Security and Authentication

Transcription

1 Security and Authentication CS 370 SE Practicum, Cengiz Günay (Some slides courtesy of Eugene Agichtein and the Internets) CS 370, Günay (Emory) Security and Authentication Spring / 15

2 Agenda Upcoming milestones: 4/17: Testing/surveying ends; x bugs, improve concept 4/22: Hacking ends; submit survey reports (anonymous) 4/24: The APPrentice! Final demo to tech transfer and business people. You will be red! 5/5: Final deliverables: installation instructions, user documentation, code documentation, package CS 370, Günay (Emory) Security and Authentication Spring / 15

3 Agenda Upcoming milestones: Today: 4/17: Testing/surveying ends; x bugs, improve concept 4/22: Hacking ends; submit survey reports (anonymous) 4/24: The APPrentice! Final demo to tech transfer and business people. You will be red! 5/5: Final deliverables: installation instructions, user documentation, code documentation, package Security and authentication CS 370, Günay (Emory) Security and Authentication Spring / 15

4 Agenda Upcoming milestones: Today: 4/17: Testing/surveying ends; x bugs, improve concept 4/22: Hacking ends; submit survey reports (anonymous) 4/24: The APPrentice! Final demo to tech transfer and business people. You will be red! 5/5: Final deliverables: installation instructions, user documentation, code documentation, package Security and authentication First: Heartbleed caught the internet o guard CS 370, Günay (Emory) Security and Authentication Spring / 15

5

6 Entry/Exit Surveys Exit survey: JavaScript, AJAX, dynamic web frameworks Give a specic example usage of AJAX in a popular web service that you use. What do you think is the next step for web computing considering the rapid development of client-side technologies? Entry survey: Security What is the Heartbleed vulnerability? How come it wasn't discovered until now? How can a programmer make such a mistake? CS 370, Günay (Emory) Security and Authentication Spring / 15

7 Security: Heartbleed Open Source Code: CS 370, Günay (Emory) Security and Authentication Spring / 15

8 Security: Heartbleed Open Source Code: "Given enough eyeballs, all bugs are shallow" -Linus's Law (from the Cathedral and the Bazaar) CS 370, Günay (Emory) Security and Authentication Spring / 15

9 Security: Heartbleed Open Source Code: "Given enough eyeballs, all bugs are shallow" -Linus's Law (from the Cathedral and the Bazaar) Yeah, but OpenSSL fail? CS 370, Günay (Emory) Security and Authentication Spring / 15

10 Security: Heartbleed Open Source Code: "Given enough eyeballs, all bugs are shallow" -Linus's Law (from the Cathedral and the Bazaar) Yeah, but OpenSSL fail? Programmer submitted buggy code, reviewers didn't catch it either The whole world missed it for two years (except the NSA) Heartbeat feature was new and not that sensitive CS 370, Günay (Emory) Security and Authentication Spring / 15

11 Security: Heartbleed Open Source Code: "Given enough eyeballs, all bugs are shallow" -Linus's Law (from the Cathedral and the Bazaar) Yeah, but OpenSSL fail? Programmer submitted buggy code, reviewers didn't catch it either The whole world missed it for two years (except the NSA) Heartbeat feature was new and not that sensitive Isn't SSL supposed to be encrypted? CS 370, Günay (Emory) Security and Authentication Spring / 15

12 Security: Heartbleed Open Source Code: "Given enough eyeballs, all bugs are shallow" -Linus's Law (from the Cathedral and the Bazaar) Yeah, but OpenSSL fail? Programmer submitted buggy code, reviewers didn't catch it either The whole world missed it for two years (except the NSA) Heartbeat feature was new and not that sensitive Isn't SSL supposed to be encrypted? Yep, it leaked the data securely CS 370, Günay (Emory) Security and Authentication Spring / 15

13 Secure connections: SSL/TLS, HTTPS How does encryption work? Example: HTTPS: HTTP + SSL/TLS CS 370, Günay (Emory) Security and Authentication Spring / 15

14 Secure connections: SSL/TLS, HTTPS How does encryption work? Example: HTTPS: HTTP + SSL/TLS Long term public-private keys to establish trust Short term session keys to encrypt data CS 370, Günay (Emory) Security and Authentication Spring / 15

15 Secure connections: SSL/TLS, HTTPS How does encryption work? Example: HTTPS: HTTP + SSL/TLS Long term public-private keys to establish trust Short term session keys to encrypt data How is trust established? CS 370, Günay (Emory) Security and Authentication Spring / 15

16 Secure connections: SSL/TLS, HTTPS How does encryption work? Example: HTTPS: HTTP + SSL/TLS Long term public-private keys to establish trust Short term session keys to encrypt data How is trust established? Certicate authorities hold public keys Owners of certicates encrypt data But allows man-in-the-middle (MiM) attacks CS 370, Günay (Emory) Security and Authentication Spring / 15

