Lecture 26 Browser Security Stephen Checkoway Oberlin College Some - - PowerPoint PPT Presentation

▶
lecture 26 browser security
SMART_READER_LITE
LIVE PREVIEW

Lecture 26 Browser Security Stephen Checkoway Oberlin College Some - - PowerPoint PPT Presentation

Jul 12, 2023 448 likes •1.75k views

Lecture 26 Browser Security Stephen Checkoway Oberlin College Some slides from Bailey's ECE 422 Documents Browser's fundamental role is to display documents comprised of - HTML - JavaScript - Style sheets (CSS) - Images - Sounds - Movies -

slide-1
SLIDE 1

Lecture 26 – Browser Security

Stephen Checkoway Oberlin College Some slides from Bailey's ECE 422

slide-2
SLIDE 2

Documents

  • Browser's fundamental role is to display documents comprised of
  • HTML
  • JavaScript
  • Style sheets (CSS)
  • Images
  • Sounds
  • Movies
  • Plugin content
  • Flash
  • SilverLight
  • QuickTime
  • …
slide-3
SLIDE 3

Document Object Model (DOM)

  • The browser allows scripts to
  • add/modify/delete/style the DOM elements
  • make changes in response to user actions (e.g., clicks)
  • submit forms
  • browse to a new document altogether
  • Scripts in one document can modify another document
  • We say that Document A scripts Document B
slide-4
SLIDE 4

Scripting other documents

  • Very powerful capability and without constraints would be dangerous
  • Consider having attacker.com open while logging into chase.com
  • If attacker.com can script chase.com, what could happen?
slide-5
SLIDE 5

Clearly we need separation

  • This is Risk #3 from last time
  • Same Origin Policy (SOP)
  • Goal: Partition documents into equivalence classes that can script each
  • ther (including reading each others' content)
  • Each document is assigned an origin and documents can script other

documents in the same origin

  • We construct the origin from the URL
slide-6
SLIDE 6

From URLs to Origins

  • General form of a URL


scheme://user:pass@host:port/path?querystring#fragment

  • Most parts are optional giving URLs like


https://www.cs.oberlin.edu/~csmc/
 https://google.com?q=hello+world

  • Origins are the triple (scheme, host, port)


What's the origin for https://www.cs.oberlin.edu/~csmc/?
 
 
 What's the origin for https://google.com?q=hello+world?

slide-7
SLIDE 7

From URLs to Origins

  • General form of a URL


scheme://user:pass@host:port/path?querystring#fragment

  • Most parts are optional giving URLs like


https://www.cs.oberlin.edu/~csmc/
 https://google.com?q=hello+world

  • Origins are the triple (scheme, host, port)


What's the origin for https://www.cs.oberlin.edu/~csmc/?
 
 
 What's the origin for https://google.com?q=hello+world? (https, www.cs.oberlin.edu, 443)

slide-8
SLIDE 8

From URLs to Origins

  • General form of a URL


scheme://user:pass@host:port/path?querystring#fragment

  • Most parts are optional giving URLs like


https://www.cs.oberlin.edu/~csmc/
 https://google.com?q=hello+world

  • Origins are the triple (scheme, host, port)


What's the origin for https://www.cs.oberlin.edu/~csmc/?
 
 
 What's the origin for https://google.com?q=hello+world? (https, www.cs.oberlin.edu, 443) (https, google.com, 443)

slide-9
SLIDE 9

Origins

slide-10
SLIDE 10

Origins

  • Why does the origin include the host?
slide-11
SLIDE 11

Origins

  • Why does the origin include the host?
  • To prevent attacker.com from scripting bank.com
slide-12
SLIDE 12

Origins

  • Why does the origin include the host?
  • To prevent attacker.com from scripting bank.com
  • Why does the origin include the scheme?
slide-13
SLIDE 13

Origins

  • Why does the origin include the host?
  • To prevent attacker.com from scripting bank.com
  • Why does the origin include the scheme?
  • If not, then http://bank.com can script https://bank.com. An "on-path"

attacker could inject <script>…</script> into http://bank.com which affects https://bank.com

slide-14
SLIDE 14

Origins

  • Why does the origin include the host?
  • To prevent attacker.com from scripting bank.com
  • Why does the origin include the scheme?
  • If not, then http://bank.com can script https://bank.com. An "on-path"

attacker could inject <script>…</script> into http://bank.com which affects https://bank.com

