Web Security EITF05 Department of Electrical and Information Technology Lund University

Size: px

Start display at page:

Download "Web Security EITF05 Department of Electrical and Information Technology Lund University"

Kathleen Sullivan
5 years ago
Views:

1 Final exam in Web Security EITF05 Department of Electrical and Information Technology Lund University October 31 st, 2014, You may answer in either Swedish or English. If any data is lacking, make (and state) reasonable assumptions. Use legible hand writing. If your answers cannot be read, you will receive zero points on that problem. Grading is done as follows. Grade 3 = 2029 points, Grade 4 = 3039 points, Grade 5 = 4050 points. Good luck! Paul & Martin Problem 1. There are two principal ways of implementing sessions in PHP, describe each alternative. State one advantage of each method over the other. Cookies and URL parameters. Not all information about a session can be stored in a cookie or in the URL, so only a session ID is stored. When the web server sees the session ID it can relate this to the seesion information itself, which is stored on the server. The session can continue if the user leaves the website and then later returns. With persistent cookies, even if the browser and/or the computer is shut down, the session can resume when the user visits the website next time. On the other hand, users could choose to turn o use of cookies in the browser. In that case, sessions will not work, while using URL parameters would still work in this case. One drawback with using URL parameters, apart from that the user cannot leave the website, is that URLs can be copied and pasted into e.g., s, forum posts, blogs and social network updates. This opens up for simple session xation attacks. Moreover, the URLs for GET requests are stored in the browser history.

2 Problem 2. Does SSL protect against XSS-attacks? Explain why or why not. No. SSL operates on session level in the OSI model, while script injection is applied on application level. SSL protects transport of content, but it does not look at the content itself. Injected scripts reside in (are part of) the website content that is stored on the server. This content is interpreted by the victims browser after transport. Problem 3. Digest authentication (RFC2617) calculates the digest according to with MD5( MD5(A1) : nonce : nc : cnonce : qop : MD5(A2) ), A1 = username : realm : password, { method : URI if qop = auth, A2 = method : U RI : MD5(entity-body) if qop = auth-int. a) Explain the usage and purpose of the realm parameter. b) Explain the usage and purpose of the nc parameter? c) Explain the usage and purpose of the cnonce parameter? a) A string explaining which password the user is expected to enter. Also used as a salt. b) Nonce counter, starts at 1 and is incremented by one for every request. Prevents replay attacks. c) A nonce that the client chooses. Prevents time-memory tradeo attacks.

3 Problem 4. You will now consider if it is possible for a Base64 string to encode to itself. Let A be the set of all strings composed of 8-bit ASCII characters, and let B be the set of all strings composed of Base64 characters (printable ASCII characters, B A). The Base64 encoding procedure can then be viewed as a mapping f : A B. A string s that satises f(s) = s is called a xed point. Base64 has an innite-length xed point s = V m.... a) Can a string of nite length be a Base64 xed point, why or why not? b) What is the third character of the innite-length xed point s above? c) What is the fourth character of the innite-length xed point s above? Hint: Here are some useful character codes in hex. Character code intervals for A-Z, a-z and 0-9 are contiguous. symbol A Z a z / Base64 0x00 0x19 0x1A 0x33 0x34 0x3D 0x3E 0x3F ASCII 0x41 0x5A 0x61 0x7A 0x30 0x39 0x2B 0x2F a) No. The encoding and decoding procedures do not preserve string length. b) 0 (a zero). c) w.

