CSE543 - Computer and Network Security Module: Web Security - - PowerPoint PPT Presentation
CSE543 - Introduction to Computer and Network Security Page
1
1
CMPSC443 - Introduction to Computer and Network Security Page
2
2
CMPSC443 - Introduction to Computer and Network Security Page
3
5 10 15 20 25 2001 2002 2003 2004 2005 2006 Web (XSS) Buffer Overflow
3
CMPSC443 - Introduction to Computer and Network Security Page
4
4-1
CMPSC443 - Introduction to Computer and Network Security Page
4
4-2
CMPSC443 - Introduction to Computer and Network Security Page
4
4-3
CMPSC443 - Introduction to Computer and Network Security Page
4
4-4
CMPSC443 - Introduction to Computer and Network Security Page
5
5
CMPSC443 - Introduction to Computer and Network Security Page
6
http://a.com/<img> http://c.com/ <img> http:// b.com/ <img>
Webpage
http:// d.com/ <IMG> http:// e.com/ <IMG> <body>
6
CMPSC443 - Introduction to Computer and Network Security Page
7
7
CMPSC443 - Introduction to Computer and Network Security Page
8
8
CMPSC443 - Introduction to Computer and Network Security Page
9
9
CMPSC443 - Introduction to Computer and Network Security Page
10
10
CMPSC443 - Introduction to Computer and Network Security Page
11
11
CMPSC443 - Introduction to Computer and Network Security Page
12
12-1
CMPSC443 - Introduction to Computer and Network Security Page
12
E{ks, ”host ip : timestamp : username”}
12-2
CMPSC443 - Introduction to Computer and Network Security Page
12
E{ks, ”host ip : timestamp : username”}+ HMAC{ks, “…”}
12-3
CMPSC443 - Introduction to Computer and Network Security Page
13
13
CMPSC443 - Introduction to Computer and Network Security Page
14
14
CMPSC443 - Introduction to Computer and Network Security Page
15
Origin A Data Origin B Data
15
CMPSC443 - Introduction to Computer and Network Security Page
16
16
CMPSC443 - Introduction to Computer and Network Security Page
people to find and exploit SOP browser bugs for cross-domain communication
17
17
CMPSC443 - Introduction to Computer and Network Security Page
18
18
CMPSC443 - Introduction to Computer and Network Security Page
19
19
CMPSC443 - Introduction to Computer and Network Security Page
20
20
CMPSC443 - Introduction to Computer and Network Security Page
21
21
CMPSC443 - Introduction to Computer and Network Security Page
22
Webpage Banner Script Onclick Script Periodic Refresh Script Web-server 1 Web-server 2 Web-server 3
22
CMPSC443 - Introduction to Computer and Network Security Page
the bank’s own webpage
23
23
CMPSC443 - Introduction to Computer and Network Security Page
24
24
CMPSC443 - Introduction to Computer and Network Security Page
25
http://www.mybank.com/loggedin?sessionid=11
25
CMPSC443 - Introduction to Computer and Network Security Page
26
http://www.abine.com/ 26
CMPSC443 - Introduction to Computer and Network Security Page
27
Protecting Browser State from Web Privacy Attacks : Jackson et al.
27
CMPSC443 - Introduction to Computer and Network Security Page
28
28
CMPSC443 - Introduction to Computer and Network Security Page
29
29
CMPSC443 - Introduction to Computer and Network Security Page
30
30
CMPSC443 - Introduction to Computer and Network Security Page
31
31
CMPSC443 - Introduction to Computer and Network Security Page
32
32
CMPSC443 - Introduction to Computer and Network Security Page
33
Process 1
http://a.com/<img> http://c.com/ <img> http:// b.com/ <img>
TAB 1
http:// d.com/ <IMG> http:// e.com/ <IMG> <body>
Process 2
http://a.com/<img> http://c.com/ <img> http:// b.com/ <img>
TAB 2
http:// d.com/ <IMG> http:// e.com/ <IMG> <body>
Process 3
http://a.com/<img> http://c.com/ <img> http:// b.com/ <img>
TAB 3
http:// d.com/ <IMG> http:// e.com/ <IMG> <body>
Main Browser Process
33
CMPSC443 - Introduction to Computer and Network Security Page
34
34
CMPSC443 - Introduction to Computer and Network Security Page
35
35
CMPSC443 - Introduction to Computer and Network Security Page
36
36
CMPSC443 - Introduction to Computer and Network Security Page
37
37
CMPSC443 - Introduction to Computer and Network Security Page
38
38
CMPSC443 - Introduction to Computer and Network Security Page
39
39
CMPSC443 - Introduction to Computer and Network Security Page
40
40
CMPSC443 - Introduction to Computer and Network Security Page
41
41
CMPSC443 - Introduction to Computer and Network Security Page
42
42
CMPSC443 - Introduction to Computer and Network Security Page
43
43
CMPSC443 - Introduction to Computer and Network Security Page
44
$INPUT = “Alice\;mail($to, $subject, $body);” <FORM METHOD=POST ACTION="../cgi-bin/mycgi.pl"> <INPUT TYPE="hidden" VALUE="~/.profile" NAME="LOGFILE"> </FORM>
44
CMPSC443 - Introduction to Computer and Network Security Page
45
xUserId = getRequestString("UserId"); txtSQL = "SELECT * FROM Users WHERE UserId = " + xUserId;
45
CMPSC443 - Introduction to Computer and Network Security Page
46
SELECT email, login, last_name FROM user_table WHERE email = 'x'; DROP TABLE members; --';
46
CMPSC443 - Introduction to Computer and Network Security Page
47
String custname = request.getParameter("customerName"); // REALLY be validated too // perform input validation to detect attacks String query = "SELECT account_balance FROM user_data WHERE user_name = ? "; PreparedStatement pstmt = connection.prepareStatement( query ); pstmt.setString( 1, custname); ResultSet results = pstmt.executeQuery( ); String query = "SELECT account_balance FROM user_data WHERE user_name = " + request.getParameter("customerName"); try { Statement statement = connection.createStatement( … ); ResultSet results = statement.executeQuery( query ); }
47
CMPSC443 - Introduction to Computer and Network Security Page
48
48
CMPSC443 - Introduction to Computer and Network Security Page
49
49