  • Why does the origin include the port?
slide-15
SLIDE 15

Origins

  • Why does the origin include the host?
  • To prevent attacker.com from scripting bank.com
  • Why does the origin include the scheme?
  • If not, then http://bank.com can script https://bank.com. An "on-path"

attacker could inject <script>…</script> into http://bank.com which affects https://bank.com

  • Why does the origin include the port?
  • Think about multiple web servers run by different users on the same
  • machine. Without including the port, https://host.com:8443 could script

the entirely unrelated https://host.com

slide-16
SLIDE 16

Not the end of the story

  • Documents (and thus scripts) can load elements from other origins

including images, scripts, style sheets, and flash objects

  • Loading these elements endorses their content and the included

elements are considered to be in the loading document's origin

  • Conversely, documents (and thus scripts) can submit forms which sends

data from the document to some server

  • Submitting forms declassifies the data sent
  • Cross-Origin Resource Sharing (CORS) can enable cross-origin requests
slide-17
SLIDE 17

Web Review | HTTP

gmail.com

slide-18
SLIDE 18

Web Review | HTTP

GET / HTTP/1.1
 Host: gmail.com gmail.com

slide-19
SLIDE 19

Web Review | HTTP

GET / HTTP/1.1
 Host: gmail.com gmail.com HTTP/1.1 200 OK
 …
 <html> <head> <script>alert(‘Hi!’)</script> </head> <img src=“//gmail.com/img.png”/>

slide-20
SLIDE 20

Web Review | HTTP

GET / HTTP/1.1
 Host: gmail.com gmail.com HTTP/1.1 200 OK
 …
 <html> <head> <script>alert(‘Hi!’)</script> </head> <img src=“//gmail.com/img.png”/> http://gmail.com/ says:
 Hi!

slide-21
SLIDE 21

Web Review | HTTP

GET / HTTP/1.1
 Host: gmail.com gmail.com HTTP/1.1 200 OK
 …
 <html> <head> <script>alert(‘Hi!’)</script> </head> <img src=“//gmail.com/img.png”/> GET /img.png HTTP/1.1
 Host: gmail.com http://gmail.com/ says:
 Hi!

slide-22
SLIDE 22

Web Review | HTTP

GET / HTTP/1.1
 Host: gmail.com gmail.com HTTP/1.1 200 OK
 …
 <html> <head> <script>alert(‘Hi!’)</script> </head> <img src=“//gmail.com/img.png”/> GET /img.png HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 <89>PNG^M ... http://gmail.com/ says:
 Hi!

slide-23
SLIDE 23

Web Review | HTTP

GET / HTTP/1.1
 Host: gmail.com gmail.com HTTP/1.1 200 OK
 …
 <html> <head> <script>alert(‘Hi!’)</script> </head> <img src=“//gmail.com/img.png”/> GET /img.png HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 <89>PNG^M ... http://gmail.com/ says:
 Hi!

slide-24
SLIDE 24

Web Review | AJAX (jQuery style)

gmail.com

slide-25
SLIDE 25

Web Review | AJAX (jQuery style)

GET / HTTP/1.1
 Host: gmail.com gmail.com

slide-26
SLIDE 26

Web Review | AJAX (jQuery style)

GET / HTTP/1.1
 Host: gmail.com gmail.com HTTP/1.1 200 OK
 … <script>
 $.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data) });
 </script>

slide-27
SLIDE 27

$.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data) });

Web Review | AJAX (jQuery style)

GET / HTTP/1.1
 Host: gmail.com gmail.com HTTP/1.1 200 OK
 … <script>
 $.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data) });
 </script>

slide-28
SLIDE 28

$.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data) });

Web Review | AJAX (jQuery style)

GET / HTTP/1.1
 Host: gmail.com gmail.com HTTP/1.1 200 OK
 … <script>
 $.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data) });
 </script> GET /msgs.json HTTP/1.1
 Host: gmail.com

slide-29
SLIDE 29

$.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data) });

Web Review | AJAX (jQuery style)

GET / HTTP/1.1
 Host: gmail.com gmail.com HTTP/1.1 200 OK
 … <script>
 $.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data) });
 </script> GET /msgs.json HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 { new_msgs: 3 }

slide-30
SLIDE 30

$.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data) });

Web Review | AJAX (jQuery style)

