . H T T P R e s p

  • n

s e w i t h C S P H e a d e r

  • 1. XSS Payload

https://vuln.com?pl=<script src=evil.com>

  • 4. HTTP GET Request evil.com
  • 5. HTTP Response of evil.js
slide-4
SLIDE 4

4 NDSS 2020 – Sebastian Roth – Complex Security Policy?

Content Security Policy (CSP)

script-src https://ad.com https://company.com 'unsafe-inline'

<html> <body> <!-- ad.com includes company.com --> <script src="https://ad.com/someads.js"> </script> <script> // ... meaningful inline script </script> </body> </html>

script-src https://company.com 'nonce-d90e0153c074f6c3fcf53' script-src 'nonce-d90e0153c074f6c3fcf53' 'strict-dynamic'

<html> <body> <script nonce="d90e0153c074f6c3fcf53"> let script = document.createElement("script"); script.src = "http://ad.com/ad.js"; document.body.appendChild(script); </script> </body> </html> <html> <body> <!-- ad.com includes company.com --> <script nonce="d90e0153c074f6c3fcf53" src="https://ad.com/someads.js"> </script> <script nonce="d90e0153c074f6c3fcf53"> // ... meaningful inline script </script> </body> </html>

'12 '14 '16

slide-5
SLIDE 5
  • We know from others studies that:

– CSP adoption is far behind expectations – Many deployed policies are insecure Ø Why is CSPs adoption so low? Ø For what purpose is CSP used in the wild? Ø What are the problems of deploying a CSP?

Research Questions

5 NDSS 2020 – Sebastian Roth – Complex Security Policy?

slide-6
SLIDE 6

6 NDSS 2020 – Sebastian Roth – Complex Security Policy?

Methodology

Dataset Construction Data Collection Analytics

  • Create a list of the Top

10k sites over time. Intersection of the Alexa Top sites of each month 2012 – 2018

  • Classify CSP Use-Cases
  • Analyze the Directives

and their Use-Cases

  • Detailed case-studies

& Developer opinions

  • Use Wayback Machine
  • Collected 20,179 CSPs
  • Checked Archive

Data against Common Crawl

slide-7
SLIDE 7

200 400 600 800 1000 2014 2015 2016 2017 2018 CSP Adoption Script Content Control

Use-Case 1: Script Content Control

7 NDSS 2020 – Sebastian Roth – Complex Security Policy?

slide-8
SLIDE 8

150 300 450 2014 2015 2016 2017 2018 Script Content Control 'unsafe-inline' http: || https: || *

Use-Case 1: Script Content Control

8 NDSS 2020 – Sebastian Roth – Complex Security Policy?

Used ‘unsafe- inline‘ in CSP Has inline event-handlers 378 180 (48%)

slide-9
SLIDE 9

Airbnb’s journey to secure their CSP

12-2017

  • 222 changes later
  • script-src: 32 entries (incl. https:)

01-2018

  • Tried to harden the CSP
  • script-src: 28 entries

03-2018

  • Finally secure CSP
  • script-src: 33 entries

11-2014

  • CSP report-only
  • script-src: 17 entries

03-2015

  • Added https:
  • script-src: 22 entries

05-2015

  • enforcement mode
  • script-src: 5 entries (incl. https:)

Script Content Control – Example

9 NDSS 2020 – Sebastian Roth – Complex Security Policy?

They needed 3 ½ years to deploy a non-trivially bypassable CSP

slide-10
SLIDE 10

200 400 600 800 1000 2014 2015 2016 2017 2018 CSP Adoption Script Content Control TLS Enforement

Use-Case 2: TLS Enforcement

10 NDSS 2020 – Sebastian Roth – Complex Security Policy?

slide-11
SLIDE 11

100 200 300 400 500 2016 2017 2018 TLS Enforcement Upgrade Insecure Requests Block All Mixed Content Whitelist HTTPS schema

Use-Case 2: TLS Enforcement

11 NDSS 2020 – Sebastian Roth – Complex Security Policy?

slide-12
SLIDE 12

Use-Case 2: TLS Enforcement

12 NDSS 2020 – Sebastian Roth – Complex Security Policy?

  • We collected all main pages of Upgrade-Insecure-Requests

sites from the Archive and extracted the 3rd party URLs

  • How hard is HTTPS migration in the wild?

– Mixed Content on 4,785 sites from the Alexa Top 10k – For 89% of them, all HTTP resources are upgradeable

slide-13
SLIDE 13

Yes!

Wanna see more Kittens?

13 NDSS 2020 – Sebastian Roth – Complex Security Policy?

Framing based attacks

https://kittenpics.org/

slide-14
SLIDE 14

Framing Control – X-Frame-Options

14 NDSS 2020 – Sebastian Roth – Complex Security Policy?

X-Headers are not standardized! Leads to security problems:

  • Partial support
  • Double Framing

... as well as functionality problems

  • X-Frame-Options can only have a single whitelist entry
slide-15
SLIDE 15

200 400 600 800 1000 2014 2015 2016 2017 2018 CSP Adoption Script Content Control TLS Enforement Framing Control

Use-Case 3: Framing Control

15 NDSS 2020 – Sebastian Roth – Complex Security Policy?

slide-16
SLIDE 16

Use-Case 3: Framing Control

16 NDSS 2020 – Sebastian Roth – Complex Security Policy?

How does CSP frame-ancestors fix these problems:

  • Partial support / Inconsistent implementation:

CSP frame-ancestors is a well-defined standard in CSP since 2014. Thus, all “modern” browsers support it.

