Cyber Crime Defense. Web Security 3. Adrian Dabrowski. Cyber Crime Defense

Transcription

1 Web Security 3 Adrian Dabrowski 1

2 Overview More on session attacks continuation of last year's lecture (session highjacking) Cross Site Request Forgery Man-in-the-Middle attacks against HTTPS https cookie stealing SSL Stripping Cryptocalypse Browser history stealing (historical) 2

3 Session Attacks 3

4 What are Session IDs again? HTTP is a stateless protocol: it does not remember previous requests Web applications must create and manage sessions themselves Session data is stored at the server associated with a unique Session ID After session creation, the client is informed about the session ID The client attaches the session ID to each request 4

5 Session Attacks Targeted at "stealing" the session ID If I know the session ID of a currently logged in user I can impersonate him 5

6 Session Attacks Targeted at stealing the session ID Interception: intercept request or response and extract session ID Prediction: predict (or make a few good guesses about) the session ID Brute Force: make many guesses about the session ID Fixation: NEW! make the victim use a certain session ID The first three attacks can be grouped into Session Hijacking attacks we discussed them in Inetsec1 6

7 Session Hijacking Attacks Interception: based on sniffing traffic Prediction/Brute forcing possible if IDs are not random enough 7

8 Session Hijacking Attacks Interception: based on sniffing traffic Prediction/Brute forcing possible if IDs are not random enough Prevention: use SSL for each request/response that transports a session ID not only for login! 8

9 Session Hijacking Attacks Interception: based on sniffing traffic Prediction/Brute forcing possible if IDs are not random enough Prevention: use SSL for each request/response that transports a session ID not only for login! Prevention: use large enough, truly random session IDs 9

10 Session Fixation Attacks So far, we have focused on preventing the attacker from obtaining session credentials This approach, however, ignores the possibility of the attacker issuing a session ID to the user s browser The browser then uses a chosen session In a session fixation attack, the attacker fixes the user s session ID before the user even logs into the target server What does this mean? The session ID does not have to be stolen 10

11 Session Fixation Attacks Session management mechanisms can be classified as: permissive and strict Permissive are those that accept arbitrary session IDs from browser (e.g., Macromedia JRun Server, PHP) Strict are those that only accept sessions that they have created (e.g., MS IIS) 11

12 Simple Scenario (permissive session management) Suppose we have a bank online.worldbank.dom, that uses permissive session management When the web site is accessed, a session ID is transported via URL parameter sessionid Attacker picks a sessionid=1234 Attacker sends sessionid to victim and tricks him into clicking on it: The user clicks on the link and is taken to the banking application login page The web application sees that a session has been assigned and does not issue a new one. Session is bound to new user The user is prompted to log in and provides his credentials Attacker can access victim s account 12

13 Simple Scenario 1) sessionid=1234 ATTACKER online.worldbank.com VICTIM 13

14 Simple Scenario 1) sessionid=1234 ATTACKER 2) login.jsp?sessionid=1234 online.worldbank.com VICTIM 14

15 Simple Scenario 1) sessionid=1234 ATTACKER 2) login.jsp?sessionid=1234 3) GET /login.jsp?sessionid=1234 4) username and password VICTIM online.worldbank.com 15

16 Simple Scenario 1) sessionid=1234 ATTACKER 5) G ET /acc oun t.jsp? 2) login.jsp?sessionid=1234 ses sion id= ) GET /login.jsp?sessionid=1234 4) username and password VICTIM online.worldbank.com 16

17 Another Scenario (strict session managment) Strict session management: the server checks it generated the sessionid When the web site is accessed, a session ID is transported via URL parameter sessionid Attacker sends a request to server Server issues attacker a sessionid=1234 Attacker sends sessionid to victim and tricks him into clicking on it: sessionid=1234 The user clicks on the link and is taken to the banking application login page The web application sees that a session has been assigned and does not issue a new one. Session is bound to new user Attacker can access victim s account 17

18 Another Scenario 1) G ET ATTACKER /log in.js p 2) s ess ioni d= online.worldbank.com VICTIM 18

19 Another Scenario 1) G ET /log in.js p 2) s ess ioni d= ATTACKER 3) login.jsp?sessionid=1234 online.worldbank.com VICTIM 19

20 Another Scenario 1) G ET /log in.js p 2) s ess ioni d= ATTACKER 3) login.jsp?sessionid=1234 4) GET /login.jsp?sessionid=1234 5) username and password VICTIM online.worldbank.com 20

21 Another Scenario 1) G ET /log in.js p 2) s ess ioni d=1 6 ) GE ATTACKER 2 34 T /a cco unt. jsp? ses sion id=1 3) login.jsp?sessionid=1234 4) GET /login.jsp?sessionid=1234 5) username and password VICTIM online.worldbank.com 21

22 Session Fixation vs Hijacking Timing! Session Fixation: Victim s browser is attacked before she logs into the target server Session Hijacking: Victim s browser is attacked after she logs into the target server 22

23 Session Fixation Attacks Attacker needs to be able to get a session ID from the server attacker is a legitimate user of the service, OR server assigns session ID before authentication The victim needs to be tricked into clicking on link (before session times out) Generally, a session fixation attack is a three-step process 1) Session setup 2) Session fixation 3) Session entrance 23

24 Session Fixation Attacks In session startup, attacker sets up a socalled trap session. Session needs to be kept alive by sending requests Next, attacker needs to introduce her session ID to the victim s browser Attacker needs to wait until the victim logs in and then enter the victim s session. 24

25 Step 1: Session Setup Session management mechanisms can be classified as: permissive and strict Against permissive systems: attacker simply picks a session ID Against strict systems: attacker sends a request to the server to obtain a session ID Permissive systems are easy to attack because the session ID picked by the attacker can be sent to the server at any time; requires no trap session maintenance 25