GET / HTTP/1.1
 Host: gmail.com gmail.com HTTP/1.1 200 OK
 … <script>
 $.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data) });
 </script> GET /msgs.json HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 { new_msgs: 3 } http://gmail.com/ says:
 { new_msgs: 3}

slide-31
SLIDE 31

Web Review | Same-Origin Policy (SOP)

(evil!)
 facebook.com gmail.com

slide-32
SLIDE 32

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com (evil!)
 facebook.com gmail.com

slide-33
SLIDE 33

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com (evil!)
 facebook.com HTTP/1.1 200 OK
 …
 <script>
 $.get(‘http://gmail.com/msgs.json’, function (data) { alert(data); } </script> gmail.com

slide-34
SLIDE 34

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com (evil!)
 facebook.com HTTP/1.1 200 OK
 …
 <script>
 $.get(‘http://gmail.com/msgs.json’, function (data) { alert(data); } </script> gmail.com $.get(‘http://gmail.com/msgs.json’, function (data) { alert(data); }

slide-35
SLIDE 35

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com (evil!)
 facebook.com HTTP/1.1 200 OK
 …
 <script>
 $.get(‘http://gmail.com/msgs.json’, function (data) { alert(data); } </script> GET /msgs.json HTTP/1.1
 Host: gmail.com gmail.com $.get(‘http://gmail.com/msgs.json’, function (data) { alert(data); }

slide-36
SLIDE 36

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com (evil!)
 facebook.com HTTP/1.1 200 OK
 …
 <script>
 $.get(‘http://gmail.com/msgs.json’, function (data) { alert(data); } </script> GET /msgs.json HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 { new_msgs: 3 } gmail.com $.get(‘http://gmail.com/msgs.json’, function (data) { alert(data); }

slide-37
SLIDE 37

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com (evil!)
 facebook.com HTTP/1.1 200 OK
 …
 <script>
 $.get(‘http://gmail.com/msgs.json’, function (data) { alert(data); } </script> GET /msgs.json HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 { new_msgs: 3 } gmail.com $.get(‘http://gmail.com/msgs.json’, function (data) { alert(data); }

slide-38
SLIDE 38

Web Review | Same-Origin Policy (SOP)

facebook.com gmail.com

slide-39
SLIDE 39

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com gmail.com

slide-40
SLIDE 40

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com HTTP/1.1 200 OK
 …
 <img src=“http://gmail.com/img.png”/> gmail.com

slide-41
SLIDE 41

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com HTTP/1.1 200 OK
 …
 <img src=“http://gmail.com/img.png”/> gmail.com

?

slide-42
SLIDE 42

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com HTTP/1.1 200 OK
 …
 <img src=“http://gmail.com/img.png”/> GET /img.png HTTP/1.1
 Host: gmail.com gmail.com

slide-43
SLIDE 43

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com HTTP/1.1 200 OK
 …
 <img src=“http://gmail.com/img.png”/> GET /img.png HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 <89>PNG^M ... gmail.com

slide-44
SLIDE 44

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com HTTP/1.1 200 OK
 …
 <img src=“http://gmail.com/img.png”/> GET /img.png HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 <89>PNG^M ... gmail.com

slide-45
SLIDE 45

Web Review | Same-Origin Policy (SOP)

facebook.com gmail.com

slide-46
SLIDE 46

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com gmail.com

slide-47
SLIDE 47

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com gmail.com HTTP/1.1 200 OK
 …
 <script src=“http://gmail.com/chat.js”/>

slide-48
SLIDE 48

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com gmail.com

?

HTTP/1.1 200 OK
 …
 <script src=“http://gmail.com/chat.js”/>

slide-49
SLIDE 49

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com GET /chat.js HTTP/1.1
 Host: gmail.com gmail.com HTTP/1.1 200 OK
 …
 <script src=“http://gmail.com/chat.js”/>

slide-50
SLIDE 50

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com GET /chat.js HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 $.get(‘http://gmail.com/chat.json’,
 function (data){ alert(data); }) gmail.com HTTP/1.1 200 OK
 …
 <script src=“http://gmail.com/chat.js”/>

slide-51
SLIDE 51

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com GET /chat.js HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 $.get(‘http://gmail.com/chat.json’,
 function (data){ alert(data); }) gmail.com $.get(‘http://gmail.com/chat.json’,
 function (data) { alert(data); }) HTTP/1.1 200 OK
 …
 <script src=“http://gmail.com/chat.js”/>

slide-52
SLIDE 52

Web Review | Same-Origin Policy (SOP)

gmail.com $.get(‘http://gmail.com/chat.json’,
 function (data) { alert(data); })

slide-53
SLIDE 53

Web Review | Same-Origin Policy (SOP)

gmail.com GET /chat.json HTTP/1.1
 Host: gmail.com $.get(‘http://gmail.com/chat.json’,
 function (data) { alert(data); })

slide-54
SLIDE 54

Web Review | Same-Origin Policy (SOP)

gmail.com GET /chat.json HTTP/1.1
 Host: gmail.com $.get(‘http://gmail.com/chat.json’,
 function (data) { alert(data); })

