Cross-Origin State Inference (COSI) Attacks: Your Browser is Leaking - - PowerPoint PPT Presentation

▶
cross origin state inference cosi attacks your browser is
SMART_READER_LITE
LIVE PREVIEW

Cross-Origin State Inference (COSI) Attacks: Your Browser is Leaking - - PowerPoint PPT Presentation

Feb 12, 2024 215 likes •770 views

Cross-Origin State Inference (COSI) Attacks: Your Browser is Leaking Your Secrets Avinash Sudhodanan Soheil Khodayari Juan Caballero 24/02/2020, NDSS 2020 COSI Attack A malicious web site infers the state of a user (the victim) at another web

slide-1
SLIDE 1

Cross-Origin State Inference (COSI) Attacks: Your Browser is Leaking Your Secrets

Avinash Sudhodanan Soheil Khodayari Juan Caballero

24/02/2020, NDSS 2020

slide-2
SLIDE 2

COSI Attack

2

Alice (victim)

A malicious web site infers the state of a user (the victim) at another web site

slide-3
SLIDE 3

COSI Attack

3

Alice (victim) Web Browser

A malicious web site infers the state of a user (the victim) at another web site

slide-4
SLIDE 4

COSI Attack

4

Alice (victim) Web Browser foo.hotcrp.com

A malicious web site infers the state of a user (the victim) at another web site

slide-5
SLIDE 5

COSI Attack

5

Alice (victim) Web Browser foo.hotcrp.com Paper #997 Paper #278

A malicious web site infers the state of a user (the victim) at another web site

slide-6
SLIDE 6

COSI Attack

6

Alice (victim) Web Browser Malice (Attacker) foo.hotcrp.com Paper #997 Paper #278

A malicious web site infers the state of a user (the victim) at another web site

slide-7
SLIDE 7

COSI Attack

7

Alice (victim) Web Browser Malice (Attacker) foo.hotcrp.com Paper #997 Paper #278

A malicious web site infers the state of a user (the victim) at another web site

slide-8
SLIDE 8

COSI Attack

8

Alice (victim) Web Browser Malice (Attacker) foo.hotcrp.com Paper #997 Paper #278 Hi Alice, Click here to finalize your reviews for FOO con

A malicious web site infers the state of a user (the victim) at another web site

slide-9
SLIDE 9

COSI Attack

9

Alice (victim) Web Browser Malice (Attacker) foo.hotcrp.com Paper #997 Paper #278 Hi Alice, Click here to finalize your reviews for FOO con mal-site.com

A malicious web site infers the state of a user (the victim) at another web site

slide-10
SLIDE 10

COSI Attack

10

Alice (victim) Web Browser Malice (Attacker) foo.hotcrp.com Paper #997 Paper #278 Hi Alice, Click here to finalize your reviews for FOO con mal-site.com

infer state

A malicious web site infers the state of a user (the victim) at another web site

slide-11
SLIDE 11

COSI Attack

11

Alice (victim) Web Browser Malice (Attacker) foo.hotcrp.com Paper #997 Paper #278 Hi Alice, Click here to finalize your reviews for FOO con mal-site.com

infer state

What does it mean by inferring state at foo.hotcrp.com

A malicious web site infers the state of a user (the victim) at another web site

slide-12
SLIDE 12

States

12

Login

Alice (victim)

Logged In Logged Out Account Type Reviewer Author Content Ownership Owns a review of paper #278 Does not own a review of paper #278 Account Ownership Owns the account user217 Does not own the account user217 Admin

foo.hotcrp.com mal-site.com infer state Web Browser

Login Detection, Login Oracle Deanonymization COSI Attack:

  • Attacker’s goal: infer states
  • Known by different names
slide-13
SLIDE 13

13

URLs returning different responses depending on the requesting browser’s state

State-dependent URLs (SD-URLs)

SD-URL: https://foo.hotcrp.com/api.php/review?p=278

slide-14
SLIDE 14

14

URLs returning different responses depending on the requesting browser’s state

State-dependent URLs (SD-URLs)