26 Step 2: Session Fixation Attacker can use several methods to transport the trap session to the victim s browser One way is to trick user into clicking a URL, for example: Another possibility is to prepare a login page (e.g., phishing page) where ID is embedded as a hidden from field additional method for session fixation attack: cookies 26

27 Step 2: Session Fixation The attacker needs to install the trap session ID cookie on the victim s browser However, browser will only accept cookie assigned either to the issuing server or the issuing server s domain. attacker.com cannot set cookie for worldbank.dom Hence, the attacker can exploit an XSS vulnerability in the website or browser to set a cookie cross-subdomain cooking evil.worldbank.com can set cookies for worldbank.com 27

28 Session Fixation Countermeasures Preventing session fixation is the responsibility of the web application, not the web server Only the web application can implement effective protection. The web server (e.g., Tomcat) only needs to make sure that session IDs cannot be brute-forced or guessed A common-denominator for session fixation attacks is that victim needs to login. Use strict session management policy (server refuses IDs it did not generate) If possible, web application should issue session IDs only after successful authentication alternatively, regenerate the session ID after login 28

29 Session Fixation Countermeasures Session ID usage should be restricted Bind to IP (network address): usual problems Session ID should be bound to SSL client certificate for highly-critical applications (was the session ID established using certificate?) Session destruction (timeout or logging out) User must have option to log out (destroy current session and any other session) use absolute session timeouts in order to prevent attacker from keeping trap session alive while waiting for victim to log in (can become inconvenient for the user) 29

30 Cross Site Request Forgery CSRF / XSRF 30

31 Cross Site Request Forgery CSRF: A type of attack that lets attackers send arbitrary HTTP requests on behalf of a victim The damage caused by this attack can be severe The attack is not too easy to understand and avoid, and it is likely that many web applications are vulnerable Typical scenario: User has established level of privilege with the site Attacker uses this privilege to do bad things 31

32 Cross Site Request Forgery The site is the target of the attack. User is the victim and unknowing accomplice. The request comes from the victim, hence, it is difficult to identify a CSRF attack. In fact, if you have not taken precautions, chances are very high that your application is vulnerable to CSRF Many web developers are still unaware of CSRF, so they take no precautions against it Many widely deployed web applications are vulnerable or have been vulnerable to CSRF 32

33 CSRF Example Suppose there exists a simple PHP Web application that can be used by (logged in) administraror for creating new users. Here is the form: <form action= create.php method= POST > <p> Username: <input type= text name= username > Password: <input type= text name= password > <input type= submit value= Create /> </p> </form> 33

34 CSRF Example here is the simple PHP application hosted at <?php session_start(); If (isset($_request[ username ] && isset($_request[ password ])) { create_new_user_dude($_request[ username ], $_REQUEST[ password ]); }?> 34

35 CSRF Example What is the problem with this application? Suppose an attacker manages to trick the authenticated user to visit a web page of which she has control Note that visiting is enough!! The owned web page has an embedded link such as: <img src= username=badguy&password=nopasswd > The browser tries to download the image from victim.com browser helpfully appends the user's cookies for victim.com 35

36 CSRF Example 1) Log in (username and password) victim.com USER attacker.com 36

37 CSRF Example 1) Log in (username and password) victim.com USER 2) GET /index.html attacker.com 37

38 CSRF Example 1) Log in (username and password) victim.com USER 3) <img src= username=badguy&password=nopasswd> 2) GET /index.html attacker.com 38

39 CSRF Example 1) Log in (username and password) 4) GET /create.php?username=badguy&password=nopasswd +session cookie for victim.com victim.com USER 3) <img src= username=badguy&password=nopasswd> 2) GET /index.html attacker.com 39

40 A First Fix Once the user visits the page, the URL is fetched and a new user is created. Hence, the web application is compromised Why did this error happen? The application used $_REQUEST instead of $_POST It could not distinguish between data sent in the URL and data provided in the form $_REQUEST and allowing GET increases your risk General principle of web application design: GET requests should have no side effects 40

41 CSRF over POST Using POST requests is not enough to prevent CSRF Attacker can fool user into clicking on submit button of a form on attacker.com form points to victim.com triggers POST request with hidden fields! JavaScript can be used to automatically submit a form no interaction needed! 41

42 CSRF Countermeasures Force the usage of your own forms. Try to identify if the request is coming from your own form For example, you could generate a token as part of the form and validate this token upon reception E.g., using unique IDs, MD5 hashes, etc. The token has to be bound to the user session Cannot be stored in a cookie You could limit the validity of the token time (e.g., 3 minutes) Attacker cannot steal the token because of SOP 42

43 CSRF Vulnerabilities Many high profile sites have been vulnerable Gmail allowed to steal user's contact list netflix allowed to change name and address, and order movies skype allowed to "steal" the user's skype number (impersonate user, receive his calls, use his credit) 43

44 CSRF against home routers Home DSL/Cable routers have often been vulnerable Typically have weak authentication no password username: admin, password: admin same password for all routers from a provider just google for "$provider $device_name password" most users don't change it Protected by firewall can only log in from inside home network Can use CSRF to send requests to the router from victim's PC inside the network 44

45 CSRF against home routers DSL router Home User attacker.cm 45

46 CSRF against home routers DSL router Home User ) <img src= 1) GET /index.html attacker.cm 46

47 CSRF against home routers 3) GET /action.php?do_something_bad DSL router Home User ) <img src= 1) GET /index.html attacker.cm 47

48 CSRF against home routers What can the attacker do? example: CSRF in home routers from mexican ISP no password was set by default /0/threaded Add names to the DNS ( PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&N AME= Disable Wireless Authentication PAGE=C05_POST&THISPAGE=C05&NEXTPAGE=C05_PO ST&NAME=encrypt_enabled&VALUE=0 Disable firewall, set new password,... 48

