Scribd
Upload
53 views

Computer Security

Computer Security hacking web security xss hickjacking etc Web secu 2, bla bla bla Computer Security hacking web security xss hickjacking etc Web secu 2, bla bla bla Computer Security hacking web security xss hickjacking etc Web secu 2, bla bla bla Computer Security hacking web security xss hickjacking etc Web secu 2, bla bla bla Computer Security hacking web security xss hickjacking etc Web secu 2, bla bla bla. Wenservices security

Uploaded by

Rank Duss
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
53 views

Computer Security

Computer Security hacking web security xss hickjacking etc Web secu 2, bla bla bla Computer Security hacking web security xss hickjacking etc Web secu 2, bla bla bla Computer Security hacking web security xss hickjacking etc Web secu 2, bla bla bla Computer Security hacking web security xss hickjacking etc Web secu 2, bla bla bla Computer Security hacking web security xss hickjacking etc Web secu 2, bla bla bla. Wenservices security

Uploaded by

Rank Duss
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 34

Web

Security
CS642:
Computer Security
Professor Ristenpart
h9p://www.cs.wisc.edu/~rist/
rist at cs dot wisc dot edu
Liberal borrowing from Mitchell, Boneh, Stanford CS 155
University of Wisconsin CS 642

Announcements
HW3 should be posted tonight or tomorrow
Check the web site announcements
Check email

Web security part 1


Basic web security models
Browser security
Same-origin policy / NavigaQon policy
Cookies / Session handling

University of Wisconsin CS 642

WWW
Tim Berners-Lee and Robert Cailliau 1990
HTTP, CERN h9pd, gopher

1993 Mosiac web browser (UIUC, Marc Andreesen)

1994 W3C WWW ConsorQum --- generate standards
Gopher started charging licensing fees
(Univ of Minnesota)

Nowdays: ecosystem of technologies

HTTP / HTTPS
AJAX
PHP
Javascript
SQL
Apache
Ruby
h9p://w3schools.com/

Threat model
network
a9acker

User
A

Internet

a9acker.com

bank.com

Some basics of HTTP


h9p://www.tom.com:80/calendar/render.php?gsessionid=OK

protocol

port
hostname

URLs only allow ASCII-US characters.


Encode other characters:

%0A = newline
%20 = space

path

query

Special characters:
+ = space
? = separates URL from parameters
% = special characters
/ = divides directories, subdirectories
# = bookmark
& = separator between parameters

HTTP Request
Method

File

HTTP version

Headers

GET /index.html HTTP/1.1


Accept: image/gif, image/x-bitmap, image/jpeg, */*
Accept-Language: en
Connection: Keep-Alive
User-Agent: Mozilla/1.22 (compatible; MSIE 2.0; Windows 95)
Host: www.example.com
Referer: http://www.google.com?q=dingbats

Blank line
Data none for GET

GET : no side eect POST : possible side eect

HTTP Response
HTTP version

Status code

Reason phrase

Headers

HTTP/1.0 200 OK
Date: Sun, 21 Apr 1996 02:20:42 GMT
Server: Microsoft-Internet-Information-Server/5.0
Connection: keep-alive
Content-Type: text/html
Last-Modified: Thu, 18 Apr 1996 17:39:05 GMT
Set-Cookie:
Content-Length: 2543
<HTML> Some data... blah, blah, blah </HTML>
Cookies

Data

Browser execuQon
Each window (or tab):
Retrieve/load content
Render it
Process the HTML
Might run scripts, fetch more
content, etc.

Respond to events
User acQons: OnClick, OnMouseover
Rendering: OnLoad, OnBeforeUnload
Timing: setTimeout(), clearTimeout()

Web pages are not single-origin


lFrames: <iframe src=//site.com/frame.html > </iframe>

Scripts:

<script src=//site.com/script.js > </script>

CSS:
<link rel="stylesheet" type="text /css href=//site/com/theme.css" />

Objects (ash): [using swfobject.js script ]


<script>


var so = new SWFObject(//site.com/ash.swf', );
so.addParam(allowscriptaccess', always');
so.write('ashdiv);




</script>

Document Object Model (DOM)


Object-oriented way to refer to objects in a web page
ProperQes: document.alinkColor, document.URL,
document.forms[ ], document.links[ ], document.anchors[ ]
Methods: document.write(document.referrer)

From h9p://w3schools.com/htmldom/default.asp

Document Object Model (DOM)


Object-oriented way to refer to objects in a web page
ProperQes: document.alinkColor, document.URL,
document.forms[ ], document.links[ ], document.anchors[ ]
Methods: document.write(document.referrer)

Browser Object Model (BOM)


window, document, frames[], history, locaQon,
navigator (type and version of browser)

Seemingly innocuous features?


<img src=bucky.jpg height=50pt
width=50pt>
Displays an image
What can a9acker do?