State Response SD-URL: https://foo.hotcrp.com/api.php/review?p=278

slide-15
SLIDE 15

State Response

15

URLs returning different responses depending on the requesting browser’s state

State-dependent URLs (SD-URLs)

Logged In Reviewer Reviews paper #278 SD-URL: https://foo.hotcrp.com/api.php/review?p=278

slide-16
SLIDE 16

State Response code = 200

16

URLs returning different responses depending on the requesting browser’s state

State-dependent URLs (SD-URLs)

Logged In Reviewer Reviews paper #278 SD-URL: https://foo.hotcrp.com/api.php/review?p=278

slide-17
SLIDE 17

State Response code = 200 code = 403

17

URLs returning different responses depending on the requesting browser’s state

State-dependent URLs (SD-URLs)

Logged In Reviewer Reviews paper #278 SD-URL: https://foo.hotcrp.com/api.php/review?p=278 Logged In Reviewer Not review paper #278

slide-18
SLIDE 18

18

State-dependent URLs (SD-URLs)

State Response code = 200 code = 403 SD-URL: https://foo.hotcrp.com/api.php/review?p=278

Alice (victim) foo.hotcrp.com mal-site.com infer state Web Browser foo.hotcrp.com State-dependent response foo.hotcrp.com/api.php/review?p=278

Logged In Reviewer Reviews paper #278 Logged In Reviewer Not review paper #278 SOP

slide-19
SLIDE 19

XS-Leaks

Browser side-channels for inferring the response of cross-origin requests

19

Leak Type References

Events-Fired [Grossman2006Blog, Goethem2015CCS, Cardwell2011Blog, ..] Object-Properties [Grossman2012Blog, Schwenk2017USENIX, Masas2018Blog..] JS-Error [Grossman2006Blog, Shiflett2006Blog] CSS-Properties [Evans2008Blog] CSP-Violation [Homakov2013Blog, Gulyas2018WPES] Timing [Bortz2007WWW, Evans2009Blog, Goethem2015CCS, ..] AppCache [Lee2015NDSS]

slide-20
SLIDE 20

20

Events Fired XS-Leak

State Response code = 200 code = 403 SD-URL: https://foo.hotcrp.com/api.php/review?p=278

Alice (victim) foo.hotcrp.com mal-site.com infer state Web Browser foo.hotcrp.com code = 200 foo.hotcrp.com/api.php/review?p=278

Logged In Reviewer Reviews paper #278 Logged In Reviewer Not review paper #278

<embed src=SD-URL

  • nload=revwr()
  • nerror=notRevwr()

>

slide-21
SLIDE 21

21

Events Fired XS-Leak

State Response code = 200 code = 403 SD-URL: https://foo.hotcrp.com/api.php/review?p=278

Alice (victim) foo.hotcrp.com mal-site.com infer state Web Browser foo.hotcrp.com code = 403 foo.hotcrp.com/api.php/review?p=278

Logged In Reviewer Reviews paper #278 Logged In Reviewer Not review paper #278

<embed src=SD-URL

  • nload=revwr()
  • nerror=notRevwr()

>

slide-22
SLIDE 22

22

Multiple States, Same Response

State Response code = 200 code = 403 SD-URL: https://foo.hotcrp.com/api.php/review?p=278 Logged In Reviewer Reviews paper #278 Logged In Reviewer Not review paper #278

slide-23
SLIDE 23

23

Multiple States, Same Response

State Response code = 200 code = 403 code = 200 SD-URL: https://foo.hotcrp.com/api.php/review?p=278 Logged In Reviewer Reviews paper #278 Logged In Reviewer Not review paper #278 Logged Out

slide-24
SLIDE 24

24

Multiple States, Same Response

State Response code = 200 code = 403 code = 200 SD-URL: https://foo.hotcrp.com/api.php/review?p=278

Alice (victim) foo.hotcrp.com mal-site.com infer state Web Browser foo.hotcrp.com Response foo.hotcrp.com/api.php/review?p=278