49 MITM Attacks against HTTPS 49

50 Stealing HTTPS cookies Man-in-the-middle attack against HTTPS encryption should protect from MITM! Cookie management policy is not consistent with Same Origin Policy SOP: in addition to domain, protocol must be the same: http https cookies: depends on a secure flag in the cookie if secure flag is not set, a cookie set inside an https session can be sent over an http session MITM can use this to steal a session ID that was set inside an HTTPS connection! 50

51 Stealing HTTPS cookies Attack steps: user logs in to server sets session ID for mybank.com in cookie encrypted in https user issues an unencrypted HTTP request for something else ( attacker (MITM) replies with redirect to browser follows redirect & sends out cookie with session ID attacker has access to user's session! 51

52 Stealing HTTPS cookies Easy to check for using your browser Check your online banking website, and send them an if they are vulnerable When I first checked the 2 banking websites I use, both were vulnerable OK! 52

53 Cookie Attributes HTTP/ OK Content-type: text/html Set-Cookie: name=value Limit to HTTPS: Set-Cookie: name=value; Secure Limit to real browser requests (not JS, XML-RPC, API...) Set-Cookie: name=value; HttpOnly 53

54 SSL Stripping A more powerful MitM attack against HTTPS Old problem, recently highlighted by: Users do not type " in their browser (or Most of the time, users reach https through http this first step is unprotected 54

55 SSL Stripping The basic idea: attacker speaks HTTPS with the server attacker speaks HTTP with the user HTTP USER HTTPS MitM mybank.com 55

56 SSL Stripping Initial requests: HTTP USER HTTP MitM mybank.com 56

57 SSL Stripping Initial requests: HTTP HTTP Now let's talk HTTPS! USER MitM mybank.com 57

58 SSL Stripping Initial requests: HTTP HTTP Now let's talk HTTPS! USER MitM HTTP mybank.com HTTPS 58

59 SSL Stripping User types in URL bar Before logging in, user would normally be directed to the bank's HTTPS website HTTP 3xx redirect, OR an https link MitM attacker can modify the data sent from the server change to in server replies! 59

60 SSL Stripping GET USER GET MitM mybank.com 60

61 SSL Stripping GET GET <html>... USER MitM <a href=" mybank.com> Online Banking </a>... mybank.com 61

62 SSL Stripping GET USER GET <html>... <html>... <a href=" mybank.com> Online Banking </a>... <a href=" mybank.com> Online Banking </a>... MitM mybank.com 62

63 SSL Stripping GET USER GET <html>... <html>... <a href=" mybank.com> Online Banking </a>... <a href=" mybank.com> Online Banking </a>... GET MitM mybank.com GET 63

64 Fooling the user User can see in the address bar some users may check for this lock favicon may help fool them Many sites use https only for login to protect username and password does not protect from session hijacking SSL stripping in these cases is undetectable unless user looks at html page source 64

65 Fooling the user user never sees https HTTPS submit link 65

66 Implementing SSL Stripping Modify server replies to replace https links with http in HTTP 3xx redirect replies in HTML page harder if page is dynamically generated with javascript Modify client requests remove secure flag on cookies sent by server otherwise user's browser will not send them over HTTP! Simplify the task: avoid compression and chunked encoding talk HTTP/1.0 with server Accept-Encoding: identity 66

67 SSL Stripping Variant Instead of stripping SSL, we can have 2 separate HTTPS conversations with user and destination site HTTPS USER HTTPS MitM mybank.com 67

68 SSL Stripping Variant Option 1: use fake, self-signed certificate for mybank.com browser warning may scare user away! Option 2: redirect user to attacker has a valid certificate for evil.com user may notice wrong domain in address bar! Option 3: like 2, but use a domain name that looks similar to mybank.com with internationalized domain names, this is a very powerful attack 68

69 SSL Stripping Variant HTTPS USER HTTPS mybonk.com Valid certificate for mybonk.com mybank.com Valid certificate for mybank.com 69

70 Recent SSL Stripping Attack DigiNotar hack July 10, 2011, wildcard certificates for google, etc. Short Video xwvy Other CAs: starcom(comodo) Certificates might also be used for software updates addons.mozilla.org login.live.com mail.google.com login.yahoo.com login.skype.com 70

71 Symantec vs Google (Sept. 2015) 71

72 72

73 Current Efforts Certificate/CA Pinning in Browser Certificate Transparency Currently for EV certificates Some APIs only accessible via HTTPS 73

74 Extended Validation (EV) Certificates Name of Entity shown Green Bar 74

75 Cryptocalypse Typical browser has 100+ Root certificates (CA) installed Each CA can delegate to sub-ca (resellers) Cost pressure reduces level of customer verification and security of infrastructure Any of theses sub-cas can sign certificates for any other domain. (e.g. finanzonline.gv.at) Also used by Deep-Packet-Inspection (DPI) Countermeasure CA or certificate pinning Software additionally checks, who issued the certificate 75

76 HTTP Strict Transport Security (HSTS) Strict-Transport-Security: max-age= ; includesubdomains; Browser caches HTTPS capability HSTS headers over HTTP are ignored HTTPS Everywhere Browser plugin that automatically redirects to Whitelist based Related: HTTP Public Key Pinning (HPKP) Allows Server to pin key/certificate authority 76

77 Perfect Forward Secrecy Scenario Some attacker sniffs encrypted traffic Obtains private keys afterwards (years later?) Decrypts traffic Perfect Forward Secrecy Use special step in initial session setup for key exchange Short term session key is not compromised, even when long term keys are compromised in the future. Optional in Ipsec, SSL/TLS since SSLv3, [Browser comp.!!!] Computational Overhead 15-30% 77

78 Where is SSL added? 78

79 Browser History Stealing (Historical) Re HT bor G P ML n U 5 f sid ilte us e c rs ing ha an nn d els 79

80 Browser History Stealing Browsers display visited links differently from nonvisited links very helpful to users (which google search results have I already visited?) This can be used to find out if the user has visited a site has user visited example.com? attacker prepares webpage at attacker.com with link: <a href=" attacker checks how the link is displayed 80

