A Server- and Browser-Transparent CSRF Defense for Web 2.0 Applications

Similar documents
Robust Defenses for Cross-Site Request Forgery

Lecture 17 Browser Security. Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Some slides from Bailey's ECE 422

Robust Defenses for Cross-Site Request Forgery

Robust Defenses for Cross-Site Request Forgery Review

Web basics: HTTP cookies

How is state managed in HTTP sessions. Web basics: HTTP cookies. Hidden fields (2) The principle. Disadvantage of this approach

Web basics: HTTP cookies

WHY CSRF WORKS. Implicit authentication by Web browsers

Cross-Site Request Forgery

CIS 4360 Secure Computer Systems XSS

CS 161 Computer Security

P2_L12 Web Security Page 1

Application vulnerabilities and defences

Cross-Site Request Forgery in Cisco SG220 series

Automatically Checking for Session Management Vulnerabilities in Web Applications

SECURING APACHE : ATTACKS ON SESSION MANAGEMENT

Web Application Security. Philippe Bogaerts

EasyCrypt passes an independent security audit

Web Security: Web Application Security [continued]

Preventing Image based Cross Site Request Forgery Attacks

CSE361 Web Security. Attacks against the client-side of web applications. Nick Nikiforakis

Web Security: Cross-Site Attacks

Chrome Extension Security Architecture

Penetration Test Report

CSC 482/582: Computer Security. Cross-Site Security

WEB SECURITY WORKSHOP TEXSAW Presented by Solomon Boyd and Jiayang Wang

WEB SECURITY: XSS & CSRF

Abusing Windows Opener to Bypass CSRF Protection (Never Relay On Client Side)

RKN 2015 Application Layer Short Summary

Cross-Site Request Forgery (CSRF) Attack Lab

More attacks on clients: Click-jacking/UI redressing, CSRF

Computer Security 3e. Dieter Gollmann. Chapter 18: 1

Information Security CS 526 Topic 8

Attacks Against Websites. Tom Chothia Computer Security, Lecture 11

Web Security: Vulnerabilities & Attacks

Excerpts of Web Application Security focusing on Data Validation. adapted for F.I.S.T. 2004, Frankfurt

Common Websites Security Issues. Ziv Perry

Perslink Security. Perslink Security. Eleonora Petridou Pascal Cuylaerts. System And Network Engineering University of Amsterdam.

Information Security CS 526 Topic 11

Secure web proxy resistant to probing attacks

Web Security IV: Cross-Site Attacks

Web Security II. Slides from M. Hicks, University of Maryland

Is Browsing Safe? Web Browser Security. Subverting the Browser. Browser Security Model. XSS / Script Injection. 1. XSS / Script Injection

Web Security: Web Application Security [continued]

Web Security. Course: EPL 682 Name: Savvas Savva

Multi-Post XSRF Web App Exploitation, total pwnage

HTML5 Web Security. Thomas Röthlisberger IT Security Analyst

Lecture Overview. IN5290 Ethical Hacking

Lecture 6: Web hacking 2, Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), Session related attacks

Advanced Web Technology 10) XSS, CSRF and SQL Injection

CS 161 Computer Security

Assignment 6: Web Security

2/16/18. CYSE 411/AIT 681 Secure Software Engineering. Secure Coding. The Web. Topic #11. Web Security. Instructor: Dr. Kun Sun

Reflected XSS Cross-Site Request Forgery Other Attacks

Sichere Software vom Java-Entwickler

Web Security. Aggelos Kiayias Justin Neumann

CSCE 813 Internet Security Case Study II: XSS

Homework 5: Exam Review

IERG 4210 Tutorial 07. Securing web page (I): login page and admin user authentication Shizhan Zhu

Department of Electrical Engineering and Computer Science MASSACHUSETTS INSTITUTE OF TECHNOLOGY Fall Quiz I

Security. CSC309 TA: Sukwon Oh

Lecture 6: Web Security CS /17/2017

Attacks Against Websites 3 The OWASP Top 10. Tom Chothia Computer Security, Lecture 14

HTML5 Web Security. Thomas Röthlisberger IT Security Analyst

Project 2: Web Security

OMOS: A Framework for Secure Communication in Mashup Applications

Exploiting and Defending: Common Web Application Vulnerabilities

last time: command injection

ESORICS September Martin Johns

MWR InfoSecurity Security Advisory. DotNetNuke Cross Site Request Forgery Vulnerability Contents