4 Problem 5. A DKIM signature header of an is given below. DKIM-Signature: v=1; a=rsa-sha256; c=simple/relaxed; d=gmail.com; s=gamma; h=received:message-id:date:from:to:subject:mime-version:content-type; bh=9gicsznlclk7yyh6virgyammrziwssbwqspihc78rrk=; b=k4ofvphpkaqmvusogvhrrncspk+jeuv9kurzo7aiypvf/6y1n2iiatvlvdzwonzx /W6Kxyx6Z4Ybuk8Dqk/vNTIE7Jpy+GQUUHFvM0NFtmZo1CbGRvo8DdHnXRBB/qWw lv+z6wxw/mq7lnujknvproaatlws5mwcz+awl8kwhg0= a) What is the s=gamma part, how is it used? b) How does the client obtain the public key? c) Explain the principle idea of DMARC. a) The selector is the eld that determines which public key should be used to verify the signature. It is used to allow a domain to have several public keys. b) The key is obtained by asking the DNS authoritative for the domain for the key. In this case it is located in a TXT record in the domain gamma._domainkey.gmail.com. c) DMARC combines DKIM and SPF with a feedback system that allows evaluation and tuning of the mail system. Problem 6. Give a regular expression that can be used for illicit mail harvesting. At least the following mail variations should be detected: first.last@domain.com first (dot) last (at) domain (dot) com first followed by a dot followed by last followed by at followed by domain followed by a dot followed by com You may assume that the name parts of the address contain only alphanumerical characters. One possibility is ^[A-Za-z0-9]+<dot>[A-Za-z0-9]+<at>[A-Za-z0-9]+<dot>com$, where <dot>=(\. $dot$ followed by a dot followed by ) and <at>=(@ $at$ followed by at followed by ).

Problem 7. Consider the following illustration of a DNS rebinding attack. a) Referring to the picture below, explain how an adversary can use DNS rebinding to breach a company rewall.

5 Problem 7. Consider the following illustration of a DNS rebinding attack. a) Referring to the picture below, explain how an adversary can use DNS rebinding to breach a company rewall. b) Where does DNS pinning t in? a) 0: Victim clicks on a link: 1: Browser queries DNS for IP. DNS returns with TTL=0. 2: Browser fetches page containing malicious script from 3: Browser executes script, which forms XHR for TTL for from step 1 expired, so DNS is queried once more. DNS now returns : The XHR is sent and internal wiki page is received. 5: Internal wiki page is sent (new XHR) to Note that steps 35 are not visible to the victim. Browser is led to believe that internal wiki and are in the same origin, so the same origin policy is not violated, as far as the browser can see. At step 4, the host header of the request will read Host: making the rebinding attack detectable. However, if the wiki server does not implement virtual hosts, it will most likely ignore this host header. b) In steps 1 and 3. DNS pinning is a form of protection against DNS rebinding that is implemented in the browser. Instead of accepting the TTL given by the DNS at step 1, the browser stores the result for, say, TTL + 30 minutes. In the scenario above, step 3 would never be executed, since the browser would use the cached IP address for instead of querying the DNS once more. (2+1 points)

6 Problem 8. Consider Domain Name System Security Extensions (DNSSEC). a) The DS record is used to verify the correctness of the public key in DNSKEY. What does the DS record contain? b) How does DNS amplication relate to DNSSEC? c) How does NSEC3 solve the zone enumeration problem? a) The hashed DNSKEY of a subdomain. b) DNSSEC responses are larger due to the signatures, which can be useful for a DNS amplication attack. c) NSEC sorts (readable) subdomain labels alphabetically and delivers a pair of subdomain labels. NSEC3 sorts (unreadable) hashed subdomain labels and returns a pair of these instead. Problem 9. What is the dierence between rst and third party cookies? Make sure that you explain what a cookie is. Also, explain how third-party cookies can be used for user tracking or advertising. Why is sning an ecient way of retrieving cookies when the client does not use SSL/TLS? A cookie is a text string that a server can send to a browser. The browser will return this cookie with every subsequent request (if protocol, domain and port match) to that server. This is useful for session handling (HTTP is stateless) and user tracking. First party cookies are cookie that are set directly by the site that the user visits. Third party cookies are cookies set by another domain, for example an advertisement provider. The primary page of a site can load resources from third parties; advertisements, images, and so on. The third party can set a cookie with an identier, storing the identier together with the hitherto provided ads in its database. The next time an ad is requested from the same user, the identier can be read from the cookie to provide new and unseen ads on the following visits. The same third party may provide ads on many dierent sites. Cookies are sent in cleartext in an HTTP header, so they are immediately revealed to anyone who can read the data stream.