81 Browser History Stealing How can the attacker check the link color? the link is displayed in the web page attacker.com SOP allows attacker to access the content use javascript to check color or font size Attack can also be performed without javascript using CSS (Cascading Style Sheets) 81

82 History Stealing without Javascript CSS is used to improve HTML by separating presentation from document structure HTML defines the content CSS specifies how to display that contant uses simple rules to match content specify how to display content matching the rules a:visited define the style for visited links a style can include a background image background: url(log_visited.php?example.com) use div+span to associate different "background" urls to each link 82

83 History Stealing Proofs of Concept CSS based used for this demo Javascript based 83

84 noscript is on 84

85 Browser History Stealing Browser history can leak user's private information not just porn!.. Recent work from seclab: de-anonymizing users of social networks using browser history stealing checks for URLs specific to facebook/xing/linkedin groups in browser history the groups you are part of, can uniquely identify you 85

86 Countermeasures (by Browsers) JAVASCRIPT Reading of certain CSS styles (e.g. color of links) always return the default value. CSS only Restrict usage of certain attributes (e.g. background:url() ) in a:visited styles. 86

87 History Stealing in Public WiFi Hotspots (and other MitM scenarios) 87

88 History stealing with Public Wi-Fi Hotspots Internet Like a well in a village We gather there, pull up a bucket or two of Internet Look at the sign from the sponsor and move on. 88

89 What is a Captive Portal? 89

90 Why Captive Portal Omnipresent in Wi-Fi Hotspots Used by you probably right now (in this very hotel) Has an elevated position on the network Man-in-the-Middle by design Sponsors of a Wi-Fi want us to see their messages (and accept the disclaimer) There is no standard for that Let's inject it into your traffic 90

91 MitM by design!? 91

92 Browser History Stealing, again? Baron et al., 2002 :visited link color Ruderman et al., 2000 :visited can load images Jang et al., 2010 Sites are actively trying to steal history TODO: Groundhog 92

93 History, so what? Culture & Language Amazon.fr, Amazon.jp Sexual orientation grindr.com, transblog.de Partnership status Okcupid.com, parship.com Employer intranet.ibm.com Other websites that give interesting insights Medical conditions Political campaigns Religious communities 93

94 Source: MindSource April 1996 BOF; Client State Tracking with Netscape Cookies; M. Strata Rose; Also reason for CSRF 95

95 Cookies (or not enough state for HTTP) Two kinds Session cookies: usually forgotten when browser closed Persistent cookies: stored on disk with expiry date Only depend on the FQDN and Protocol XSS XSRF HTTP set cookie also used for HTTPS Insecure set cookies mixed into the cookies over HTTPS 96

96 97

97 (+cookies) 302 redirect login.hotspotsys.com/login login.hotspotsys.com/login <html>. <img href= a.com/probe (+cookies) (+cookies). 98

98 99

99 Sure, crypto will save us! HTTPS hides content (and therefore cookies) But is not used by default (e.g., when URL entered in location bar) HTTP Strict Transport Security (HSTS) Site announces availability of HTTPS with same content as via HTTP Client caches this Uses HTTPS by default next time for this site 100

100 Sure, crypto will save us! HTTPS hides traffic (and cookies) But is not used by default (e.g., when URL entered in location bar) HTTP Strict Transport Security (HSTS) Site announces availability of HTTPS with same content as via HTTP Client caches this side channel Uses HTTPS by default next time for this site 101

101 102

102 103

103 Which users are affected? Everyone who uses the standard browser to login into the captivce portal (mobile, notebook,...) Even VPN users Android and ios introduced captive portal detectors Primarily for convenience starts stripped down browser The online test is very easy to fool, since based on HTTP User will use main browser to login, exposing their history 104

104 Sure, VPN will save us? Connecting to new WiFi Wifi Connection WiFi Connection DHCP Captive Portal VPN VPN Browser history time 105

105 Captive Portal Detection A convenience feature ios since Version 4 Android since 4.2 used default browser Android since 5 uses captive portal browser Test is easy to circumvent HTTP!

106 Which sites affected? Uses long-term (persistent) cookie e.g., for session, tracking, or configuration Can be set via HTTP Header Javascript Uses HSTS header 107

107 Top 1K 82-92% Top 200K 59-86% 108

108 Implementation POC implementation Speed up by Marking probe request with a special string Returning 1x1 pixel or killing connections Caching DNS Still one DNS request for each probed site Added de-anonymization e.g., via amazon.com 109

109 Hotspot Ecosystem Internet There is no standard for hotspot splash screen display Choose to present message in-band By redirecting/tampering with traffic Some do this also for SSL traffic e.g., via DNS _portal.local Effects VPN Users as well 111

110 Conclusions We covered a range of advanced topics in web security session fixation cross-site request forgery https cookie theft SSL problems Cryptocalypse browser history stealing 125

111 Web Security 3 Adrian Dabrowski 1

112 Overview More on session attacks continuation of last year's lecture (session highjacking) Cross Site Request Forgery Man-in-the-Middle attacks against HTTPS https cookie stealing SSL Stripping Cryptocalypse Browser history stealing (historical) 2

113 Session Attacks 3

114 What are Session IDs again? HTTP is a stateless protocol: it does not remember previous requests Web applications must create and manage sessions themselves Session data is stored at the server associated with a unique Session ID After session creation, the client is informed about the session ID The client attaches the session ID to each request 4

115 Session Attacks Targeted at "stealing" the session ID If I know the session ID of a currently logged in user I can impersonate him 5

116 Session Attacks Targeted at stealing the session ID Interception: intercept request or response and extract session ID Prediction: predict (or make a few good guesses about) the session ID Brute Force: make many guesses about the session ID Fixation: NEW! make the victim use a certain session ID The first three attacks can be grouped into Session Hijacking attacks we discussed them in Inetsec1 Interception WIFI 6