Javascript Qming
<html><body><img id="test" style="display: none">
<script>
var test = document.getElementById(test);
var start = new Date();
test.onerror = funcQon() {
var end = new Date();
alert("Total Qme: " + (end - start));
}
test.src = "h9p://www.example.com/page.html";
</script>
</body></html>

Behind-rewall webapp scanning


JavaScript can:
Request images from internal IP addresses
Example: <img src=192.168.0.4:8080/>

Use Qmeout/onError to determine success/failure


Fingerprint webapps using known image names
Server

1) show me dancing pigs!

scan

Malicious
Web page

2) check this out

3) port scan results

scan

Firewall

Browser

scan

Browser security model


Should be safe to visit an a9acker website

Should be safe to visit sites


simultaneously
Should be safe to delegate content

Browser isolaQon
Browser is running untrusted inputs (a9acker webpage)
Like all big, complex so}ware, browser has security
vulnerabiliQes
Browsers include Rich Internet ApplicaQons (RIAs)
that increase a9ack surface:
e.g., Adobe Flash (see reading for today by Blazakis)
Malicious website exploits browser, from there system

Browser handles mulQple sites, must maintain separate


security contexts for each
OperaQng system
PrimiQves
System calls
Processes
Disks
Principals: Users
DiscreQonary access controls
VulnerabiliQes
Buer overows
root exploit

Browsers
PrimiQves
Document object model
Frames
Cookies / local storage
Principals: Origins
Mandatory access controls
VulnerabiliQes
Cross-site scripQng (XSS)
Cross-site request forgery (CSRF)
Cache history a9acks

Same-origin policy
Each frame of page(s) has an origin
protocol://host:port
Origin is (protocol,host,port)

Frame can access its own orign


Network access, Read/write DOM, storage
(cookies)

Frame cannot access data associated with


another origin

Frame relaQonships

Child

Sibling
Frame Bust
Descendant

21

Frame policies
canScript(A,B) and canNavigate(A, B)

Permissive
any frame can navigate any other frame

Child
only can navigate if you are parent

Descendent
only can navigate if you are ancestor
Which do you think should be used?

Problems with permissive


frames['right'].window.locaQon=evil.com/login.html;

window.open("https://attacker.com/",
"awglogin");

awglogin

UI Redressing (Clickjacking)

Overlayed frame




Do evil thing()

FramebusQng
<script type="text/javascript">
if(top != self) top.locaQon.replace(locaQon);
</script>

Cookies: Seng/DeleQng
GET

if expires=NULL:
this session only

HTTP Header:
Set-cookie: NAME=VALUE ;
domain = (when to send) ;
scope
path = (when to send)
secure = (only send over SSL);
expires = (when expires) ;
HttpOnly

Delete cookie by setting expires to date in past


Default scope is domain and path of setting URL
Client can also set cookies (Javascript)

Cookie scope rules


(domain and path)
Say we are at www.wisc.edu
Any non-TLD sux can be scope:
allowed: www.wisc.edu or wisc.edu
disallowed: www2.wisc.edu or ucsd.edu

Path can be set to anything

Cookies: reading by server


GET /url-domain/url-path
Cookie: name=value

Browser sends all cookies such that


domain scope is suffix of url-domain
path is prefix of url-path
protocol is HTTPS if cookie marked secure

Cookie security issues


Cookies have no integrity
HTTPS cookies can be overwri9en by HTTP cookie
(network injecQon)
Malicious clients can modify cookies
Shopping cart vulnerabiliQes

Privacy
Cookies can be used to track you around the Internet

HTTP cookies sent in clear


Session hijacking

<script type="text/javascript">
//<![CDATA[

var hint = 'mainpage';
document.write('<script type="text/javascript" src="h9p://ad.doubleclick.net/adj/
ostg.slashdot/pg_index_p1_leader;pg=index2;logged_in=0;Qle='+dfp_Qle
+';sz=728x90;u=;ord='+dfp_ord+'?"><\/script>');

dfp_Qle++;
//]]>
</script>

In addiQon to ads based on interest categories, Google allows


adverQsers (including Google) to show you ads based on your
previous interacQons online, such as visits to adverQsers websites.
For example, someone who visited the website of an online sporQng
goods store can receive ads about special oers from that store.
--- h9p://www.google.com/privacy/ads/

Session handling and login


GET /index.html
Set-Cookie: AnonSessID=134fds1431

Protocol
is HTTPS.
Elsewhere
just HTTP

POST /login.html?name=bob&pw=12345
Cookie: AnonSessID=134fds1431
Set-Cookie: SessID=83431Adf
GET /account.html
Cookie: SessID=83431Adf

Session Hijacking

From h9p://codebutler.com/resheep

Towards prevenQng hijacking


Use encrypQon when seng session cookies
SessID = Enc(K,info) where :
K is server-side secret key
Enc is Encrypt-then-MAC encrypQon scheme
info contains:
user id
expiraQon Qme
other data

Server should record if user logs out


Does this prevent Firesheep hijacking?

include in data machine-specic informaQon


turn on HTTPS always

You might also like