17 Secure connections: SSL/TLS, HTTPS How does encryption work? Example: HTTPS: HTTP + SSL/TLS Long term public-private keys to establish trust Short term session keys to encrypt data How is trust established? Certicate authorities hold public keys Owners of certicates encrypt data But allows man-in-the-middle (MiM) attacks Why not use Web of Trust? CS 370, Günay (Emory) Security and Authentication Spring / 15

18 Secure connections: SSL/TLS, HTTPS How does encryption work? Example: HTTPS: HTTP + SSL/TLS Long term public-private keys to establish trust Short term session keys to encrypt data How is trust established? Certicate authorities hold public keys Owners of certicates encrypt data But allows man-in-the-middle (MiM) attacks Why not use Web of Trust? Decentralized PGP system Problem: Expiration or lost private keys New entries untrusted, possible to create many fake entries with strong trust CS 370, Günay (Emory) Security and Authentication Spring / 15

19 Secure connections: SSL/TLS, HTTPS How does encryption work? Example: HTTPS: HTTP + SSL/TLS Long term public-private keys to establish trust Short term session keys to encrypt data How is trust established? Certicate authorities hold public keys Owners of certicates encrypt data But allows man-in-the-middle (MiM) attacks Why not use Web of Trust? Decentralized PGP system Problem: Expiration or lost private keys New entries untrusted, possible to create many fake entries with strong trust When to use HTTPS? Before login? During login authentication? During whole session? CS 370, Günay (Emory) Security and Authentication Spring / 15

20 Secure connections: SSL/TLS, HTTPS How does encryption work? Example: HTTPS: HTTP + SSL/TLS Long term public-private keys to establish trust Short term session keys to encrypt data How is trust established? Certicate authorities hold public keys Owners of certicates encrypt data But allows man-in-the-middle (MiM) attacks Why not use Web of Trust? Decentralized PGP system Problem: Expiration or lost private keys New entries untrusted, possible to create many fake entries with strong trust When to use HTTPS? Before login? During login authentication? During whole session? But there was a lot of heartbleed. What now? CS 370, Günay (Emory) Security and Authentication Spring / 15

21 Secure connections: SSL/TLS, HTTPS How does encryption work? Example: HTTPS: HTTP + SSL/TLS Long term public-private keys to establish trust Short term session keys to encrypt data How is trust established? Certicate authorities hold public keys Owners of certicates encrypt data But allows man-in-the-middle (MiM) attacks Why not use Web of Trust? Decentralized PGP system Problem: Expiration or lost private keys New entries untrusted, possible to create many fake entries with strong trust When to use HTTPS? Before login? During login authentication? During whole session? But there was a lot of heartbleed. What now? Not again.. CS 370, Günay (Emory) Security and Authentication Spring / 15

22

23

24 Cookie Authentication Authentication steps: 1 Client authenticates Cookie contents: 2 Server sends session key domain + data + expiration date 3 Client saves key in cookie and uses it during session CS 370, Günay (Emory) Security and Authentication Spring / 15

25 Cookie Authentication Authentication steps: 1 Client authenticates Cookie contents: 2 Server sends session key domain + data + expiration date 3 Client saves key in cookie and uses it during session Cookies? MiM: Can somebody else act as you if they had your cookie? CS 370, Günay (Emory) Security and Authentication Spring / 15

26 Cookie Authentication Authentication steps: 1 Client authenticates Cookie contents: 2 Server sends session key domain + data + expiration date 3 Client saves key in cookie and uses it during session Cookies? MiM: Can somebody else act as you if they had your cookie? Solutions: Cookie expiration, ushing cookies, disabling cookies. CS 370, Günay (Emory) Security and Authentication Spring / 15

27 Authentication steps: 1 Client authenticates 2 Server sends session key Cookie Authentication 3 Client saves key in cookie and uses it during session Cookies? MiM: Can somebody else act as you if they had your cookie? Solutions: Cookie expiration, ushing cookies, disabling cookies. Cross site logins? How do the like buttons on non-facebook sites work? Cookie contents: domain + data + expiration date CS 370, Günay (Emory) Security and Authentication Spring / 15

28 Authentication steps: 1 Client authenticates 2 Server sends session key Cookie Authentication 3 Client saves key in cookie and uses it during session Cookies? MiM: Can somebody else act as you if they had your cookie? Solutions: Cookie expiration, ushing cookies, disabling cookies. Cross site logins? How do the like buttons on non-facebook sites work? Multiple iframe elements can fetch pages from across domains (i.e. access dierent cookies) Cookie contents: domain + data + expiration date CS 370, Günay (Emory) Security and Authentication Spring / 15