117 Session Hijacking Attacks Interception: based on sniffing traffic Prediction/Brute forcing possible if IDs are not random enough 7

118 Session Hijacking Attacks Interception: based on sniffing traffic Prediction/Brute forcing possible if IDs are not random enough Prevention: use SSL for each request/response that transports a session ID not only for login! 8

119 Session Hijacking Attacks Interception: based on sniffing traffic Prediction/Brute forcing possible if IDs are not random enough Prevention: use SSL for each request/response that transports a session ID not only for login! Prevention: use large enough, truly random session IDs 9

120 Session Fixation Attacks So far, we have focused on preventing the attacker from obtaining session credentials This approach, however, ignores the possibility of the attacker issuing a session ID to the user s browser The browser then uses a chosen session In a session fixation attack, the attacker fixes the user s session ID before the user even logs into the target server What does this mean? The session ID does not have to be stolen 10

121 Session Fixation Attacks Session management mechanisms can be classified as: permissive and strict Permissive are those that accept arbitrary session IDs from browser (e.g., Macromedia JRun Server, PHP) Strict are those that only accept sessions that they have created (e.g., MS IIS) 11 Permissive im sinne von Tollerant

122 Simple Scenario (permissive session management) Suppose we have a bank online.worldbank.dom, that uses permissive session management When the web site is accessed, a session ID is transported via URL parameter sessionid Attacker picks a sessionid=1234 Attacker sends sessionid to victim and tricks him into clicking on it: The user clicks on the link and is taken to the banking application login page The web application sees that a session has been assigned and does not issue a new one. Session is bound to new user The user is prompted to log in and provides his credentials Attacker can access victim s account 12

123 Simple Scenario 1) sessionid=1234 ATTACKER online.worldbank.com VICTIM 13

124 Simple Scenario 1) sessionid=1234 ATTACKER 2) login.jsp?sessionid=1234 online.worldbank.com VICTIM 14

125 Simple Scenario 1) sessionid=1234 ATTACKER 2) login.jsp?sessionid=1234 3) GET /login.jsp?sessionid=1234 4) username and password VICTIM online.worldbank.com 15

126 Simple Scenario 1) sessionid=1234 ATTACKER 5) G ET /acc o 2) login.jsp?sessionid=1234 unt. jsp? ses sio nid= ) GET /login.jsp?sessionid=1234 4) username and password VICTIM online.worldbank.com 16

127 Another Scenario (strict session managment) Strict session management: the server checks it generated the sessionid When the web site is accessed, a session ID is transported via URL parameter sessionid Attacker sends a request to server Server issues attacker a sessionid=1234 Attacker sends sessionid to victim and tricks him into clicking on it: sessionid=1234 The user clicks on the link and is taken to the banking application login page The web application sees that a session has been assigned and does not issue a new one. Session is bound to new user Attacker can access victim s account 17

128 Another Scenario ATTACKER 1) G ET /log in.js p 2) s e ss ioni d= online.worldbank.com VICTIM 18

129 Another Scenario 1) G ET /log in.js p 2) s e ss ioni d= ATTACKER 3) login.jsp?sessionid=1234 online.worldbank.com VICTIM 19

130 Another Scenario 1) G ET /log in.js p 2) s e ss ioni d= ATTACKER 3) login.jsp?sessionid=1234 4) GET /login.jsp?sessionid=1234 5) username and password VICTIM online.worldbank.com 20

131 Another Scenario 1) G ET /log in.js p 2) s e ss ioni d 6) G = 12 ATTACKER ET 34 /acc oun t.jsp?se ssio nid= 3) login.jsp?sessionid=1234 4) GET /login.jsp?sessionid=1234 5) username and password VICTIM online.worldbank.com 21

132 Session Fixation vs Hijacking Timing! Session Fixation: Victim s browser is attacked before she logs into the target server Session Hijacking: Victim s browser is attacked after she logs into the target server Difference? 22

133 Session Fixation Attacks Attacker needs to be able to get a session ID from the server attacker is a legitimate user of the service, OR server assigns session ID before authentication The victim needs to be tricked into clicking on link (before session times out) Generally, a session fixation attack is a three-step process 1) Session setup 2) Session fixation 3) Session entrance 23

134 Session Fixation Attacks In session startup, attacker sets up a socalled trap session. Session needs to be kept alive by sending requests Next, attacker needs to introduce her session ID to the victim s browser Attacker needs to wait until the victim logs in and then enter the victim s session. 24

135 Step 1: Session Setup Session management mechanisms can be classified as: permissive and strict Against permissive systems: attacker simply picks a session ID Against strict systems: attacker sends a request to the server to obtain a session ID Permissive systems are easy to attack because the session ID picked by the attacker can be sent to the server at any time; requires no trap session maintenance 25

136 Step 2: Session Fixation Attacker can use several methods to transport the trap session to the victim s browser One way is to trick user into clicking a URL, for example: Another possibility is to prepare a login page (e.g., phishing page) where ID is embedded as a hidden from field additional method for session fixation attack: cookies 26 Cookies obey same origin policy

137 Step 2: Session Fixation The attacker needs to install the trap session ID cookie on the victim s browser However, browser will only accept cookie assigned either to the issuing server or the issuing server s domain. attacker.com cannot set cookie for worldbank.dom Hence, the attacker can exploit an XSS vulnerability in the website or browser to set a cookie cross-subdomain cooking evil.worldbank.com can set cookies for worldbank.com 27

138 Session Fixation Countermeasures Preventing session fixation is the responsibility of the web application, not the web server Only the web application can implement effective protection. The web server (e.g., Tomcat) only needs to make sure that session IDs cannot be brute-forced or guessed A common-denominator for session fixation attacks is that victim needs to login. Use strict session management policy (server refuses IDs it did not generate) If possible, web application should issue session IDs only after successful authentication alternatively, regenerate the session ID after login 28 PHP creates session as soon as you use $_SESSION Maybe do your own session management?

