Session Juggler Elie Bursztein, Chinmay Soman, Dan Boneh, John - - PowerPoint PPT Presentation

▶
session juggler
SMART_READER_LITE
LIVE PREVIEW

Session Juggler Elie Bursztein, Chinmay Soman, Dan Boneh, John - - PowerPoint PPT Presentation

Jan 13, 2024 632 likes •921 views

Session Juggler Elie Bursztein, Chinmay Soman, Dan Boneh, John Michell Stanford University / Google 1 About this presentation Date: 19 April 2012 Conference: WWW 2012 Feel free to contact me URL: http://ly.tl/p23 if you have any question

slide-1
SLIDE 1

Session Juggler

Elie Bursztein, Chinmay Soman, Dan Boneh, John Michell Stanford University / Google

1

slide-2
SLIDE 2

Elie Bursztein Slide deck 2010 http://ly.tl/t1

About this presentation

Date: 19 April 2012 Conference: WWW 2012 URL: http://ly.tl/p23

if you have any question Feel free to contact me

slide-3
SLIDE 3

Elie Bursztein Slide deck 2010 http://ly.tl/t1

slide-4
SLIDE 4

Elie Bursztein Slide deck 2010 http://ly.tl/t1

slide-5
SLIDE 5

Elie Bursztein Slide deck 2010 http://ly.tl/t1

slide-6
SLIDE 6

Elie Bursztein Slide deck 2010 http://ly.tl/t1

slide-7
SLIDE 7

Elie Bursztein Slide deck 2010 http://ly.tl/t1

\

Afraid of the Dark ?

slide-8
SLIDE 8

Elie Bursztein Slide deck 2010 http://ly.tl/t1

\

Afraid of the Dark ?

slide-9
SLIDE 9

Elie Bursztein http://elie.im Session Juggler WWW 2012

Looking for something ?

slide-10
SLIDE 10

Elie Bursztein http://elie.im Session Juggler WWW 2012

Looking for something ?

slide-11
SLIDE 11

Elie Bursztein http://elie.im Session Juggler WWW 2012

HTTPS adoption

% of site using HTTPS 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% Number of sites (logarithmic) 102 103 104 105 % of sites using HTTPS to log users

slide-12
SLIDE 12

Elie Bursztein http://elie.im Session Juggler WWW 2012

Ephemeral login

  • Can’t trust the client at all
  • Work for every browser every site
  • Use a secure device / secure channel (phone)
slide-13
SLIDE 13

Elie Bursztein http://elie.im Session Juggler WWW 2012

Not that easy

[5] [24] [29] [21] [12] [28] [31] year 1999 2004 2006 2007 2008 2008 2009 Trusted device Palm Pilot PDA Phone Phone Phone Phone Phone Requires server-side changes X X X X X Requires client-side changes X X X X X X X Connection type USB USB Net USB/BT USB Net NFC Hardware needed TPM TPM/NFC

slide-14
SLIDE 14

Elie Bursztein Slide deck 2010 http://ly.tl/t1

Ephemeral login vs OTP

  • Site specific

password list proliferation

  • Logout issue

how to be sure ?

slide-15
SLIDE 15

Elie Bursztein http://elie.im Session Juggler WWW 2012

Sometime bad guys make the best good guys

slide-16
SLIDE 16

Elie Bursztein Slide deck 2010 http://ly.tl/t1

Let’s steal a session (demo)

slide-17
SLIDE 17

Elie Bursztein http://elie.im Session Juggler WWW 2012

In case the demo failed :)

Log me in Discard Do you want to be logged to

www.facebook.com

slide-18
SLIDE 18

Elie Bursztein http://elie.im Session Juggler WWW 2012

Flow view

  • 2. Login
  • 5. Resume session
  • 3. {Session data}k
  • 4. {Session data} k
  • 1. QR code exchange

Phone Blackboard Unsecure terminal Target website

Out of band exchange HTTP(S) traffic Encrypted data

slide-19
SLIDE 19

Elie Bursztein http://elie.im Session Juggler WWW 2012

Flow view

  • 2. Login
  • 5. Resume session
  • 3. {Session data}k
  • 4. {Session data} k
  • 1. QR code exchange

Phone Blackboard Unsecure terminal Target website

Out of band exchange HTTP(S) traffic Encrypted data

slide-20
SLIDE 20

Elie Bursztein http://elie.im Session Juggler WWW 2012

Flow view

  • 2. Login
  • 5. Resume session
  • 3. {Session data}k
  • 4. {Session data} k
  • 1. QR code exchange

Phone Blackboard Unsecure terminal Target website

Out of band exchange HTTP(S) traffic Encrypted data

slide-21
SLIDE 21

Elie Bursztein http://elie.im Session Juggler WWW 2012

Flow view

  • 2. Login
  • 5. Resume session
  • 3. {Session data}k
  • 4. {Session data} k
  • 1. QR code exchange

Phone Blackboard Unsecure terminal Target website

Out of band exchange HTTP(S) traffic Encrypted data

slide-22
SLIDE 22

Elie Bursztein http://elie.im Session Juggler WWW 2012

Flow view

  • 2. Login
  • 5. Resume session
  • 3. {Session data}k
  • 4. {Session data} k
  • 1. QR code exchange

Phone Blackboard Unsecure terminal Target website

Out of band exchange HTTP(S) traffic Encrypted data

slide-23
SLIDE 23

Elie Bursztein http://elie.im Session Juggler WWW 2012

Hijacking defense

Defense % of Alexa100 Login over HTTPS 83% Using secure cookies 52% Seperating mobile and desktop sessions 6% Binding session to IP address 8% Checking local time 1% Binding session to user-agent header 0% Binding session to local language 0% Logout over HTTPS 1%

slide-24
SLIDE 24

Elie Bursztein http://elie.im Session Juggler WWW 2012

Experimental results

  • Works on 98% of the Alexa top 100
  • Can be extended to work against arbitrary defense
slide-25
SLIDE 25

Elie Bursztein http://elie.im Session Juggler WWW 2012

Conclusion

  • Steal http session to provide a temporary login
  • No server side or client modification
slide-26
SLIDE 26

Elie Bursztein http://elie.im Session Juggler WWW 2012

Questions ? Follow-me ! Thank you ! Google+ / Twitter: @elie More research: http://elie.im/

Thank you

slide-27
SLIDE 27

Elie Bursztein http://elie.im Session Juggler WWW 2012

Alternative architecture

1) key 5) Login 3) {Request} Resume session 7) {Session data} 2) {Request} 6) {Session data} 4) Get password