7 Problem 10. Here is some code that may have been used in the 2014 celebrity photo icloud breach. def TryPass(apple_id,password): url = ' headers = {'User-Agent': 'FindMyiPhone/376 CFNetwork/ Darwin/14.0.0', } <some omitted code> base64string = base64.encodestring('%s:%s' % (apple_id, password)).replace('\n', '') req.add_header("authorization", "Basic %s" % base64string) resp = urllib2.urlopen(req) a) What is a User-Agent? b) Note that Basic HTTP authentication is used together with SSL. Is that a reasonable way of utilizing Basic HTTP authentication, why or why not? c) Is it reasonable to use Digest HTTP authentication together with SSL in the same way, why or why not? a) The software (browser, spider, app,... ) that acts on behalf of the user. Depending on the user-agent string, the server may tailor content to t that particular device. b) Yes. Basic HTTP authentication sends username and password in cleartext, but SSL protects the transport. Note that a hash of the password is stored at the server for comparison, not the password itself. c) No. The server stores MD5(A1), which can be viewed as the password as the entire digest can be calculated from this value. So, anyone with server access can extract the full credentials. This is contrary to Basic HTTP authentication. Another argument against using SSL with Digest HTTP authentication is that the SSL usage consumes server resources (client resources are less important) without providing clear benets. In the other direction, it can be argued that SSL is useful for protecting against a MITM that can replace the digest authentication header with a basic one.

8 Problem 11. Consider a website that stores unsalted MD5-hashed passwords in a database. In an on-line attack, passwords are tested against the fully functional website. If the database (together with its credentials) containing the hashed passwords is stolen, an o-line attack can be performed locally on the attackers computer. Consider the following password attacks: a) On-line brute-force b) O-line brute-force c) Dictionary/TMTO (O-line) Classify the following actions on the website server according to eciency against each password attack. Categorize as {not, somewhat, very} ecient. 1) Setting strict password criteria; minimum 15 symbols, at least one each from [A-Z], [a-z] and [0-9], disallowing the most common passwords, 2) Salting the passwords (unique for each user) 3) Slower hash function 4) A timeout of 3 minutes after 5 failed login attempts 5) Using a CAPTCHA Short answers are accepted according to the table below. s that deviate from this table are also accepted if they are explicitly justied. a b c 1 v/s v/s s/n 2 n v v 3 s s s 4 v n n 5 v n n On-line brute-force: Username/password combinations are tried separately one at a time, and usernames are generally not known. It is necessary to go through the entire password space once for each and every user. O-line brute-force: Usernames are explicitly given in the stolen database, and it is possible to look up all users with a given password hash with one single database query. It is therefore sucient to go through the password space only once in order to nd the passwords of all users. Dictionary/TMTO: A standard MD5 TMTO table or dictionary can be downloaded from the Internet. A dictionary contains password/hash pairs, and you may think of it a being stored in an O(1) lookup hash table for fast retrieval of a password when its hash value is given. 1) Increasing entropy and staying away from "easy" passwords is very ecient in theory, but in practice humans are notoriously bad at choosing high entropy passwords. The dictionary still work for all words it contains that satisfy the criteria, so all users with those passwords will have their password revealed. 2) No eect on-line. O-line, entire password space now needs to be tested for each user separately, increasing complexity linearly in the number of users (can be very large). Dictionary/TMTO does not work at all.

