WPSE: F ORTIFYING W EB P ROTOCOLS VIA B ROWSER -S IDE S ECURITY M - - PowerPoint PPT Presentation
WPSE: F ORTIFYING W EB P ROTOCOLS VIA B ROWSER -S IDE S ECURITY M ONITORING Stefano Calzavara Mauro Tempesta Matteo Ma ff ei Riccardo Focardi Marco Squarcina Clara Schneidewind August 17, 2018 - 27 th Usenix Security Symposium O VERVIEW OF A W
Stefano Calzavara Riccardo Focardi Matteo Maffei Clara Schneidewind Marco Squarcina Mauro Tempesta
August 17, 2018 - 27th Usenix Security Symposium
2
RP IdP
2
RP IdP
2
RP IdP
2
user = MrStorm, pwd = ●●●●●●● RP IdP
Designing and implementing web protocols is HARD!
Security Study of Commercially Deployed Single-Sign-On Web Services (S&P ’12)
SSO Systems (CCS ’12)
3
Designing and implementing web protocols is HARD!
Security Study of Commercially Deployed Single-Sign-On Web Services (S&P ’12)
SSO Systems (CCS ’12)
3
Designing and implementing web protocols is HARD!
Security Study of Commercially Deployed Single-Sign-On Web Services (S&P ’12)
SSO Systems (CCS ’12)
3
The browser is not aware of the existence of web protocols and of their semantics!
4
Extend the browser with a lightweight security monitor that enforces the compliance of the browser behaviors with respect to the web protocol specifications
4
Extend the browser with a lightweight security monitor that enforces the compliance of the browser behaviors with respect to the web protocol specifications
Implemented as a Google Chrome extension
4
Extend the browser with a lightweight security monitor that enforces the compliance of the browser behaviors with respect to the web protocol specifications Advantages:
class of attacks
Implemented as a Google Chrome extension
5
1 2 3
Compliance with the protocol flow
exchanged by honest participants
messages Secrecy of message components
tokens and credentials
WPSE protocol specification:
placeholders before they enter the DOM
1 2 3
user = MrStorm, pwd = ●●●●●●●
7
RP_id, rdr_uri, state
RP IdP U
Login form
1 2 3
auth_code, state rdr_uri
4 5 auth_code, RP_id, rdr_uri 6
access_token
7
access_token
8
resource
user = MrStorm, pwd = ●●●●●●●
7
RP IdP U
Login form
1 2 3 4 5 auth_code, RP_id, rdr_uri 6
access_token
7
access_token
8
resource
WPSE
Protocol Flow 2 → 3 → 4 with same rdr_uri and state in steps 2, 4
RP_id, rdr_uri, state auth_code, state rdr_uri
user = MrStorm, pwd = ●●●●●●●
7
RP IdP U
Login form
1 2 3 4 5 auth_code, RP_id, rdr_uri 6
access_token
7
access_token
8
resource
WPSE
Protocol Flow 2 → 3 → 4 with same rdr_uri and state in steps 2, 4 Secrecy RP < auth_code, state > IdP
RP_id, rdr_uri, state auth_code, state rdr_uri
8
user = h4ckerb0y, pwd = ●●●●●●● RP_id, rdr_uri
RP IdP
Login form
1 2 3
A auth_code
8
U A
8
user = h4ckerb0y, pwd = ●●●●●●● RP_id, rdr_uri
RP IdP
Login form
1 2 3
A auth_code
8
U A
Gimme torrents plz!
8
user = h4ckerb0y, pwd = ●●●●●●● RP_id, rdr_uri
RP IdP
Login form
1 2 3
A auth_code rdr_uri
4 5
A auth_code, RP_id, rdr_uri
6
A access_token
7
A access_token
8
A resource
8
U A
Gimme torrents plz!
A auth_code
8
user = h4ckerb0y, pwd = ●●●●●●● RP_id, rdr_uri
RP IdP
Login form
1 2 3
A auth_code rdr_uri
4 5
A auth_code, RP_id, rdr_uri
6
A access_token
7
A access_token
8
A resource
8
U A
Gimme torrents plz!
A auth_code
P r
fl
v i
a t i
! R e q u e s t b l
k e d b y W P S E
9
user = MrStorm, pwd = ●●●●●●● RP_id, rdr_uri, state
RP IdP
Login form
1 2 3
rdr_uri
4 5
auth_code, RP_id, rdr_uri
6
access_token
7
access_token
8
resource
9
U
auth_code, state
9
user = MrStorm, pwd = ●●●●●●● RP_id, rdr_uri, state
RP IdP
Login form
1 2 3
rdr_uri
4 5
auth_code, RP_id, rdr_uri
6
access_token
7
access_token
8
resource
9
U Attacker’s website
auth_code, state
Referer header auth_code, state
9
user = MrStorm, pwd = ●●●●●●● RP_id, rdr_uri, state
RP IdP
Login form
1 2 3
rdr_uri
4 5
auth_code, RP_id, rdr_uri
6
access_token
7
access_token
8
resource
9
U Attacker’s website
auth_code, state
Referer header auth_code, state
W P S E r e p l a c e s s e c r e t d a t a w i t h r a n d
p l a c e h
d e r s
(H1) The protocol fulfills safety property P with a benign webpage (H2) WPSE allows only a subset of the I/O sequences performed by the browser in a honest protocol run (H3) Secrets are not leaked and securely stored by the browser
10
(H1) The protocol fulfills safety property P with a benign webpage (H2) WPSE allows only a subset of the I/O sequences performed by the browser in a honest protocol run (H3) Secrets are not leaked and securely stored by the browser
10
The protocol fulfills P with a compromised browser monitored by WPSE
11
Security
advertisement libraries (4 RPs)
parameter (55 RPs)
Compatibility
Problems due to security critical deviations in the protocol flow (7 RPs), e.g. auth code is sent twice, second time over HTTP
12
12
Feb 4
Report to Google
12
Feb 4 Feb 27
Report to Google
12
Feb 4 Feb 27 Apr 25
Report to Google
13
Lightweight policies on the client-side suffice to enforce provable security guarantees in web protocols
from protocol specifications / browser traffic
13
Lightweight policies on the client-side suffice to enforce provable security guarantees in web protocols
tempesta@unive.it https://sites.google.com/site/wpseproject/