The Problem(s) with the Browser Collin Jackson - - PowerPoint PPT Presentation

▶
the problem s with the browser
SMART_READER_LITE
LIVE PREVIEW

The Problem(s) with the Browser Collin Jackson - - PowerPoint PPT Presentation

Jun 09, 2023 29 likes •512 views

The Problem(s) with the Browser Collin Jackson collin.jackson@sv.cmu.edu Web: The OS of the Future? Ubiquitous Dynamic Instant updates Interactive Programs Pages Web Applications Remote code? Are you crazy?? Integrity Compromise

slide-1
SLIDE 1

The Problem(s) with the Browser

Collin Jackson collin.jackson@sv.cmu.edu

slide-2
SLIDE 2

Web: The OS of the Future?

Pages Web Applications Programs Dynamic Interactive Ubiquitous Instant updates

slide-3
SLIDE 3

Remote code? Are you crazy??

  • Integrity

– Compromise your machine – Install a malware rootkit – Buy stuff with your credit card

  • Confidentiality

– Steal passwords – Read your email

slide-4
SLIDE 4

Browser Sandbox

  • Goal

– Run remote web applications safely – Limit access to OS, network, and browser

data

  • Approach

– Isolate sites in different security contexts – Browser manages resources, like an OS

slide-5
SLIDE 5

What the Sandbox Can't Stop

Cross-Site Scripting (XSS) Cross-Site Request Forgery (CSRF) Clickjacking Network Attacks (Firesheep, etc.)

slide-6
SLIDE 6

WEB BUILDING BLOCKS

6

slide-7
SLIDE 7

Safe to Type My Password?

  • Click to edit Master text styles

– Second level

– Third level

  • Fourth level

– Fifth level

slide-8
SLIDE 8

URLs

  • Global identifiers of network-retrievable documents
  • Example:

http:// sv.cmu.edu :81/class?name=browsersec #homework

Protocol Hostname Port Path Query Fragment

slide-9
SLIDE 9

GET /index.html HTTP/1.1 Accept: image/gif, image/x-bitmap, image/jpeg, */* Accept-Language: en Connection: Keep-Alive User-Agent: Mozilla/1.22 (compatible; MSIE 2.0; Windows 95) Host: www.example.com Referer: http://www.google.com?q=dingbats

HTTP Request

Method File HTTP version Headers Data – none for GET Blank line

GET : no side effect POST : possible side effect

slide-10
SLIDE 10

HTTP/1.0 200 OK Date: Sun, 21 Apr 1996 02:20:42 GMT Server: Microsoft-Internet-Information-Server/5.0 Connection: keep-alive Content-Type: text/html Last-Modified: Thu, 18 Apr 1996 17:39:05 GMT Set-Cookie: … Content-Length: 2543 <HTML> Some data... blah, blah, blah </HTML>

HTTP Response

HTTP version Status code Reason phrase Headers Data

slide-11
SLIDE 11
  • Navigation
  • <a href="http://www.a.com">Click here</a>
  • Import
  • <script src="prototype.js"></script>
  • <link rel="stylesheet" href="base.css">
  • Export
  • <form action="login.cgi">
  • postMessage('hello world', '*');
  • XMLHttpRequest

Network Primitives

slide-12
SLIDE 12

Same-Origin Access

  • Click to edit Master text styles

– Second level

– Third level

  • Fourth level

– Fifth level

12 Origin = Scheme, host, port Full DOM access

slide-13
SLIDE 13

Cross-Origin Access

  • Click to edit Master text styles

– Second level

– Third level

  • Fourth level

– Fifth level

http://www.google.com != http://petscaravan.com Navigation, import, export only

slide-14
SLIDE 14

Domain Relaxation

  • Origin: scheme, host, (port), hasSetDomain
  • Try document.domain = document.domain

www.facebook.com www.facebook.com

www.facebook.com chat.facebook.com

chat.facebook.com

facebook.com facebook.com

slide-15
SLIDE 15

Newer forms of Import/Export

Cross-origin network requests Access-Control-Allow-Origin: <list of domains> Access-Control-Allow-Origin: * Cross-origin client side communication Client-side messaging via navigation (older browsers) postMessage (newer browsers)

Site B Site A

Site A context Site B context

slide-16
SLIDE 16

SESSION MANAGEMENT

16

slide-17
SLIDE 17

URL-based Session Management

  • Click to edit Master text styles

– Second level

– Third level

  • Fourth level

– Fifth level

slide-18
SLIDE 18

Limitations of URL-based Session Management

  • Shoulder surfing
  • Screenshots
  • HTML Sharing
  • Printing
  • Referrer leaking
  • Accidental sharing
  • Cache
  • Bookmark theft
slide-19
SLIDE 19

Alternatives

  • HTTP Authentication
  • HTTPS Mutual Authentication
  • Cookies

– Expiration – Wildcard sharing – Logout – Recovery – Minimizing server state

slide-20
SLIDE 20

Cookies

  • Used to store state on user’s machine

Browser

Server

POST … HTTP Header: Set-cookie: NAME=VALUE ; domain = (who can read) ; expires = (when expires) ; secure = (only over SSL) Browser