HTTP/1.1 200 OK
 …
 { new_msg: { from: “Bob”, msg: “Hi!”}}

slide-55
SLIDE 55

Web Review | Same-Origin Policy (SOP)

gmail.com GET /chat.json HTTP/1.1
 Host: gmail.com $.get(‘http://gmail.com/chat.json’,
 function (data) { alert(data); })

HTTP/1.1 200 OK
 …
 { new_msg: { from: “Bob”, msg: “Hi!”}}

slide-56
SLIDE 56

iframes

  • Complete document inside a document


<iframe src="https://somewhere.com/page.html"></iframe>

  • The contents of each iframe belong to its source origin


(https, somewhere.com, 443) for the iframe above

  • The iframe element itself belongs to its containing document
  • iframes obey the SOP
slide-57
SLIDE 57

Web Review | Same-Origin Policy (SOP)

facebook.com gmail.com

slide-58
SLIDE 58

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com gmail.com

slide-59
SLIDE 59

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com gmail.com HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/chat”/>

slide-60
SLIDE 60

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com gmail.com

?

HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/chat”/>

slide-61
SLIDE 61

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com gmail.com HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/chat”/>

slide-62
SLIDE 62

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com gmail.com HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/chat”/> GET /chat HTTP/1.1
 Host: gmail.com

slide-63
SLIDE 63

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com gmail.com HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/chat”/> GET /chat HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 <script>
 $.get(‘http://gmail.com/chat.json/’,
 function (data) { alert(data); });
 </script>

slide-64
SLIDE 64

Web Review | Same-Origin Policy (SOP)

GET / HTTP/1.1
 Host: facebook.com facebook.com gmail.com HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/chat”/> GET /chat HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 <script>
 $.get(‘http://gmail.com/chat.json/’,
 function (data) { alert(data); });
 </script>

$.get(‘http://gmail.com/chat.json’,
 function (data) { alert(data); })

slide-65
SLIDE 65

Web Review | Same-Origin Policy (SOP)

gmail.com

$.get(‘http://gmail.com/chat.json’,
 function (data) { alert(data); })

slide-66
SLIDE 66

Web Review | Same-Origin Policy (SOP)

gmail.com GET /chat.json HTTP/1.1
 Host: gmail.com

$.get(‘http://gmail.com/chat.json’,
 function (data) { alert(data); })

slide-67
SLIDE 67

Web Review | Same-Origin Policy (SOP)

gmail.com GET /chat.json HTTP/1.1
 Host: gmail.com

$.get(‘http://gmail.com/chat.json’,
 function (data) { alert(data); }) HTTP/1.1 200 OK
 …
 { new_msg: { from: “Bob”, msg: “Hi!”}}

slide-68
SLIDE 68

Web Review | Same-Origin Policy (SOP)

gmail.com GET /chat.json HTTP/1.1
 Host: gmail.com

$.get(‘http://gmail.com/chat.json’,
 function (data) { alert(data); }) HTTP/1.1 200 OK
 …
 { new_msg: { from: “Bob”, msg: “Hi!”}}

http://gmail.com/ says:
 
 { new_msgs: { from: “Bob”, msg: “Hi!”}}

slide-69
SLIDE 69

Beware finer-grained origins

  • Not all web features respect the SOP
  • Example: Cookies can include a path
  • In order to read a cookie with a path, the path of the document's URL

must extend the path of the cookie
 Cookie path: /a/b/c
 Document path: /a/b <- Cannot read the cookie
 /a/b/c/d <- Can read the cookie

  • This is "finer-grained" than the standard SOP
  • Is this a problem?
slide-70
SLIDE 70

Cookie paths example cont.