CSCD 303 Essential Computer Security Fall 2018

Web Attacks CMSC 414. September 25 & 27, 2017

Your Scripts in My Page: What Could Possibly Go Wrong? Sebastian Lekies / Ben Stock Martin Johns

Preparing for the Cross Site Request Forgery Defense

Progressive Authentication in ios

The three faces. DeepSec Martin Johns University of Hamburg Universität Hamburg

Provide you with a quick introduction to web application security Increase you awareness and knowledge of security in general Show you that any

Welcome to the OWASP TOP 10

Title: Multiple Remote Command Execution vulnerabilities on Avaya Intuity Audix LX (plus some client-side bugs)

2/16/18. Secure Coding. CYSE 411/AIT 681 Secure Software Engineering. Web Security Outline. The Web. The Web, Basically.

Ben Livshits and Úlfar Erlingsson. Microsoft Research

Eradicating DNS Rebinding with the Extended Same-Origin Policy

CS4264 Programming Assignment 3 Principles of Computer Security Due 4/11/2018, 5PM EST.

Web Application Security

Client-Side Security Using CORS

Stop sweating the password and learn to love public key cryptography. Chris Streeks Solutions Engineer, Yubico

Web Security. Jace Baker, Nick Ramos, Hugo Espiritu, Andrew Le

Web Attacks Lab. 35 Points Group Lab Due Date: Lesson 16

Web Security Part 2. Professor Ristenpart h9p:// rist at cs dot wisc dot edu

Web Security. Thierry Sans

Web security: an introduction to attack techniques and defense methods

Application Architectures for Critical Data Isolation. Zhenkai Liang

Cyber Security. Web Application Security 2. Adrian Dabrowski, Christian Kudera

Unusual Web Bugs. A Web App Hacker s Bag O Tricks. Alex kuza55 K.

20486-Developing ASP.NET MVC 4 Web Applications

Introductions. Jack Katie

CSCD 303 Essential Computer Security Fall 2017

Web 2.0 and AJAX Security. OWASP Montgomery. August 21 st, 2007

Man-In-The-Browser Attacks. Daniel Tomescu

Cross Site Request Forgery

Transcription:

A Server- and Browser-Transparent CSRF Defense for Web 2.0 Applications Riccardo Pelizzi System Security Lab Department of Computer Science Stony Brook University December 8, 2011 1 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Outline CSRF Attacks 2 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Outline CSRF Attacks 2 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Outline CSRF Attacks 2 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Outline CSRF Attacks and Q&A 2 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

CSRF Attacks Attacker Victim Please visit evil.com Browser Bank 3 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

CSRF Attacks Attacker Victim Please visit evil.com Click on link Browser Bank 3 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

CSRF Attacks Attacker Victim Please visit evil.com Click on link Browser POST bank.com data + cookies Bank 3 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

CSRF Attacks Attacker Victim Please visit evil.com Click on link Browser POST bank.com data + cookies Bank Transfer money to attacker 3 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

CSRF Attacks (2) Attacker Please visit evil.com Victim Click on link Browser Malicious Server Bank Server Bank Database 4 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

CSRF Attacks (2) Attacker Please visit evil.com Victim Click on link Browser Malicious Server Bank Server Bank Database GET evil.com Send response 4 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

CSRF Attacks (2) Attacker Please visit evil.com Victim Click on link Browser Malicious Server Bank Server Bank Database GET evil.com Send response Automatically submit form 4 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

CSRF Attacks (2) Attacker Please visit evil.com Victim Click on link Browser Malicious Server Bank Server Bank Database GET evil.com Send response Automatically submit form POST bank.com data + cookies 4 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