Server

POST … Cookie: NAME = VALUE HTTP is stateless protocol; cookies add state If expires=NULL: this session only

slide-21
SLIDE 21

Cookie-based Session Management

Browser Web Server POST login.cgi Username & pwd Set-cookie: auth=val GET restricted.html Cookie: auth=val If YES, restricted.html

slide-22
SLIDE 22

Cookie Security Policy

  • Uses:

– User authentication – Personalization – User tracking: e.g. Doubleclick (3rd party

cookies)

  • Browser will store:

– At most 20 cookies/site, 3 KB / cookie

  • Origin is the tuple <domain, path>

– Can set cookies valid across a domain suffix

slide-23
SLIDE 23

History

  • Click to edit Master text styles

– Second level

– Third level

  • Fourth level

– Fifth level

slide-24
SLIDE 24

httpOnly Cookies

Browser

Server

GET … HTTP Header: Set-cookie: NAME=VALUE ; httpOnly

  • Cookie sent over HTTP(s), but not accessible to scripts
  • cannot be read via document.cookie
  • Helps prevent cookie theft via XSS

… but does not stop most other risks of XSS bugs

slide-25
SLIDE 25

SESSION INTEGRITY

slide-26
SLIDE 26

Threat Models

  • Web Attacker

– https://www.attacker.com – Free user visit

  • Sibling Domain Attacker

– attacker.appspot.com

  • Network Attacker

– Eavesdrop (Firesheep) – Corrupt network traffic – Present fake certificates

slide-27
SLIDE 27

Cross-Site Request Forgery

slide-28
SLIDE 28

Login CSRF

slide-29
SLIDE 29

Payments Login CSRF

slide-30
SLIDE 30

Payments Login CSRF

slide-31
SLIDE 31

Payments Login CSRF

slide-32
SLIDE 32

Payments Login CSRF

slide-33
SLIDE 33

Another login CSRF problem

slide-34
SLIDE 34

Common CSRF Defense

  • Secret Validation Token
  • Referer Validation
  • Custom HTTP Header

<input type=hidden value=23a3af01b> Referer: http://www.facebook.com/home.php X-Requested-By: XMLHttpRequest

slide-35
SLIDE 35

What have we lost?

  • Shoulder surfing
  • Screenshots
  • HTML Sharing
  • Printing
  • Referrer leaking
  • Accidental sharing
  • Cache
  • Bookmark theft
slide-36
SLIDE 36

Alternatives

  • Referer Validation / Origin Validation
  • Custom HTTP Header

Referer: http://www.facebook.com/home.php X-Requested-By: XMLHttpRequest

slide-37
SLIDE 37

Cross-Subdomain Overwriting

  • Click to edit Master text styles

– Second level

–

Third level

  • Fourth level

– Fifth level

  • Shopping cart

modification

  • Login CSRF
  • Session fixation
slide-38
SLIDE 38

Network Attacker

  • Eavesdrop or corrupt network traffic

– Wireless networks – ISP – Pharming

  • Defense: HTTPS

– Protects passwords – Use “Secure” cookies to protect session

slide-39
SLIDE 39

Secure Cookie Overwriting

  • Click to edit Master text styles

– Second level

– Third level

  • Fourth level

– Fifth level

slide-40
SLIDE 40

Secure Cookie Overwriting

  • Click to edit Master text styles

– Second level

– Third level

  • Fourth level

– Fifth level

Hidden http://mail.google.com iframe

slide-41
SLIDE 41

SSL Rebinding

  • Click to edit Master text styles

– Second level

– Third level

  • Fourth level

– Fifth level

slide-42
SLIDE 42

SSL Rebinding

  • Click to edit Master text styles

– Second level

– Third level

  • Fourth level

– Fifth level

slide-43
SLIDE 43

Is there any hope?

slide-44
SLIDE 44

What we want

Unforgeability + Integrity + Persistence = Session integrity

slide-45
SLIDE 45

Suggestion

  • Existing browsers: Custom HTTP Header

– Use LocalStorage for integrity

  • Future browsers: Send it automatically

– Doesn't solve confused deputy problems – Still need CSRF defenses

X-Session-T

  • ken: 62DV2f323t23

Courtesy of Adam Barth, Andrew Bortz, and Alexei Czeskis

Cake: 62DV2f323t23

slide-46
SLIDE 46

Strict Transport Security

– HTTPS is rarely used

securely

–

SSL stripping

–

Mixed content

–

Certificate error override

– Help browsers identify

high-security servers

– Reduces burden on user – Extensible – Backwards compatible

Collaborators: Adam Barth (UC Berkeley), Jeff Hodges (PayPal), Sid Stamm (Mozilla), VeriSig

slide-47
SLIDE 47

Browserscope.org

  • Click to edit Master text styles

– Second level

– Third level

  • Fourth level

– Fifth level

slide-48
SLIDE 48

Thanks!

http://websec.sv.cmu.edu/