Logged In Reviewer Reviews paper #278 Logged In Reviewer Not review paper #278

<embed src=SD-URL

  • nload=revwr()
  • nerror=notRevwr()

>

Logged Out

slide-25
SLIDE 25

25

Same Attack Payload, Browser-specific Behavior

Alice (victim) foo.hotcrp.com mal-site.com infer state foo.hotcrp.com 200 foo.hotcrp.com/api.php/review?p=278 <embed src=SD-URL

  • nload=revwr()
  • nerror=notRevwr()

>

The same XS-Leak payload may work differently on different browsers

Alice (victim) foo.hotcrp.com mal-site.com infer state foo.hotcrp.com 200 foo.hotcrp.com/api.php/review?p=278 <link href=SD-URL

  • nload=revwr()
  • nerror=notRevwr()

rel = stylesheet>

slide-26
SLIDE 26

Attack Classes

26

slide-27
SLIDE 27

Attack Classes

27

Name :

slide-28
SLIDE 28

Attack Classes

28

Name SD-URL Responses Response A Response B :

slide-29
SLIDE 29

Attack Classes

29

Name SD-URL Responses XS-Leak Response A Response B Inclusion Manifest. :

slide-30
SLIDE 30

Attack Classes

30

Name SD-URL Responses XS-Leak Browser Support Response A Response B Inclusion Manifest. Chrome Firefox Edge :

slide-31
SLIDE 31

Attack Classes

31

Name SD-URL Responses XS-Leak Browser Support Response A Response B Inclusion Manifest. Chrome Firefox Edge EF- StatusErro rScript code = 200 content-type = text/javascript code = 4xx || 5xx <script>

  • nload /
  • nerror

✓ ✓ ✓ :

slide-32
SLIDE 32

Attack Classes

32

Name SD-URL Responses XS-Leak Browser Support Response A Response B Inclusion Manifest. Chrome Firefox Edge EF- StatusErro rScript code = 200 content-type = text/javascript code = 4xx || 5xx <script>

  • nload /
  • nerror

✓ ✓ ✓ :

slide-33
SLIDE 33

Attack Classes

  • 40 attack classes
  • 21 new attack classes
  • 1 completely novel XS-Leak (based on postMessage API)

33

Name SD-URL Responses XS-Leak Browser Support Response A Response B Inclusion Manifest. Chrome Firefox Edge EF- StatusErro rScript code = 200 content-type = text/javascript code = 4xx || 5xx <script>

  • nload /
  • nerror

✓ ✓ ✓

slide-34
SLIDE 34

New XS-Leak: postMessage broadcasts

  • SD-URL property

34

Alice (victim) foo.hotcrp.com mal-site.com infer state

State Response A Broadcasts message “x” B Broadcasts message “y”

window.open(SDURL)

slide-35
SLIDE 35

New XS-Leak: postMessage broadcasts

35

Alice (victim) foo.hotcrp.com mal-site.com infer state

window.open(SDURL)

mal-site.com

postmessage(“x”, *)

  • SD-URL property

State Response A Broadcasts message “x” B Broadcasts message “y”

slide-36
SLIDE 36

New XS-Leak: postMessage broadcasts

  • SD-URL property

36

Alice (victim) foo.hotcrp.com mal-site.com infer state

State Response A Broadcasts message “x” B Broadcasts message “y”

window.open(SDURL)

mal-site.com

postmessage(“x”, *) if rcvMsg === “x”{ state = “A” }

state = A

slide-37
SLIDE 37

Related Work

37

Attack References

Events-Fired [Grossman2006Blog, Goethem2015CCS, Cardwell2011Blog, ..] Object-Properties [Grossman2012Blog, Schwenk2017USENIX, Masas2018Blog..] JS-Error [Grossman2006Blog, Shiflett2006Blog] CSS-Properties [Evans2008Blog] CSP-Violation [Homakov2013Blog, Gulyas2018WPES] Timing [Bortz2007WWW, Evans2009Blog, Goethem2015CCS, ..] AppCache [Lee2015NDSS]

: :

  • Given different names login

detection, login oracle, URL status identification, etc.