  • Double Framing:

Applies to all of a frame's ancestors not only the top-most frame.

  • Explicit whitelist:

frame-ancestors supports wildcards and multiple source-expressions

frame-ancestors www.foo.com ‘self’ *.partner.com

slide-17
SLIDE 17

500 1000 1500 2000 2500 3000 3500 2012 2013 2014 2015 2016 2017 2018 X-Frame-Options CSP frame-ancestors Both

Use-Case 3: Framing Control

17 NDSS 2020 – Sebastian Roth – Complex Security Policy? XFO Deprecated

slide-18
SLIDE 18

Framing Control – Developer Study

18 NDSS 2020 – Sebastian Roth – Complex Security Policy?

  • We notified the 2,699 Web sites about their problem using XFO but not

CSP frame-ancestors via email.

  • Received 117 responses that went beyond automatic answers.
  • Many developers have the misconception that different CSP features

cannot be used in isolation!

slide-19
SLIDE 19

Developer Study

19 NDSS 2020 – Sebastian Roth – Complex Security Policy?

„

“

[...] adding CSP [...] already placed on the roadmap in August of last year. We ran into some trouble with properly enabling the policies, as they ended up effectively killing the website.

CSP destroys Web applications

slide-20
SLIDE 20

Developer Study

20 NDSS 2020 – Sebastian Roth – Complex Security Policy?

„

“

CSP is a complex beast [...]. Some of our partner are iframing

  • ur site. We already had issue to implement the X-Frame

header, that we did not want to deal with CSP.

Misconceptions about CSP

slide-21
SLIDE 21

10 20 30 40 Yes No I don't know No answer

Do you believe CSP is a viable

  • ption to improve your site’s

resilience against XSS attacks?

Framing Control – Developer Study

21 NDSS 2020 – Sebastian Roth – Complex Security Policy?

10 20 30 40 Yes No I don't know No answer

Would your site work out of the box if you deployed a script-content restricting CSP today (disallow eval, inline scripts, and event handlers)?

slide-22
SLIDE 22

Complex Security Policy?

22 NDSS 2020 – Sebastian Roth – Complex Security Policy?

slide-23
SLIDE 23

23 NDSS 2020 – Sebastian Roth – Complex Security Policy?

How to go back in time?

Also stores original HTTP headers prefixed with X-Archive-Orig-

slide-24
SLIDE 24

Appendix – Developer Study

24 NDSS 2020 – Sebastian Roth – Complex Security Policy?

„

“

We have a small team. Do we want to update our version of python or do we want to add CSP? Do we want to move to the new LTS version of Ubuntu or CSP? […] CSP always loose.

Building a CSP requires massive effort

slide-25
SLIDE 25

Appendix – Developer Study

25 NDSS 2020 – Sebastian Roth – Complex Security Policy?

„

“

[…] many first and third party integrations […] having a generic CSP policy that adds value and which is suitable for our entire estate is something that is very difficult to achieve.

CSP is too complex to deploy

slide-26
SLIDE 26

10 20 30 Yes No No answer

Did you know about the frame- ancestors directive and its improved protection capabilities compared to X-Frame-Options before our notification?

Developer Study

26 NDSS 2020 – Sebastian Roth – Complex Security Policy?

5 10 15 Yes No No answer

Did you know that frame-ancestors can be deployed independently of any other part of CSP before our notification?

slide-27
SLIDE 27

5 10 15 20 25 Pentest / Consultant Tools we use Own decision Other

Why have you implemented the X-Frame-Options header?

Appendix – Developer Study

27 NDSS 2020 – Sebastian Roth – Complex Security Policy?

slide-28
SLIDE 28

GitHub’s journey to secure their CSP

11-2013

  • Started to use CSP in Enforcement Mode
  • script-src contains 5 entries (Self, Analytics, CDNs)

05-2014

  • Removed some Analytics & built own CDN
  • script-src contains 2 entries (GitHub CDN & Google Analytics)

10-2014

  • Removed Google Analytics
  • script-src contains 1 single entry (GitHub CDN)

Appendix – Good CSP Deployment

28 NDSS 2020 – Sebastian Roth – Complex Security Policy?

They never ever used any dangerous source expression!

slide-29
SLIDE 29

=> ALLOW-FROM fails insecurely for Chrome & Co. *

Appendix – Partial support

29 NDSS 2020 – Sebastian Roth – Complex Security Policy? * Meanwhile, since Firefox 70, ALLOW-FROM is no longer supported.

slide-30
SLIDE 30

Appendix – Double Framing

30 NDSS 2020 – Sebastian Roth – Complex Security Policy?

https://using-same-origin.com https://attacker.com https://using-same-origin.com

X-Frame-Options: SAMEORIGIN

=> In legacy browsers XFO is only checked against top-most frame.

slide-31
SLIDE 31

31 NDSS 2020 – Sebastian Roth – Complex Security Policy?

Appendix – Related Work

USENIX ‘17 CCS ‘16 TWEB ‘18