139 Session Fixation Countermeasures Session ID usage should be restricted Bind to IP (network address): usual problems Session ID should be bound to SSL client certificate for highly-critical applications (was the session ID established using certificate?) Session destruction (timeout or logging out) User must have option to log out (destroy current session and any other session) use absolute session timeouts in order to prevent attacker from keeping trap session alive while waiting for victim to log in (can become inconvenient for the user) 29

140 Cross Site Request Forgery CSRF / XSRF 30

141 Cross Site Request Forgery CSRF: A type of attack that lets attackers send arbitrary HTTP requests on behalf of a victim The damage caused by this attack can be severe The attack is not too easy to understand and avoid, and it is likely that many web applications are vulnerable Typical scenario: User has established level of privilege with the site Attacker uses this privilege to do bad things 31

142 Cross Site Request Forgery The site is the target of the attack. User is the victim and unknowing accomplice. The request comes from the victim, hence, it is difficult to identify a CSRF attack. In fact, if you have not taken precautions, chances are very high that your application is vulnerable to CSRF Many web developers are still unaware of CSRF, so they take no precautions against it Many widely deployed web applications are vulnerable or have been vulnerable to CSRF 32

143 CSRF Example Suppose there exists a simple PHP Web application that can be used by (logged in) administraror for creating new users. Here is the form: <form action= create.php method= POST > <p> Username: <input type= text name= username > Password: <input type= text name= password > <input type= submit value= Create /> </p> </form> 33

144 CSRF Example here is the simple PHP application hosted at <?php session_start(); If (isset($_request[ username ] && isset($_request[ password ])) { create_new_user_dude($_request[ username ], $_REQUEST[ password ]); }?> 34

145 CSRF Example What is the problem with this application? Suppose an attacker manages to trick the authenticated user to visit a web page of which she has control Note that visiting is enough!! The owned web page has an embedded link such as: <img src= username=badguy&password=nopasswd > The browser tries to download the image from victim.com browser helpfully appends the user's cookies for victim.com 35

146 CSRF Example 1) Log in (username and password) victim.com USER attacker.com 36

147 CSRF Example 1) Log in (username and password) victim.com USER 2) GET /index.html attacker.com 37

148 CSRF Example 1) Log in (username and password) victim.com USER 3) <img src= username=badguy&password=nopasswd> 2) GET /index.html attacker.com 38

149 CSRF Example 1) Log in (username and password) 4) GET /create.php?username=badguy&password=nopasswd +session cookie for victim.com victim.com USER 3) <img src= username=badguy&password=nopasswd> 2) GET /index.html attacker.com 39

150 A First Fix Once the user visits the page, the URL is fetched and a new user is created. Hence, the web application is compromised Why did this error happen? The application used $_REQUEST instead of $_POST It could not distinguish between data sent in the URL and data provided in the form $_REQUEST and allowing GET increases your risk General principle of web application design: GET requests should have no side effects 40

151 CSRF over POST Using POST requests is not enough to prevent CSRF Attacker can fool user into clicking on submit button of a form on attacker.com form points to victim.com triggers POST request with hidden fields! JavaScript can be used to automatically submit a form no interaction needed! 41

152 CSRF Countermeasures Force the usage of your own forms. Try to identify if the request is coming from your own form For example, you could generate a token as part of the form and validate this token upon reception E.g., using unique IDs, MD5 hashes, etc. The token has to be bound to the user session Cannot be stored in a cookie You could limit the validity of the token time (e.g., 3 minutes) Attacker cannot steal the token because of SOP 42

153 CSRF Vulnerabilities Many high profile sites have been vulnerable Gmail allowed to steal user's contact list netflix allowed to change name and address, and order movies skype allowed to "steal" the user's skype number (impersonate user, receive his calls, use his credit) Facebook mobile site 43

154 CSRF against home routers Home DSL/Cable routers have often been vulnerable Typically have weak authentication no password username: admin, password: admin same password for all routers from a provider just google for "$provider $device_name password" most users don't change it Protected by firewall can only log in from inside home network Can use CSRF to send requests to the router from victim's PC inside the network 44

155 CSRF against home routers DSL router Home User attacker.cm 45

156 CSRF against home routers DSL router Home User ) <img src= 1) GET /index.html attacker.cm 46

157 CSRF against home routers 3) GET /action.php?do_something_bad DSL router Home User ) <img src= 1) GET /index.html attacker.cm 47

158 CSRF against home routers What can the attacker do? example: CSRF in home routers from mexican ISP no password was set by default /0/threaded Add names to the DNS ( PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET&N AME= Disable Wireless Authentication PAGE=C05_POST&THISPAGE=C05&NEXTPAGE=C05_PO ST&NAME=encrypt_enabled&VALUE=0 Disable firewall, set new password, More: Trigger firmware updates for printers, network phones, etc...

159 MITM Attacks against HTTPS 49

160 Stealing HTTPS cookies Man-in-the-middle attack against HTTPS encryption should protect from MITM! Cookie management policy is not consistent with Same Origin Policy SOP: in addition to domain, protocol must be the same: http https cookies: depends on a secure flag in the cookie if secure flag is not set, a cookie set inside an https session can be sent over an http session MITM can use this to steal a session ID that was set inside an HTTPS connection! 50

161 Stealing HTTPS cookies Attack steps: user logs in to server sets session ID for mybank.com in cookie encrypted in https user issues an unencrypted HTTP request for something else ( attacker (MITM) replies with redirect to browser follows redirect & sends out cookie with session ID attacker has access to user's session! 51

162 Stealing HTTPS cookies Easy to check for using your browser Check your online banking website, and send them an if they are vulnerable When I first checked the 2 banking websites I use, both were vulnerable OK! 52