  • Not much discussion on

○ need to handle multiple states ○ support for multiple browsers ○ automatic detection of COSI attacks and automatic creation

  • f attack pages
slide-38
SLIDE 38

Contributions

Present COSI attacks as a comprehensive category Introduce the concept of attack classes Identify a new XS-Leak (based on postMessage API) Present Basta-COSI, a tool to automatically identify COSI attacks and build complex attack pages Test 4 stand-alone web apps and 58 top web sites, discovering COSI attacks on all of them

38

slide-39
SLIDE 39

Outline

Introduction ➔ Approach Evaluation Conclusion

39

slide-40
SLIDE 40

Basta-COSI: Architecture

Tool to automatically identify COSI attacks on web apps

40

slide-41
SLIDE 41

Basta-COSI: Architecture

Tool to automatically identify COSI attacks on web apps

41

Selenium scripts to load states in browsers

slide-42
SLIDE 42

Basta-COSI: Architecture

Tool to automatically identify COSI attacks on web apps

42

Web app crawler to identify SD-URLs

slide-43
SLIDE 43

Basta-COSI: Architecture

Tool to automatically identify COSI attacks on web apps

43

Identifies attack vectors for the SD-URLs

slide-44
SLIDE 44

Basta-COSI: Architecture

Tool to automatically identify COSI attacks on web apps

44

Combine attack vectors and generate pages

slide-45
SLIDE 45

Outline

Introduction Approach ➔ Evaluation Conclusion

45

slide-46
SLIDE 46

Experiments

Tested:

  • 4 stand-alone web applications (HotCRP, GitLab, GitHub Enterprise,

OpenCart)

  • 58 web sites from the Alexa Top 150 (having account creation)

Results:

  • Found at least one attack on all sites
  • Responsibly disclosed, vulnerabilities confirmed, some already fixed, some

bug bounties paid

46

slide-47
SLIDE 47

Results (Excerpt)

47

Web Site Vendor Top Vulnerabilities Deanonymize reviewer

slide-48
SLIDE 48

Results (Excerpt)

48

Web Site Vendor Top Vulnerabilities Deanonymize reviewer Deanonymize blog/file owner Deanonymize channel owner

slide-49
SLIDE 49

Results (Excerpt)

49

Web Site Vendor Top Vulnerabilities Deanonymize reviewer Deanonymize blog/file owner Deanonymize channel owner Deanonymize user

slide-50
SLIDE 50

Results (Excerpt)

50

Web Site Vendor Top Vulnerabilities Deanonymize reviewer Deanonymize blog/file owner Deanonymize channel owner Deanonymize user Deanonymize users and role Ethics: All tests were performed

  • n the accounts we controlled
slide-51
SLIDE 51

Defenses

Browser-based:

  • Enforce default SameSite policy
  • Tor browser behavior SameSite=Lax (not send cookies in 3rd party context)

○ does not prevent window based attacks (postMessage, frame count) ○ reported and Tor is planning to fix this

51

Web site-based:

  • SameSite Cookies (control automatic sending of cookies in 3rd party context)
  • Cross-Origin Resource Policy
  • Fetch Metadata
  • Cross-Origin Opener Policy..
slide-52
SLIDE 52

Conclusions

Present COSI attacks as a comprehensive category Introduce the concept of COSI attack classes Identify a new XS-Leak (based on postMessage API) Present Basta-COSI, a tool to automatically identify COSI attacks and build complex attack pages Test 4 stand-alone web apps and 58 top web sites, finding COSI attacks on each

  • f them

52

slide-53
SLIDE 53

Thank You

53

slide-54
SLIDE 54

Questions?

54

Alice (victim) Web Browser Malice (Attacker) foo.hotcrp.com Paper #997 Paper #278 Hi Alice, Click here to finalize your reviews for FOO con mal-site.com