  • Since documents in the same page can script each other, page /a/b can

still read the cookie:

  • Create an iframe with src set to /a/b/c/d (where this the path of some

real document that can read the cookie value)

  • Since the iframe is in the same origin, page /a/b can inject a script

element into the iframe's document

  • The injected script reads the cookie value and sends it back to the

containing page

  • Cookie paths should not be used as a security boundary
slide-71
SLIDE 71

Mixed content

  • Documents can contain elements loaded over both http and https
  • Browsers indicate that this is insecure (by not displaying a lock icon) on

the page with mixed content

  • Other documents in the same origin are not similarly marked as insecure
slide-72
SLIDE 72

Mixed content

  • Documents can contain elements loaded over both http and https
  • Browsers indicate that this is insecure (by not displaying a lock icon) on

the page with mixed content

  • Other documents in the same origin are not similarly marked as insecure

Loaded over http

slide-73
SLIDE 73

Mixed content

  • Documents can contain elements loaded over both http and https
  • Browsers indicate that this is insecure (by not displaying a lock icon) on

the page with mixed content

  • Other documents in the same origin are not similarly marked as insecure

Loaded over http No lock

slide-74
SLIDE 74

Mixed content

  • Documents can contain elements loaded over both http and https
  • Browsers indicate that this is insecure (by not displaying a lock icon) on

the page with mixed content

  • Other documents in the same origin are not similarly marked as insecure

Loaded over http No lock Lock

slide-75
SLIDE 75

Mixed content

slide-76
SLIDE 76

Mixed content

  • Is that an issue?
slide-77
SLIDE 77

Mixed content

  • Is that an issue?
  • Yes, script injected from the element loaded over http could script other

pages in the same origin…

slide-78
SLIDE 78

Mixed content

  • Is that an issue?
  • Yes, script injected from the element loaded over http could script other

pages in the same origin…

  • …except modern browsers explicitly do not run scripts loaded via http in

an https page, so not really any more

slide-79
SLIDE 79

Cross-origin attacks

slide-80
SLIDE 80

Setup

  • Web attacker
  • Controls one or more domains (e.g., attacker.com, evil.com)
  • Can cause the victim to browse to a page serving JavaScript at one of

these domains

  • Victim is logged in to bank.com (or any other interesting site)
slide-81
SLIDE 81

Quick review

slide-82
SLIDE 82

Quick review

  • Can the attacker's JavaScript read bank.com?
slide-83
SLIDE 83

Quick review

  • Can the attacker's JavaScript read bank.com?
  • No. Same origin policy
slide-84
SLIDE 84

Quick review

  • Can the attacker's JavaScript read bank.com?
  • No. Same origin policy
  • The attacker's script uses XMLHttpRequest("https://bank.com") which

causes the browser to fetch https://bank.com and return its contents. Can the attacker's script read the response?

slide-85
SLIDE 85

Quick review

  • Can the attacker's JavaScript read bank.com?
  • No. Same origin policy
  • The attacker's script uses XMLHttpRequest("https://bank.com") which

causes the browser to fetch https://bank.com and return its contents. Can the attacker's script read the response?

  • No. Same origin policy
slide-86
SLIDE 86

Quick review

  • Can the attacker's JavaScript read bank.com?
  • No. Same origin policy
  • The attacker's script uses XMLHttpRequest("https://bank.com") which

causes the browser to fetch https://bank.com and return its contents. Can the attacker's script read the response?

  • No. Same origin policy
  • Can the attacker's script use


XMLHttpRequest("https://bank.com/transfer?from=victim&to=attacker")?

slide-87
SLIDE 87

Quick review

  • Can the attacker's JavaScript read bank.com?
  • No. Same origin policy
  • The attacker's script uses XMLHttpRequest("https://bank.com") which

causes the browser to fetch https://bank.com and return its contents. Can the attacker's script read the response?

  • No. Same origin policy
  • Can the attacker's script use


XMLHttpRequest("https://bank.com/transfer?from=victim&to=attacker")?

