DIMVA 2019 On the Perils of Leaking Referrers in Online Collaboration Services Authors: Beliz Kaleli Manuel Egele Gianluca Stringhini bkaleli@bu.edu megele@bu.edu gian@bu.edu
Online Collaboration Services (OCSs) File operations; ▪ Upload/Create ▪ View/Edit online Online ▪ Share Collaboration Services Beliz Kaleli 2
Sharing a File on an OCS Upload secret location: or Create Share https://www.ocs-name.com/ < UniqueIdentifier > } OCS Ideally unguessable Beliz Kaleli 3
This year McAfee reported that; “8% of shared files contain sensitive data” [1] ▪ OCS Files, used by individuals and companies, can contain sensitive information . [1] Where cloud files are shared. [1] https://www.skyhighnetworks.com/cloud-computing-trends-2019/ Beliz Kaleli 4
Introduction We show that: The secret location of OCS files can be leaked by the improper handling of links embedded in these files. ▪ 21 OCS are analyzed on 6 different web browsers Beliz Kaleli 5
Background - HTTP Referer ▪ HTTP Request Header that identifies the URI from which the request originated. Request Headers Value http://ocs.com/file1 HTTP Accept text/html, application/xhtml+xml Request Accept-Encoding gzip, deflate Accept-Language en-US, en; q=0.5 -------------- Connection keep-alive -------------- -------------- DNT 1 -------------- Host ocs.com Referer http://ocs.com/file1 User-Agent Mozilla/5.0 (X11; Linux x86_64) Beliz Kaleli 6
Background - HTTP Referer Purpose: ▪ Personalize the website: provide specific help, suggest relevant pages to targeted users ▪ Generate special offers ▪ Webpage analytics (e.g., analyzing where most of the traffic is coming from) ▪ Block visitors from specific domains The HTTP Referer field is configurable with the Referrer Policy [1] [1] W3C Candidate Recommendation referrer policy. https://www.w3.org/TR/referrer-policy/. Beliz Kaleli 7
Background - Existing Mitigations ● "no-referrer" ● "no-referrer-when-downgrade" ● "same-origin" ▪ Referrer Policy ● "origin" ● "strict-origin" ● "origin-when-cross-origin" ▪ HTML Link Type ● "strict-origin-when-cross-origin" (i.e. rel=”noreferrer”) ● "unsafe-url" HTTP Referer Referrer Structure No Referrer - ASCII Serialized http(s)://www.service-name.com/ Full Referrer http(s)://www.service-name.com/<UniqueIdentifier> Beliz Kaleli 8
Attack Model maggi.cc Eve Beliz Kaleli 9
Attack Model secret maggi.cc URL Eve Beliz Kaleli 10
Attack Model secret URL secret maggi.cc URL Eve Beliz Kaleli 11
Attack Model secret URL secret maggi.cc Referrer: secret URL URL Eve Beliz Kaleli 12
Attack Model secret URL secret maggi.cc Referrer: secret URL URL maggi.cc Eve Beliz Kaleli 13
Alice: Upload/Create file Beliz Kaleli 14
Alice: Share file https://docs.google.com/document/d /17AA7PNbyu94pHe8QxKHKq8SsK PuLZV-9-ZrWvV-k45o/edit?usp=sha ring Beliz Kaleli 15
Bob: Visit link Beliz Kaleli 16
Implementation - Methodology To test our attack model on real-world OCSs: 1. Identifying relevant services 2. Creating files 3. Sharing files 4. Examining the referrer Beliz Kaleli 17
Implementation - Identifying Relevant Services ▪ We obtained the most popular services by Google queries and crawling Alexa lists ▪ Top/Computers/Internet/File_Sharing ▪ Top/Computers/Internet/On_the_Web/Web_Applications/Storage ▪ Test manually: --------------------- -------------------o ▪ Setup an account ur-server.com ▪ Upload/Create file with link to our server ------------------- --------------------- ▪ Check if clickable ------------------- ▪ Check if shareable via a URL Uploaded file Beliz Kaleli 18
Implementation - Creating Files ▪ Created different types of files: “.doc”, “.docx”, “.pdf”, “.xls”, “.xlsx”, “.ppt”, “.pptx”, “.note”, etc. Embedded Our web HTTP headers are logged URL server Beliz Kaleli 19
Implementation - Sharing Files Relevant OCSs = File Hosting Services + Instant Messaging Services For file hosting services and instant messaging services; ▪ Shared through links which are editable or view-only For some instant messaging services; (e.g., Flock) ▪ File sent directly to chat between two accounts Beliz Kaleli 20