CSRF Attacks (2) Attacker Please visit evil.com Victim Click on link Browser Malicious Server Bank Server Bank Database GET evil.com Send response Automatically submit form POST bank.com data + cookies Transfer money 4 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Harder: Must recognize which requests are intended. Easier: allow requests from trusted origins. 5 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Harder: Must recognize which requests are intended. Easier: allow requests from trusted origins. Two techniques: Use explicit origin information. Referrer : http :// attacker. com / csrf. html Require source pages to (manually) insert a secret token in requests. <form action="transfer.php" method="post"> <input type="hidden" name="csrf-token" value="gdfgf4sjhf4fgfa-df4">... 5 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Key Benefits of Our Approach How does our solution improve the state of the art? 6 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Key Benefits of Our Approach How does our solution improve the state of the art? Handles requests dynamically generated on the browser from JavaScript code. 6 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Key Benefits of Our Approach How does our solution improve the state of the art? Handles requests dynamically generated on the browser from JavaScript code. Can authenticate cross-origin requests. 6 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Key Benefits of Our Approach How does our solution improve the state of the art? Handles requests dynamically generated on the browser from JavaScript code. Can authenticate cross-origin requests. Is compatible with all browsers and transparent to web applications and languages. 6 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Overview User Browser Visit safe.com GET Proxy GET Response Server 7 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Overview User Browser Visit safe.com Display page GET Modified Response Proxy GET Response Server 7 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Overview User Browser Visit safe.com Display page Submit form GET Modified Response Proxy GET Response Server 7 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Overview User Browser Visit safe.com Display page Submit form GET Modified Response Proxy GET Response Server adds token POST 7 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Overview User Browser Visit safe.com Display page Submit form GET Modified Response Proxy GET Response Server adds token POST Verify Token POST 7 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Same-Origin Protocol User Browser Proxy Bank Server Visit safe.com GET safe.com GET safe.com Response 8 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Same-Origin Protocol User Browser Proxy Bank Server Visit safe.com GET safe.com GET safe.com Set-Cookie: C Response Response + jscript 8 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Same-Origin Protocol User Browser Proxy Bank Server Visit safe.com GET safe.com GET safe.com Set-Cookie: C Response Response + jscript Register submit handler for forms 8 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Same-Origin Protocol User Browser Proxy Bank Server Visit safe.com GET safe.com GET safe.com Set-Cookie: C Response Response + jscript Display page Register submit handler for forms 8 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Same-Origin Protocol User Browser Proxy Bank Server Visit safe.com GET safe.com GET safe.com Set-Cookie: C Response Response + jscript Display page Submit form Register submit handler for forms 8 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Same-Origin Protocol User Browser Proxy Bank Server Visit safe.com GET safe.com GET safe.com Set-Cookie: C Response Response + jscript Display page Submit form Handler Register submit handler for forms Copy C from cookies into form as P 8 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Same-Origin Protocol User Browser Proxy Bank Server Visit safe.com GET safe.com GET safe.com Set-Cookie: C Response Response + jscript Display page Submit form Handler Register submit handler for forms Copy C from cookies into form as P POST post.php Cookie: C Data: form data + P 8 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Same-Origin Protocol User Browser Proxy Bank Server Visit safe.com GET safe.com GET safe.com Set-Cookie: C Response Response + jscript Display page Submit form Handler Register submit handler for forms Copy C from cookies into form as P POST post.php Cookie: C Data: form data + P C == P 8 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Same-Origin Protocol User Browser Proxy Bank Server Visit safe.com GET safe.com GET safe.com Set-Cookie: C Response Response + jscript Display page Submit form Handler Register submit handler for forms Copy C from cookies into form as P POST post.php Cookie: C Data: form data + P C == P POST post.php Data: form data 8 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Potential Attack Vectors Guess the user s token. 9 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Potential Attack Vectors Guess the user s token. Steal user s token. 9 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Potential Attack Vectors Guess the user s token. Steal user s token. Cause victim to use attacker s token. 