  • Yes! Same origin policy doesn't prevent this. The script just cannot read

the response

slide-88
SLIDE 88

Cross-site request forgery (CSRF)

  • The attacker's site instructs the victim's browser to make a request to an

honest site (e.g., using XMLHttpRequest or even just an enticing link)

  • An XMLHttpRequest allows both GET and POST
  • The browser sends all relevant cookies, including any sessions cookies

identifying the logged in victim

  • From the server's perspective, it looks exactly like a normal request from

the victim's browser

slide-89
SLIDE 89

Cross-site Request Forgery (CSRF)

bank.com POST /login?user=bob&pass=abc123 HTTP/1.1
 Host: bank.com HTTP/1.1 200 OK
 Set-Cookie: login=fde874
 ….

slide-90
SLIDE 90

Cross-site Request Forgery (CSRF)

bank.com POST /login?user=bob&pass=abc123 HTTP/1.1
 Host: bank.com HTTP/1.1 200 OK
 Set-Cookie: login=fde874
 …. fde874 = bob

slide-91
SLIDE 91

Cross-site Request Forgery (CSRF)

bank.com GET /account HTTP/1.1
 Host: bank.com Cookie: login=fde874 fde874 = bob

slide-92
SLIDE 92

Cross-site Request Forgery (CSRF)

bank.com GET /account HTTP/1.1
 Host: bank.com Cookie: login=fde874 HTTP/1.1 200 OK
 …. $378.42 fde874 = bob

slide-93
SLIDE 93

Cross-site Request Forgery (CSRF)

bank.com fde874 = bob Click me!!!
 http://bank.com/transfer?to=badguy&amt=100

slide-94
SLIDE 94

Cross-site Request Forgery (CSRF)

bank.com GET /transfer?to=badguy&amt=100 HTTP/1.1
 Host: bank.com Cookie: login=fde874 fde874 = bob Click me!!!
 http://bank.com/transfer?to=badguy&amt=100

slide-95
SLIDE 95

Cross-site Request Forgery (CSRF)

bank.com GET /transfer?to=badguy&amt=100 HTTP/1.1
 Host: bank.com Cookie: login=fde874 HTTP/1.1 200 OK
 …. Transfer complete: -$100.00 fde874 = bob Click me!!!
 http://bank.com/transfer?to=badguy&amt=100

slide-96
SLIDE 96

Why not make requests directly?

  • Use the browser's state: The browser sends cookies, client certificates,

basic auth credentials in the request

  • Set the browser's state: The browser parses and acts on responses, even

if the JavaScript cannot read the responses

  • Leverage the browser's network connectivity: The browser can connect to

servers the malicious site cannot reach (e.g., those behind a firewall)

slide-97
SLIDE 97

CSRF Defenses

  • Need to “authenticate” each user action originates from the legitimate site
  • Only needed for actions that change state (E.g., POST but not GET)
  • Why isn't it needed for GET?
  • Possibilities
  • Secret token
  • HTTP Referer header (yes, Referer not Referrer, it was misspelled)
  • Custom HTTP header
  • Origin header
slide-98
SLIDE 98

Secret token

  • Hidden form field with the token value
  • The token should be unpredictable to attackers
  • Random numbers work, but then need to be stored server side
  • Using crypto, we can do better (HMAC)
  • The token should be sent along with every POST and checked by the

server

  • This is a hassle for dynamically-generated content since it needs to

include the tokens

  • What prevents malicious script from fetching the page (e.g., with

XMLHttpRequest), reading the token, and then sending a response with the token?

slide-99
SLIDE 99

Example CSRF token

<form action="/transfer" method="post"> <input type="hidden" name="token" value="8d64"> To <input type="text" name="to"><br> Amount <input type="text" name="amount"><br> <input type="submit" value="Transfer"> </form>

slide-100
SLIDE 100

CSRF Defenses

bank.com fde874 = bob HTTP/1.1 200 OK
 Set-Cookie: login=fde874 <form action="/transfer" method="post"> <input type="hidden" name="token" value="8d64"> …

This is not actually how POST data is encoded and sent, but the principle is the same

slide-101
SLIDE 101

CSRF Defenses

bank.com POST /transfer?to=joe&amt=25&token=8d64 HTTP/1.1
 Host: bank.com Cookie: login=fde874 fde874 = bob HTTP/1.1 200 OK
 Set-Cookie: login=fde874 <form action="/transfer" method="post"> <input type="hidden" name="token" value="8d64"> …

This is not actually how POST data is encoded and sent, but the principle is the same

slide-102
SLIDE 102

CSRF Defenses

bank.com POST /transfer?to=joe&amt=25&token=8d64 HTTP/1.1
 Host: bank.com Cookie: login=fde874 HTTP/1.1 200 OK
 …. Transfer complete: -$25.00 fde874 = bob HTTP/1.1 200 OK
 Set-Cookie: login=fde874 <form action="/transfer" method="post"> <input type="hidden" name="token" value="8d64"> …