163 Cookie Attributes HTTP/ OK Content-type: text/html Set-Cookie: name=value Limit to HTTPS: Set-Cookie: name=value; Secure Limit to real browser requests (not JS, XML-RPC, API...) Set-Cookie: name=value; HttpOnly 53

164 SSL Stripping A more powerful MitM attack against HTTPS Old problem, recently highlighted by: Users do not type " in their browser (or Most of the time, users reach https through http this first step is unprotected 54 See later: Most users enter or just and will be redirected to intercept first step

165 SSL Stripping The basic idea: attacker speaks HTTPS with the server attacker speaks HTTP with the user HTTP USER HTTPS MitM mybank.com 55

166 SSL Stripping Initial requests: HTTP USER HTTP MitM mybank.com 56

167 SSL Stripping Initial requests: HTTP HTTP Now let's talk HTTPS! USER MitM mybank.com 57

168 SSL Stripping Initial requests: HTTP HTTP Now let's talk HTTPS! USER MitM HTTP mybank.com HTTPS 58

169 SSL Stripping User types in URL bar Before logging in, user would normally be directed to the bank's HTTPS website HTTP 3xx redirect, OR an https link MitM attacker can modify the data sent from the server change to in server replies! Now on a more technical level 59

170 SSL Stripping GET USER GET MitM mybank.com 60

171 SSL Stripping GET GET <html>... USER MitM <a href=" mybank.com> Online Banking </a>... mybank.com 61

172 SSL Stripping GET USER GET <html>... <html>... <a href=" mybank.com> Online Banking </a>... <a href=" mybank.com> Online Banking </a>... MitM mybank.com 62

173 SSL Stripping GET USER GET <html>... <html>... <a href=" mybank.com> Online Banking </a>... <a href=" mybank.com> Online Banking </a>... GET MitM mybank.com GET 63

174 Fooling the user User can see in the address bar some users may check for this lock favicon may help fool them Many sites use https only for login to protect username and password does not protect from session hijacking SSL stripping in these cases is undetectable unless user looks at html page source 64

175 Fooling the user user never sees https HTTPS submit link 65

176 Implementing SSL Stripping Modify server replies to replace https links with http in HTTP 3xx redirect replies in HTML page harder if page is dynamically generated with javascript Modify client requests remove secure flag on cookies sent by server otherwise user's browser will not send them over HTTP! Simplify the task: avoid compression and chunked encoding talk HTTP/1.0 with server Accept-Encoding: identity 66

177 SSL Stripping Variant Instead of stripping SSL, we can have 2 separate HTTPS conversations with user and destination site HTTPS USER HTTPS MitM mybank.com 67

178 SSL Stripping Variant Option 1: use fake, self-signed certificate for mybank.com browser warning may scare user away! Option 2: redirect user to attacker has a valid certificate for evil.com user may notice wrong domain in address bar! Option 3: like 2, but use a domain name that looks similar to mybank.com with internationalized domain names, this is a very powerful attack 68

179 SSL Stripping Variant HTTPS USER HTTPS mybonk.com Valid certificate for mybonk.com mybank.com Valid certificate for mybank.com 69

180 Recent SSL Stripping Attack DigiNotar hack July 10, 2011, wildcard certificates for google, etc. Short Video xwvy Other CAs: starcom(comodo) Certificates might also be used for software updates addons.mozilla.org login.live.com mail.google.com login.yahoo.com login.skype.com 70 Online Certificate Status Protocol (OCSP) Diginotar did not publicly reveal the breach, Poorly serviced XP machines Chromium detected via certificate pinning Used in netherlands for tax & customs administration, state owned identity management,.

181 Symantec vs Google (Sept. 2015) 71

182 72

183 Current Efforts Certificate/CA Pinning in Browser Certificate Transparency Currently for EV certificates Some APIs only accessible via HTTPS 73

184 Extended Validation (EV) Certificates Name of Entity shown Green Bar 74

185 Cryptocalypse Typical browser has 100+ Root certificates (CA) installed Each CA can delegate to sub-ca (resellers) Cost pressure reduces level of customer verification and security of infrastructure Any of theses sub-cas can sign certificates for any other domain. (e.g. finanzonline.gv.at) Also used by Deep-Packet-Inspection (DPI) Countermeasure CA or certificate pinning Software additionally checks, who issued the certificate 75

186 HTTP Strict Transport Security (HSTS) Strict-Transport-Security: max-age= ; includesubdomains; Browser caches HTTPS capability HSTS headers over HTTP are ignored HTTPS Everywhere Browser plugin that automatically redirects to Whitelist based Related: HTTP Public Key Pinning (HPKP) Allows Server to pin key/certificate authority 76

187 Perfect Forward Secrecy Scenario Some attacker sniffs encrypted traffic Obtains private keys afterwards (years later?) Decrypts traffic Perfect Forward Secrecy Use special step in initial session setup for key exchange Short term session key is not compromised, even when long term keys are compromised in the future. Optional in Ipsec, SSL/TLS since SSLv3, [Browser comp.!!!] Computational Overhead 15-30% 77 Lavabit Eduad Snowdens provider. FBI seized private Key. Vienneese ISP recorded Traffic for one day for testing purposes 1 year later Debian SSL/SSH problems got public destroyed recordings immediately. PFS: Google starting transition in 2012, Twitter Nov 2013

188 Where is SSL added? 78 Involuntarily, unknowingly? Forced?

189 Browser History Stealing (Historical) Re HT bor G P ML n U 5 f sid ilte us e c rs ing ha an nn d e ls 79

190 Browser History Stealing Browsers display visited links differently from nonvisited links very helpful to users (which google search results have I already visited?) This can be used to find out if the user has visited a site has user visited example.com? attacker prepares webpage at attacker.com with link: <a href=" attacker checks how the link is displayed 80