9 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Supporting Cross-Origin Request Scenario: Source domain S submits a request to target T. Problem: S can set authentication parameter P for T, but can t set a cookie for T. 10 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Supporting Cross-Origin Request Scenario: Source domain S submits a request to target T. Problem: S can set authentication parameter P for T, but can t set a cookie for T. Approach: T gives S a capability S includes this capability into the request for T. 10 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Supporting Cross-Origin Request Scenario: Source domain S submits a request to target T. Problem: S can set authentication parameter P for T, but can t set a cookie for T. Approach: T gives S a capability S includes this capability into the request for T. Challenge: capability should be usable only by one specific user. If S requests the capability from T on behalf of the user, T has nothing to bind the user to. Solution: have the browser bind the capability for T, then send it to S. 10 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Cross-Origin Protocol User Browser Source Proxy (S) Target Proxy (T) Visit safe.com GET safe.com Response + jscript Register submit handler for forms Display page Submit form 11 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Cross-Origin Protocol User Browser Source Proxy (S) Target Proxy (T) Visit safe.com GET safe.com Response + jscript Register submit handler for forms Display page Submit form S handler 11 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Cross-Origin Protocol User Browser Source Proxy (S) Target Proxy (T) Visit safe.com GET safe.com Response + jscript Register submit handler for forms Display page Submit form GET T iframe T iframe T S IFRAME handler 11 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Cross-Origin Protocol User Browser Source Proxy (S) Target Proxy (T) Visit safe.com GET safe.com Response + jscript Register submit handler for forms Display page Submit form GET T iframe T iframe T S IFRAME handler XmlHttpRequest X-No-Csrf: Yes Data: S 11 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Cross-Origin Protocol User Browser Source Proxy (S) Target Proxy (T) Visit safe.com GET safe.com Response + jscript Register submit handler for forms Display page Submit form GET T iframe T iframe T S IFRAME handler XmlHttpRequest X-No-Csrf: Yes Data: S Set-Cookie: C P ST P ST = AES(C S) 11 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Cross-Origin Protocol User Browser Source Proxy (S) Target Proxy (T) Visit safe.com GET safe.com Response + jscript Register submit handler for forms Display page Submit form GET T iframe T iframe T S IFRAME handler Insert P ST into form postmessage P ST to S XmlHttpRequest X-No-Csrf: Yes Data: S Set-Cookie: C P ST P ST = AES(C S) 11 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Cross-Origin Protocol User Browser Source Proxy (S) Target Proxy (T) Visit safe.com GET safe.com Response + jscript Register submit handler for forms Display page Submit form GET T iframe T iframe T S IFRAME handler Insert P ST into form postmessage P ST to S XmlHttpRequest X-No-Csrf: Yes Data: S Set-Cookie: C P ST P ST = AES(C S) POST post.php Cookie: C Data: form data + P ST Decrypt P ST to check for C and S 11 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Potential Attack Vectors Guess the user s token. 12 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Potential Attack Vectors Guess the user s token. Steal the user s token. 12 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Potential Attack Vectors Guess the user s token. Steal the user s token. Cause victim to use attacker s token. 12 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Limitations only protects POST requests. RFC 2616 mandates GET requests free of side effects Usability Issues: cannot type url or bookmark pages 13 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Implementation Prototype implemented in Python as a server-side transparent proxy that includes a JavaScript file in every HTML page. Adds token to POST forms before submission. Uses jquery s live handlers to bind the token handler to all forms, including those dynamically created afterwards. Wraps existing event handlers to make transparent to them. 14 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Protection Correctness is achieved by design, by relying on the Same-Origin Policy to prevent the attack scenarios presented. Tested it against two CVE vulnerabilities (RoundCube CVE-2009-4076, Acc PHP email CVE-2009-4906). 15 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Compatibility Tested with popular Open-Source web applications. Future Work: develop a client-side proxy to test it with known web applications. Application Version LOC Type Compatible phpmyadmin 3.3.7 196K MySQL Administration Tool Yes SquirrelMail 1.4.21 35K WebMail Yes punbb 1.3 25K Bulletin Board Yes WordPress 3.0.1 87K Content-Management System Yes Drupal 6.18 20K Content-Management System Yes MediaWiki 1.15.5 548K Content-Management System Yes phpbb 3.0.7 150K Bulletin Board Yes 16 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

Related Work NoForge Dynamic Requests Support Cross-Origin Support Com- Browser patible No source code required X-Protect CSRFMagic CSRFGuard Origin SOMA 17 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

and Q&A Automatically protect dynamic web applications against POST-based CSRF attacks. Low overhead (if implemented as an apache module), compatible with most web applications. 18 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

and Q&A Automatically protect dynamic web applications against POST-based CSRF attacks. Low overhead (if implemented as an apache module), compatible with most web applications. Questions? 18 / 18 Riccardo Pelizzi : A CSRF Defense for Web 2.0 Applications

2024 © technodocbox.com Privacy Policy | Terms of Service | Feedback