Implementation - Examining Referrers Alice OCS --------------------- -------------------o ur-server.com Share Upload ------------------- secret URL --------------------- ------------------- Beliz Kaleli 21
Implementation - Examining Referrers Alice OCS --------------------- -------------------o ur-server.com Share Upload ------------------- secret URL --------------------- ------------------- Beliz Kaleli 22
Implementation - Examining Referrers Bob our-server Click on --------------------- embedded Collect Referrer -------------------o link Visit link URL from output ur-server.com secret URL of script ------------------- --------------------- ------------------- Beliz Kaleli 23
Implementation - Examining Referrers Bob our-server Click on --------------------- embedded Collect Referrer -------------------o link Visit link URL from output ur-server.com secret URL of script ------------------- --------------------- ------------------- Beliz Kaleli 24
Implementation - Examining Referrers Bob our-server Click on --------------------- embedded Collect Referrer -------------------o link Visit link URL from output ur-server.com secret URL of script ------------------- --------------------- ------------------- Beliz Kaleli 25
Implementation - Examining Referrers Visit recorded Referrer URL Beliz Kaleli 26
Implementation - Examining Referrers Visit recorded Referrer URL File is NOT accessed Beliz Kaleli 27
Implementation - Examining Referrers Visit recorded Referrer URL File is NOT accessed Secret URL is NOT leaked Beliz Kaleli 28
Implementation - Examining Referrers Visit recorded Referrer URL File is NOT File is accessed accessed Secret URL is NOT leaked Beliz Kaleli 29
Implementation - Examining Referrers Visit recorded Referrer URL File is NOT File is accessed accessed Secret URL Secret URL is NOT leaked is leaked Beliz Kaleli 30
Referrer Policy First Public Draft (2014): Working Draft (2016): ▪ "none" ▪ "no-referrer" ▪ "none-when-downgrade" ▪ "no-referrer-when-downgrade" ▪ "origin-only" ▪ "same-origin" ▪ "origin-when-cross-origin" ▪ "origin" ▪ "unsafe-url" ▪ "origin-when-cross-origin" ▪ "unsafe-url" Beliz Kaleli 31
Referrer Policy First Public Draft (2014): Working Draft (2016): ▪ "none" ▪ "no-referrer" ▪ "none-when-downgrade" ▪ "no-referrer-when-downgrade" ▪ "origin-only" ▪ "same-origin" ▪ "origin-when-cross-origin" ▪ "origin" ▪ "unsafe-url" ▪ "strict-origin" ▪ "origin-when-cross-origin" ▪ "strict-origin-when-cross-origin" ▪ "unsafe-url" Currently a Candidate Recommendation Beliz Kaleli 32
Evaluation - Common Insights Reasons behind vulnerabilities; ▪ Referrer Policy is not set by the OCS ▪ Referrer Policy option is not Services secure enough ▪ Different behavior on mobile and desktop browsers ▪ Edge and iOS Safari support Browsers older draft of Referrer Policy Beliz Kaleli 33
Evaluation 7/21 Vulnerable : Vulnerable : Not vulnerable : N/A Beliz Kaleli 34
Evaluation ▪ Edge and iOS Safari supports older draft of Referrer Policy e.g., Overleaf ▪ "origin-when-cross-origin" → Overleaf changed to "no-referrer" and added "rel=noreferrer" → No longer vulnerable Beliz Kaleli 35
Evaluation ▪ Different behaviors on desktop and mobile browsers ▪ PDF.js removes referrers, built-in mechanisms may not e.g., Box ▪ Desktop browsers - PDF.js (removes referrers in requests) ▪ Mobile browsers - native PDF viewer (no referrer removal) ▪ "no-referrer-when-downgrade" Vulnerable: HTTPS → HTTPS ▪ Beliz Kaleli 36
Evaluation ▪ Referrer Policy is not set by the OCS e.g., Onehub, Linkedin Slideshare, Evernote Fallback to "no-referrer-when-downgrade" ▪ Vulnerable: HTTPS → HTTPS ▪ Beliz Kaleli 37
Adoption of Referrer Policy ▪ First 100K of lists : less safe option Beliz Kaleli 38
Countermeasures User Provider ▪ Configure browser settings ▪ Trim HTTP Referer to only ▪ Use browser extensions display the hostname ▪ Use private browsing mode ▪ Use rel=”noreferrer” (on Firefox) ▪ Redirect links inside documents Beliz Kaleli 39
Future Steps ▪ Analyze different browsers and OCSs ▪ Investigate whether this vulnerability is known ▪ Embed links to several real-world websites ▪ Analyze the use of information ▪ Fill files with fake sensitive data Beliz Kaleli 40
Recommend
More recommend