9 3) Assume that the execution time of the hash function h is k (constant factor) times that of MD5. The total time for the on-line attack is then increased by a factor of k. The same argument applies to the o-line case. For dictionary/tmto, if h is a non-standard hash function, then the dictionary/tables need to be recalculated, which will take k times longer than to perform the corresponding work for MD5. If h is a standard hash function, new dictionary/tmto tables can be downloaded from the Internet. The dictionary lookup time is not aected, as the hash function used in the hash table is fast (h is not used here). TMTO lookup time is increased by a factor of k due to usage of h in the chains. 4) Limits password testing to 5 per 3 minutes in the on-line case. No eect o-line or for dictionary/tmto. Timeout functionality is not part of the database itself. 5) Prevents automated on-line password testing (unless CAPTCHAs cen be eciently interpreted). CAPTCHAs are presented in the web interface and checked before the database is queried, so o-line brute-force and dictionary/tmto are not aected. (5 points) Problem 12. The social networking site Myspace was infected by the XSS worm Samy in Myspace used a secret validation token for CSRF protection. This protection was bypassed by the worm in order to send friend requests to its creator as it propagated. a) Explain how CSRF protection with a secret validation token works. b) Explain how XSS can be used to bypass this type of CSRF protection. Hint 1: You may assume that Myspace had unltered input elds. Hint 2: JavaScript can access the entire HTML DOM-tree. a) Several implementation variants of secret validation tokens are possible. Consider a page with a form that the end-user can ll out to submit a request. The server generates a secret validation token (a random number with decent entropy) and stores it in two places: 1. in _SESSION (as variable csrf_token, say), 2. as a hidden eld in the form. When the server receives the request from the user, it checks that the (hidden) eld value and the csrf_token variable are matching. The token value is unknown to the adversary, who cannot construct a valid query. A simplied variant is to reuse the session id instead of generating a new random number. b) An XSS exploit can parse the HTML code and extract the secret validation token from the hidden eld before submitting the request. (2+3 points)

10 Problem 13. Consider a Hashcash solution in which a string is hashed using SHA-1, where ver : bits : date : resource : rand : counter ver is version number (currently 1), bits indicates how costly the function is for sender, date gives current date, resource is recipients address, rand is a random number (separates dierent senders). A spammer wants to send 1000 messages M 1,..., M 1000 to each and every recipient on his very large mailing list, and he plans on including a Hashcash header with each mail. a) How many calls to SHA-1 does it take to generate a Hashcash header with bits = 30? Exactly or on average? b) How many calls to SHA-1 does it take to verify a Hashcash header with bits = 30? Exactly or on average? c) Which values for bits are reasonable for normal Hashcash header usage? d) What prevents the spammer from using the same Hashcash header when sending the message M 1 to all recipients on his mailing list? e) What prevents the spammer from using the same Hashcash header when sending all messages M 1,..., M 1000 to one specic recipient? a) 2 30 times on average. b) Exactly once. c) Too low gives no signicant proof of work. Too high is computationally impractical. About or so seems reasonable for normal usage. d) Recipient's address is included in the hashed string. e) Nothing prevents the spammer from constructing one Hashcash header that is valid for all messages, but the mail client on the user-side typically stores previously used headers so that they cannot be used more than once. (5 points)

11 Problem 14. Briey explain the following terms. a) Nolisting b) File inclusion c) Same-origin policy d) Reduction function e) Cache poisoning a) A spam prevention technique that lists a dummy mail server in the MX record. b) A feature in PHP that allows a programmer to include PHP code stored separately. If inclusion of remote PHP les (located on a dierent server) is allowed, a remote le inclusion attack may be possible. c) Browser-enforced policy that restricts information sharing between web pages. d) A function used for TMTO tables. Maps hash values into password space. e) An attack that aims at injecting erroneous IP addresses into a DNS. (5 points)

Web Security EITF05 Department of Electrical and Information Technology Lund University

Final exam in Web Security EITF05 Department of Electrical and Information Technology Lund University October 31 st, 2014, 8.0013.00 You may answer in either Swedish or English. If any data is lacking,