This is not actually how POST data is encoded and sent, but the principle is the same

slide-103
SLIDE 103

Referer header

  • Sent by the browser and contains the URL of the page containing the link

that was clicked or form that was submitted

  • Easy to handle server side, just check that the request comes with the

correct Referer header

  • However, it is frequently stripped by the browser or middle boxes (for

privacy reasons)

  • It's stripped less often over HTTPS since middle boxes can't modify

content

slide-104
SLIDE 104

Custom HTTP header

  • XMLHttpRequest supports adding custom headers but browsers disallow

them on cross-origin requests

  • Server can check that the custom header is present
slide-105
SLIDE 105

Origin header

  • The evolution of the Referer header but only contains the scheme, host,

and port, not the full URL

  • As with the Referer and custom headers, the server checks the Origin is

correct

  • Supported by all major browsers
  • Unlike custom headers, it's part of the standard
slide-106
SLIDE 106

Cross-site scripting (XSS)

  • XSS is a method for attackers to embed content (often JavaScript) in

another page

  • Two basic types
  • Reflected XSS
  • Stored XSS
slide-107
SLIDE 107

Reflected XSS

  • Web attacker causes the victim to click a link to a legitimate page where

the link contains some script

  • The server includes the script verbatim in the legitimate page which is

sent back to the browser

  • The browser interprets it as script coming from the legitimate origin
slide-108
SLIDE 108

Cross-Site Scripting (XSS)

<?php echo “Hello, ” . $_GET[“user”] . “!”;

slide-109
SLIDE 109

Cross-Site Scripting (XSS)

<?php echo “Hello, ” . $_GET[“user”] . “!”; GET /?user=Bob HTTP/1.1

slide-110
SLIDE 110

Cross-Site Scripting (XSS)

<?php echo “Hello, ” . $_GET[“user”] . “!”; GET /?user=Bob HTTP/1.1 HTTP/1.1 200 OK
 …
 Hello, Bob!

slide-111
SLIDE 111

Cross-Site Scripting (XSS)

<?php echo “Hello, ” . $_GET[“user”] . “!”; GET /?user=<u>Bob</u> HTTP/1.1

slide-112
SLIDE 112

Cross-Site Scripting (XSS)

<?php echo “Hello, ” . $_GET[“user”] . “!”; GET /?user=<u>Bob</u> HTTP/1.1 HTTP/1.1 200 OK
 …
 Hello, <u>Bob</u>!

slide-113
SLIDE 113

Cross-Site Scripting (XSS)

<?php echo “Hello, ” . $_GET[“user”] . “!”; GET /?user=<script>alert(‘XSS’)</script> HTTP/1.1

slide-114
SLIDE 114

Cross-Site Scripting (XSS)

<?php echo “Hello, ” . $_GET[“user”] . “!”; GET /?user=<script>alert(‘XSS’)</script> HTTP/1.1 HTTP/1.1 200 OK
 …
 Hello, <script>alert(‘XSS’)</script>!

slide-115
SLIDE 115

Cross-Site Scripting (XSS)

<?php echo “Hello, ” . $_GET[“user”] . “!”; GET /?user=<script>alert(‘XSS’)</script> HTTP/1.1 HTTP/1.1 200 OK
 …
 Hello, <script>alert(‘XSS’)</script>! http://vuln.com/ says:
 XSS

slide-116
SLIDE 116

Cross-Site Scripting (XSS)

<?php echo “Hello, ” . $_GET[“user”] . “!”; GET /?user=<script>alert(‘XSS’)</script> HTTP/1.1 HTTP/1.1 200 OK
 …
 Hello, <script>alert(‘XSS’)</script>! http://vuln.com/ says:
 XSS Click me!!!
 http://vuln.com/?user=<script>alert(‘XSS’)</script>

slide-117
SLIDE 117

Cross-Site Scripting (XSS) Attack

GET / HTTP/1.1
 Host: facebook.com (evil!)
 facebook.com HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/?user=<script>
 $.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data); })
 </script>”></iframe> gmail.com

slide-118
SLIDE 118

Cross-Site Scripting (XSS) Attack

GET / HTTP/1.1
 Host: facebook.com (evil!)
 facebook.com HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/?user=<script>
 $.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data); })
 </script>”></iframe> gmail.com

slide-119
SLIDE 119

Cross-Site Scripting (XSS) Attack

GET / HTTP/1.1
 Host: facebook.com (evil!)
 facebook.com HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/?user=<script>
 $.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data); })
 </script>”></iframe> GET /?user=<script>$.get(‘ … </script> HTTP/1.1
 Host: gmail.com gmail.com

slide-120
SLIDE 120

Cross-Site Scripting (XSS) Attack

GET / HTTP/1.1
 Host: facebook.com (evil!)
 facebook.com HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/?user=<script>
 $.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data); })
 </script>”></iframe> GET /?user=<script>$.get(‘ … </script> HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 Hello, <script>$.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data); }) </script> gmail.com

slide-121
SLIDE 121

$.get(‘http://gmail.com/
 msgs.json’, function (data) 
 { alert(data); })