29 Authentication steps: 1 Client authenticates 2 Server sends session key Cookie Authentication 3 Client saves key in cookie and uses it during session Cookies? MiM: Can somebody else act as you if they had your cookie? Solutions: Cookie expiration, ushing cookies, disabling cookies. Cross site logins? How do the like buttons on non-facebook sites work? Multiple iframe elements can fetch pages from across domains (i.e. access dierent cookies) Google AdSense: cross-site ads uses cookies Cookie contents: domain + data + expiration date CS 370, Günay (Emory) Security and Authentication Spring / 15

30 Authentication steps: 1 Client authenticates 2 Server sends session key Cookie Authentication 3 Client saves key in cookie and uses it during session Cookies? MiM: Can somebody else act as you if they had your cookie? Solutions: Cookie expiration, ushing cookies, disabling cookies. Cross site logins? How do the like buttons on non-facebook sites work? Multiple iframe elements can fetch pages from across domains (i.e. access dierent cookies) Google AdSense: cross-site ads uses cookies Helps NSA track you Cookie contents: domain + data + expiration date CS 370, Günay (Emory) Security and Authentication Spring / 15

31 Hacking: Tracking Track people via s? CS 370, Günay (Emory) Security and Authentication Spring / 15

32 Hacking: Tracking Track people via s? header codes (look at your Gmail headers!) Visible/invisible images (how??) CS 370, Günay (Emory) Security and Authentication Spring / 15

33 Hacking: Tracking Track people via s? header codes (look at your Gmail headers!) Visible/invisible images (how??) Anonymous s? demo phishing (only for the gullible) CS 370, Günay (Emory) Security and Authentication Spring / 15

34 Two-step authentication? More on authentication CS 370, Günay (Emory) Security and Authentication Spring / 15

35 Two-step authentication? More on authentication banks and other high-security places use it involves a 2nd device: phone calls, texting, password generator device CS 370, Günay (Emory) Security and Authentication Spring / 15

36 Two-step authentication? More on authentication banks and other high-security places use it involves a 2nd device: phone calls, texting, password generator device What's Google Authenticator? CS 370, Günay (Emory) Security and Authentication Spring / 15

37 Two-step authentication? More on authentication banks and other high-security places use it involves a 2nd device: phone calls, texting, password generator device What's Google Authenticator? Generates a unique password each time That can verify your authenticity (through public-private keys) CS 370, Günay (Emory) Security and Authentication Spring / 15

38 Two-step authentication? More on authentication banks and other high-security places use it involves a 2nd device: phone calls, texting, password generator device What's Google Authenticator? Generates a unique password each time That can verify your authenticity (through public-private keys) What're the best practices in authentication? Use PHP to transmit and store cleartext passwords? CS 370, Günay (Emory) Security and Authentication Spring / 15

39 Two-step authentication? More on authentication banks and other high-security places use it involves a 2nd device: phone calls, texting, password generator device What's Google Authenticator? Generates a unique password each time That can verify your authenticity (through public-private keys) What're the best practices in authentication? Use PHP to transmit and store cleartext passwords? Err, no. CS 370, Günay (Emory) Security and Authentication Spring / 15

40 Two-step authentication? More on authentication banks and other high-security places use it involves a 2nd device: phone calls, texting, password generator device What's Google Authenticator? Generates a unique password each time That can verify your authenticity (through public-private keys) What're the best practices in authentication? Use PHP to transmit and store cleartext passwords? Err, no. Standards: OAuth Facebook, Google, Microsoft APIs require it At version 2.0 CS 370, Günay (Emory) Security and Authentication Spring / 15

41 Two-step authentication? More on authentication banks and other high-security places use it involves a 2nd device: phone calls, texting, password generator device What's Google Authenticator? Generates a unique password each time That can verify your authenticity (through public-private keys) What're the best practices in authentication? Use PHP to transmit and store cleartext passwords? Err, no. Standards: OAuth Facebook, Google, Microsoft APIs require it At version 2.0 Complementary to OpenID passwordless logins via installing certicates in browser, smart cards, biometrics, etc. private key on the client side; personal URI holds public key CS 370, Günay (Emory) Security and Authentication Spring / 15

42

43

44 Structure looks ne, even has padding!

45 Structure looks ne, even has padding! First read type & length:

46 Structure looks ne, even has padding! First read type & length: Looks right so far:

47 Structure looks ne, even has padding! Response from Yahoo!: First read type & length: Looks right so far:

48 Upcoming episodes Documentation, coding style, sustainability, design patterns Scrum now! CS 370, Günay (Emory) Security and Authentication Spring / 15