191 Browser History Stealing How can the attacker check the link color? the link is displayed in the web page attacker.com SOP allows attacker to access the content use javascript to check color or font size Attack can also be performed without javascript using CSS (Cascading Style Sheets) 81

192 History Stealing without Javascript CSS is used to improve HTML by separating presentation from document structure HTML defines the content CSS specifies how to display that contant uses simple rules to match content specify how to display content matching the rules a:visited define the style for visited links a style can include a background image background: url(log_visited.php?example.com) use div+span to associate different "background" urls to each link 82

193 History Stealing Proofs of Concept CSS based used for this demo Javascript based 83

194 noscript is on 84

195 Browser History Stealing Browser history can leak user's private information not just porn!.. Recent work from seclab: de-anonymizing users of social networks using browser history stealing checks for URLs specific to facebook/xing/linkedin groups in browser history the groups you are part of, can uniquely identify you 85

196 Countermeasures (by Browsers) JAVASCRIPT Reading of certain CSS styles (e.g. color of links) always return the default value. CSS only Restrict usage of certain attributes (e.g. background:url() ) in a:visited styles. 86

197 History Stealing in Public WiFi Hotspots (and other MitM scenarios) 87

198 History stealing with Public Wi-Fi Hotspots Internet Like a well in a village We gather there, pull up a bucket or two of Internet Look at the sign from the sponsor and move on. 88 Public internet hotspots are like village wells For letting me pull up one or two buckets of their internet, I accept to look at a sign from the sponsor and accept their terms and conditions

199 What is a Captive Portal? 89 Many people use it but don't know it by its name. You probably have used it this morgning when you logged into the conference WIFI Step by step

200 Why Captive Portal Omnipresent in Wi-Fi Hotspots Used by you probably right now (in this very hotel) Has an elevated position on the network Man-in-the-Middle by design Sponsors of a Wi-Fi want us to see their messages (and accept the disclaimer) There is no standard for that Let's inject it into your traffic 90

201 MitM by design!? 91 The way to look at it: Its is effectively Man-in-the-middeling connections. Spoof a redirect to the login/info page We expect to not tamper with the traffic after login

202 Browser History Stealing, again? Baron et al., 2002 :visited link color Ruderman et al., 2000 :visited can load images Jang et al., 2010 Sites are actively trying to steal history TODO: Groundhog 92

203 History, so what? Culture & Language Amazon.fr, Amazon.jp Sexual orientation grindr.com, transblog.de Partnership status Okcupid.com, parship.com Employer intranet.ibm.com Other websites that give interesting insights Medical conditions Political campaigns Religious communities 93 You don't need much immagination if to draw conclusions about one, if you know about a subjects browser history Its not only a privacy thing, its also a money thing United, delta vs kayak, chipmonk, Xvideos vs pornhub

204 Source: MindSource April 1996 BOF; Client State Tracking with Netscape Cookies; M. Strata Rose; Also reason for CSRF Cookie beeing sent depend on Protocol, host (suffix), path (prefix) 95

205 Cookies (or not enough state for HTTP) Two kinds Session cookies: usually forgotten when browser closed Persistent cookies: stored on disk with expiry date Only depend on the FQDN and Protocol XSS XSRF HTTP set cookie also used for HTTPS Insecure set cookies mixed into the cookies over HTTPS Used for login sessions Configuration Tracking 96

206 To small, close up 97

207 (+cookies) 302 redirect login.hotspotsys.com/login login.hotspotsys.com/login <html>. <img href= a.com/probe123 >... (+cookies) (+cookies). 98

208 99 Dont mind if the flow chart looks sparse and unfinished We will complete it later on

209 Sure, crypto will save us! HTTPS hides content (and therefore cookies) But is not used by default (e.g., when URL entered in location bar) HTTP Strict Transport Security (HSTS) Site announces availability of HTTPS with same content as via HTTP Client caches this Uses HTTPS by default next time for this site 100

210 Sure, crypto will save us! HTTPS hides traffic (and cookies) But is not used by default (e.g., when URL entered in location bar) HTTP Strict Transport Security (HSTS) Site announces availability of HTTPS with same content as via HTTP Client caches this side channel Uses HTTPS by default next time for this site 101

211 102

212 103

213 Which users are affected? Everyone who uses the standard browser to login into the captivce portal (mobile, notebook,...) Even VPN users Android and ios introduced captive portal detectors Primarily for convenience starts stripped down browser The online test is very easy to fool, since based on HTTP User will use main browser to login, exposing their history 104

214 Sure, VPN will save us? Connecting to new WiFi Wifi Connection WiFi Connection DHCP Captive Portal VPN VPN Browser history time 105

215 Captive Portal Detection A convenience feature ios since Version 4 Android since 4.2 used default browser Android since 5 uses captive portal browser Test is easy to circumvent HTTP! Chromium So included in mobile and desktop chrome

216 Which sites affected? Uses long-term (persistent) cookie e.g., for session, tracking, or configuration Can be set via HTTP Header Javascript Uses HSTS header 107 An attacker would test popular sites first, unless its an targeted attack or he/she is just filtering for particular users (e.g. users of a specific site, e.g. intranet) How did we test ans estimate how prevailing the conditions or problem is? Run a headless browser on amazon s3 spot instances Recorded all the traffic while visiting the main page and randomly selecting and visiting 3 links to sub pages Analyzed recorded traffic for HTTP headers

217 Top 1K 82-92% Top 200K 59-86% 108 For top % For top 200k 59-86% Estimation! Upper bound Overestimate: Some JS cookies could be session only (not seen in traffic dump) Underestimate:

218 Implementation POC implementation Speed up by Marking probe request with a special string Returning 1x1 pixel or killing connections Caching DNS Still one DNS request for each probed site Added de-anonymization e.g., via amazon.com 109 Poc implementation ~ probed sites per sek Cookies: de-anonymization e.g. via Amazon Half and full login Wish list feature leaks full name of user, even when not fully logged in via the unsecure http cookie