Cross-Site Scripting (XSS) Attack

GET / HTTP/1.1
 Host: facebook.com (evil!)
 facebook.com HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/?user=<script>
 $.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data); })
 </script>”></iframe> GET /?user=<script>$.get(‘ … </script> HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 Hello, <script>$.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data); }) </script> gmail.com

slide-122
SLIDE 122

Cross-Site Scripting (XSS) Attack

GET / HTTP/1.1
 Host: facebook.com HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/?user=<script>
 $.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data); })
 </script>”></iframe> gmail.com

$.get(‘http://gmail.com/
 msgs.json’, function (data) { alert(data); })

(evil!)
 facebook.com

slide-123
SLIDE 123

Cross-Site Scripting (XSS) Attack

GET / HTTP/1.1
 Host: facebook.com HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/?user=<script>
 $.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data); })
 </script>”></iframe> GET /msgs.json HTTP/1.1
 Host: gmail.com gmail.com

$.get(‘http://gmail.com/
 msgs.json’, function (data) { alert(data); })

(evil!)
 facebook.com

slide-124
SLIDE 124

Cross-Site Scripting (XSS) Attack

GET / HTTP/1.1
 Host: facebook.com HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/?user=<script>
 $.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data); })
 </script>”></iframe> GET /msgs.json HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 { new_msgs: 3 } gmail.com

$.get(‘http://gmail.com/
 msgs.json’, function (data) { alert(data); })

(evil!)
 facebook.com

slide-125
SLIDE 125

Cross-Site Scripting (XSS) Attack

GET / HTTP/1.1
 Host: facebook.com HTTP/1.1 200 OK
 …
 <iframe src=“http://gmail.com/?user=<script>
 $.get(‘http://gmail.com/msgs.json’, 
 function (data) { alert(data); })
 </script>”></iframe> GET /msgs.json HTTP/1.1
 Host: gmail.com HTTP/1.1 200 OK
 …
 { new_msgs: 3 } gmail.com

$.get(‘http://gmail.com/
 msgs.json’, function (data) { alert(data); })

(evil!)
 facebook.com http://gmail.com/ says:
 { new_msgs: 3 }

slide-126
SLIDE 126

XSS capabilities

  • Execute arbitrary scripts in the context (i.e., Origin) of the vulnerable

server

  • Manipulate the DOM of the vulnerable page
  • Submit/read forms (including any CSRF tokens)
  • Read cookies
  • Install event handlers
  • In essence, anything that JavaScript can do!
slide-127
SLIDE 127

Stored XSS

  • Some web sites serve user-generated content but fail to properly sanitize

the user's input

  • The attacker POSTs some HTML with JavaScript on the page (e.g., a post
  • n a forum)
  • When victims visit the page, the attacker's script is served and the

browser (not realizing it came from the attacker) executes it as normal

  • The script can do anything JavaScript can do!
slide-128
SLIDE 128

Example: Samy worm

  • Myspace allowed users to insert HTML in their profiles, but disallowed

<script>

  • Some browsers support JavaScript inside CSS


<div style="background:url('javascript: eval(...)')">

  • Myspace disallowed the word javascript but Internet Explorer (at the time

anyway) allowed
 java
 script
 which bypassed their filter

  • Other filters were bypassed by using eval()
slide-129
SLIDE 129

Example: Samy worm

  • Samy Kamkar discovered this and put some script in his profile
  • When his page was viewed by a victim, the victim's browser would run the

script which would modify the victim's profile to include "but most of all, samy is my hero" as well as the script itself

  • Within 20 hours, over one million people's profiles were infected
  • Myspace had to go offline to fix the problem
  • Kamkar pleaded guilty to a felony and got 3 years probation, a fine, and

restricted computer use (now he makes cool YouTube videos!)